Edit tour

Windows Analysis Report
run.exe

Overview

General Information

Sample name:	run.exe
Analysis ID:	1579290
MD5:	cd860c78e0374dec3a2b1a73507fce4a
SHA1:	3f3bfa99784864377725873c23a13bb1045c92ae
SHA256:	ad3129449969566ca74bbfe8a4e2a0a551d2725b1d1f9d5bcce4e9dd476927b5
Tags:	exeuser-smica83
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Found direct / indirect Syscall (likely to bypass EDR)

Modifies existing user documents (likely ransomware behavior)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sigma detected: CurrentVersion Autorun Keys Modification

Classification

Process Tree

System is w10x64

run.exe (PID: 7316 cmdline: "C:\Users\user\Desktop\run.exe" MD5: CD860C78E0374DEC3A2B1A73507FCE4A)

conhost.exe (PID: 7324 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\p4yx0rl0s3\run.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\run.exe, ProcessId: 7316, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\p4yx0rl0s3

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: run.exe	Virustotal: Detection: 63%			Perma Link
Source: run.exe	ReversingLabs: Detection: 57%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 97.9% probability

Source: run.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: unknown	TCP traffic detected without corresponding DNS query: 91.208.206.195
Source: unknown	TCP traffic detected without corresponding DNS query: 91.208.206.195
Source: unknown	TCP traffic detected without corresponding DNS query: 91.208.206.195
Source: unknown	TCP traffic detected without corresponding DNS query: 91.208.206.195
Source: unknown	TCP traffic detected without corresponding DNS query: 91.208.206.195
Source: unknown	TCP traffic detected without corresponding DNS query: 91.208.206.195

Source: unknown

HTTP traffic detected: POST /store HTTP/1.1Host: 91.208.206.195User-Agent: ureq/2.10.1Accept: */*Content-Type: application/jsonaccept-encoding: gzipContent-Length: 47

Source: run.exe, 00000000.00000002.1698572592.000002059373C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.208.206.195/store
Source: run.exe	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: run.exe	String found in binary or memory: https://docs.rs/rustls/latest/rustls/manual/_03_howto/index.html#unexpected-eof
Source: run.exe	String found in binary or memory: https://github.com/clap-rs/clap/issues
Source: run.exe	String found in binary or memory: https://github.com/clap-rs/clap/issues/home/kali/.cargo/registry/src/index.crates.io-6f17d22bba15001
Source: run.exe	String found in binary or memory: https://github.com/clap-rs/clap/issuesCOMMAND
Source: run.exe	String found in binary or memory: https://github.com/clap-rs/clap/issuesj

Spam, unwanted Advertisements and Ransom Demands

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\run.exe	File deleted: C:\Users\user\Desktop\KATAXZVCPS.jpg	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	File deleted: C:\Users\user\Desktop\VLZDGUKUTZ.docx	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	File deleted: C:\Users\user\Desktop\ONBQCLYSPU\ONBQCLYSPU.docx	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	File deleted: C:\Users\user\Desktop\BPMLNOBVSB.png	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	File deleted: C:\Users\user\Desktop\UMMBDNEQBN\UMMBDNEQBN.docx	Jump to behavior

Source: classification engine

Classification label: mal64.rans.evad.winEXE@2/75@0/1

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7324:120:WilError_03

Source: run.exe, 00000000.00000000.1675092431.00007FF7463BF000.00000002.00000001.01000000.00000003.sdmp	Memory string: rustls::msgs::handshake
Source: run.exe, 00000000.00000000.1675092431.00007FF7463BF000.00000002.00000001.01000000.00000003.sdmp	Memory string: rustls::msgs::handshakeClientExtension

Source: run.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\run.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: run.exe	Virustotal: Detection: 63%
Source: run.exe	ReversingLabs: Detection: 57%

Source: run.exe	String found in binary or memory: helpPrint helpPrint help (see more with '--help')Print help (see a summary with '-h')versionPrint versionPrint this message or the help of the given subcommand(s)subcommandCOMMANDPrint help for the subcommand(s)
Source: run.exe	String found in binary or memory: helpPrint helpPrint help (see more with '--help')Print help (see a summary with '-h')versionPrint versionPrint this message or the help of the given subcommand(s)subcommandCOMMANDPrint help for the subcommand(s)
Source: run.exe	String found in binary or memory: 3helpPrint helpPrint help (see more with '--help')Print help (see a summary with '-h')versionPrint versionPrint this message or the help of the given subcommand(s)subcommandCOMMANDPrint help for the subcommand(s)
Source: run.exe	String found in binary or memory: 3helpPrint helpPrint help (see more with '--help')Print help (see a summary with '-h')versionPrint versionPrint this message or the help of the given subcommand(s)subcommandCOMMANDPrint help for the subcommand(s)
Source: run.exe	String found in binary or memory: --helphelp--
Source: run.exe	String found in binary or memory: --helphelp--
Source: run.exe	String found in binary or memory: {before-help}{about-with-newline}
Source: run.exe	String found in binary or memory: {usage-heading} {usage}{after-help}{before-help}{about-with-newline}
Source: run.exe	String found in binary or memory: {all-args}{after-help}
Source: run.exe	String found in binary or memory: 7{before-help}{about-with-newline}
Source: run.exe	String found in binary or memory: namebinversionauthorauthor-with-newlineauthor-sectionaboutabout-with-newlineabout-sectionusage-headingusageall-argsoptionspositionalssubcommandstabafter-helpbefore-help{}
Source: run.exe	String found in binary or memory: namebinversionauthorauthor-with-newlineauthor-sectionaboutabout-with-newlineabout-sectionusage-headingusageall-argsoptionspositionalssubcommandstabafter-helpbefore-help{}xU<@

Source: unknown	Process created: C:\Users\user\Desktop\run.exe "C:\Users\user\Desktop\run.exe"
Source: C:\Users\user\Desktop\run.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\run.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Section loaded: mswsock.dll	Jump to behavior

Source: run.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: run.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: run.exe

Static file information: File size 6138219 > 1048576

Source: run.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x31d000

Source: run.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: run.exe

Static PE information: section name: .xdata

Source: C:\Users\user\Desktop\run.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run p4yx0rl0s3			Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run p4yx0rl0s3			Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: run.exe

Binary or memory string: FROMUTF16ERRORP4YX0RL0S31.0KEYKEYSETS A KEYFILESETS THE INPUT FILE OR DIRECTORYFILEVMSRVC.EXETCPVIEW.EXEWIRESHARK.EXEFIDDLER.EXEVMWARE.EXEVIRTUALBOX.EXEPROCEXP.EXEAUTOIT.EXEVBOXTRAY.EXEVMTOOLSD.EXEVMRAWDSK.SYS.VMUSBMOUSE.SYS.DF5SERV.EXEVBOXSERVICE.EXE

Source: run.exe, 00000000.00000002.1698572592.000002059373C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vboxservice.exeolm.T
Source: run.exe, 00000000.00000002.1698572592.000002059373C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmsrvc.exe.sys.olm.T
Source: run.exe, 00000000.00000002.1698572592.000002059373C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmware.exeemqbuolm.
Source: run.exe, 00000000.00000002.1698572592.000002059373C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vboxtray.exexeuolm.
Source: run.exe	Binary or memory string: FromUtf16Errorp4yx0rl0s31.0keyKEYSets a keyfileSets the input file or directoryFILEvmsrvc.exetcpview.exewireshark.exefiddler.exevmware.exeVirtualBox.exeprocexp.exeautoit.exevboxtray.exevmtoolsd.exevmrawdsk.sys.vmusbmouse.sys.df5serv.exevboxservice.exe
Source: run.exe, 00000000.00000002.1698572592.000002059373C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmtoolsd.exeqbuolm.
Source: run.exe, 00000000.00000002.1698572592.000002059373C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vboxservice.exeolm.
Source: run.exe, 00000000.00000003.1698386422.000002059375A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: run.exe, 00000000.00000002.1698572592.000002059373C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vboxservice.exeolm.

Source: C:\Users\user\Desktop\run.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\run.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\run.exe	NtWriteFile: Indirect: 0x7FF746345866			Jump to behavior
Source: C:\Users\user\Desktop\run.exe	NtReadFile: Indirect: 0x7FF746345746			Jump to behavior

Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Contacts VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Contacts\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Contacts\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\BPMLNOBVSB.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\BPMLNOBVSB.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\BPMLNOBVSB.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\DVWHKMNFNN.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\DVWHKMNFNN.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\DVWHKMNFNN.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\DVWHKMNFNN.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\Excel.lnk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\HTAGVDFUIE.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\JSDNGYCOWY.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\JSDNGYCOWY.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\JSDNGYCOWY.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\JSDNGYCOWY.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\KATAXZVCPS.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\KATAXZVCPS.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\KATAXZVCPS.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\LTKMYBSEYZ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\MXPXCVPDVN VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\NWTVCDUMOB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\NWTVCDUMOB.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\NWTVCDUMOB.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\NWTVCDUMOB.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\ONBQCLYSPU VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\ONBQCLYSPU\DVWHKMNFNN.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\ONBQCLYSPU\DVWHKMNFNN.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\ONBQCLYSPU\HTAGVDFUIE.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\ONBQCLYSPU\HTAGVDFUIE.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\ONBQCLYSPU\HTAGVDFUIE.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\ONBQCLYSPU\KATAXZVCPS.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\ONBQCLYSPU\KATAXZVCPS.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\ONBQCLYSPU\KATAXZVCPS.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\ONBQCLYSPU\ONBQCLYSPU.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\ONBQCLYSPU\ONBQCLYSPU.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\ONBQCLYSPU\ONBQCLYSPU.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\ONBQCLYSPU\UMMBDNEQBN.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\ONBQCLYSPU\UMMBDNEQBN.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\ONBQCLYSPU\UMMBDNEQBN.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\ONBQCLYSPU\VLZDGUKUTZ.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\ONBQCLYSPU\VLZDGUKUTZ.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\ONBQCLYSPU\VLZDGUKUTZ.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\ONBQCLYSPU.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\ONBQCLYSPU.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\ONBQCLYSPU.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\RAYHIWGKDI VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\run.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\run.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\UMMBDNEQBN VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\UMMBDNEQBN\BPMLNOBVSB.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\UMMBDNEQBN\BPMLNOBVSB.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\UMMBDNEQBN\BPMLNOBVSB.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\UMMBDNEQBN\CURQNKVOIX.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\UMMBDNEQBN\CURQNKVOIX.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\UMMBDNEQBN\DVWHKMNFNN.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\UMMBDNEQBN\DVWHKMNFNN.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\UMMBDNEQBN\DVWHKMNFNN.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\UMMBDNEQBN\JSDNGYCOWY.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\UMMBDNEQBN\JSDNGYCOWY.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\UMMBDNEQBN\JSDNGYCOWY.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\UMMBDNEQBN\UMMBDNEQBN.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\UMMBDNEQBN\UMMBDNEQBN.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\UMMBDNEQBN\UMMBDNEQBN.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\UMMBDNEQBN\WUTJSCBCFX.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\UMMBDNEQBN\WUTJSCBCFX.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\UMMBDNEQBN\WUTJSCBCFX.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\UMMBDNEQBN.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\UMMBDNEQBN.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\UMMBDNEQBN.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\UMMBDNEQBN.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\UMMBDNEQBN.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\VLZDGUKUTZ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\VLZDGUKUTZ\DVWHKMNFNN.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\VLZDGUKUTZ\DVWHKMNFNN.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\VLZDGUKUTZ\JSDNGYCOWY.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\VLZDGUKUTZ\KATAXZVCPS.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\VLZDGUKUTZ\KATAXZVCPS.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\VLZDGUKUTZ\KATAXZVCPS.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\VLZDGUKUTZ\NWTVCDUMOB.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\VLZDGUKUTZ\NWTVCDUMOB.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\VLZDGUKUTZ\VLZDGUKUTZ.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\VLZDGUKUTZ\YPSIACHYXW.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\VLZDGUKUTZ\YPSIACHYXW.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\VLZDGUKUTZ.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\VLZDGUKUTZ.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\VLZDGUKUTZ.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\VLZDGUKUTZ.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\VLZDGUKUTZ.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\VLZDGUKUTZ.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\WUTJSCBCFX.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\WUTJSCBCFX.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\YPSIACHYXW.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Desktop\YPSIACHYXW.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\BPMLNOBVSB.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\BPMLNOBVSB.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\DVWHKMNFNN.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\DVWHKMNFNN.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\DVWHKMNFNN.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\DVWHKMNFNN.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\HTAGVDFUIE.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\JSDNGYCOWY.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\JSDNGYCOWY.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\KATAXZVCPS.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\KATAXZVCPS.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\KATAXZVCPS.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\LTKMYBSEYZ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Music\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Pictures\Camera Roll\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Pictures\Camera Roll\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Pictures\Saved Pictures\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Pictures\Saved Pictures\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\NWTVCDUMOB.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\ONBQCLYSPU\DVWHKMNFNN.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\ONBQCLYSPU\DVWHKMNFNN.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\ONBQCLYSPU\HTAGVDFUIE.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\ONBQCLYSPU\HTAGVDFUIE.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\ONBQCLYSPU\HTAGVDFUIE.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\ONBQCLYSPU\KATAXZVCPS.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\ONBQCLYSPU\KATAXZVCPS.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\ONBQCLYSPU\KATAXZVCPS.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\ONBQCLYSPU\ONBQCLYSPU.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\ONBQCLYSPU\ONBQCLYSPU.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\ONBQCLYSPU\ONBQCLYSPU.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\ONBQCLYSPU\UMMBDNEQBN.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\ONBQCLYSPU\UMMBDNEQBN.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\ONBQCLYSPU\UMMBDNEQBN.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\ONBQCLYSPU\VLZDGUKUTZ.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\ONBQCLYSPU\VLZDGUKUTZ.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\ONBQCLYSPU\VLZDGUKUTZ.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\ONBQCLYSPU.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\RAYHIWGKDI VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\UMMBDNEQBN VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\UMMBDNEQBN\BPMLNOBVSB.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\UMMBDNEQBN\CURQNKVOIX.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\UMMBDNEQBN\CURQNKVOIX.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\UMMBDNEQBN\DVWHKMNFNN.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\UMMBDNEQBN\DVWHKMNFNN.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\UMMBDNEQBN\DVWHKMNFNN.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\UMMBDNEQBN\JSDNGYCOWY.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\UMMBDNEQBN\JSDNGYCOWY.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\UMMBDNEQBN\JSDNGYCOWY.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\UMMBDNEQBN\UMMBDNEQBN.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\UMMBDNEQBN\UMMBDNEQBN.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\UMMBDNEQBN\WUTJSCBCFX.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\UMMBDNEQBN.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\UMMBDNEQBN.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\UMMBDNEQBN.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\UMMBDNEQBN.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\UMMBDNEQBN.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\UMMBDNEQBN.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\VAMYDFPUND VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\VLZDGUKUTZ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\VLZDGUKUTZ\DVWHKMNFNN.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\VLZDGUKUTZ\DVWHKMNFNN.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\VLZDGUKUTZ\DVWHKMNFNN.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\VLZDGUKUTZ\JSDNGYCOWY.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\VLZDGUKUTZ\JSDNGYCOWY.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\VLZDGUKUTZ\KATAXZVCPS.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\VLZDGUKUTZ\NWTVCDUMOB.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\VLZDGUKUTZ\NWTVCDUMOB.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\VLZDGUKUTZ\NWTVCDUMOB.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\VLZDGUKUTZ\VLZDGUKUTZ.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\VLZDGUKUTZ\VLZDGUKUTZ.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\VLZDGUKUTZ\VLZDGUKUTZ.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\VLZDGUKUTZ\YPSIACHYXW.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\VLZDGUKUTZ\YPSIACHYXW.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\VLZDGUKUTZ.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\VLZDGUKUTZ.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\VLZDGUKUTZ.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\VLZDGUKUTZ.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\VLZDGUKUTZ.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\VLZDGUKUTZ.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\WUTJSCBCFX.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\WUTJSCBCFX.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\YPSIACHYXW.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\YPSIACHYXW.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Documents\YPSIACHYXW.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Downloads\BPMLNOBVSB.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Downloads\BPMLNOBVSB.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Downloads\CURQNKVOIX.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Downloads\CURQNKVOIX.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Downloads\DVWHKMNFNN.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Downloads\DVWHKMNFNN.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Downloads\DVWHKMNFNN.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Downloads\DVWHKMNFNN.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Downloads\DVWHKMNFNN.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Downloads\HTAGVDFUIE.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Downloads\JSDNGYCOWY.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Downloads\JSDNGYCOWY.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Downloads\KATAXZVCPS.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Downloads\KATAXZVCPS.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Downloads\NWTVCDUMOB.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Downloads\ONBQCLYSPU.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Downloads\ONBQCLYSPU.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Downloads\UMMBDNEQBN.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Downloads\UMMBDNEQBN.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Downloads\UMMBDNEQBN.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Downloads\UMMBDNEQBN.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Downloads\UMMBDNEQBN.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Downloads\UMMBDNEQBN.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Downloads\VLZDGUKUTZ.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Downloads\VLZDGUKUTZ.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Downloads\VLZDGUKUTZ.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Downloads\VLZDGUKUTZ.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Downloads\VLZDGUKUTZ.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Downloads\VLZDGUKUTZ.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Downloads\WUTJSCBCFX.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Downloads\WUTJSCBCFX.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Downloads\WUTJSCBCFX.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Downloads\YPSIACHYXW.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Downloads\YPSIACHYXW.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Favorites\Amazon.url VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Favorites\Amazon.url VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Favorites\Bing.url VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Favorites\Bing.url VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Favorites\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Favorites\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Favorites\Facebook.url VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Favorites\Facebook.url VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Favorites\Google.url VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Favorites\Links VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Favorites\Links\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Favorites\Links\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Favorites\Live.url VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Favorites\Live.url VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Favorites\NYTimes.url VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Favorites\Reddit.url VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Favorites\Reddit.url VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Favorites\Twitter.url VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Music\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Music\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Pictures\Camera Roll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Pictures\Camera Roll\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Pictures\Camera Roll\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Pictures\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Pictures\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Pictures\Saved Pictures VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Pictures\Saved Pictures\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Pictures\Saved Pictures\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Videos\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\run.exe	Queries volume information: C:\Users\user\Videos\desktop.ini VolumeInformation	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	1 Disable or Modify Tools	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Abuse Elevation Control Mechanism	1 Process Injection	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	11 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
run.exe	64%	Virustotal		Browse
run.exe	58%	ReversingLabs	Win64.Trojan.Generic

Name	Malicious	Antivirus Detection	Reputation
http://91.208.206.195/store	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://github.com/clap-rs/clap/issuesj	run.exe	false	high
https://github.com/clap-rs/clap/issues/home/kali/.cargo/registry/src/index.crates.io-6f17d22bba15001	run.exe	false	high
https://github.com/clap-rs/clap/issuesCOMMAND	run.exe	false	high
https://github.com/clap-rs/clap/issues	run.exe	false	high
https://docs.rs/getrandom#nodejs-es-module-support	run.exe	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
91.208.206.195	unknown	unknown		200019	ALEXHOSTMD	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579290
Start date and time:	2024-12-21 13:14:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	run.exe
Detection:	MAL
Classification:	mal64.rans.evad.winEXE@2/75@0/1
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target run.exe, PID 7316 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:15:04	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run p4yx0rl0s3 "C:\Users\user\p4yx0rl0s3\run.exe"
12:15:13	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run p4yx0rl0s3 "C:\Users\user\p4yx0rl0s3\run.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
91.208.206.195	em_webdev_assignment_dec2024.doc	Get hash	malicious	Unknown	Browse	91.208.206.195/store

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ALEXHOSTMD	em_webdev_assignment_dec2024.doc	Get hash	malicious	Unknown	Browse	91.208.206.195
	Svcrhpjadgyclc.cmd	Get hash	malicious	DBatLoader	Browse	176.123.5.143
	armv6l.elf	Get hash	malicious	Unknown	Browse	45.84.8.182
	NLRpif3sEB.exe	Get hash	malicious	Unknown	Browse	213.226.100.197
	NLRpif3sEB.exe	Get hash	malicious	Unknown	Browse	213.226.100.197
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	176.123.5.14
	http://server.citierupticx.com/specId/product-mje%EF%BC%A0ml.avio.co.jp	Get hash	malicious	HTMLPhisher	Browse	91.208.197.216
	2024-11 eStmt 5563019.exe	Get hash	malicious	ScreenConnect Tool	Browse	176.123.1.130
	otis.exe	Get hash	malicious	Unknown	Browse	91.132.92.231
	otis.exe	Get hash	malicious	Unknown	Browse	91.132.92.231

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.936991678958394
Encrypted:	false
SSDEEP:	24:I8DfZBwyIBrVjixE9v8qRia70elZW1f33qhqt:lDHmN8Kv8qiP4iHqK
MD5:	B6A510A26480E97554818D3CD644B611
SHA1:	47E927CB000B69FE4C241E8199F841B7E1F72480
SHA-256:	A4AFCA894F2DEA2B8BE2BB3AAF8F9145257EC001941893A592AE4A0F3D5192FB
SHA-512:	43C50DF8C2FCFDBC9DAEC4123909B21BE8570EFDB27D29BF345085A1E6F27BEA64FAAB61C72C1E163F00A96030D1FAE55E89D667560DEF73EDD4BE53AB084C6A
Malicious:	true
Reputation:	low
Preview:	sbx{x~{afwjuggs~y`}ugzwe`dlx`bu~ssyzwtc.ivf}echuqdyw\|fys{.}rsj}}lb`pqrkq~~{pbv{sxbyp`dkdfrakfl{dwvn.ytcybfvdbtwwoemkacsjuys}o\|zfozyrgwvww{c{zctxl{upysljx}teg}dd{.wzcbqrdljapfy}{u.aiv\|od\|rgvl{zs{j{`uz\|bbtq.d{uzxhxtzmfd`xh`cxefa\|nacpte}oxcheu~zey.i.de`}ip.nxefyzgv}su~tcyv}}fypv{}q~}h{{fwttrdydynnzyycskx\|...pybz{bcyz~jynudj`b}rcv~zq}bxwaat.zbugy.ucmy`skd~s`c{gh~vvy{rnmpd}t}\|lywp\|syegt\|{\|~amtdesrg}k`cf\|sadia{awvfuraa\|ba{ys.vyzh~romzeqrqxyybgeptcs.bdcm`dqnthtpqv~o.b{pems..{`pqvxeabdwbbtwzxp{q\|zis}ftwdyvvcpwmffacbf.j{\|qtbxzd\|i.gedwx`ar\|u~xqruees}a~mdbiylmwxbqj``qo{fjppevgdej\|utnbc}gpyrk}~x{aqnhdvtsbuhv.ff`ymwy\|.lqqcbxxfj`ao\|\|vo`u.{zbcs}tsdyapu\|wm`xsf.qqggkqw\|a\|rcfv\|qcmgf\|j.adgawyo~zfu\|oyspv~pytzmzww.v.xcfb\|t.oyse~grdupbd}`vfdp{.awoxa{fhy\|qmwho~s{vjxnsuutm}xk`t~h.ycmm{\|n{}cp}qhexr}ahasbve~~`ktk.gitmdnuzdglq\|spoj\|gcqh\|zowgtvafavcak`xbnztcv~svqdmzwpvxszb`phw\|b.rdwymv`v{vspg.\|d{`{mt}ufb\|v`cvzuck`yggorxptpgtaudg.pj~gzielcutku.m{jz\|i.xbdfaevse}ub.oldsprvz{vthwauak.mdaaggchptv~fgatxpu}.x`uj{q~gg{\|s

C:\Users\user\Desktop\DVWHKMNFNN.pdf

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.942242596232926
Encrypted:	false
SSDEEP:	24:Uk7SZOe50qYsxLDARVEaYUaqNfXDVE4mAATEAB:z7iOe502VeEaYVqNfXJE43AIa
MD5:	4E6FD14005C7648C313F96E925692446
SHA1:	D1909A64392809F5EC206F1D689E1155A40EC8F6
SHA-256:	616753A4356E5E612D99D25A9CA659CB58083A469B3A1C452F0A0925DDC7D8F6
SHA-512:	AA3AE4277C74DFA22374957B97E7AD10B5B868EAAAB1608E93BA52DC949DE66269018653B723530CA06161F273DACAFCCAD2C6968D121B23FEA8E8456A4ABAE2
Malicious:	false
Reputation:	low
Preview:	udb.}\|wq{{kked~`taafrceoezn.~ery.miekkq..s.ferv.ot\|q.awe}agtgsz~ggvu}ruzrzbch~vrhv~`nvjbd{kv~zqcadzjkea}zhtplwi{~~kgeh\|zauwmcv.xm{y~{elduesshvxy~voea`o}.}ojx\|f..fto`gotsqtdnpne\|.\|xctamwg\|femb{dq`bwz`eyb.mr\|}oel}yumoh}crdgbye}`ktlaykzzjp}g}crkoxcavu.`ousymktposs~o.pyvy\|`jv{~id~evzc{dt~yxdw`yardk{.x~jug~}uytzffo`rp~ztcxegkoxdfs~`t{kbbiyg.{hec\|\|rsoyozpynm}q}pn`.`\|{}tku}~bcaakc~zvacfe`uctmtqa\|y}q}dg`.sd}vcvcatrlicnz.zax.`}grxeat.sue`y.~}}oruetynisfdazwccwabtzvgc~{xej.zei~.mjkh.`tidspawvdvf~~\|w\|vzfxaypafwwhcmem{.qyyk`tax}qtubqeftrbrrjzqc{agdxb~fv.}drcd\|{\|y`{ycwfbn}c~lfow.\|ahd`\|\|pus{`e\|}d}}vzbmgwc\|a\|fwsnw~dgzbgydtqdfruku`bu`lr~{ubqulsfxeqcjdf{k`rct{wvlq~kbrxhf.xgfjqt.}t.}\|{j.\|tibtcxbxcep{zzfzh\|pohg.rgz\|or~vm\|o~otucddfbxcs\|ktlr`vtbl\|yke.h`lcfc}gvs.t\|ampjjdtwhp}u`k~gstpyyh.~{perke.{f`at\|hrvdpfcsnvbxb{erc~v\|`i.lvysyex{dpyqkmbaco`ym\|vk.`ayzt~b}lmm{wauxafpdtusewzegco{ouxnrh`tb{vrgf}cfw\|d.qiebbsabavbgfuo`cmb~}\|ev\|v`qnbsf\|zb}qsaojbb.ax{e.hgxlgskjsybbegn.wkcgsbura\|iau`vvqo.ibhfzdgbobse`nygrvscqzshzc

C:\Users\user\Desktop\DVWHKMNFNN.xlsx

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.942242596232926
Encrypted:	false
SSDEEP:	24:Uk7SZOe50qYsxLDARVEaYUaqNfXDVE4mAATEAB:z7iOe502VeEaYVqNfXJE43AIa
MD5:	4E6FD14005C7648C313F96E925692446
SHA1:	D1909A64392809F5EC206F1D689E1155A40EC8F6
SHA-256:	616753A4356E5E612D99D25A9CA659CB58083A469B3A1C452F0A0925DDC7D8F6
SHA-512:	AA3AE4277C74DFA22374957B97E7AD10B5B868EAAAB1608E93BA52DC949DE66269018653B723530CA06161F273DACAFCCAD2C6968D121B23FEA8E8456A4ABAE2
Malicious:	false
Reputation:	low
Preview:	udb.}\|wq{{kked~`taafrceoezn.~ery.miekkq..s.ferv.ot\|q.awe}agtgsz~ggvu}ruzrzbch~vrhv~`nvjbd{kv~zqcadzjkea}zhtplwi{~~kgeh\|zauwmcv.xm{y~{elduesshvxy~voea`o}.}ojx\|f..fto`gotsqtdnpne\|.\|xctamwg\|femb{dq`bwz`eyb.mr\|}oel}yumoh}crdgbye}`ktlaykzzjp}g}crkoxcavu.`ousymktposs~o.pyvy\|`jv{~id~evzc{dt~yxdw`yardk{.x~jug~}uytzffo`rp~ztcxegkoxdfs~`t{kbbiyg.{hec\|\|rsoyozpynm}q}pn`.`\|{}tku}~bcaakc~zvacfe`uctmtqa\|y}q}dg`.sd}vcvcatrlicnz.zax.`}grxeat.sue`y.~}}oruetynisfdazwccwabtzvgc~{xej.zei~.mjkh.`tidspawvdvf~~\|w\|vzfxaypafwwhcmem{.qyyk`tax}qtubqeftrbrrjzqc{agdxb~fv.}drcd\|{\|y`{ycwfbn}c~lfow.\|ahd`\|\|pus{`e\|}d}}vzbmgwc\|a\|fwsnw~dgzbgydtqdfruku`bu`lr~{ubqulsfxeqcjdf{k`rct{wvlq~kbrxhf.xgfjqt.}t.}\|{j.\|tibtcxbxcep{zzfzh\|pohg.rgz\|or~vm\|o~otucddfbxcs\|ktlr`vtbl\|yke.h`lcfc}gvs.t\|ampjjdtwhp}u`k~gstpyyh.~{perke.{f`at\|hrvdpfcsnvbxb{erc~v\|`i.lvysyex{dpyqkmbaco`ym\|vk.`ayzt~b}lmm{wauxafpdtusewzegco{ouxnrh`tb{vrgf}cfw\|d.qiebbsabavbgfuo`cmb~}\|ev\|v`qnbsf\|zb}qsaojbb.ax{e.hgxlgskjsybbegn.wkcgsbura\|iau`vvqo.ibhfzdgbobse`nygrvscqzshzc

C:\Users\user\Desktop\HTAGVDFUIE.png

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.943725656860274
Encrypted:	false
SSDEEP:	24:EiXcvQJYGCIgRpzVVh1E+oC0fS1EJKy+ZOUd7wZtOn:EiMvQJYXNl/h1oLRGwUdsZtO
MD5:	54F60EA10B28914C04BD866A48120434
SHA1:	9D317146F5E1936402871FF3CF1AE9896901EE4A
SHA-256:	13A012D89F7BEF0E6203E18706B6E8C134151D0043FDF3C5C9632A5895F3F103
SHA-512:	029CF1DCA30708B9944DB6FCFBC2B391315FBDC02560AA9316471FDB3A713A7A605EFB7C540B05669A07325A15878730118BBA3225F89B5AB891FA1E6B8291BE
Malicious:	false
Reputation:	low
Preview:	yftp`u.b\|pttmr{fhhpbbc\|duitx~f{rmqrdsbu`{ytu.krrrsytzsw{gb.`{}l~a\|o~~b{}b{ov.utvixdvx\|tx`yqeceiughaf~~o`thm.lzp~zbq.ffurrs\|py.wecpm~cwlqw.cgw\|qdgaqreyyumuska`xjz`dsckvbo\|syp~j{pxxty}`{\|ynfw\|r`v}a.j~q.btzrpzmfep}dq`~q{td\|yjfooi{`ae{dzw.bwfxcg~{\|orvysb{zbr}cy}`a.c~}exc\|{o`\|fcufx}pgup`qtz}o`eaj~lmf}bd.geya}xv\|sekksun.pgmyhkobge}{o\|uaes`~f}rz\|tb{y\|wg{yqpgnhyfzght~ruoes{z.wv`zjv\|.ohckxv\|snta{uqeqqxvdayiw}rqhh\|od{t{bp}q.bczjvfg\|leylsdb}m.tapi\|h`fnrmmz~ijo~ygvwadb}zfczc\|~p}\|vz.a{{`dddpp~ezxam{wcwb{tgvgu~b\|r.hc`t`qtfzywu.stbbcn~hawbszoxiwgq.xczx\|a~oawsw.yapa~~zx~}ssgrvadc{}\|.a}u\|giwzxg~iwgzay}n}.yajpiuywvsp`t{f\|vfflvhj\|e~{`x~~t}ev{wo\|rfj~\|`r~t\|zdwstsbeblspapvgd{wrgwxy}as.slppd~zrxjobfy.b\|}lvtshbw{cgx`ecgyssqgurfqjc.vxu}pzfettzxv{fgenvhjxvwkddsx}oqe~}\|f.kdgstyzdpfc.bstr\|\|`rau..gcjempam.`t{vxr}hgkxc{u.{pdm.aqoqga}fbtxgff{aquit}r.pngw`bke~chcqrxhmyrnkdnty.bsfzc`e{}jmqq`eyvhjyp{axywcwfunaoogqave~am`fgbu`sab.xzpq\|h.p{ew}ct`r`m}p}s\|pymfw{{hc}c.n.lxgaljzwuvu\|mirqvc.p{t~lhftshbggdrf~\|gokr~xgpuan{uvb\|j

C:\Users\user\Desktop\JSDNGYCOWY.jpg

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.9241713610950555
Encrypted:	false
SSDEEP:	24:6NrLFNtuG3tyDvGUGK6MUpB2ow5wKhfKrB7XydlKIj28Masaf:6NfFNtuG3ArGUXwpZSwO8XDaf
MD5:	442F7BCEBC7B69EEFA06CFBF9D214C0A
SHA1:	587CCE88520987CF47A5039E1C36E4AA2646B897
SHA-256:	4D9CA0A42CB5A9B1DC17E88E9430F748555966AE33BB7C3642D860757E302406
SHA-512:	268D8222D5AE68AD7A392F668B49652E0545178C295A77FF25100366563136A5E4CB3BBC3D4865306B966967D27353CC6B109B883559BEED4F8BEEB4FF8BD53F
Malicious:	false
Reputation:	low
Preview:	{aqyqhzxblpxd{otuq~uc`aqo{t{wykrz`}h`pbgw`mn.rpb}ovzzbtxjfqh`\|mvuc.`fpoyuqjcz~rrakmesrz`q.sz~{mu\|kf}vs}dz~i{yttrrp\|yxfx.rvrn.sv`oojv~qoajcewd~o~nw`y\|`u}czy~edvrydy\|s{uu~rwxonovaeede~afz.mmqlu`rwa.c{d~r\|\|v\|~nsvvu{`xqdtstazhmol{vdp{zy.n}~{dxspzqylvc~yskz{`ksxjsrws\|g~gqol}r{aynzydx}h}rp`xra.`nj{p~f{quskyfadukctykkqzuqb~p.vapu}ij.f}nwapsewzyys~ec{fpttt{eqchc\|{bf}tfvaavpq.~\|p``vz.cvf`palizvw.{xqm`xus.{ej{qzxp{axzac.yqf.xfupyt`h}ay{{wouy{\|fpsr`ogrevqvbbdc\|tqdued`bpu~d.nbyl.yaq}t~xeeq\|yltsbcyligd\|pdvru}qrqgb~}egrqrutc~hfqhsdecelv{vafm~}\|ew~ybv{bz}so.`hqf\|}xwga}z.pbgc}.meyia}~vguygiymnaxhf{.vazm{~x~.gtactxrhdm\|txee~akwsjbp}dzp`~bbweebnaegqupcezwax\|sv`uupqbyzgcwucx\|r\|rwttcaeswqpuerfdpgivftew\|nuhkcjyt}y.sdwhs\|yhz`f.vkfqeyao{\|xzzx`k`.sp\|~yyuukm}ea\|tcayvf`njsfx.usceyfwvevpwefzzdvagsuzdu{~sp{ytqwav{zv`sey}x~itdvhgd{pucczxts~et~{dp}y\|zs`xdk`zv~f~g{lxxlh}m`wtd\|y}c{cz~~zqoatgrpyuwjpzi~{ezbq}dr~{~~\|~xzx`a.sgotpoegipcf\|{kv}uyzf\|pskmxmti}v\|v}kth`xwtt`.emc{jt\|`yu\|sgtw`b}axpc}p\|orbjhw`gr}cdphc.\|ybyfestzq{b

C:\Users\user\Desktop\KATAXZVCPS.jpg

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.941173070112748
Encrypted:	false
SSDEEP:	24:R926993Moyy/wIwMb5HjP84K0wFVIW8Oc/Jhp:R926X3Moy3MlDP8iw7yOchH
MD5:	3FEE51B980A650924530A248376C74A1
SHA1:	10C4D5D8F581ECEAB39989F1B547A76E45ABC373
SHA-256:	2231C12F39DB9271BC7BE48B948D342605012A5A68187F36FE37972DF6F38B0D
SHA-512:	C9F95A5EC80AF0D91BFFCCA1A081152053DCA9D27887A97819CA8E366BAC0F76E1DB92CFC62FA95076F2D227C8E2F00B4535C5377104EBBC442FEBE1DAC6E797
Malicious:	true
Reputation:	low
Preview:	zsavnkotef`wywjuf{rqy~au{`lqtlkdrytc}..}xyessr{tzlh~d`lzzbs{k\|rqqfzy``.zplhwpet`cyqpt~ngf{ugqmqzdk~dacr}owvv.xoefppda.nxajspx~lewwqeabu`beur}cmbupabstaad`{yejvq\|y.}lxualovqggujsuojusfq`vrua}vtr`tc{zgbxde~`yotfg\|fuq.w\|hzxbkd{d~sgo\|tvnnqtvssa.`r.wscydxhbzqnydweuesdb~da`~ll`b.mj.fdyagm}d.cxye..eg~pqzngv.gsf}{b\|\|~{qavte`v\|sgemzusb}\|u}`.u{ak~{pcrdzv{`wsmkvgsgtjsd}xtoyb{udaiyy~ydxc{attp\|dfnog.vydcaccygupd.eck~\|.`yi{dp.}fo\|.jtm..`g{eb}pfudkdtiab}\|bhstwbvfel~fq{c{}vgdp\|p.sopzsd.~}f.s`tomsyprmbv}mfrc~en}gg}cny.qqaaq.pjp`\|c`}pmg`wzbctr\|n{o`w\|qeifftxrzf.zkzcw~fux.v`ql~ezlvcfjjvgodx`s~~kltehvmb}jcygze.zbetk`pyiodl~tumumcxhsfsww.~vaf}ony`zmu~avif{p.w{zg\|zp\|gw`y\|deybprbwttdlp.}ge`{f`~y\|jz{.{`bw\|}bpnigszeg\|yd.ucq\|w.bbfl~kf\|uxtxp`dacemo{ke~id{gxqextroup{gpjvs}otw.~ctyo`xr}c\|elgxn`}hx~i\|u~n.zauy`je`vrzkt}s}uca.\|xs`ylganq}w{g}gxtxfbhtqsujgghu~p~aifbcck\|erw\|gt}j`d`c~vw{oncm.pf`bqaia`ubaucbpbvacfr\|j`}id}yvrp{t}.tlalvbkymnyb`eu\|ktarw}.bz.v\|utgbp..yw{~~}.}otpec~qcxp\|h~k\|xs}z~\|p{yudlfsauuzuzrec}qwt{cx`v.`hxw

C:\Users\user\Desktop\KATAXZVCPS.xlsx

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.941173070112748
Encrypted:	false
SSDEEP:	24:R926993Moyy/wIwMb5HjP84K0wFVIW8Oc/Jhp:R926X3Moy3MlDP8iw7yOchH
MD5:	3FEE51B980A650924530A248376C74A1
SHA1:	10C4D5D8F581ECEAB39989F1B547A76E45ABC373
SHA-256:	2231C12F39DB9271BC7BE48B948D342605012A5A68187F36FE37972DF6F38B0D
SHA-512:	C9F95A5EC80AF0D91BFFCCA1A081152053DCA9D27887A97819CA8E366BAC0F76E1DB92CFC62FA95076F2D227C8E2F00B4535C5377104EBBC442FEBE1DAC6E797
Malicious:	false
Reputation:	low
Preview:	zsavnkotef`wywjuf{rqy~au{`lqtlkdrytc}..}xyessr{tzlh~d`lzzbs{k\|rqqfzy``.zplhwpet`cyqpt~ngf{ugqmqzdk~dacr}owvv.xoefppda.nxajspx~lewwqeabu`beur}cmbupabstaad`{yejvq\|y.}lxualovqggujsuojusfq`vrua}vtr`tc{zgbxde~`yotfg\|fuq.w\|hzxbkd{d~sgo\|tvnnqtvssa.`r.wscydxhbzqnydweuesdb~da`~ll`b.mj.fdyagm}d.cxye..eg~pqzngv.gsf}{b\|\|~{qavte`v\|sgemzusb}\|u}`.u{ak~{pcrdzv{`wsmkvgsgtjsd}xtoyb{udaiyy~ydxc{attp\|dfnog.vydcaccygupd.eck~\|.`yi{dp.}fo\|.jtm..`g{eb}pfudkdtiab}\|bhstwbvfel~fq{c{}vgdp\|p.sopzsd.~}f.s`tomsyprmbv}mfrc~en}gg}cny.qqaaq.pjp`\|c`}pmg`wzbctr\|n{o`w\|qeifftxrzf.zkzcw~fux.v`ql~ezlvcfjjvgodx`s~~kltehvmb}jcygze.zbetk`pyiodl~tumumcxhsfsww.~vaf}ony`zmu~avif{p.w{zg\|zp\|gw`y\|deybprbwttdlp.}ge`{f`~y\|jz{.{`bw\|}bpnigszeg\|yd.ucq\|w.bbfl~kf\|uxtxp`dacemo{ke~id{gxqextroup{gpjvs}otw.~ctyo`xr}c\|elgxn`}hx~i\|u~n.zauy`je`vrzkt}s}uca.\|xs`ylganq}w{g}gxtxfbhtqsujgghu~p~aifbcck\|erw\|gt}j`d`c~vw{oncm.pf`bqaia`ubaucbpbvacfr\|j`}id}yvrp{t}.tlalvbkymnyb`eu\|ktarw}.bz.v\|utgbp..yw{~~}.}otpec~qcxp\|h~k\|xs}z~\|p{yudlfsauuzuzrec}qwt{cx`v.`hxw

C:\Users\user\Desktop\NWTVCDUMOB.jpg

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.930818611892816
Encrypted:	false
SSDEEP:	24:C9qyd6NWxjwt5IcATJd/eA+gdSgHkuq9yWMfFP:/Wrxst5LATX/elgHxq8t
MD5:	35DA0E6A73175C1EBB4BBAC516DA1329
SHA1:	7438FE68FD89FA558D944A1C42BAF0C9E0E80729
SHA-256:	D0637AB4266F2191B69C41BE9909E67C2859234E5E3C5F5316A933D80341BEFF
SHA-512:	98B3FD1BFFEDCBBDFC169C4A8DF8A6924817C885F870CF7C9484C0417FE297F00E987799C73EEB88A78AA5754A0D03E54A824060326FC09BC13047C2CA89FCC8
Malicious:	false
Reputation:	low
Preview:	.eaauulzzwlceeibzjf\|x.rg\|imrxez}nxztycqetdr~e{jadgucznkskwnab}abw{.~ymtg\|r}dz~dq\|kprp}w}f}tgcr``fvyevjpq.vottbh~szm{qv~jvb}zsbr`fxmcy{~wdjqdbzf\|zro.davxs\|\|.v`}.dfpberxbtcueuywaky\|babonpd~osmo~`fyqytta~g}~b}lt}r~ir{qb\|q}v{}culxrsg{}ao{kbyae}yya}cv.rzzvu`xn\|fx`hdtevrf`~`qsrme`qh`q`dcdv{cm~zppfs`tu}en}xvzmwim{rc}tbwi~xhp}xwdny}nrxf.ibvoj}{uat.d{gg~ewamztr{wxuqdk`ot}{hrxtlvxzq.xyuivclsoiv{ygwdosaq\|qa`e.gme\|tdoms~ydkqxx}{z\|gv\|i~dyovx}fr`u.tsrpv~qeucs~vesbqzk~pb.jqa.gnuvevxy}~xsbfafvdfsu}\|{}nyeerfyqbqu}g`dt\|slanuv{ozb\|ogb\|t}ugatyyl}fduxczsy}t{fcksmo.r~zz\|\|uwuuvaaawvc}xfui.cry\|{vvvp`n{gxs~vn.ss~cwfbjiu`xcfauwev\|`r}`y.\|}a}m~yer}pgheo~.q{g\|qvvr~b}.ng\|zrg.jwa.y.\|fcclrazzqmf~s~.w.u}vsropk~vto~popopyyt`dysqx\|o\|qs~emmoywyug\|sq`rkab\|zw.txqsqwdwcp.ee\|a\|`fwxo~}{qqgbwef~eum\|ca\|evmke~`.dfxrtn`ty\|aiy.wz.aqsbfyxpwun~yyygxdnb{~ra`ut~fckbv.~gefkae{caz{b}ypmmzw}gmpzpes~zx}mtc`j~ydpb\|qbjet`g.dp`}kzpslhqsg\|patvjuhse~{{m\|rwitbmu}vbd.qq.}ztq}faxbg~aj}z.djonyblm{.iqounb}pcfs{{zexinz{tje.qz}\|\|gya`v\|fpvyzlivera\|f~x

C:\Users\user\Desktop\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.930565775245372
Encrypted:	false
SSDEEP:	24:wkwvcp6U1Bf7KdqI0qEdiDybFQ+WywU6yhOwy4:Mvcv1lWgdik1s9wy4
MD5:	37D4B66418541B22320B95DF35F5753A
SHA1:	AC699928F847B503DBF34F18553F24CDB16D0D4E
SHA-256:	F11CB588DD176BBD4FB6C047E740893CC039D8F1B59402C014A19B961C43709D
SHA-512:	73BBACFD99D469916E2C4FA145DF6F7E71E9CC157DB65B553B09DAAA61B76F8D25B97E2944C9857BEB575917DFA53F238F829AADC2DC54652998AEB93393A5CC
Malicious:	false
Preview:	~\|wfu}`de`zwve{{ukygizerx`w{.o.kt\|`a\|jm~rhwb~h}oepup}dyekcdfy.r\|~{lqssawvl\|sz}{.phpgbfccbq.cqx`..qo\|r{\|}yitag{ufz`qqdzfcf\|tp.hzfwzbi.{veepo{ug.ntcidy{~tcaqtf\|pztsaxnzqrsx}avebdp.fwzh`\|nu{zrgrwx{.sfhm{`.pm\|cnmctbageldebrdr{x{f\|`ybote{ljbgg\|\|.{xcouwn\|.lirrrv\|.`d~ts\|dcpyvg\|pqsrsx\|zi`zroqgqale}fqvvg{ubfvplf}xx}y\|nrtbqzwumyhyfeydkyrokpcaspytqsvbmvy.ispwqi}fsqtk.qevm{nhrpyb`qt\|rw`qe~\|ypd.\|{s{eucuc`adarqpgp\|svl~.wb.vqksth.}s~eg}\|wcotbz~mkz.e}rwfomez`ys.a`uftudzxgkgd.ndjd.pkzr.ph~f{y}.fz\|kqosb.yfzocqv{htewmfv{ccqnpgdmt~tp~k``\|\|~xy.c`eclt}c~qexdp`br{\|zwaizuwf{.f}{kgnzbv{ffyptx{tfdoszy.sxfhvpavk.}wcqvch}~crg}w{rqq\|bxvt\|\|shedlnea}`bopwdmpp`jzeps}}.vjpyf~xtsyvbgvqbkoqskn.lqtbsa{zxjz~\|f{trrty\|.ipds}c}uawhplg{ecuwswrtnu.ydq~t~zzqbmtd`\|aq.ttu}..eh~mufs`qg}ppm}ftkxg}kptqxzzr`siebvzgcc\|`~}bbakmmwnjzdytp~dgzaf\|tvntbw~vrnqshgmwtkxntban`vpvvx~x`apg`xxvt.h.foy}splk.d}{itsqrt\|yot.apbtztw{f~arcngvxes.pfpkte}n{z}lb~wnzmbh..rq{b}e}tx{xpht}gwyi{ml{}yrvxeesldrz\|bs.mlz}wabsihmfertf~qsuuwpx.bzjywy{xb`np.vqef`dp.gt

C:\Users\user\Desktop\ONBQCLYSPU\HTAGVDFUIE.png

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.943725656860274
Encrypted:	false
SSDEEP:	24:EiXcvQJYGCIgRpzVVh1E+oC0fS1EJKy+ZOUd7wZtOn:EiMvQJYXNl/h1oLRGwUdsZtO
MD5:	54F60EA10B28914C04BD866A48120434
SHA1:	9D317146F5E1936402871FF3CF1AE9896901EE4A
SHA-256:	13A012D89F7BEF0E6203E18706B6E8C134151D0043FDF3C5C9632A5895F3F103
SHA-512:	029CF1DCA30708B9944DB6FCFBC2B391315FBDC02560AA9316471FDB3A713A7A605EFB7C540B05669A07325A15878730118BBA3225F89B5AB891FA1E6B8291BE
Malicious:	false
Preview:	yftp`u.b\|pttmr{fhhpbbc\|duitx~f{rmqrdsbu`{ytu.krrrsytzsw{gb.`{}l~a\|o~~b{}b{ov.utvixdvx\|tx`yqeceiughaf~~o`thm.lzp~zbq.ffurrs\|py.wecpm~cwlqw.cgw\|qdgaqreyyumuska`xjz`dsckvbo\|syp~j{pxxty}`{\|ynfw\|r`v}a.j~q.btzrpzmfep}dq`~q{td\|yjfooi{`ae{dzw.bwfxcg~{\|orvysb{zbr}cy}`a.c~}exc\|{o`\|fcufx}pgup`qtz}o`eaj~lmf}bd.geya}xv\|sekksun.pgmyhkobge}{o\|uaes`~f}rz\|tb{y\|wg{yqpgnhyfzght~ruoes{z.wv`zjv\|.ohckxv\|snta{uqeqqxvdayiw}rqhh\|od{t{bp}q.bczjvfg\|leylsdb}m.tapi\|h`fnrmmz~ijo~ygvwadb}zfczc\|~p}\|vz.a{{`dddpp~ezxam{wcwb{tgvgu~b\|r.hc`t`qtfzywu.stbbcn~hawbszoxiwgq.xczx\|a~oawsw.yapa~~zx~}ssgrvadc{}\|.a}u\|giwzxg~iwgzay}n}.yajpiuywvsp`t{f\|vfflvhj\|e~{`x~~t}ev{wo\|rfj~\|`r~t\|zdwstsbeblspapvgd{wrgwxy}as.slppd~zrxjobfy.b\|}lvtshbw{cgx`ecgyssqgurfqjc.vxu}pzfettzxv{fgenvhjxvwkddsx}oqe~}\|f.kdgstyzdpfc.bstr\|\|`rau..gcjempam.`t{vxr}hgkxc{u.{pdm.aqoqga}fbtxgff{aquit}r.pngw`bke~chcqrxhmyrnkdnty.bsfzc`e{}jmqq`eyvhjyp{axywcwfunaoogqave~am`fgbu`sab.xzpq\|h.p{ew}ct`r`m}p}s\|pymfw{{hc}c.n.lxgaljzwuvu\|mirqvc.p{t~lhftshbggdrf~\|gokr~xgpuan{uvb\|j

C:\Users\user\Desktop\ONBQCLYSPU\KATAXZVCPS.jpg

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.941173070112748
Encrypted:	false
SSDEEP:	24:R926993Moyy/wIwMb5HjP84K0wFVIW8Oc/Jhp:R926X3Moy3MlDP8iw7yOchH
MD5:	3FEE51B980A650924530A248376C74A1
SHA1:	10C4D5D8F581ECEAB39989F1B547A76E45ABC373
SHA-256:	2231C12F39DB9271BC7BE48B948D342605012A5A68187F36FE37972DF6F38B0D
SHA-512:	C9F95A5EC80AF0D91BFFCCA1A081152053DCA9D27887A97819CA8E366BAC0F76E1DB92CFC62FA95076F2D227C8E2F00B4535C5377104EBBC442FEBE1DAC6E797
Malicious:	false
Preview:	zsavnkotef`wywjuf{rqy~au{`lqtlkdrytc}..}xyessr{tzlh~d`lzzbs{k\|rqqfzy``.zplhwpet`cyqpt~ngf{ugqmqzdk~dacr}owvv.xoefppda.nxajspx~lewwqeabu`beur}cmbupabstaad`{yejvq\|y.}lxualovqggujsuojusfq`vrua}vtr`tc{zgbxde~`yotfg\|fuq.w\|hzxbkd{d~sgo\|tvnnqtvssa.`r.wscydxhbzqnydweuesdb~da`~ll`b.mj.fdyagm}d.cxye..eg~pqzngv.gsf}{b\|\|~{qavte`v\|sgemzusb}\|u}`.u{ak~{pcrdzv{`wsmkvgsgtjsd}xtoyb{udaiyy~ydxc{attp\|dfnog.vydcaccygupd.eck~\|.`yi{dp.}fo\|.jtm..`g{eb}pfudkdtiab}\|bhstwbvfel~fq{c{}vgdp\|p.sopzsd.~}f.s`tomsyprmbv}mfrc~en}gg}cny.qqaaq.pjp`\|c`}pmg`wzbctr\|n{o`w\|qeifftxrzf.zkzcw~fux.v`ql~ezlvcfjjvgodx`s~~kltehvmb}jcygze.zbetk`pyiodl~tumumcxhsfsww.~vaf}ony`zmu~avif{p.w{zg\|zp\|gw`y\|deybprbwttdlp.}ge`{f`~y\|jz{.{`bw\|}bpnigszeg\|yd.ucq\|w.bbfl~kf\|uxtxp`dacemo{ke~id{gxqextroup{gpjvs}otw.~ctyo`xr}c\|elgxn`}hx~i\|u~n.zauy`je`vrzkt}s}uca.\|xs`ylganq}w{g}gxtxfbhtqsujgghu~p~aifbcck\|erw\|gt}j`d`c~vw{oncm.pf`bqaia`ubaucbpbvacfr\|j`}id}yvrp{t}.tlalvbkymnyb`eu\|ktarw}.bz.v\|utgbp..yw{~~}.}otpec~qcxp\|h~k\|xs}z~\|p{yudlfsauuzuzrec}qwt{cx`v.`hxw

C:\Users\user\Desktop\ONBQCLYSPU\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.930565775245372
Encrypted:	false
SSDEEP:	24:wkwvcp6U1Bf7KdqI0qEdiDybFQ+WywU6yhOwy4:Mvcv1lWgdik1s9wy4
MD5:	37D4B66418541B22320B95DF35F5753A
SHA1:	AC699928F847B503DBF34F18553F24CDB16D0D4E
SHA-256:	F11CB588DD176BBD4FB6C047E740893CC039D8F1B59402C014A19B961C43709D
SHA-512:	73BBACFD99D469916E2C4FA145DF6F7E71E9CC157DB65B553B09DAAA61B76F8D25B97E2944C9857BEB575917DFA53F238F829AADC2DC54652998AEB93393A5CC
Malicious:	true
Preview:	~\|wfu}`de`zwve{{ukygizerx`w{.o.kt\|`a\|jm~rhwb~h}oepup}dyekcdfy.r\|~{lqssawvl\|sz}{.phpgbfccbq.cqx`..qo\|r{\|}yitag{ufz`qqdzfcf\|tp.hzfwzbi.{veepo{ug.ntcidy{~tcaqtf\|pztsaxnzqrsx}avebdp.fwzh`\|nu{zrgrwx{.sfhm{`.pm\|cnmctbageldebrdr{x{f\|`ybote{ljbgg\|\|.{xcouwn\|.lirrrv\|.`d~ts\|dcpyvg\|pqsrsx\|zi`zroqgqale}fqvvg{ubfvplf}xx}y\|nrtbqzwumyhyfeydkyrokpcaspytqsvbmvy.ispwqi}fsqtk.qevm{nhrpyb`qt\|rw`qe~\|ypd.\|{s{eucuc`adarqpgp\|svl~.wb.vqksth.}s~eg}\|wcotbz~mkz.e}rwfomez`ys.a`uftudzxgkgd.ndjd.pkzr.ph~f{y}.fz\|kqosb.yfzocqv{htewmfv{ccqnpgdmt~tp~k``\|\|~xy.c`eclt}c~qexdp`br{\|zwaizuwf{.f}{kgnzbv{ffyptx{tfdoszy.sxfhvpavk.}wcqvch}~crg}w{rqq\|bxvt\|\|shedlnea}`bopwdmpp`jzeps}}.vjpyf~xtsyvbgvqbkoqskn.lqtbsa{zxjz~\|f{trrty\|.ipds}c}uawhplg{ecuwswrtnu.ydq~t~zzqbmtd`\|aq.ttu}..eh~mufs`qg}ppm}ftkxg}kptqxzzr`siebvzgcc\|`~}bbakmmwnjzdytp~dgzaf\|tvntbw~vrnqshgmwtkxntban`vpvvx~x`apg`xxvt.h.foy}splk.d}{itsqrt\|yot.apbtztw{f~arcngvxes.pfpkte}n{z}lb~wnzmbh..rq{b}e}tx{xpht}gwyi{ml{}yrvxeesldrz\|bs.mlz}wabsihmfertf~qsuuwpx.bzjywy{xb`np.vqef`dp.gt

C:\Users\user\Desktop\ONBQCLYSPU\UMMBDNEQBN.pdf

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.936865080324893
Encrypted:	false
SSDEEP:	24:YhFkSGZ7zL9NitoPJLQ2aeSqEnrlHrQ8Gzc5ttEdJa:YIDHL9qoPq2fKprBG4Ca
MD5:	C9AEBF8842AACD9B7E568D86FE5802C4
SHA1:	01FAF29DC6C1CCD27E8B962847C57502A1BA85BA
SHA-256:	42A564C57A9E954C435EC0C3F81CE5775BF609BF2A040181D33A06B4060C37E8
SHA-512:	AD7E3F2A402589AD2465E9F358EDC31E5718AB813D5CD0C45D960330F98C2EE098AAFC6ED3408F4D10F3064E1DB778AF8CA729075B5E9A98E9867EF7406B4A47
Malicious:	false
Preview:	d.xur.\|fw{nzzvvuzkmssym`{`s\|l\|kgvzk`\|tohsyt{.x\|zpbyufqhfw.msxjmy{`{pzmo`smksey~iax\|cxc\|zcg`cg~btgfzwc`gpbrqaypoeb~.hwgff~\|dawr\|qbomp~u~jbtphxgzxtk\|rxrud}eqwyy~shx.`wwl\|loyyrsmcyus`cbmtyfpgwgmt.c\|th~pczhct~gogry}uysqd~pa~p}cowa~vat\|yu}ifp\|}wfjgdshrtfcb\|d`{pzkqxdvp`xv\|~svnardbvhvmbxfsr`wzfdbrjmlhgyx`xeer`wbm\|qvyercb}{uqjy`bt\|soeyqota.hspqfe~zd~{}lq`ratzd.bw.dbabfpax~eceztm}o~\|waiwt.uu\|{dmcyqyfvjg~tddstywi}.~owtawvchzzbsw{`beufccuw{zzwez{`kzxgrvk{.byb}pr`qecvf{z{wdkevfuu}{{tvybwa~agwsxem~hpelw{zzabfjt\|qyvcly{vfeakvyaj`al{up\|prwi~z~.a\|x`rexmd`pu~{{j.bfub\|uqhyxga\|xrf.f\|.y}wju{ptwvvxbv~oxqtgsmk{yqz`g{{sriafvpipeaz~tw`}h.frqdq~~\|.fn{u}ja\|.ed{bxvnbslsjezbj}}ccckm{lykmm{}w}avbkuyyxhfg``{xywjaec.v.c`ee`fmas`zm{u.\|x~\|he}fuvez\|~accwujelvctuu\|d`~q.dx..w~uozocvke\|ksqnq\|\|c{m}\|oxwxykf`tk}b`e.pmdltgezehccfwjoqcghrgdbytmabtpn..scqr~uc{g.dfm.aketgdegrb{cpc.uvqelkb}{..doqdtoxgxzb}{{~}s{s{z}t~`j.~ym}u}jz`pdab.pezzrqarpff.jbt{~u}hoankoy}vqbnm`\|.xyc~hz~dv~}~`okywoa\|qq}vc\|f`.ra\|rjp{g\|ecbrt}aycqskogautqcacaq{~

C:\Users\user\Desktop\ONBQCLYSPU\VLZDGUKUTZ.xlsx

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.938072176856892
Encrypted:	false
SSDEEP:	12:nOqQ4Lwh74tvIBvXYchI5aakrlpxElnbB/AANQ4pu7VIwfeWDlgwZmXA6/1xsH4x:TQ4EDBvXfS5BEMnVze57GwdQL1bdV+HC
MD5:	FC5D88555A4781662E12D72620E6B4B6
SHA1:	73ED6C1F5B188D67E2705E88D3FFC9EE7D1B707D
SHA-256:	B61553C30E2EF648A00854F8CEBA3AC39C996E4B44BCEAA4DD221FEFD836AE99
SHA-512:	CD6347AE2245BF6770E3CE889099508642B5DD760C331EC410B5FDF1CC4E92253F7A77BB3A2E271999CF22FE99BD4CDB5DF17115F60F6D587DB2FAA7A00008FA
Malicious:	false
Preview:	g~osqdrbao`x`athpes.ew\|u`yopeow~r`nu~zr{`ccnxdtbtztqygphkfe{iw{~zxjb}qyvrnohwgy~\|e.c}{sxy}szp~z{zwz\|kbc.sd}{}`bpdvmkusgab~}tpfqopl~jcr.hfcywip\|bwxvnvv{vdx`yc.mtgjvsfztnfbmuf{wukqfqbu.ozgvr~mz\|ul\|gyuvgp.fr~b.x`wbvdgpubdbgsato{u}d{a~ye}rdqkysw~vzwhqvdwwexm{c{qv`~w\|vykcs}g~pudz{x`vq}u`zukadfgsd``te`qvw\|p~{gpmzpywaqpjt}bzhhh```u\|t`w~x}m.sd\|gykz.vugid{zkjpybs\|u.~vhv.{vkawybdnl}`gk.cvy{n{spbz`naeeb\|tgrigvfnxkvpvdiyudyuuseevqdpfb`zc~aurultfgvcatv{whogyg{k`wv{spstgyfqtgcxboramw~ch}ouwhlydsiuxfp~}ryqugajdf{p\|d\|`lb.ctqmt\|xcxcw`r.y}nm`kyz.zsxd`whxw}lxk}fgv.se}dthv{g.~q\|bp.qts{~qbw`kzsbxyq{prctrmzuqagwaxzsqmsxwoz{orru}mdkbfzeesntksgxbt\|~\|vztufx{.{`rwzvagpynfqjyt}ut}yaew}gaovcbrm\|wwx\|czctf~igzx}iumluxy\|gdcg.ue.a~dzyvdl}~hvtbecg\|hkpgqmdd`vqj~gau.eaabjqp}~d.ga\|u\|..hhxqwujxaoji}c`puggtk~ez}ec.c\|`\|qa~zbpc\|w`rz{crxavo`dfkajh}~kxrqn\|hzml`xf{~gws\|u{.rgb`lfblspmc~u}u}he`wsssafbf\|{brze{`g~~}pybfnqg\|z.mvustfzja~s{zgrcrxmky.t`t\|n\|tt{\|\|fi`{yy}`vjvsaqbux`g~gce}p~q~ziqy.xf\|cz{rsngaxa~zrjq~e~dk`cqzujx\|sj~}w{cjk{d

C:\Users\user\Desktop\UMMBDNEQBN.docx

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.936865080324893
Encrypted:	false
SSDEEP:	24:YhFkSGZ7zL9NitoPJLQ2aeSqEnrlHrQ8Gzc5ttEdJa:YIDHL9qoPq2fKprBG4Ca
MD5:	C9AEBF8842AACD9B7E568D86FE5802C4
SHA1:	01FAF29DC6C1CCD27E8B962847C57502A1BA85BA
SHA-256:	42A564C57A9E954C435EC0C3F81CE5775BF609BF2A040181D33A06B4060C37E8
SHA-512:	AD7E3F2A402589AD2465E9F358EDC31E5718AB813D5CD0C45D960330F98C2EE098AAFC6ED3408F4D10F3064E1DB778AF8CA729075B5E9A98E9867EF7406B4A47
Malicious:	false
Preview:	d.xur.\|fw{nzzvvuzkmssym`{`s\|l\|kgvzk`\|tohsyt{.x\|zpbyufqhfw.msxjmy{`{pzmo`smksey~iax\|cxc\|zcg`cg~btgfzwc`gpbrqaypoeb~.hwgff~\|dawr\|qbomp~u~jbtphxgzxtk\|rxrud}eqwyy~shx.`wwl\|loyyrsmcyus`cbmtyfpgwgmt.c\|th~pczhct~gogry}uysqd~pa~p}cowa~vat\|yu}ifp\|}wfjgdshrtfcb\|d`{pzkqxdvp`xv\|~svnardbvhvmbxfsr`wzfdbrjmlhgyx`xeer`wbm\|qvyercb}{uqjy`bt\|soeyqota.hspqfe~zd~{}lq`ratzd.bw.dbabfpax~eceztm}o~\|waiwt.uu\|{dmcyqyfvjg~tddstywi}.~owtawvchzzbsw{`beufccuw{zzwez{`kzxgrvk{.byb}pr`qecvf{z{wdkevfuu}{{tvybwa~agwsxem~hpelw{zzabfjt\|qyvcly{vfeakvyaj`al{up\|prwi~z~.a\|x`rexmd`pu~{{j.bfub\|uqhyxga\|xrf.f\|.y}wju{ptwvvxbv~oxqtgsmk{yqz`g{{sriafvpipeaz~tw`}h.frqdq~~\|.fn{u}ja\|.ed{bxvnbslsjezbj}}ccckm{lykmm{}w}avbkuyyxhfg``{xywjaec.v.c`ee`fmas`zm{u.\|x~\|he}fuvez\|~accwujelvctuu\|d`~q.dx..w~uozocvke\|ksqnq\|\|c{m}\|oxwxykf`tk}b`e.pmdltgezehccfwjoqcghrgdbytmabtpn..scqr~uc{g.dfm.aketgdegrb{cpc.uvqelkb}{..doqdtoxgxzb}{{~}s{s{z}t~`j.~ym}u}jz`pdab.pezzrqarpff.jbt{~u}hoankoy}vqbnm`\|.xyc~hz~dv~}~`okywoa\|qq}vc\|f`.ra\|rjp{g\|ecbrt}aycqskogautqcacaq{~

C:\Users\user\Desktop\UMMBDNEQBN.pdf

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.936865080324893
Encrypted:	false
SSDEEP:	24:YhFkSGZ7zL9NitoPJLQ2aeSqEnrlHrQ8Gzc5ttEdJa:YIDHL9qoPq2fKprBG4Ca
MD5:	C9AEBF8842AACD9B7E568D86FE5802C4
SHA1:	01FAF29DC6C1CCD27E8B962847C57502A1BA85BA
SHA-256:	42A564C57A9E954C435EC0C3F81CE5775BF609BF2A040181D33A06B4060C37E8
SHA-512:	AD7E3F2A402589AD2465E9F358EDC31E5718AB813D5CD0C45D960330F98C2EE098AAFC6ED3408F4D10F3064E1DB778AF8CA729075B5E9A98E9867EF7406B4A47
Malicious:	false
Preview:	d.xur.\|fw{nzzvvuzkmssym`{`s\|l\|kgvzk`\|tohsyt{.x\|zpbyufqhfw.msxjmy{`{pzmo`smksey~iax\|cxc\|zcg`cg~btgfzwc`gpbrqaypoeb~.hwgff~\|dawr\|qbomp~u~jbtphxgzxtk\|rxrud}eqwyy~shx.`wwl\|loyyrsmcyus`cbmtyfpgwgmt.c\|th~pczhct~gogry}uysqd~pa~p}cowa~vat\|yu}ifp\|}wfjgdshrtfcb\|d`{pzkqxdvp`xv\|~svnardbvhvmbxfsr`wzfdbrjmlhgyx`xeer`wbm\|qvyercb}{uqjy`bt\|soeyqota.hspqfe~zd~{}lq`ratzd.bw.dbabfpax~eceztm}o~\|waiwt.uu\|{dmcyqyfvjg~tddstywi}.~owtawvchzzbsw{`beufccuw{zzwez{`kzxgrvk{.byb}pr`qecvf{z{wdkevfuu}{{tvybwa~agwsxem~hpelw{zzabfjt\|qyvcly{vfeakvyaj`al{up\|prwi~z~.a\|x`rexmd`pu~{{j.bfub\|uqhyxga\|xrf.f\|.y}wju{ptwvvxbv~oxqtgsmk{yqz`g{{sriafvpipeaz~tw`}h.frqdq~~\|.fn{u}ja\|.ed{bxvnbslsjezbj}}ccckm{lykmm{}w}avbkuyyxhfg``{xywjaec.v.c`ee`fmas`zm{u.\|x~\|he}fuvez\|~accwujelvctuu\|d`~q.dx..w~uozocvke\|ksqnq\|\|c{m}\|oxwxykf`tk}b`e.pmdltgezehccfwjoqcghrgdbytmabtpn..scqr~uc{g.dfm.aketgdegrb{cpc.uvqelkb}{..doqdtoxgxzb}{{~}s{s{z}t~`j.~ym}u}jz`pdab.pezzrqarpff.jbt{~u}hoankoy}vqbnm`\|.xyc~hz~dv~}~`okywoa\|qq}vc\|f`.ra\|rjp{g\|ecbrt}aycqskogautqcacaq{~

C:\Users\user\Desktop\UMMBDNEQBN\BPMLNOBVSB.png

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.936991678958394
Encrypted:	false
SSDEEP:	24:I8DfZBwyIBrVjixE9v8qRia70elZW1f33qhqt:lDHmN8Kv8qiP4iHqK
MD5:	B6A510A26480E97554818D3CD644B611
SHA1:	47E927CB000B69FE4C241E8199F841B7E1F72480
SHA-256:	A4AFCA894F2DEA2B8BE2BB3AAF8F9145257EC001941893A592AE4A0F3D5192FB
SHA-512:	43C50DF8C2FCFDBC9DAEC4123909B21BE8570EFDB27D29BF345085A1E6F27BEA64FAAB61C72C1E163F00A96030D1FAE55E89D667560DEF73EDD4BE53AB084C6A
Malicious:	false
Preview:	sbx{x~{afwjuggs~y`}ugzwe`dlx`bu~ssyzwtc.ivf}echuqdyw\|fys{.}rsj}}lb`pqrkq~~{pbv{sxbyp`dkdfrakfl{dwvn.ytcybfvdbtwwoemkacsjuys}o\|zfozyrgwvww{c{zctxl{upysljx}teg}dd{.wzcbqrdljapfy}{u.aiv\|od\|rgvl{zs{j{`uz\|bbtq.d{uzxhxtzmfd`xh`cxefa\|nacpte}oxcheu~zey.i.de`}ip.nxefyzgv}su~tcyv}}fypv{}q~}h{{fwttrdydynnzyycskx\|...pybz{bcyz~jynudj`b}rcv~zq}bxwaat.zbugy.ucmy`skd~s`c{gh~vvy{rnmpd}t}\|lywp\|syegt\|{\|~amtdesrg}k`cf\|sadia{awvfuraa\|ba{ys.vyzh~romzeqrqxyybgeptcs.bdcm`dqnthtpqv~o.b{pems..{`pqvxeabdwbbtwzxp{q\|zis}ftwdyvvcpwmffacbf.j{\|qtbxzd\|i.gedwx`ar\|u~xqruees}a~mdbiylmwxbqj``qo{fjppevgdej\|utnbc}gpyrk}~x{aqnhdvtsbuhv.ff`ymwy\|.lqqcbxxfj`ao\|\|vo`u.{zbcs}tsdyapu\|wm`xsf.qqggkqw\|a\|rcfv\|qcmgf\|j.adgawyo~zfu\|oyspv~pytzmzww.v.xcfb\|t.oyse~grdupbd}`vfdp{.awoxa{fhy\|qmwho~s{vjxnsuutm}xk`t~h.ycmm{\|n{}cp}qhexr}ahasbve~~`ktk.gitmdnuzdglq\|spoj\|gcqh\|zowgtvafavcak`xbnztcv~svqdmzwpvxszb`phw\|b.rdwymv`v{vspg.\|d{`{mt}ufb\|v`cvzuck`yggorxptpgtaudg.pj~gzielcutku.m{jz\|i.xbdfaevse}ub.oldsprvz{vthwauak.mdaaggchptv~fgatxpu}.x`uj{q~gg{\|s

C:\Users\user\Desktop\UMMBDNEQBN\DVWHKMNFNN.xlsx

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.942242596232926
Encrypted:	false
SSDEEP:	24:Uk7SZOe50qYsxLDARVEaYUaqNfXDVE4mAATEAB:z7iOe502VeEaYVqNfXJE43AIa
MD5:	4E6FD14005C7648C313F96E925692446
SHA1:	D1909A64392809F5EC206F1D689E1155A40EC8F6
SHA-256:	616753A4356E5E612D99D25A9CA659CB58083A469B3A1C452F0A0925DDC7D8F6
SHA-512:	AA3AE4277C74DFA22374957B97E7AD10B5B868EAAAB1608E93BA52DC949DE66269018653B723530CA06161F273DACAFCCAD2C6968D121B23FEA8E8456A4ABAE2
Malicious:	false
Preview:	udb.}\|wq{{kked~`taafrceoezn.~ery.miekkq..s.ferv.ot\|q.awe}agtgsz~ggvu}ruzrzbch~vrhv~`nvjbd{kv~zqcadzjkea}zhtplwi{~~kgeh\|zauwmcv.xm{y~{elduesshvxy~voea`o}.}ojx\|f..fto`gotsqtdnpne\|.\|xctamwg\|femb{dq`bwz`eyb.mr\|}oel}yumoh}crdgbye}`ktlaykzzjp}g}crkoxcavu.`ousymktposs~o.pyvy\|`jv{~id~evzc{dt~yxdw`yardk{.x~jug~}uytzffo`rp~ztcxegkoxdfs~`t{kbbiyg.{hec\|\|rsoyozpynm}q}pn`.`\|{}tku}~bcaakc~zvacfe`uctmtqa\|y}q}dg`.sd}vcvcatrlicnz.zax.`}grxeat.sue`y.~}}oruetynisfdazwccwabtzvgc~{xej.zei~.mjkh.`tidspawvdvf~~\|w\|vzfxaypafwwhcmem{.qyyk`tax}qtubqeftrbrrjzqc{agdxb~fv.}drcd\|{\|y`{ycwfbn}c~lfow.\|ahd`\|\|pus{`e\|}d}}vzbmgwc\|a\|fwsnw~dgzbgydtqdfruku`bu`lr~{ubqulsfxeqcjdf{k`rct{wvlq~kbrxhf.xgfjqt.}t.}\|{j.\|tibtcxbxcep{zzfzh\|pohg.rgz\|or~vm\|o~otucddfbxcs\|ktlr`vtbl\|yke.h`lcfc}gvs.t\|ampjjdtwhp}u`k~gstpyyh.~{perke.{f`at\|hrvdpfcsnvbxb{erc~v\|`i.lvysyex{dpyqkmbaco`ym\|vk.`ayzt~b}lmm{wauxafpdtusewzegco{ouxnrh`tb{vrgf}cfw\|d.qiebbsabavbgfuo`cmb~}\|ev\|v`qnbsf\|zb}qsaojbb.ax{e.hgxlgskjsybbegn.wkcgsbura\|iau`vvqo.ibhfzdgbobse`nygrvscqzshzc

C:\Users\user\Desktop\UMMBDNEQBN\JSDNGYCOWY.jpg

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.9241713610950555
Encrypted:	false
SSDEEP:	24:6NrLFNtuG3tyDvGUGK6MUpB2ow5wKhfKrB7XydlKIj28Masaf:6NfFNtuG3ArGUXwpZSwO8XDaf
MD5:	442F7BCEBC7B69EEFA06CFBF9D214C0A
SHA1:	587CCE88520987CF47A5039E1C36E4AA2646B897
SHA-256:	4D9CA0A42CB5A9B1DC17E88E9430F748555966AE33BB7C3642D860757E302406
SHA-512:	268D8222D5AE68AD7A392F668B49652E0545178C295A77FF25100366563136A5E4CB3BBC3D4865306B966967D27353CC6B109B883559BEED4F8BEEB4FF8BD53F
Malicious:	false
Preview:	{aqyqhzxblpxd{otuq~uc`aqo{t{wykrz`}h`pbgw`mn.rpb}ovzzbtxjfqh`\|mvuc.`fpoyuqjcz~rrakmesrz`q.sz~{mu\|kf}vs}dz~i{yttrrp\|yxfx.rvrn.sv`oojv~qoajcewd~o~nw`y\|`u}czy~edvrydy\|s{uu~rwxonovaeede~afz.mmqlu`rwa.c{d~r\|\|v\|~nsvvu{`xqdtstazhmol{vdp{zy.n}~{dxspzqylvc~yskz{`ksxjsrws\|g~gqol}r{aynzydx}h}rp`xra.`nj{p~f{quskyfadukctykkqzuqb~p.vapu}ij.f}nwapsewzyys~ec{fpttt{eqchc\|{bf}tfvaavpq.~\|p``vz.cvf`palizvw.{xqm`xus.{ej{qzxp{axzac.yqf.xfupyt`h}ay{{wouy{\|fpsr`ogrevqvbbdc\|tqdued`bpu~d.nbyl.yaq}t~xeeq\|yltsbcyligd\|pdvru}qrqgb~}egrqrutc~hfqhsdecelv{vafm~}\|ew~ybv{bz}so.`hqf\|}xwga}z.pbgc}.meyia}~vguygiymnaxhf{.vazm{~x~.gtactxrhdm\|txee~akwsjbp}dzp`~bbweebnaegqupcezwax\|sv`uupqbyzgcwucx\|r\|rwttcaeswqpuerfdpgivftew\|nuhkcjyt}y.sdwhs\|yhz`f.vkfqeyao{\|xzzx`k`.sp\|~yyuukm}ea\|tcayvf`njsfx.usceyfwvevpwefzzdvagsuzdu{~sp{ytqwav{zv`sey}x~itdvhgd{pucczxts~et~{dp}y\|zs`xdk`zv~f~g{lxxlh}m`wtd\|y}c{cz~~zqoatgrpyuwjpzi~{ezbq}dr~{~~\|~xzx`a.sgotpoegipcf\|{kv}uyzf\|pskmxmti}v\|v}kth`xwtt`.emc{jt\|`yu\|sgtw`b}axpc}p\|orbjhw`gr}cdphc.\|ybyfestzq{b

C:\Users\user\Desktop\UMMBDNEQBN\UMMBDNEQBN.docx

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.936865080324893
Encrypted:	false
SSDEEP:	24:YhFkSGZ7zL9NitoPJLQ2aeSqEnrlHrQ8Gzc5ttEdJa:YIDHL9qoPq2fKprBG4Ca
MD5:	C9AEBF8842AACD9B7E568D86FE5802C4
SHA1:	01FAF29DC6C1CCD27E8B962847C57502A1BA85BA
SHA-256:	42A564C57A9E954C435EC0C3F81CE5775BF609BF2A040181D33A06B4060C37E8
SHA-512:	AD7E3F2A402589AD2465E9F358EDC31E5718AB813D5CD0C45D960330F98C2EE098AAFC6ED3408F4D10F3064E1DB778AF8CA729075B5E9A98E9867EF7406B4A47
Malicious:	true
Preview:	d.xur.\|fw{nzzvvuzkmssym`{`s\|l\|kgvzk`\|tohsyt{.x\|zpbyufqhfw.msxjmy{`{pzmo`smksey~iax\|cxc\|zcg`cg~btgfzwc`gpbrqaypoeb~.hwgff~\|dawr\|qbomp~u~jbtphxgzxtk\|rxrud}eqwyy~shx.`wwl\|loyyrsmcyus`cbmtyfpgwgmt.c\|th~pczhct~gogry}uysqd~pa~p}cowa~vat\|yu}ifp\|}wfjgdshrtfcb\|d`{pzkqxdvp`xv\|~svnardbvhvmbxfsr`wzfdbrjmlhgyx`xeer`wbm\|qvyercb}{uqjy`bt\|soeyqota.hspqfe~zd~{}lq`ratzd.bw.dbabfpax~eceztm}o~\|waiwt.uu\|{dmcyqyfvjg~tddstywi}.~owtawvchzzbsw{`beufccuw{zzwez{`kzxgrvk{.byb}pr`qecvf{z{wdkevfuu}{{tvybwa~agwsxem~hpelw{zzabfjt\|qyvcly{vfeakvyaj`al{up\|prwi~z~.a\|x`rexmd`pu~{{j.bfub\|uqhyxga\|xrf.f\|.y}wju{ptwvvxbv~oxqtgsmk{yqz`g{{sriafvpipeaz~tw`}h.frqdq~~\|.fn{u}ja\|.ed{bxvnbslsjezbj}}ccckm{lykmm{}w}avbkuyyxhfg``{xywjaec.v.c`ee`fmas`zm{u.\|x~\|he}fuvez\|~accwujelvctuu\|d`~q.dx..w~uozocvke\|ksqnq\|\|c{m}\|oxwxykf`tk}b`e.pmdltgezehccfwjoqcghrgdbytmabtpn..scqr~uc{g.dfm.aketgdegrb{cpc.uvqelkb}{..doqdtoxgxzb}{{~}s{s{z}t~`j.~ym}u}jz`pdab.pezzrqarpff.jbt{~u}hoankoy}vqbnm`\|.xyc~hz~dv~}~`okywoa\|qq}vc\|f`.ra\|rjp{g\|ecbrt}aycqskogautqcacaq{~

C:\Users\user\Desktop\UMMBDNEQBN\WUTJSCBCFX.pdf

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.9507220049371385
Encrypted:	false
SSDEEP:	24:QsD5EROeoVH9txjTKr3YXxNkSQ1/Kite/vruQSenAgCfXJ:QshV5lLk9KiWruQSeCfXJ
MD5:	7B36984F9548618E7561EB00C5311C74
SHA1:	DD903AC81B25EFCB1E6553134085BEA95211DBF5
SHA-256:	747FA6767A71C82E19B8C9BE0082B717898874CF41EBC2D61B9CDFB825253183
SHA-512:	4B2C31F2DC25424024B38E034C07E2142E68F55AACC6B1894914C7AD6B6A4F9A0F28091102A216C07BAE14B4A7EE37F117FE204905E4A6C6DD8C1EF449683F8C
Malicious:	false
Preview:	fga}er{tsmv`rc.~eun.~ccara.ys`ucfurd\|jy{\|jdeycob\|la}fcy.}hcykbpvr~rreqtezz}\|t{~styzctgixqv}{az\|w.ftquudubdjesq{bxrbhcqdytyw}xc\|sllnuxl~~asafcvwxr`ibpdmivb.t~jxgbygcr`vna{hibrwbjt}`xhebl.hpetn.mew~hczusa\|sebjxv.vjesluwze\|ejydtizarwwzs.sw{g.`gxmq.sl\|}}pzm~`p\|aqfb{wb`uu}cdp.mevbydbivawnzuiafobzvs`dhycj\|}x.}{mttvt}~\|nhc}nxkgzt~\|msemo``c{fhyahdb.obdhal~n}u`w}jkd.`krxd~l}l\|izuxbjez`xbvqd.ukvdw~{qayaxxqzku.zn}r.xptiswzaswtr{glsz~wffllu~sjtjdnaicrxwh`fmsrbqdy`cb\|jp``qzwcvyeu\|orstssqahc.dthk{mfad~xspe\|y{.baorwqqvwlfrcaguwzrk.pq~.tuqg}.fqaty{qqcvbmyut.bmiqc}kazsrgkfcq\|crry\|zbfq`aetmevur\|lijgbz`jg{{qx{.~v}eap.nnoghgxcyucbafk~}goh{sdamu`rqdukxr`amrdymbq`p\|}}jxtyfa~}\|oyyi.ldhjsskcc\|xudesayg`z}prqvf\|~ubacewguts.drcv`bubqdsorbfygw`\|yftt.avvuxztucafz{yzvy.ki}~svtkqfewdrcx{n{oh~b~ih\|xaev\|r\|s.z}~{zg\|va}wgbwwt~~tgqyt`pjravvphg{whpebban}zuev~rpbay.~k}mpfpybprpqspy{}eeysgmo.{\|lxwdm\|\|decuyewfazvorvwzysppgqexzwewf\|breb}rcgs}ypvoyax.srhqp`v\|punivgd.usbeftd}dztabcz~.kgub{\|g}pbtbv{~dbf~uu{.jw.ms`xpycg.kdfajpkuy

C:\Users\user\Desktop\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.938072176856892
Encrypted:	false
SSDEEP:	12:nOqQ4Lwh74tvIBvXYchI5aakrlpxElnbB/AANQ4pu7VIwfeWDlgwZmXA6/1xsH4x:TQ4EDBvXfS5BEMnVze57GwdQL1bdV+HC
MD5:	FC5D88555A4781662E12D72620E6B4B6
SHA1:	73ED6C1F5B188D67E2705E88D3FFC9EE7D1B707D
SHA-256:	B61553C30E2EF648A00854F8CEBA3AC39C996E4B44BCEAA4DD221FEFD836AE99
SHA-512:	CD6347AE2245BF6770E3CE889099508642B5DD760C331EC410B5FDF1CC4E92253F7A77BB3A2E271999CF22FE99BD4CDB5DF17115F60F6D587DB2FAA7A00008FA
Malicious:	true
Preview:	g~osqdrbao`x`athpes.ew\|u`yopeow~r`nu~zr{`ccnxdtbtztqygphkfe{iw{~zxjb}qyvrnohwgy~\|e.c}{sxy}szp~z{zwz\|kbc.sd}{}`bpdvmkusgab~}tpfqopl~jcr.hfcywip\|bwxvnvv{vdx`yc.mtgjvsfztnfbmuf{wukqfqbu.ozgvr~mz\|ul\|gyuvgp.fr~b.x`wbvdgpubdbgsato{u}d{a~ye}rdqkysw~vzwhqvdwwexm{c{qv`~w\|vykcs}g~pudz{x`vq}u`zukadfgsd``te`qvw\|p~{gpmzpywaqpjt}bzhhh```u\|t`w~x}m.sd\|gykz.vugid{zkjpybs\|u.~vhv.{vkawybdnl}`gk.cvy{n{spbz`naeeb\|tgrigvfnxkvpvdiyudyuuseevqdpfb`zc~aurultfgvcatv{whogyg{k`wv{spstgyfqtgcxboramw~ch}ouwhlydsiuxfp~}ryqugajdf{p\|d\|`lb.ctqmt\|xcxcw`r.y}nm`kyz.zsxd`whxw}lxk}fgv.se}dthv{g.~q\|bp.qts{~qbw`kzsbxyq{prctrmzuqagwaxzsqmsxwoz{orru}mdkbfzeesntksgxbt\|~\|vztufx{.{`rwzvagpynfqjyt}ut}yaew}gaovcbrm\|wwx\|czctf~igzx}iumluxy\|gdcg.ue.a~dzyvdl}~hvtbecg\|hkpgqmdd`vqj~gau.eaabjqp}~d.ga\|u\|..hhxqwujxaoji}c`puggtk~ez}ec.c\|`\|qa~zbpc\|w`rz{crxavo`dfkajh}~kxrqn\|hzml`xf{~gws\|u{.rgb`lfblspmc~u}u}he`wsssafbf\|{brze{`g~~}pybfnqg\|z.mvustfzja~s{zgrcrxmky.t`t\|n\|tt{\|\|fi`{yy}`vjvsaqbux`g~gce}p~q~ziqy.xf\|cz{rsngaxa~zrjq~e~dk`cqzujx\|sj~}w{cjk{d

C:\Users\user\Desktop\VLZDGUKUTZ.xlsx

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.938072176856892
Encrypted:	false
SSDEEP:	12:nOqQ4Lwh74tvIBvXYchI5aakrlpxElnbB/AANQ4pu7VIwfeWDlgwZmXA6/1xsH4x:TQ4EDBvXfS5BEMnVze57GwdQL1bdV+HC
MD5:	FC5D88555A4781662E12D72620E6B4B6
SHA1:	73ED6C1F5B188D67E2705E88D3FFC9EE7D1B707D
SHA-256:	B61553C30E2EF648A00854F8CEBA3AC39C996E4B44BCEAA4DD221FEFD836AE99
SHA-512:	CD6347AE2245BF6770E3CE889099508642B5DD760C331EC410B5FDF1CC4E92253F7A77BB3A2E271999CF22FE99BD4CDB5DF17115F60F6D587DB2FAA7A00008FA
Malicious:	false
Preview:	g~osqdrbao`x`athpes.ew\|u`yopeow~r`nu~zr{`ccnxdtbtztqygphkfe{iw{~zxjb}qyvrnohwgy~\|e.c}{sxy}szp~z{zwz\|kbc.sd}{}`bpdvmkusgab~}tpfqopl~jcr.hfcywip\|bwxvnvv{vdx`yc.mtgjvsfztnfbmuf{wukqfqbu.ozgvr~mz\|ul\|gyuvgp.fr~b.x`wbvdgpubdbgsato{u}d{a~ye}rdqkysw~vzwhqvdwwexm{c{qv`~w\|vykcs}g~pudz{x`vq}u`zukadfgsd``te`qvw\|p~{gpmzpywaqpjt}bzhhh```u\|t`w~x}m.sd\|gykz.vugid{zkjpybs\|u.~vhv.{vkawybdnl}`gk.cvy{n{spbz`naeeb\|tgrigvfnxkvpvdiyudyuuseevqdpfb`zc~aurultfgvcatv{whogyg{k`wv{spstgyfqtgcxboramw~ch}ouwhlydsiuxfp~}ryqugajdf{p\|d\|`lb.ctqmt\|xcxcw`r.y}nm`kyz.zsxd`whxw}lxk}fgv.se}dthv{g.~q\|bp.qts{~qbw`kzsbxyq{prctrmzuqagwaxzsqmsxwoz{orru}mdkbfzeesntksgxbt\|~\|vztufx{.{`rwzvagpynfqjyt}ut}yaew}gaovcbrm\|wwx\|czctf~igzx}iumluxy\|gdcg.ue.a~dzyvdl}~hvtbecg\|hkpgqmdd`vqj~gau.eaabjqp}~d.ga\|u\|..hhxqwujxaoji}c`puggtk~ez}ec.c\|`\|qa~zbpc\|w`rz{crxavo`dfkajh}~kxrqn\|hzml`xf{~gws\|u{.rgb`lfblspmc~u}u}he`wsssafbf\|{brze{`g~~}pybfnqg\|z.mvustfzja~s{zgrcrxmky.t`t\|n\|tt{\|\|fi`{yy}`vjvsaqbux`g~gce}p~q~ziqy.xf\|cz{rsngaxa~zrjq~e~dk`cqzujx\|sj~}w{cjk{d

C:\Users\user\Desktop\VLZDGUKUTZ\DVWHKMNFNN.pdf

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.942242596232926
Encrypted:	false
SSDEEP:	24:Uk7SZOe50qYsxLDARVEaYUaqNfXDVE4mAATEAB:z7iOe502VeEaYVqNfXJE43AIa
MD5:	4E6FD14005C7648C313F96E925692446
SHA1:	D1909A64392809F5EC206F1D689E1155A40EC8F6
SHA-256:	616753A4356E5E612D99D25A9CA659CB58083A469B3A1C452F0A0925DDC7D8F6
SHA-512:	AA3AE4277C74DFA22374957B97E7AD10B5B868EAAAB1608E93BA52DC949DE66269018653B723530CA06161F273DACAFCCAD2C6968D121B23FEA8E8456A4ABAE2
Malicious:	false
Preview:	udb.}\|wq{{kked~`taafrceoezn.~ery.miekkq..s.ferv.ot\|q.awe}agtgsz~ggvu}ruzrzbch~vrhv~`nvjbd{kv~zqcadzjkea}zhtplwi{~~kgeh\|zauwmcv.xm{y~{elduesshvxy~voea`o}.}ojx\|f..fto`gotsqtdnpne\|.\|xctamwg\|femb{dq`bwz`eyb.mr\|}oel}yumoh}crdgbye}`ktlaykzzjp}g}crkoxcavu.`ousymktposs~o.pyvy\|`jv{~id~evzc{dt~yxdw`yardk{.x~jug~}uytzffo`rp~ztcxegkoxdfs~`t{kbbiyg.{hec\|\|rsoyozpynm}q}pn`.`\|{}tku}~bcaakc~zvacfe`uctmtqa\|y}q}dg`.sd}vcvcatrlicnz.zax.`}grxeat.sue`y.~}}oruetynisfdazwccwabtzvgc~{xej.zei~.mjkh.`tidspawvdvf~~\|w\|vzfxaypafwwhcmem{.qyyk`tax}qtubqeftrbrrjzqc{agdxb~fv.}drcd\|{\|y`{ycwfbn}c~lfow.\|ahd`\|\|pus{`e\|}d}}vzbmgwc\|a\|fwsnw~dgzbgydtqdfruku`bu`lr~{ubqulsfxeqcjdf{k`rct{wvlq~kbrxhf.xgfjqt.}t.}\|{j.\|tibtcxbxcep{zzfzh\|pohg.rgz\|or~vm\|o~otucddfbxcs\|ktlr`vtbl\|yke.h`lcfc}gvs.t\|ampjjdtwhp}u`k~gstpyyh.~{perke.{f`at\|hrvdpfcsnvbxb{erc~v\|`i.lvysyex{dpyqkmbaco`ym\|vk.`ayzt~b}lmm{wauxafpdtusewzegco{ouxnrh`tb{vrgf}cfw\|d.qiebbsabavbgfuo`cmb~}\|ev\|v`qnbsf\|zb}qsaojbb.ax{e.hgxlgskjsybbegn.wkcgsbura\|iau`vvqo.ibhfzdgbobse`nygrvscqzshzc

C:\Users\user\Desktop\VLZDGUKUTZ\KATAXZVCPS.xlsx

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.941173070112748
Encrypted:	false
SSDEEP:	24:R926993Moyy/wIwMb5HjP84K0wFVIW8Oc/Jhp:R926X3Moy3MlDP8iw7yOchH
MD5:	3FEE51B980A650924530A248376C74A1
SHA1:	10C4D5D8F581ECEAB39989F1B547A76E45ABC373
SHA-256:	2231C12F39DB9271BC7BE48B948D342605012A5A68187F36FE37972DF6F38B0D
SHA-512:	C9F95A5EC80AF0D91BFFCCA1A081152053DCA9D27887A97819CA8E366BAC0F76E1DB92CFC62FA95076F2D227C8E2F00B4535C5377104EBBC442FEBE1DAC6E797
Malicious:	false
Preview:	zsavnkotef`wywjuf{rqy~au{`lqtlkdrytc}..}xyessr{tzlh~d`lzzbs{k\|rqqfzy``.zplhwpet`cyqpt~ngf{ugqmqzdk~dacr}owvv.xoefppda.nxajspx~lewwqeabu`beur}cmbupabstaad`{yejvq\|y.}lxualovqggujsuojusfq`vrua}vtr`tc{zgbxde~`yotfg\|fuq.w\|hzxbkd{d~sgo\|tvnnqtvssa.`r.wscydxhbzqnydweuesdb~da`~ll`b.mj.fdyagm}d.cxye..eg~pqzngv.gsf}{b\|\|~{qavte`v\|sgemzusb}\|u}`.u{ak~{pcrdzv{`wsmkvgsgtjsd}xtoyb{udaiyy~ydxc{attp\|dfnog.vydcaccygupd.eck~\|.`yi{dp.}fo\|.jtm..`g{eb}pfudkdtiab}\|bhstwbvfel~fq{c{}vgdp\|p.sopzsd.~}f.s`tomsyprmbv}mfrc~en}gg}cny.qqaaq.pjp`\|c`}pmg`wzbctr\|n{o`w\|qeifftxrzf.zkzcw~fux.v`ql~ezlvcfjjvgodx`s~~kltehvmb}jcygze.zbetk`pyiodl~tumumcxhsfsww.~vaf}ony`zmu~avif{p.w{zg\|zp\|gw`y\|deybprbwttdlp.}ge`{f`~y\|jz{.{`bw\|}bpnigszeg\|yd.ucq\|w.bbfl~kf\|uxtxp`dacemo{ke~id{gxqextroup{gpjvs}otw.~ctyo`xr}c\|elgxn`}hx~i\|u~n.zauy`je`vrzkt}s}uca.\|xs`ylganq}w{g}gxtxfbhtqsujgghu~p~aifbcck\|erw\|gt}j`d`c~vw{oncm.pf`bqaia`ubaucbpbvacfr\|j`}id}yvrp{t}.tlalvbkymnyb`eu\|ktarw}.bz.v\|utgbp..yw{~~}.}otpec~qcxp\|h~k\|xs}z~\|p{yudlfsauuzuzrec}qwt{cx`v.`hxw

C:\Users\user\Desktop\VLZDGUKUTZ\NWTVCDUMOB.jpg

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.930818611892816
Encrypted:	false
SSDEEP:	24:C9qyd6NWxjwt5IcATJd/eA+gdSgHkuq9yWMfFP:/Wrxst5LATX/elgHxq8t
MD5:	35DA0E6A73175C1EBB4BBAC516DA1329
SHA1:	7438FE68FD89FA558D944A1C42BAF0C9E0E80729
SHA-256:	D0637AB4266F2191B69C41BE9909E67C2859234E5E3C5F5316A933D80341BEFF
SHA-512:	98B3FD1BFFEDCBBDFC169C4A8DF8A6924817C885F870CF7C9484C0417FE297F00E987799C73EEB88A78AA5754A0D03E54A824060326FC09BC13047C2CA89FCC8
Malicious:	false
Preview:	.eaauulzzwlceeibzjf\|x.rg\|imrxez}nxztycqetdr~e{jadgucznkskwnab}abw{.~ymtg\|r}dz~dq\|kprp}w}f}tgcr``fvyevjpq.vottbh~szm{qv~jvb}zsbr`fxmcy{~wdjqdbzf\|zro.davxs\|\|.v`}.dfpberxbtcueuywaky\|babonpd~osmo~`fyqytta~g}~b}lt}r~ir{qb\|q}v{}culxrsg{}ao{kbyae}yya}cv.rzzvu`xn\|fx`hdtevrf`~`qsrme`qh`q`dcdv{cm~zppfs`tu}en}xvzmwim{rc}tbwi~xhp}xwdny}nrxf.ibvoj}{uat.d{gg~ewamztr{wxuqdk`ot}{hrxtlvxzq.xyuivclsoiv{ygwdosaq\|qa`e.gme\|tdoms~ydkqxx}{z\|gv\|i~dyovx}fr`u.tsrpv~qeucs~vesbqzk~pb.jqa.gnuvevxy}~xsbfafvdfsu}\|{}nyeerfyqbqu}g`dt\|slanuv{ozb\|ogb\|t}ugatyyl}fduxczsy}t{fcksmo.r~zz\|\|uwuuvaaawvc}xfui.cry\|{vvvp`n{gxs~vn.ss~cwfbjiu`xcfauwev\|`r}`y.\|}a}m~yer}pgheo~.q{g\|qvvr~b}.ng\|zrg.jwa.y.\|fcclrazzqmf~s~.w.u}vsropk~vto~popopyyt`dysqx\|o\|qs~emmoywyug\|sq`rkab\|zw.txqsqwdwcp.ee\|a\|`fwxo~}{qqgbwef~eum\|ca\|evmke~`.dfxrtn`ty\|aiy.wz.aqsbfyxpwun~yyygxdnb{~ra`ut~fckbv.~gefkae{caz{b}ypmmzw}gmpzpes~zx}mtc`j~ydpb\|qbjet`g.dp`}kzpslhqsg\|patvjuhse~{{m\|rwitbmu}vbd.qq.}ztq}faxbg~aj}z.djonyblm{.iqounb}pcfs{{zexinz{tje.qz}\|\|gya`v\|fpvyzlivera\|f~x

C:\Users\user\Desktop\VLZDGUKUTZ\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.938072176856892
Encrypted:	false
SSDEEP:	12:nOqQ4Lwh74tvIBvXYchI5aakrlpxElnbB/AANQ4pu7VIwfeWDlgwZmXA6/1xsH4x:TQ4EDBvXfS5BEMnVze57GwdQL1bdV+HC
MD5:	FC5D88555A4781662E12D72620E6B4B6
SHA1:	73ED6C1F5B188D67E2705E88D3FFC9EE7D1B707D
SHA-256:	B61553C30E2EF648A00854F8CEBA3AC39C996E4B44BCEAA4DD221FEFD836AE99
SHA-512:	CD6347AE2245BF6770E3CE889099508642B5DD760C331EC410B5FDF1CC4E92253F7A77BB3A2E271999CF22FE99BD4CDB5DF17115F60F6D587DB2FAA7A00008FA
Malicious:	false
Preview:	g~osqdrbao`x`athpes.ew\|u`yopeow~r`nu~zr{`ccnxdtbtztqygphkfe{iw{~zxjb}qyvrnohwgy~\|e.c}{sxy}szp~z{zwz\|kbc.sd}{}`bpdvmkusgab~}tpfqopl~jcr.hfcywip\|bwxvnvv{vdx`yc.mtgjvsfztnfbmuf{wukqfqbu.ozgvr~mz\|ul\|gyuvgp.fr~b.x`wbvdgpubdbgsato{u}d{a~ye}rdqkysw~vzwhqvdwwexm{c{qv`~w\|vykcs}g~pudz{x`vq}u`zukadfgsd``te`qvw\|p~{gpmzpywaqpjt}bzhhh```u\|t`w~x}m.sd\|gykz.vugid{zkjpybs\|u.~vhv.{vkawybdnl}`gk.cvy{n{spbz`naeeb\|tgrigvfnxkvpvdiyudyuuseevqdpfb`zc~aurultfgvcatv{whogyg{k`wv{spstgyfqtgcxboramw~ch}ouwhlydsiuxfp~}ryqugajdf{p\|d\|`lb.ctqmt\|xcxcw`r.y}nm`kyz.zsxd`whxw}lxk}fgv.se}dthv{g.~q\|bp.qts{~qbw`kzsbxyq{prctrmzuqagwaxzsqmsxwoz{orru}mdkbfzeesntksgxbt\|~\|vztufx{.{`rwzvagpynfqjyt}ut}yaew}gaovcbrm\|wwx\|czctf~igzx}iumluxy\|gdcg.ue.a~dzyvdl}~hvtbecg\|hkpgqmdd`vqj~gau.eaabjqp}~d.ga\|u\|..hhxqwujxaoji}c`puggtk~ez}ec.c\|`\|qa~zbpc\|w`rz{crxavo`dfkajh}~kxrqn\|hzml`xf{~gws\|u{.rgb`lfblspmc~u}u}he`wsssafbf\|{brze{`g~~}pybfnqg\|z.mvustfzja~s{zgrcrxmky.t`t\|n\|tt{\|\|fi`{yy}`vjvsaqbux`g~gce}p~q~ziqy.xf\|cz{rsngaxa~zrjq~e~dk`cqzujx\|sj~}w{cjk{d

C:\Users\user\Desktop\VLZDGUKUTZ\YPSIACHYXW.png

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	zlib compressed data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.940902937007019
Encrypted:	false
SSDEEP:	24:eqgZ2xBD1HqbmGkvzZd+l3hf9jtf8vuMkMYPtlELF5bJNG:eix51qmGgMlx1OW9ZPtlUdI
MD5:	E3BB78DC32B75F14FEB47E950A968C42
SHA1:	12AF7D9E2A342319DAEC8F80AB9E59401E5A9D85
SHA-256:	6355754B2F78684A535AC85B21C4829A8CDCBED37FF9ED7E7BC7FBBD0B897804
SHA-512:	FE6E94FE71B78B7322560D0C28684A7559DFDF658E68F9A355EEDEBC09D175FB53E35C7D9B46F36F922256EBF44DC88582E26DF205D8879BA3A6B5CDA09D439F
Malicious:	false
Preview:	hbf~wrqnmb\|\|v{y~xq}ihy}\|{v`~owa.}gm~sfms}s~pbyr~oobcmyzsxtyaz`bp}y}rpltttfukjdxzrjeer~.acm\|udnv`~u{e.pddubo}m~p.brv}y`tqbddyc{}nb{ogysrkp{\|st`s~dfmmc`m}\|z{.gu\|d\|ag~`}.fao\|ed\|bfk`bb.boeeyptcehz`av}akes.dm.yw\|c~o\|g~qq}cztxfzqosuauoskd~r~~jfoaigw}uehdqrnrzesfgz}qpwqrsrnqzp\|pvutu\|yracu.g`t\|a.el`e{mhtb.{ag}{whk.c`turg`juydqxkyv`bnz\|fkpzf.dcuovvtlot`{eo}q.{nigx`fzygcupu{gv{mr\|{`g`gbezc{ectxott`d~byfp{{bid`ure.yb`i.gn}~wfot`bv`\|iketdq.vbnhtszwde`no~ktd{mj{gv~f\|oype.areiyvoh{dcaeefur{wvzsvqevtlyvzzyaqz\|g}wxbii\|rxl\|}}ku}fbe~tc}fp~yx}~`vrjzcg.}hgg{w{oyoe}~yymvhsb}ch}f\|snav`kbvqvegfevsgsbaxi}lctjsaqpxacdwufqtym\|\|mr}a~mkxudxkzxsy.v.wxtbs`pufb{igyrbnfqrlapg`{w.c}pewcread`ucbq.cfpps{}xkymyw``v\|ozcncohapsg.bg`qwa.{e~uz\|sqqweyfqavuzpamybqy{lpkvx`{plclfwdml`endpsug.riyegwwwmrb}xxvhjfq{rx}p~`furye`yv}vqvpre~{szxwndgqw}dsmq\|usj}{tq`.lfmouga~t{sqpuijpdwvk\|ver}c.bz..td{hv{a.myp.~ft{\|~dptzy{{`\|h{{gmkx{bs\|kug\|iu~r~\|adq~qrg\|juzpxsycp}f\|sr~guacxr\|k\|exubef}{qorlr~sawwa.uf{}w\|\|flbffbvfu.zs\|diwp}~lwadypvq{~oqzur}

C:\Users\user\Desktop\WUTJSCBCFX.pdf

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.9507220049371385
Encrypted:	false
SSDEEP:	24:QsD5EROeoVH9txjTKr3YXxNkSQ1/Kite/vruQSenAgCfXJ:QshV5lLk9KiWruQSeCfXJ
MD5:	7B36984F9548618E7561EB00C5311C74
SHA1:	DD903AC81B25EFCB1E6553134085BEA95211DBF5
SHA-256:	747FA6767A71C82E19B8C9BE0082B717898874CF41EBC2D61B9CDFB825253183
SHA-512:	4B2C31F2DC25424024B38E034C07E2142E68F55AACC6B1894914C7AD6B6A4F9A0F28091102A216C07BAE14B4A7EE37F117FE204905E4A6C6DD8C1EF449683F8C
Malicious:	false
Preview:	fga}er{tsmv`rc.~eun.~ccara.ys`ucfurd\|jy{\|jdeycob\|la}fcy.}hcykbpvr~rreqtezz}\|t{~styzctgixqv}{az\|w.ftquudubdjesq{bxrbhcqdytyw}xc\|sllnuxl~~asafcvwxr`ibpdmivb.t~jxgbygcr`vna{hibrwbjt}`xhebl.hpetn.mew~hczusa\|sebjxv.vjesluwze\|ejydtizarwwzs.sw{g.`gxmq.sl\|}}pzm~`p\|aqfb{wb`uu}cdp.mevbydbivawnzuiafobzvs`dhycj\|}x.}{mttvt}~\|nhc}nxkgzt~\|msemo``c{fhyahdb.obdhal~n}u`w}jkd.`krxd~l}l\|izuxbjez`xbvqd.ukvdw~{qayaxxqzku.zn}r.xptiswzaswtr{glsz~wffllu~sjtjdnaicrxwh`fmsrbqdy`cb\|jp``qzwcvyeu\|orstssqahc.dthk{mfad~xspe\|y{.baorwqqvwlfrcaguwzrk.pq~.tuqg}.fqaty{qqcvbmyut.bmiqc}kazsrgkfcq\|crry\|zbfq`aetmevur\|lijgbz`jg{{qx{.~v}eap.nnoghgxcyucbafk~}goh{sdamu`rqdukxr`amrdymbq`p\|}}jxtyfa~}\|oyyi.ldhjsskcc\|xudesayg`z}prqvf\|~ubacewguts.drcv`bubqdsorbfygw`\|yftt.avvuxztucafz{yzvy.ki}~svtkqfewdrcx{n{oh~b~ih\|xaev\|r\|s.z}~{zg\|va}wgbwwt~~tgqyt`pjravvphg{whpebban}zuev~rpbay.~k}mpfpybprpqspy{}eeysgmo.{\|lxwdm\|\|decuyewfazvorvwzysppgqexzwewf\|breb}rcgs}ypvoyax.srhqp`v\|punivgd.usbeftd}dztabcz~.kgub{\|g}pbtbv{~dbf~uu{.jw.ms`xpycg.kdfajpkuy

C:\Users\user\Desktop\YPSIACHYXW.png

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	zlib compressed data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.940902937007019
Encrypted:	false
SSDEEP:	24:eqgZ2xBD1HqbmGkvzZd+l3hf9jtf8vuMkMYPtlELF5bJNG:eix51qmGgMlx1OW9ZPtlUdI
MD5:	E3BB78DC32B75F14FEB47E950A968C42
SHA1:	12AF7D9E2A342319DAEC8F80AB9E59401E5A9D85
SHA-256:	6355754B2F78684A535AC85B21C4829A8CDCBED37FF9ED7E7BC7FBBD0B897804
SHA-512:	FE6E94FE71B78B7322560D0C28684A7559DFDF658E68F9A355EEDEBC09D175FB53E35C7D9B46F36F922256EBF44DC88582E26DF205D8879BA3A6B5CDA09D439F
Malicious:	false
Preview:	hbf~wrqnmb\|\|v{y~xq}ihy}\|{v`~owa.}gm~sfms}s~pbyr~oobcmyzsxtyaz`bp}y}rpltttfukjdxzrjeer~.acm\|udnv`~u{e.pddubo}m~p.brv}y`tqbddyc{}nb{ogysrkp{\|st`s~dfmmc`m}\|z{.gu\|d\|ag~`}.fao\|ed\|bfk`bb.boeeyptcehz`av}akes.dm.yw\|c~o\|g~qq}cztxfzqosuauoskd~r~~jfoaigw}uehdqrnrzesfgz}qpwqrsrnqzp\|pvutu\|yracu.g`t\|a.el`e{mhtb.{ag}{whk.c`turg`juydqxkyv`bnz\|fkpzf.dcuovvtlot`{eo}q.{nigx`fzygcupu{gv{mr\|{`g`gbezc{ectxott`d~byfp{{bid`ure.yb`i.gn}~wfot`bv`\|iketdq.vbnhtszwde`no~ktd{mj{gv~f\|oype.areiyvoh{dcaeefur{wvzsvqevtlyvzzyaqz\|g}wxbii\|rxl\|}}ku}fbe~tc}fp~yx}~`vrjzcg.}hgg{w{oyoe}~yymvhsb}ch}f\|snav`kbvqvegfevsgsbaxi}lctjsaqpxacdwufqtym\|\|mr}a~mkxudxkzxsy.v.wxtbs`pufb{igyrbnfqrlapg`{w.c}pewcread`ucbq.cfpps{}xkymyw``v\|ozcncohapsg.bg`qwa.{e~uz\|sqqweyfqavuzpamybqy{lpkvx`{plclfwdml`endpsug.riyegwwwmrb}xxvhjfq{rx}p~`furye`yv}vqvpre~{szxwndgqw}dsmq\|usj}{tq`.lfmouga~t{sqpuijpdwvk\|ver}c.bz..td{hv{a.myp.~ft{\|~dptzy{{`\|h{{gmkx{bs\|kug\|iu~r~\|adq~qrg\|juzpxsycp}f\|sr~guacxr\|k\|exubef}{qorlr~sawwa.uf{}w\|\|flbffbvfu.zs\|diwp}~lwadypvq{~oqzur}

C:\Users\user\Documents\BPMLNOBVSB.png

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.936991678958394
Encrypted:	false
SSDEEP:	24:I8DfZBwyIBrVjixE9v8qRia70elZW1f33qhqt:lDHmN8Kv8qiP4iHqK
MD5:	B6A510A26480E97554818D3CD644B611
SHA1:	47E927CB000B69FE4C241E8199F841B7E1F72480
SHA-256:	A4AFCA894F2DEA2B8BE2BB3AAF8F9145257EC001941893A592AE4A0F3D5192FB
SHA-512:	43C50DF8C2FCFDBC9DAEC4123909B21BE8570EFDB27D29BF345085A1E6F27BEA64FAAB61C72C1E163F00A96030D1FAE55E89D667560DEF73EDD4BE53AB084C6A
Malicious:	false
Preview:	sbx{x~{afwjuggs~y`}ugzwe`dlx`bu~ssyzwtc.ivf}echuqdyw\|fys{.}rsj}}lb`pqrkq~~{pbv{sxbyp`dkdfrakfl{dwvn.ytcybfvdbtwwoemkacsjuys}o\|zfozyrgwvww{c{zctxl{upysljx}teg}dd{.wzcbqrdljapfy}{u.aiv\|od\|rgvl{zs{j{`uz\|bbtq.d{uzxhxtzmfd`xh`cxefa\|nacpte}oxcheu~zey.i.de`}ip.nxefyzgv}su~tcyv}}fypv{}q~}h{{fwttrdydynnzyycskx\|...pybz{bcyz~jynudj`b}rcv~zq}bxwaat.zbugy.ucmy`skd~s`c{gh~vvy{rnmpd}t}\|lywp\|syegt\|{\|~amtdesrg}k`cf\|sadia{awvfuraa\|ba{ys.vyzh~romzeqrqxyybgeptcs.bdcm`dqnthtpqv~o.b{pems..{`pqvxeabdwbbtwzxp{q\|zis}ftwdyvvcpwmffacbf.j{\|qtbxzd\|i.gedwx`ar\|u~xqruees}a~mdbiylmwxbqj``qo{fjppevgdej\|utnbc}gpyrk}~x{aqnhdvtsbuhv.ff`ymwy\|.lqqcbxxfj`ao\|\|vo`u.{zbcs}tsdyapu\|wm`xsf.qqggkqw\|a\|rcfv\|qcmgf\|j.adgawyo~zfu\|oyspv~pytzmzww.v.xcfb\|t.oyse~grdupbd}`vfdp{.awoxa{fhy\|qmwho~s{vjxnsuutm}xk`t~h.ycmm{\|n{}cp}qhexr}ahasbve~~`ktk.gitmdnuzdglq\|spoj\|gcqh\|zowgtvafavcak`xbnztcv~svqdmzwpvxszb`phw\|b.rdwymv`v{vspg.\|d{`{mt}ufb\|v`cvzuck`yggorxptpgtaudg.pj~gzielcutku.m{jz\|i.xbdfaevse}ub.oldsprvz{vthwauak.mdaaggchptv~fgatxpu}.x`uj{q~gg{\|s

C:\Users\user\Documents\DVWHKMNFNN.pdf

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.942242596232926
Encrypted:	false
SSDEEP:	24:Uk7SZOe50qYsxLDARVEaYUaqNfXDVE4mAATEAB:z7iOe502VeEaYVqNfXJE43AIa
MD5:	4E6FD14005C7648C313F96E925692446
SHA1:	D1909A64392809F5EC206F1D689E1155A40EC8F6
SHA-256:	616753A4356E5E612D99D25A9CA659CB58083A469B3A1C452F0A0925DDC7D8F6
SHA-512:	AA3AE4277C74DFA22374957B97E7AD10B5B868EAAAB1608E93BA52DC949DE66269018653B723530CA06161F273DACAFCCAD2C6968D121B23FEA8E8456A4ABAE2
Malicious:	false
Preview:	udb.}\|wq{{kked~`taafrceoezn.~ery.miekkq..s.ferv.ot\|q.awe}agtgsz~ggvu}ruzrzbch~vrhv~`nvjbd{kv~zqcadzjkea}zhtplwi{~~kgeh\|zauwmcv.xm{y~{elduesshvxy~voea`o}.}ojx\|f..fto`gotsqtdnpne\|.\|xctamwg\|femb{dq`bwz`eyb.mr\|}oel}yumoh}crdgbye}`ktlaykzzjp}g}crkoxcavu.`ousymktposs~o.pyvy\|`jv{~id~evzc{dt~yxdw`yardk{.x~jug~}uytzffo`rp~ztcxegkoxdfs~`t{kbbiyg.{hec\|\|rsoyozpynm}q}pn`.`\|{}tku}~bcaakc~zvacfe`uctmtqa\|y}q}dg`.sd}vcvcatrlicnz.zax.`}grxeat.sue`y.~}}oruetynisfdazwccwabtzvgc~{xej.zei~.mjkh.`tidspawvdvf~~\|w\|vzfxaypafwwhcmem{.qyyk`tax}qtubqeftrbrrjzqc{agdxb~fv.}drcd\|{\|y`{ycwfbn}c~lfow.\|ahd`\|\|pus{`e\|}d}}vzbmgwc\|a\|fwsnw~dgzbgydtqdfruku`bu`lr~{ubqulsfxeqcjdf{k`rct{wvlq~kbrxhf.xgfjqt.}t.}\|{j.\|tibtcxbxcep{zzfzh\|pohg.rgz\|or~vm\|o~otucddfbxcs\|ktlr`vtbl\|yke.h`lcfc}gvs.t\|ampjjdtwhp}u`k~gstpyyh.~{perke.{f`at\|hrvdpfcsnvbxb{erc~v\|`i.lvysyex{dpyqkmbaco`ym\|vk.`ayzt~b}lmm{wauxafpdtusewzegco{ouxnrh`tb{vrgf}cfw\|d.qiebbsabavbgfuo`cmb~}\|ev\|v`qnbsf\|zb}qsaojbb.ax{e.hgxlgskjsybbegn.wkcgsbura\|iau`vvqo.ibhfzdgbobse`nygrvscqzshzc

C:\Users\user\Documents\DVWHKMNFNN.xlsx

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.942242596232926
Encrypted:	false
SSDEEP:	24:Uk7SZOe50qYsxLDARVEaYUaqNfXDVE4mAATEAB:z7iOe502VeEaYVqNfXJE43AIa
MD5:	4E6FD14005C7648C313F96E925692446
SHA1:	D1909A64392809F5EC206F1D689E1155A40EC8F6
SHA-256:	616753A4356E5E612D99D25A9CA659CB58083A469B3A1C452F0A0925DDC7D8F6
SHA-512:	AA3AE4277C74DFA22374957B97E7AD10B5B868EAAAB1608E93BA52DC949DE66269018653B723530CA06161F273DACAFCCAD2C6968D121B23FEA8E8456A4ABAE2
Malicious:	false
Preview:	udb.}\|wq{{kked~`taafrceoezn.~ery.miekkq..s.ferv.ot\|q.awe}agtgsz~ggvu}ruzrzbch~vrhv~`nvjbd{kv~zqcadzjkea}zhtplwi{~~kgeh\|zauwmcv.xm{y~{elduesshvxy~voea`o}.}ojx\|f..fto`gotsqtdnpne\|.\|xctamwg\|femb{dq`bwz`eyb.mr\|}oel}yumoh}crdgbye}`ktlaykzzjp}g}crkoxcavu.`ousymktposs~o.pyvy\|`jv{~id~evzc{dt~yxdw`yardk{.x~jug~}uytzffo`rp~ztcxegkoxdfs~`t{kbbiyg.{hec\|\|rsoyozpynm}q}pn`.`\|{}tku}~bcaakc~zvacfe`uctmtqa\|y}q}dg`.sd}vcvcatrlicnz.zax.`}grxeat.sue`y.~}}oruetynisfdazwccwabtzvgc~{xej.zei~.mjkh.`tidspawvdvf~~\|w\|vzfxaypafwwhcmem{.qyyk`tax}qtubqeftrbrrjzqc{agdxb~fv.}drcd\|{\|y`{ycwfbn}c~lfow.\|ahd`\|\|pus{`e\|}d}}vzbmgwc\|a\|fwsnw~dgzbgydtqdfruku`bu`lr~{ubqulsfxeqcjdf{k`rct{wvlq~kbrxhf.xgfjqt.}t.}\|{j.\|tibtcxbxcep{zzfzh\|pohg.rgz\|or~vm\|o~otucddfbxcs\|ktlr`vtbl\|yke.h`lcfc}gvs.t\|ampjjdtwhp}u`k~gstpyyh.~{perke.{f`at\|hrvdpfcsnvbxb{erc~v\|`i.lvysyex{dpyqkmbaco`ym\|vk.`ayzt~b}lmm{wauxafpdtusewzegco{ouxnrh`tb{vrgf}cfw\|d.qiebbsabavbgfuo`cmb~}\|ev\|v`qnbsf\|zb}qsaojbb.ax{e.hgxlgskjsybbegn.wkcgsbura\|iau`vvqo.ibhfzdgbobse`nygrvscqzshzc

C:\Users\user\Documents\HTAGVDFUIE.png

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.943725656860274
Encrypted:	false
SSDEEP:	24:EiXcvQJYGCIgRpzVVh1E+oC0fS1EJKy+ZOUd7wZtOn:EiMvQJYXNl/h1oLRGwUdsZtO
MD5:	54F60EA10B28914C04BD866A48120434
SHA1:	9D317146F5E1936402871FF3CF1AE9896901EE4A
SHA-256:	13A012D89F7BEF0E6203E18706B6E8C134151D0043FDF3C5C9632A5895F3F103
SHA-512:	029CF1DCA30708B9944DB6FCFBC2B391315FBDC02560AA9316471FDB3A713A7A605EFB7C540B05669A07325A15878730118BBA3225F89B5AB891FA1E6B8291BE
Malicious:	false
Preview:	yftp`u.b\|pttmr{fhhpbbc\|duitx~f{rmqrdsbu`{ytu.krrrsytzsw{gb.`{}l~a\|o~~b{}b{ov.utvixdvx\|tx`yqeceiughaf~~o`thm.lzp~zbq.ffurrs\|py.wecpm~cwlqw.cgw\|qdgaqreyyumuska`xjz`dsckvbo\|syp~j{pxxty}`{\|ynfw\|r`v}a.j~q.btzrpzmfep}dq`~q{td\|yjfooi{`ae{dzw.bwfxcg~{\|orvysb{zbr}cy}`a.c~}exc\|{o`\|fcufx}pgup`qtz}o`eaj~lmf}bd.geya}xv\|sekksun.pgmyhkobge}{o\|uaes`~f}rz\|tb{y\|wg{yqpgnhyfzght~ruoes{z.wv`zjv\|.ohckxv\|snta{uqeqqxvdayiw}rqhh\|od{t{bp}q.bczjvfg\|leylsdb}m.tapi\|h`fnrmmz~ijo~ygvwadb}zfczc\|~p}\|vz.a{{`dddpp~ezxam{wcwb{tgvgu~b\|r.hc`t`qtfzywu.stbbcn~hawbszoxiwgq.xczx\|a~oawsw.yapa~~zx~}ssgrvadc{}\|.a}u\|giwzxg~iwgzay}n}.yajpiuywvsp`t{f\|vfflvhj\|e~{`x~~t}ev{wo\|rfj~\|`r~t\|zdwstsbeblspapvgd{wrgwxy}as.slppd~zrxjobfy.b\|}lvtshbw{cgx`ecgyssqgurfqjc.vxu}pzfettzxv{fgenvhjxvwkddsx}oqe~}\|f.kdgstyzdpfc.bstr\|\|`rau..gcjempam.`t{vxr}hgkxc{u.{pdm.aqoqga}fbtxgff{aquit}r.pngw`bke~chcqrxhmyrnkdnty.bsfzc`e{}jmqq`eyvhjyp{axywcwfunaoogqave~am`fgbu`sab.xzpq\|h.p{ew}ct`r`m}p}s\|pymfw{{hc}c.n.lxgaljzwuvu\|mirqvc.p{t~lhftshbggdrf~\|gokr~xgpuan{uvb\|j

C:\Users\user\Documents\JSDNGYCOWY.jpg

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.9241713610950555
Encrypted:	false
SSDEEP:	24:6NrLFNtuG3tyDvGUGK6MUpB2ow5wKhfKrB7XydlKIj28Masaf:6NfFNtuG3ArGUXwpZSwO8XDaf
MD5:	442F7BCEBC7B69EEFA06CFBF9D214C0A
SHA1:	587CCE88520987CF47A5039E1C36E4AA2646B897
SHA-256:	4D9CA0A42CB5A9B1DC17E88E9430F748555966AE33BB7C3642D860757E302406
SHA-512:	268D8222D5AE68AD7A392F668B49652E0545178C295A77FF25100366563136A5E4CB3BBC3D4865306B966967D27353CC6B109B883559BEED4F8BEEB4FF8BD53F
Malicious:	false
Preview:	{aqyqhzxblpxd{otuq~uc`aqo{t{wykrz`}h`pbgw`mn.rpb}ovzzbtxjfqh`\|mvuc.`fpoyuqjcz~rrakmesrz`q.sz~{mu\|kf}vs}dz~i{yttrrp\|yxfx.rvrn.sv`oojv~qoajcewd~o~nw`y\|`u}czy~edvrydy\|s{uu~rwxonovaeede~afz.mmqlu`rwa.c{d~r\|\|v\|~nsvvu{`xqdtstazhmol{vdp{zy.n}~{dxspzqylvc~yskz{`ksxjsrws\|g~gqol}r{aynzydx}h}rp`xra.`nj{p~f{quskyfadukctykkqzuqb~p.vapu}ij.f}nwapsewzyys~ec{fpttt{eqchc\|{bf}tfvaavpq.~\|p``vz.cvf`palizvw.{xqm`xus.{ej{qzxp{axzac.yqf.xfupyt`h}ay{{wouy{\|fpsr`ogrevqvbbdc\|tqdued`bpu~d.nbyl.yaq}t~xeeq\|yltsbcyligd\|pdvru}qrqgb~}egrqrutc~hfqhsdecelv{vafm~}\|ew~ybv{bz}so.`hqf\|}xwga}z.pbgc}.meyia}~vguygiymnaxhf{.vazm{~x~.gtactxrhdm\|txee~akwsjbp}dzp`~bbweebnaegqupcezwax\|sv`uupqbyzgcwucx\|r\|rwttcaeswqpuerfdpgivftew\|nuhkcjyt}y.sdwhs\|yhz`f.vkfqeyao{\|xzzx`k`.sp\|~yyuukm}ea\|tcayvf`njsfx.usceyfwvevpwefzzdvagsuzdu{~sp{ytqwav{zv`sey}x~itdvhgd{pucczxts~et~{dp}y\|zs`xdk`zv~f~g{lxxlh}m`wtd\|y}c{cz~~zqoatgrpyuwjpzi~{ezbq}dr~{~~\|~xzx`a.sgotpoegipcf\|{kv}uyzf\|pskmxmti}v\|v}kth`xwtt`.emc{jt\|`yu\|sgtw`b}axpc}p\|orbjhw`gr}cdphc.\|ybyfestzq{b

C:\Users\user\Documents\KATAXZVCPS.jpg

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.941173070112748
Encrypted:	false
SSDEEP:	24:R926993Moyy/wIwMb5HjP84K0wFVIW8Oc/Jhp:R926X3Moy3MlDP8iw7yOchH
MD5:	3FEE51B980A650924530A248376C74A1
SHA1:	10C4D5D8F581ECEAB39989F1B547A76E45ABC373
SHA-256:	2231C12F39DB9271BC7BE48B948D342605012A5A68187F36FE37972DF6F38B0D
SHA-512:	C9F95A5EC80AF0D91BFFCCA1A081152053DCA9D27887A97819CA8E366BAC0F76E1DB92CFC62FA95076F2D227C8E2F00B4535C5377104EBBC442FEBE1DAC6E797
Malicious:	false
Preview:	zsavnkotef`wywjuf{rqy~au{`lqtlkdrytc}..}xyessr{tzlh~d`lzzbs{k\|rqqfzy``.zplhwpet`cyqpt~ngf{ugqmqzdk~dacr}owvv.xoefppda.nxajspx~lewwqeabu`beur}cmbupabstaad`{yejvq\|y.}lxualovqggujsuojusfq`vrua}vtr`tc{zgbxde~`yotfg\|fuq.w\|hzxbkd{d~sgo\|tvnnqtvssa.`r.wscydxhbzqnydweuesdb~da`~ll`b.mj.fdyagm}d.cxye..eg~pqzngv.gsf}{b\|\|~{qavte`v\|sgemzusb}\|u}`.u{ak~{pcrdzv{`wsmkvgsgtjsd}xtoyb{udaiyy~ydxc{attp\|dfnog.vydcaccygupd.eck~\|.`yi{dp.}fo\|.jtm..`g{eb}pfudkdtiab}\|bhstwbvfel~fq{c{}vgdp\|p.sopzsd.~}f.s`tomsyprmbv}mfrc~en}gg}cny.qqaaq.pjp`\|c`}pmg`wzbctr\|n{o`w\|qeifftxrzf.zkzcw~fux.v`ql~ezlvcfjjvgodx`s~~kltehvmb}jcygze.zbetk`pyiodl~tumumcxhsfsww.~vaf}ony`zmu~avif{p.w{zg\|zp\|gw`y\|deybprbwttdlp.}ge`{f`~y\|jz{.{`bw\|}bpnigszeg\|yd.ucq\|w.bbfl~kf\|uxtxp`dacemo{ke~id{gxqextroup{gpjvs}otw.~ctyo`xr}c\|elgxn`}hx~i\|u~n.zauy`je`vrzkt}s}uca.\|xs`ylganq}w{g}gxtxfbhtqsujgghu~p~aifbcck\|erw\|gt}j`d`c~vw{oncm.pf`bqaia`ubaucbpbvacfr\|j`}id}yvrp{t}.tlalvbkymnyb`eu\|ktarw}.bz.v\|utgbp..yw{~~}.}otpec~qcxp\|h~k\|xs}z~\|p{yudlfsauuzuzrec}qwt{cx`v.`hxw

C:\Users\user\Documents\KATAXZVCPS.xlsx

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.941173070112748
Encrypted:	false
SSDEEP:	24:R926993Moyy/wIwMb5HjP84K0wFVIW8Oc/Jhp:R926X3Moy3MlDP8iw7yOchH
MD5:	3FEE51B980A650924530A248376C74A1
SHA1:	10C4D5D8F581ECEAB39989F1B547A76E45ABC373
SHA-256:	2231C12F39DB9271BC7BE48B948D342605012A5A68187F36FE37972DF6F38B0D
SHA-512:	C9F95A5EC80AF0D91BFFCCA1A081152053DCA9D27887A97819CA8E366BAC0F76E1DB92CFC62FA95076F2D227C8E2F00B4535C5377104EBBC442FEBE1DAC6E797
Malicious:	false
Preview:	zsavnkotef`wywjuf{rqy~au{`lqtlkdrytc}..}xyessr{tzlh~d`lzzbs{k\|rqqfzy``.zplhwpet`cyqpt~ngf{ugqmqzdk~dacr}owvv.xoefppda.nxajspx~lewwqeabu`beur}cmbupabstaad`{yejvq\|y.}lxualovqggujsuojusfq`vrua}vtr`tc{zgbxde~`yotfg\|fuq.w\|hzxbkd{d~sgo\|tvnnqtvssa.`r.wscydxhbzqnydweuesdb~da`~ll`b.mj.fdyagm}d.cxye..eg~pqzngv.gsf}{b\|\|~{qavte`v\|sgemzusb}\|u}`.u{ak~{pcrdzv{`wsmkvgsgtjsd}xtoyb{udaiyy~ydxc{attp\|dfnog.vydcaccygupd.eck~\|.`yi{dp.}fo\|.jtm..`g{eb}pfudkdtiab}\|bhstwbvfel~fq{c{}vgdp\|p.sopzsd.~}f.s`tomsyprmbv}mfrc~en}gg}cny.qqaaq.pjp`\|c`}pmg`wzbctr\|n{o`w\|qeifftxrzf.zkzcw~fux.v`ql~ezlvcfjjvgodx`s~~kltehvmb}jcygze.zbetk`pyiodl~tumumcxhsfsww.~vaf}ony`zmu~avif{p.w{zg\|zp\|gw`y\|deybprbwttdlp.}ge`{f`~y\|jz{.{`bw\|}bpnigszeg\|yd.ucq\|w.bbfl~kf\|uxtxp`dacemo{ke~id{gxqextroup{gpjvs}otw.~ctyo`xr}c\|elgxn`}hx~i\|u~n.zauy`je`vrzkt}s}uca.\|xs`ylganq}w{g}gxtxfbhtqsujgghu~p~aifbcck\|erw\|gt}j`d`c~vw{oncm.pf`bqaia`ubaucbpbvacfr\|j`}id}yvrp{t}.tlalvbkymnyb`eu\|ktarw}.bz.v\|utgbp..yw{~~}.}otpec~qcxp\|h~k\|xs}z~\|p{yudlfsauuzuzrec}qwt{cx`v.`hxw

C:\Users\user\Documents\NWTVCDUMOB.jpg

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.930818611892816
Encrypted:	false
SSDEEP:	24:C9qyd6NWxjwt5IcATJd/eA+gdSgHkuq9yWMfFP:/Wrxst5LATX/elgHxq8t
MD5:	35DA0E6A73175C1EBB4BBAC516DA1329
SHA1:	7438FE68FD89FA558D944A1C42BAF0C9E0E80729
SHA-256:	D0637AB4266F2191B69C41BE9909E67C2859234E5E3C5F5316A933D80341BEFF
SHA-512:	98B3FD1BFFEDCBBDFC169C4A8DF8A6924817C885F870CF7C9484C0417FE297F00E987799C73EEB88A78AA5754A0D03E54A824060326FC09BC13047C2CA89FCC8
Malicious:	false
Preview:	.eaauulzzwlceeibzjf\|x.rg\|imrxez}nxztycqetdr~e{jadgucznkskwnab}abw{.~ymtg\|r}dz~dq\|kprp}w}f}tgcr``fvyevjpq.vottbh~szm{qv~jvb}zsbr`fxmcy{~wdjqdbzf\|zro.davxs\|\|.v`}.dfpberxbtcueuywaky\|babonpd~osmo~`fyqytta~g}~b}lt}r~ir{qb\|q}v{}culxrsg{}ao{kbyae}yya}cv.rzzvu`xn\|fx`hdtevrf`~`qsrme`qh`q`dcdv{cm~zppfs`tu}en}xvzmwim{rc}tbwi~xhp}xwdny}nrxf.ibvoj}{uat.d{gg~ewamztr{wxuqdk`ot}{hrxtlvxzq.xyuivclsoiv{ygwdosaq\|qa`e.gme\|tdoms~ydkqxx}{z\|gv\|i~dyovx}fr`u.tsrpv~qeucs~vesbqzk~pb.jqa.gnuvevxy}~xsbfafvdfsu}\|{}nyeerfyqbqu}g`dt\|slanuv{ozb\|ogb\|t}ugatyyl}fduxczsy}t{fcksmo.r~zz\|\|uwuuvaaawvc}xfui.cry\|{vvvp`n{gxs~vn.ss~cwfbjiu`xcfauwev\|`r}`y.\|}a}m~yer}pgheo~.q{g\|qvvr~b}.ng\|zrg.jwa.y.\|fcclrazzqmf~s~.w.u}vsropk~vto~popopyyt`dysqx\|o\|qs~emmoywyug\|sq`rkab\|zw.txqsqwdwcp.ee\|a\|`fwxo~}{qqgbwef~eum\|ca\|evmke~`.dfxrtn`ty\|aiy.wz.aqsbfyxpwun~yyygxdnb{~ra`ut~fckbv.~gefkae{caz{b}ypmmzw}gmpzpes~zx}mtc`j~ydpb\|qbjet`g.dp`}kzpslhqsg\|patvjuhse~{{m\|rwitbmu}vbd.qq.}ztq}faxbg~aj}z.djonyblm{.iqounb}pcfs{{zexinz{tje.qz}\|\|gya`v\|fpvyzlivera\|f~x

C:\Users\user\Documents\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.930565775245372
Encrypted:	false
SSDEEP:	24:wkwvcp6U1Bf7KdqI0qEdiDybFQ+WywU6yhOwy4:Mvcv1lWgdik1s9wy4
MD5:	37D4B66418541B22320B95DF35F5753A
SHA1:	AC699928F847B503DBF34F18553F24CDB16D0D4E
SHA-256:	F11CB588DD176BBD4FB6C047E740893CC039D8F1B59402C014A19B961C43709D
SHA-512:	73BBACFD99D469916E2C4FA145DF6F7E71E9CC157DB65B553B09DAAA61B76F8D25B97E2944C9857BEB575917DFA53F238F829AADC2DC54652998AEB93393A5CC
Malicious:	false
Preview:	~\|wfu}`de`zwve{{ukygizerx`w{.o.kt\|`a\|jm~rhwb~h}oepup}dyekcdfy.r\|~{lqssawvl\|sz}{.phpgbfccbq.cqx`..qo\|r{\|}yitag{ufz`qqdzfcf\|tp.hzfwzbi.{veepo{ug.ntcidy{~tcaqtf\|pztsaxnzqrsx}avebdp.fwzh`\|nu{zrgrwx{.sfhm{`.pm\|cnmctbageldebrdr{x{f\|`ybote{ljbgg\|\|.{xcouwn\|.lirrrv\|.`d~ts\|dcpyvg\|pqsrsx\|zi`zroqgqale}fqvvg{ubfvplf}xx}y\|nrtbqzwumyhyfeydkyrokpcaspytqsvbmvy.ispwqi}fsqtk.qevm{nhrpyb`qt\|rw`qe~\|ypd.\|{s{eucuc`adarqpgp\|svl~.wb.vqksth.}s~eg}\|wcotbz~mkz.e}rwfomez`ys.a`uftudzxgkgd.ndjd.pkzr.ph~f{y}.fz\|kqosb.yfzocqv{htewmfv{ccqnpgdmt~tp~k``\|\|~xy.c`eclt}c~qexdp`br{\|zwaizuwf{.f}{kgnzbv{ffyptx{tfdoszy.sxfhvpavk.}wcqvch}~crg}w{rqq\|bxvt\|\|shedlnea}`bopwdmpp`jzeps}}.vjpyf~xtsyvbgvqbkoqskn.lqtbsa{zxjz~\|f{trrty\|.ipds}c}uawhplg{ecuwswrtnu.ydq~t~zzqbmtd`\|aq.ttu}..eh~mufs`qg}ppm}ftkxg}kptqxzzr`siebvzgcc\|`~}bbakmmwnjzdytp~dgzaf\|tvntbw~vrnqshgmwtkxntban`vpvvx~x`apg`xxvt.h.foy}splk.d}{itsqrt\|yot.apbtztw{f~arcngvxes.pfpkte}n{z}lb~wnzmbh..rq{b}e}tx{xpht}gwyi{ml{}yrvxeesldrz\|bs.mlz}wabsihmfertf~qsuuwpx.bzjywy{xb`np.vqef`dp.gt

C:\Users\user\Documents\ONBQCLYSPU\HTAGVDFUIE.png

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.943725656860274
Encrypted:	false
SSDEEP:	24:EiXcvQJYGCIgRpzVVh1E+oC0fS1EJKy+ZOUd7wZtOn:EiMvQJYXNl/h1oLRGwUdsZtO
MD5:	54F60EA10B28914C04BD866A48120434
SHA1:	9D317146F5E1936402871FF3CF1AE9896901EE4A
SHA-256:	13A012D89F7BEF0E6203E18706B6E8C134151D0043FDF3C5C9632A5895F3F103
SHA-512:	029CF1DCA30708B9944DB6FCFBC2B391315FBDC02560AA9316471FDB3A713A7A605EFB7C540B05669A07325A15878730118BBA3225F89B5AB891FA1E6B8291BE
Malicious:	false
Preview:	yftp`u.b\|pttmr{fhhpbbc\|duitx~f{rmqrdsbu`{ytu.krrrsytzsw{gb.`{}l~a\|o~~b{}b{ov.utvixdvx\|tx`yqeceiughaf~~o`thm.lzp~zbq.ffurrs\|py.wecpm~cwlqw.cgw\|qdgaqreyyumuska`xjz`dsckvbo\|syp~j{pxxty}`{\|ynfw\|r`v}a.j~q.btzrpzmfep}dq`~q{td\|yjfooi{`ae{dzw.bwfxcg~{\|orvysb{zbr}cy}`a.c~}exc\|{o`\|fcufx}pgup`qtz}o`eaj~lmf}bd.geya}xv\|sekksun.pgmyhkobge}{o\|uaes`~f}rz\|tb{y\|wg{yqpgnhyfzght~ruoes{z.wv`zjv\|.ohckxv\|snta{uqeqqxvdayiw}rqhh\|od{t{bp}q.bczjvfg\|leylsdb}m.tapi\|h`fnrmmz~ijo~ygvwadb}zfczc\|~p}\|vz.a{{`dddpp~ezxam{wcwb{tgvgu~b\|r.hc`t`qtfzywu.stbbcn~hawbszoxiwgq.xczx\|a~oawsw.yapa~~zx~}ssgrvadc{}\|.a}u\|giwzxg~iwgzay}n}.yajpiuywvsp`t{f\|vfflvhj\|e~{`x~~t}ev{wo\|rfj~\|`r~t\|zdwstsbeblspapvgd{wrgwxy}as.slppd~zrxjobfy.b\|}lvtshbw{cgx`ecgyssqgurfqjc.vxu}pzfettzxv{fgenvhjxvwkddsx}oqe~}\|f.kdgstyzdpfc.bstr\|\|`rau..gcjempam.`t{vxr}hgkxc{u.{pdm.aqoqga}fbtxgff{aquit}r.pngw`bke~chcqrxhmyrnkdnty.bsfzc`e{}jmqq`eyvhjyp{axywcwfunaoogqave~am`fgbu`sab.xzpq\|h.p{ew}ct`r`m}p}s\|pymfw{{hc}c.n.lxgaljzwuvu\|mirqvc.p{t~lhftshbggdrf~\|gokr~xgpuan{uvb\|j

C:\Users\user\Documents\ONBQCLYSPU\KATAXZVCPS.jpg

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.941173070112748
Encrypted:	false
SSDEEP:	24:R926993Moyy/wIwMb5HjP84K0wFVIW8Oc/Jhp:R926X3Moy3MlDP8iw7yOchH
MD5:	3FEE51B980A650924530A248376C74A1
SHA1:	10C4D5D8F581ECEAB39989F1B547A76E45ABC373
SHA-256:	2231C12F39DB9271BC7BE48B948D342605012A5A68187F36FE37972DF6F38B0D
SHA-512:	C9F95A5EC80AF0D91BFFCCA1A081152053DCA9D27887A97819CA8E366BAC0F76E1DB92CFC62FA95076F2D227C8E2F00B4535C5377104EBBC442FEBE1DAC6E797
Malicious:	false
Preview:	zsavnkotef`wywjuf{rqy~au{`lqtlkdrytc}..}xyessr{tzlh~d`lzzbs{k\|rqqfzy``.zplhwpet`cyqpt~ngf{ugqmqzdk~dacr}owvv.xoefppda.nxajspx~lewwqeabu`beur}cmbupabstaad`{yejvq\|y.}lxualovqggujsuojusfq`vrua}vtr`tc{zgbxde~`yotfg\|fuq.w\|hzxbkd{d~sgo\|tvnnqtvssa.`r.wscydxhbzqnydweuesdb~da`~ll`b.mj.fdyagm}d.cxye..eg~pqzngv.gsf}{b\|\|~{qavte`v\|sgemzusb}\|u}`.u{ak~{pcrdzv{`wsmkvgsgtjsd}xtoyb{udaiyy~ydxc{attp\|dfnog.vydcaccygupd.eck~\|.`yi{dp.}fo\|.jtm..`g{eb}pfudkdtiab}\|bhstwbvfel~fq{c{}vgdp\|p.sopzsd.~}f.s`tomsyprmbv}mfrc~en}gg}cny.qqaaq.pjp`\|c`}pmg`wzbctr\|n{o`w\|qeifftxrzf.zkzcw~fux.v`ql~ezlvcfjjvgodx`s~~kltehvmb}jcygze.zbetk`pyiodl~tumumcxhsfsww.~vaf}ony`zmu~avif{p.w{zg\|zp\|gw`y\|deybprbwttdlp.}ge`{f`~y\|jz{.{`bw\|}bpnigszeg\|yd.ucq\|w.bbfl~kf\|uxtxp`dacemo{ke~id{gxqextroup{gpjvs}otw.~ctyo`xr}c\|elgxn`}hx~i\|u~n.zauy`je`vrzkt}s}uca.\|xs`ylganq}w{g}gxtxfbhtqsujgghu~p~aifbcck\|erw\|gt}j`d`c~vw{oncm.pf`bqaia`ubaucbpbvacfr\|j`}id}yvrp{t}.tlalvbkymnyb`eu\|ktarw}.bz.v\|utgbp..yw{~~}.}otpec~qcxp\|h~k\|xs}z~\|p{yudlfsauuzuzrec}qwt{cx`v.`hxw

C:\Users\user\Documents\ONBQCLYSPU\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.930565775245372
Encrypted:	false
SSDEEP:	24:wkwvcp6U1Bf7KdqI0qEdiDybFQ+WywU6yhOwy4:Mvcv1lWgdik1s9wy4
MD5:	37D4B66418541B22320B95DF35F5753A
SHA1:	AC699928F847B503DBF34F18553F24CDB16D0D4E
SHA-256:	F11CB588DD176BBD4FB6C047E740893CC039D8F1B59402C014A19B961C43709D
SHA-512:	73BBACFD99D469916E2C4FA145DF6F7E71E9CC157DB65B553B09DAAA61B76F8D25B97E2944C9857BEB575917DFA53F238F829AADC2DC54652998AEB93393A5CC
Malicious:	false
Preview:	~\|wfu}`de`zwve{{ukygizerx`w{.o.kt\|`a\|jm~rhwb~h}oepup}dyekcdfy.r\|~{lqssawvl\|sz}{.phpgbfccbq.cqx`..qo\|r{\|}yitag{ufz`qqdzfcf\|tp.hzfwzbi.{veepo{ug.ntcidy{~tcaqtf\|pztsaxnzqrsx}avebdp.fwzh`\|nu{zrgrwx{.sfhm{`.pm\|cnmctbageldebrdr{x{f\|`ybote{ljbgg\|\|.{xcouwn\|.lirrrv\|.`d~ts\|dcpyvg\|pqsrsx\|zi`zroqgqale}fqvvg{ubfvplf}xx}y\|nrtbqzwumyhyfeydkyrokpcaspytqsvbmvy.ispwqi}fsqtk.qevm{nhrpyb`qt\|rw`qe~\|ypd.\|{s{eucuc`adarqpgp\|svl~.wb.vqksth.}s~eg}\|wcotbz~mkz.e}rwfomez`ys.a`uftudzxgkgd.ndjd.pkzr.ph~f{y}.fz\|kqosb.yfzocqv{htewmfv{ccqnpgdmt~tp~k``\|\|~xy.c`eclt}c~qexdp`br{\|zwaizuwf{.f}{kgnzbv{ffyptx{tfdoszy.sxfhvpavk.}wcqvch}~crg}w{rqq\|bxvt\|\|shedlnea}`bopwdmpp`jzeps}}.vjpyf~xtsyvbgvqbkoqskn.lqtbsa{zxjz~\|f{trrty\|.ipds}c}uawhplg{ecuwswrtnu.ydq~t~zzqbmtd`\|aq.ttu}..eh~mufs`qg}ppm}ftkxg}kptqxzzr`siebvzgcc\|`~}bbakmmwnjzdytp~dgzaf\|tvntbw~vrnqshgmwtkxntban`vpvvx~x`apg`xxvt.h.foy}splk.d}{itsqrt\|yot.apbtztw{f~arcngvxes.pfpkte}n{z}lb~wnzmbh..rq{b}e}tx{xpht}gwyi{ml{}yrvxeesldrz\|bs.mlz}wabsihmfertf~qsuuwpx.bzjywy{xb`np.vqef`dp.gt

C:\Users\user\Documents\ONBQCLYSPU\UMMBDNEQBN.pdf

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.936865080324893
Encrypted:	false
SSDEEP:	24:YhFkSGZ7zL9NitoPJLQ2aeSqEnrlHrQ8Gzc5ttEdJa:YIDHL9qoPq2fKprBG4Ca
MD5:	C9AEBF8842AACD9B7E568D86FE5802C4
SHA1:	01FAF29DC6C1CCD27E8B962847C57502A1BA85BA
SHA-256:	42A564C57A9E954C435EC0C3F81CE5775BF609BF2A040181D33A06B4060C37E8
SHA-512:	AD7E3F2A402589AD2465E9F358EDC31E5718AB813D5CD0C45D960330F98C2EE098AAFC6ED3408F4D10F3064E1DB778AF8CA729075B5E9A98E9867EF7406B4A47
Malicious:	false
Preview:	d.xur.\|fw{nzzvvuzkmssym`{`s\|l\|kgvzk`\|tohsyt{.x\|zpbyufqhfw.msxjmy{`{pzmo`smksey~iax\|cxc\|zcg`cg~btgfzwc`gpbrqaypoeb~.hwgff~\|dawr\|qbomp~u~jbtphxgzxtk\|rxrud}eqwyy~shx.`wwl\|loyyrsmcyus`cbmtyfpgwgmt.c\|th~pczhct~gogry}uysqd~pa~p}cowa~vat\|yu}ifp\|}wfjgdshrtfcb\|d`{pzkqxdvp`xv\|~svnardbvhvmbxfsr`wzfdbrjmlhgyx`xeer`wbm\|qvyercb}{uqjy`bt\|soeyqota.hspqfe~zd~{}lq`ratzd.bw.dbabfpax~eceztm}o~\|waiwt.uu\|{dmcyqyfvjg~tddstywi}.~owtawvchzzbsw{`beufccuw{zzwez{`kzxgrvk{.byb}pr`qecvf{z{wdkevfuu}{{tvybwa~agwsxem~hpelw{zzabfjt\|qyvcly{vfeakvyaj`al{up\|prwi~z~.a\|x`rexmd`pu~{{j.bfub\|uqhyxga\|xrf.f\|.y}wju{ptwvvxbv~oxqtgsmk{yqz`g{{sriafvpipeaz~tw`}h.frqdq~~\|.fn{u}ja\|.ed{bxvnbslsjezbj}}ccckm{lykmm{}w}avbkuyyxhfg``{xywjaec.v.c`ee`fmas`zm{u.\|x~\|he}fuvez\|~accwujelvctuu\|d`~q.dx..w~uozocvke\|ksqnq\|\|c{m}\|oxwxykf`tk}b`e.pmdltgezehccfwjoqcghrgdbytmabtpn..scqr~uc{g.dfm.aketgdegrb{cpc.uvqelkb}{..doqdtoxgxzb}{{~}s{s{z}t~`j.~ym}u}jz`pdab.pezzrqarpff.jbt{~u}hoankoy}vqbnm`\|.xyc~hz~dv~}~`okywoa\|qq}vc\|f`.ra\|rjp{g\|ecbrt}aycqskogautqcacaq{~

C:\Users\user\Documents\ONBQCLYSPU\VLZDGUKUTZ.xlsx

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.938072176856892
Encrypted:	false
SSDEEP:	12:nOqQ4Lwh74tvIBvXYchI5aakrlpxElnbB/AANQ4pu7VIwfeWDlgwZmXA6/1xsH4x:TQ4EDBvXfS5BEMnVze57GwdQL1bdV+HC
MD5:	FC5D88555A4781662E12D72620E6B4B6
SHA1:	73ED6C1F5B188D67E2705E88D3FFC9EE7D1B707D
SHA-256:	B61553C30E2EF648A00854F8CEBA3AC39C996E4B44BCEAA4DD221FEFD836AE99
SHA-512:	CD6347AE2245BF6770E3CE889099508642B5DD760C331EC410B5FDF1CC4E92253F7A77BB3A2E271999CF22FE99BD4CDB5DF17115F60F6D587DB2FAA7A00008FA
Malicious:	false
Preview:	g~osqdrbao`x`athpes.ew\|u`yopeow~r`nu~zr{`ccnxdtbtztqygphkfe{iw{~zxjb}qyvrnohwgy~\|e.c}{sxy}szp~z{zwz\|kbc.sd}{}`bpdvmkusgab~}tpfqopl~jcr.hfcywip\|bwxvnvv{vdx`yc.mtgjvsfztnfbmuf{wukqfqbu.ozgvr~mz\|ul\|gyuvgp.fr~b.x`wbvdgpubdbgsato{u}d{a~ye}rdqkysw~vzwhqvdwwexm{c{qv`~w\|vykcs}g~pudz{x`vq}u`zukadfgsd``te`qvw\|p~{gpmzpywaqpjt}bzhhh```u\|t`w~x}m.sd\|gykz.vugid{zkjpybs\|u.~vhv.{vkawybdnl}`gk.cvy{n{spbz`naeeb\|tgrigvfnxkvpvdiyudyuuseevqdpfb`zc~aurultfgvcatv{whogyg{k`wv{spstgyfqtgcxboramw~ch}ouwhlydsiuxfp~}ryqugajdf{p\|d\|`lb.ctqmt\|xcxcw`r.y}nm`kyz.zsxd`whxw}lxk}fgv.se}dthv{g.~q\|bp.qts{~qbw`kzsbxyq{prctrmzuqagwaxzsqmsxwoz{orru}mdkbfzeesntksgxbt\|~\|vztufx{.{`rwzvagpynfqjyt}ut}yaew}gaovcbrm\|wwx\|czctf~igzx}iumluxy\|gdcg.ue.a~dzyvdl}~hvtbecg\|hkpgqmdd`vqj~gau.eaabjqp}~d.ga\|u\|..hhxqwujxaoji}c`puggtk~ez}ec.c\|`\|qa~zbpc\|w`rz{crxavo`dfkajh}~kxrqn\|hzml`xf{~gws\|u{.rgb`lfblspmc~u}u}he`wsssafbf\|{brze{`g~~}pybfnqg\|z.mvustfzja~s{zgrcrxmky.t`t\|n\|tt{\|\|fi`{yy}`vjvsaqbux`g~gce}p~q~ziqy.xf\|cz{rsngaxa~zrjq~e~dk`cqzujx\|sj~}w{cjk{d

C:\Users\user\Documents\UMMBDNEQBN.docx

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.936865080324893
Encrypted:	false
SSDEEP:	24:YhFkSGZ7zL9NitoPJLQ2aeSqEnrlHrQ8Gzc5ttEdJa:YIDHL9qoPq2fKprBG4Ca
MD5:	C9AEBF8842AACD9B7E568D86FE5802C4
SHA1:	01FAF29DC6C1CCD27E8B962847C57502A1BA85BA
SHA-256:	42A564C57A9E954C435EC0C3F81CE5775BF609BF2A040181D33A06B4060C37E8
SHA-512:	AD7E3F2A402589AD2465E9F358EDC31E5718AB813D5CD0C45D960330F98C2EE098AAFC6ED3408F4D10F3064E1DB778AF8CA729075B5E9A98E9867EF7406B4A47
Malicious:	false
Preview:	d.xur.\|fw{nzzvvuzkmssym`{`s\|l\|kgvzk`\|tohsyt{.x\|zpbyufqhfw.msxjmy{`{pzmo`smksey~iax\|cxc\|zcg`cg~btgfzwc`gpbrqaypoeb~.hwgff~\|dawr\|qbomp~u~jbtphxgzxtk\|rxrud}eqwyy~shx.`wwl\|loyyrsmcyus`cbmtyfpgwgmt.c\|th~pczhct~gogry}uysqd~pa~p}cowa~vat\|yu}ifp\|}wfjgdshrtfcb\|d`{pzkqxdvp`xv\|~svnardbvhvmbxfsr`wzfdbrjmlhgyx`xeer`wbm\|qvyercb}{uqjy`bt\|soeyqota.hspqfe~zd~{}lq`ratzd.bw.dbabfpax~eceztm}o~\|waiwt.uu\|{dmcyqyfvjg~tddstywi}.~owtawvchzzbsw{`beufccuw{zzwez{`kzxgrvk{.byb}pr`qecvf{z{wdkevfuu}{{tvybwa~agwsxem~hpelw{zzabfjt\|qyvcly{vfeakvyaj`al{up\|prwi~z~.a\|x`rexmd`pu~{{j.bfub\|uqhyxga\|xrf.f\|.y}wju{ptwvvxbv~oxqtgsmk{yqz`g{{sriafvpipeaz~tw`}h.frqdq~~\|.fn{u}ja\|.ed{bxvnbslsjezbj}}ccckm{lykmm{}w}avbkuyyxhfg``{xywjaec.v.c`ee`fmas`zm{u.\|x~\|he}fuvez\|~accwujelvctuu\|d`~q.dx..w~uozocvke\|ksqnq\|\|c{m}\|oxwxykf`tk}b`e.pmdltgezehccfwjoqcghrgdbytmabtpn..scqr~uc{g.dfm.aketgdegrb{cpc.uvqelkb}{..doqdtoxgxzb}{{~}s{s{z}t~`j.~ym}u}jz`pdab.pezzrqarpff.jbt{~u}hoankoy}vqbnm`\|.xyc~hz~dv~}~`okywoa\|qq}vc\|f`.ra\|rjp{g\|ecbrt}aycqskogautqcacaq{~

C:\Users\user\Documents\UMMBDNEQBN.pdf

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.936865080324893
Encrypted:	false
SSDEEP:	24:YhFkSGZ7zL9NitoPJLQ2aeSqEnrlHrQ8Gzc5ttEdJa:YIDHL9qoPq2fKprBG4Ca
MD5:	C9AEBF8842AACD9B7E568D86FE5802C4
SHA1:	01FAF29DC6C1CCD27E8B962847C57502A1BA85BA
SHA-256:	42A564C57A9E954C435EC0C3F81CE5775BF609BF2A040181D33A06B4060C37E8
SHA-512:	AD7E3F2A402589AD2465E9F358EDC31E5718AB813D5CD0C45D960330F98C2EE098AAFC6ED3408F4D10F3064E1DB778AF8CA729075B5E9A98E9867EF7406B4A47
Malicious:	false
Preview:	d.xur.\|fw{nzzvvuzkmssym`{`s\|l\|kgvzk`\|tohsyt{.x\|zpbyufqhfw.msxjmy{`{pzmo`smksey~iax\|cxc\|zcg`cg~btgfzwc`gpbrqaypoeb~.hwgff~\|dawr\|qbomp~u~jbtphxgzxtk\|rxrud}eqwyy~shx.`wwl\|loyyrsmcyus`cbmtyfpgwgmt.c\|th~pczhct~gogry}uysqd~pa~p}cowa~vat\|yu}ifp\|}wfjgdshrtfcb\|d`{pzkqxdvp`xv\|~svnardbvhvmbxfsr`wzfdbrjmlhgyx`xeer`wbm\|qvyercb}{uqjy`bt\|soeyqota.hspqfe~zd~{}lq`ratzd.bw.dbabfpax~eceztm}o~\|waiwt.uu\|{dmcyqyfvjg~tddstywi}.~owtawvchzzbsw{`beufccuw{zzwez{`kzxgrvk{.byb}pr`qecvf{z{wdkevfuu}{{tvybwa~agwsxem~hpelw{zzabfjt\|qyvcly{vfeakvyaj`al{up\|prwi~z~.a\|x`rexmd`pu~{{j.bfub\|uqhyxga\|xrf.f\|.y}wju{ptwvvxbv~oxqtgsmk{yqz`g{{sriafvpipeaz~tw`}h.frqdq~~\|.fn{u}ja\|.ed{bxvnbslsjezbj}}ccckm{lykmm{}w}avbkuyyxhfg``{xywjaec.v.c`ee`fmas`zm{u.\|x~\|he}fuvez\|~accwujelvctuu\|d`~q.dx..w~uozocvke\|ksqnq\|\|c{m}\|oxwxykf`tk}b`e.pmdltgezehccfwjoqcghrgdbytmabtpn..scqr~uc{g.dfm.aketgdegrb{cpc.uvqelkb}{..doqdtoxgxzb}{{~}s{s{z}t~`j.~ym}u}jz`pdab.pezzrqarpff.jbt{~u}hoankoy}vqbnm`\|.xyc~hz~dv~}~`okywoa\|qq}vc\|f`.ra\|rjp{g\|ecbrt}aycqskogautqcacaq{~

C:\Users\user\Documents\UMMBDNEQBN\BPMLNOBVSB.png

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.936991678958394
Encrypted:	false
SSDEEP:	24:I8DfZBwyIBrVjixE9v8qRia70elZW1f33qhqt:lDHmN8Kv8qiP4iHqK
MD5:	B6A510A26480E97554818D3CD644B611
SHA1:	47E927CB000B69FE4C241E8199F841B7E1F72480
SHA-256:	A4AFCA894F2DEA2B8BE2BB3AAF8F9145257EC001941893A592AE4A0F3D5192FB
SHA-512:	43C50DF8C2FCFDBC9DAEC4123909B21BE8570EFDB27D29BF345085A1E6F27BEA64FAAB61C72C1E163F00A96030D1FAE55E89D667560DEF73EDD4BE53AB084C6A
Malicious:	false
Preview:	sbx{x~{afwjuggs~y`}ugzwe`dlx`bu~ssyzwtc.ivf}echuqdyw\|fys{.}rsj}}lb`pqrkq~~{pbv{sxbyp`dkdfrakfl{dwvn.ytcybfvdbtwwoemkacsjuys}o\|zfozyrgwvww{c{zctxl{upysljx}teg}dd{.wzcbqrdljapfy}{u.aiv\|od\|rgvl{zs{j{`uz\|bbtq.d{uzxhxtzmfd`xh`cxefa\|nacpte}oxcheu~zey.i.de`}ip.nxefyzgv}su~tcyv}}fypv{}q~}h{{fwttrdydynnzyycskx\|...pybz{bcyz~jynudj`b}rcv~zq}bxwaat.zbugy.ucmy`skd~s`c{gh~vvy{rnmpd}t}\|lywp\|syegt\|{\|~amtdesrg}k`cf\|sadia{awvfuraa\|ba{ys.vyzh~romzeqrqxyybgeptcs.bdcm`dqnthtpqv~o.b{pems..{`pqvxeabdwbbtwzxp{q\|zis}ftwdyvvcpwmffacbf.j{\|qtbxzd\|i.gedwx`ar\|u~xqruees}a~mdbiylmwxbqj``qo{fjppevgdej\|utnbc}gpyrk}~x{aqnhdvtsbuhv.ff`ymwy\|.lqqcbxxfj`ao\|\|vo`u.{zbcs}tsdyapu\|wm`xsf.qqggkqw\|a\|rcfv\|qcmgf\|j.adgawyo~zfu\|oyspv~pytzmzww.v.xcfb\|t.oyse~grdupbd}`vfdp{.awoxa{fhy\|qmwho~s{vjxnsuutm}xk`t~h.ycmm{\|n{}cp}qhexr}ahasbve~~`ktk.gitmdnuzdglq\|spoj\|gcqh\|zowgtvafavcak`xbnztcv~svqdmzwpvxszb`phw\|b.rdwymv`v{vspg.\|d{`{mt}ufb\|v`cvzuck`yggorxptpgtaudg.pj~gzielcutku.m{jz\|i.xbdfaevse}ub.oldsprvz{vthwauak.mdaaggchptv~fgatxpu}.x`uj{q~gg{\|s

C:\Users\user\Documents\UMMBDNEQBN\DVWHKMNFNN.xlsx

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.942242596232926
Encrypted:	false
SSDEEP:	24:Uk7SZOe50qYsxLDARVEaYUaqNfXDVE4mAATEAB:z7iOe502VeEaYVqNfXJE43AIa
MD5:	4E6FD14005C7648C313F96E925692446
SHA1:	D1909A64392809F5EC206F1D689E1155A40EC8F6
SHA-256:	616753A4356E5E612D99D25A9CA659CB58083A469B3A1C452F0A0925DDC7D8F6
SHA-512:	AA3AE4277C74DFA22374957B97E7AD10B5B868EAAAB1608E93BA52DC949DE66269018653B723530CA06161F273DACAFCCAD2C6968D121B23FEA8E8456A4ABAE2
Malicious:	false
Preview:	udb.}\|wq{{kked~`taafrceoezn.~ery.miekkq..s.ferv.ot\|q.awe}agtgsz~ggvu}ruzrzbch~vrhv~`nvjbd{kv~zqcadzjkea}zhtplwi{~~kgeh\|zauwmcv.xm{y~{elduesshvxy~voea`o}.}ojx\|f..fto`gotsqtdnpne\|.\|xctamwg\|femb{dq`bwz`eyb.mr\|}oel}yumoh}crdgbye}`ktlaykzzjp}g}crkoxcavu.`ousymktposs~o.pyvy\|`jv{~id~evzc{dt~yxdw`yardk{.x~jug~}uytzffo`rp~ztcxegkoxdfs~`t{kbbiyg.{hec\|\|rsoyozpynm}q}pn`.`\|{}tku}~bcaakc~zvacfe`uctmtqa\|y}q}dg`.sd}vcvcatrlicnz.zax.`}grxeat.sue`y.~}}oruetynisfdazwccwabtzvgc~{xej.zei~.mjkh.`tidspawvdvf~~\|w\|vzfxaypafwwhcmem{.qyyk`tax}qtubqeftrbrrjzqc{agdxb~fv.}drcd\|{\|y`{ycwfbn}c~lfow.\|ahd`\|\|pus{`e\|}d}}vzbmgwc\|a\|fwsnw~dgzbgydtqdfruku`bu`lr~{ubqulsfxeqcjdf{k`rct{wvlq~kbrxhf.xgfjqt.}t.}\|{j.\|tibtcxbxcep{zzfzh\|pohg.rgz\|or~vm\|o~otucddfbxcs\|ktlr`vtbl\|yke.h`lcfc}gvs.t\|ampjjdtwhp}u`k~gstpyyh.~{perke.{f`at\|hrvdpfcsnvbxb{erc~v\|`i.lvysyex{dpyqkmbaco`ym\|vk.`ayzt~b}lmm{wauxafpdtusewzegco{ouxnrh`tb{vrgf}cfw\|d.qiebbsabavbgfuo`cmb~}\|ev\|v`qnbsf\|zb}qsaojbb.ax{e.hgxlgskjsybbegn.wkcgsbura\|iau`vvqo.ibhfzdgbobse`nygrvscqzshzc

C:\Users\user\Documents\UMMBDNEQBN\JSDNGYCOWY.jpg

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.9241713610950555
Encrypted:	false
SSDEEP:	24:6NrLFNtuG3tyDvGUGK6MUpB2ow5wKhfKrB7XydlKIj28Masaf:6NfFNtuG3ArGUXwpZSwO8XDaf
MD5:	442F7BCEBC7B69EEFA06CFBF9D214C0A
SHA1:	587CCE88520987CF47A5039E1C36E4AA2646B897
SHA-256:	4D9CA0A42CB5A9B1DC17E88E9430F748555966AE33BB7C3642D860757E302406
SHA-512:	268D8222D5AE68AD7A392F668B49652E0545178C295A77FF25100366563136A5E4CB3BBC3D4865306B966967D27353CC6B109B883559BEED4F8BEEB4FF8BD53F
Malicious:	false
Preview:	{aqyqhzxblpxd{otuq~uc`aqo{t{wykrz`}h`pbgw`mn.rpb}ovzzbtxjfqh`\|mvuc.`fpoyuqjcz~rrakmesrz`q.sz~{mu\|kf}vs}dz~i{yttrrp\|yxfx.rvrn.sv`oojv~qoajcewd~o~nw`y\|`u}czy~edvrydy\|s{uu~rwxonovaeede~afz.mmqlu`rwa.c{d~r\|\|v\|~nsvvu{`xqdtstazhmol{vdp{zy.n}~{dxspzqylvc~yskz{`ksxjsrws\|g~gqol}r{aynzydx}h}rp`xra.`nj{p~f{quskyfadukctykkqzuqb~p.vapu}ij.f}nwapsewzyys~ec{fpttt{eqchc\|{bf}tfvaavpq.~\|p``vz.cvf`palizvw.{xqm`xus.{ej{qzxp{axzac.yqf.xfupyt`h}ay{{wouy{\|fpsr`ogrevqvbbdc\|tqdued`bpu~d.nbyl.yaq}t~xeeq\|yltsbcyligd\|pdvru}qrqgb~}egrqrutc~hfqhsdecelv{vafm~}\|ew~ybv{bz}so.`hqf\|}xwga}z.pbgc}.meyia}~vguygiymnaxhf{.vazm{~x~.gtactxrhdm\|txee~akwsjbp}dzp`~bbweebnaegqupcezwax\|sv`uupqbyzgcwucx\|r\|rwttcaeswqpuerfdpgivftew\|nuhkcjyt}y.sdwhs\|yhz`f.vkfqeyao{\|xzzx`k`.sp\|~yyuukm}ea\|tcayvf`njsfx.usceyfwvevpwefzzdvagsuzdu{~sp{ytqwav{zv`sey}x~itdvhgd{pucczxts~et~{dp}y\|zs`xdk`zv~f~g{lxxlh}m`wtd\|y}c{cz~~zqoatgrpyuwjpzi~{ezbq}dr~{~~\|~xzx`a.sgotpoegipcf\|{kv}uyzf\|pskmxmti}v\|v}kth`xwtt`.emc{jt\|`yu\|sgtw`b}axpc}p\|orbjhw`gr}cdphc.\|ybyfestzq{b

C:\Users\user\Documents\UMMBDNEQBN\UMMBDNEQBN.docx

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.936865080324893
Encrypted:	false
SSDEEP:	24:YhFkSGZ7zL9NitoPJLQ2aeSqEnrlHrQ8Gzc5ttEdJa:YIDHL9qoPq2fKprBG4Ca
MD5:	C9AEBF8842AACD9B7E568D86FE5802C4
SHA1:	01FAF29DC6C1CCD27E8B962847C57502A1BA85BA
SHA-256:	42A564C57A9E954C435EC0C3F81CE5775BF609BF2A040181D33A06B4060C37E8
SHA-512:	AD7E3F2A402589AD2465E9F358EDC31E5718AB813D5CD0C45D960330F98C2EE098AAFC6ED3408F4D10F3064E1DB778AF8CA729075B5E9A98E9867EF7406B4A47
Malicious:	false
Preview:	d.xur.\|fw{nzzvvuzkmssym`{`s\|l\|kgvzk`\|tohsyt{.x\|zpbyufqhfw.msxjmy{`{pzmo`smksey~iax\|cxc\|zcg`cg~btgfzwc`gpbrqaypoeb~.hwgff~\|dawr\|qbomp~u~jbtphxgzxtk\|rxrud}eqwyy~shx.`wwl\|loyyrsmcyus`cbmtyfpgwgmt.c\|th~pczhct~gogry}uysqd~pa~p}cowa~vat\|yu}ifp\|}wfjgdshrtfcb\|d`{pzkqxdvp`xv\|~svnardbvhvmbxfsr`wzfdbrjmlhgyx`xeer`wbm\|qvyercb}{uqjy`bt\|soeyqota.hspqfe~zd~{}lq`ratzd.bw.dbabfpax~eceztm}o~\|waiwt.uu\|{dmcyqyfvjg~tddstywi}.~owtawvchzzbsw{`beufccuw{zzwez{`kzxgrvk{.byb}pr`qecvf{z{wdkevfuu}{{tvybwa~agwsxem~hpelw{zzabfjt\|qyvcly{vfeakvyaj`al{up\|prwi~z~.a\|x`rexmd`pu~{{j.bfub\|uqhyxga\|xrf.f\|.y}wju{ptwvvxbv~oxqtgsmk{yqz`g{{sriafvpipeaz~tw`}h.frqdq~~\|.fn{u}ja\|.ed{bxvnbslsjezbj}}ccckm{lykmm{}w}avbkuyyxhfg``{xywjaec.v.c`ee`fmas`zm{u.\|x~\|he}fuvez\|~accwujelvctuu\|d`~q.dx..w~uozocvke\|ksqnq\|\|c{m}\|oxwxykf`tk}b`e.pmdltgezehccfwjoqcghrgdbytmabtpn..scqr~uc{g.dfm.aketgdegrb{cpc.uvqelkb}{..doqdtoxgxzb}{{~}s{s{z}t~`j.~ym}u}jz`pdab.pezzrqarpff.jbt{~u}hoankoy}vqbnm`\|.xyc~hz~dv~}~`okywoa\|qq}vc\|f`.ra\|rjp{g\|ecbrt}aycqskogautqcacaq{~

C:\Users\user\Documents\UMMBDNEQBN\WUTJSCBCFX.pdf

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.9507220049371385
Encrypted:	false
SSDEEP:	24:QsD5EROeoVH9txjTKr3YXxNkSQ1/Kite/vruQSenAgCfXJ:QshV5lLk9KiWruQSeCfXJ
MD5:	7B36984F9548618E7561EB00C5311C74
SHA1:	DD903AC81B25EFCB1E6553134085BEA95211DBF5
SHA-256:	747FA6767A71C82E19B8C9BE0082B717898874CF41EBC2D61B9CDFB825253183
SHA-512:	4B2C31F2DC25424024B38E034C07E2142E68F55AACC6B1894914C7AD6B6A4F9A0F28091102A216C07BAE14B4A7EE37F117FE204905E4A6C6DD8C1EF449683F8C
Malicious:	false
Preview:	fga}er{tsmv`rc.~eun.~ccara.ys`ucfurd\|jy{\|jdeycob\|la}fcy.}hcykbpvr~rreqtezz}\|t{~styzctgixqv}{az\|w.ftquudubdjesq{bxrbhcqdytyw}xc\|sllnuxl~~asafcvwxr`ibpdmivb.t~jxgbygcr`vna{hibrwbjt}`xhebl.hpetn.mew~hczusa\|sebjxv.vjesluwze\|ejydtizarwwzs.sw{g.`gxmq.sl\|}}pzm~`p\|aqfb{wb`uu}cdp.mevbydbivawnzuiafobzvs`dhycj\|}x.}{mttvt}~\|nhc}nxkgzt~\|msemo``c{fhyahdb.obdhal~n}u`w}jkd.`krxd~l}l\|izuxbjez`xbvqd.ukvdw~{qayaxxqzku.zn}r.xptiswzaswtr{glsz~wffllu~sjtjdnaicrxwh`fmsrbqdy`cb\|jp``qzwcvyeu\|orstssqahc.dthk{mfad~xspe\|y{.baorwqqvwlfrcaguwzrk.pq~.tuqg}.fqaty{qqcvbmyut.bmiqc}kazsrgkfcq\|crry\|zbfq`aetmevur\|lijgbz`jg{{qx{.~v}eap.nnoghgxcyucbafk~}goh{sdamu`rqdukxr`amrdymbq`p\|}}jxtyfa~}\|oyyi.ldhjsskcc\|xudesayg`z}prqvf\|~ubacewguts.drcv`bubqdsorbfygw`\|yftt.avvuxztucafz{yzvy.ki}~svtkqfewdrcx{n{oh~b~ih\|xaev\|r\|s.z}~{zg\|va}wgbwwt~~tgqyt`pjravvphg{whpebban}zuev~rpbay.~k}mpfpybprpqspy{}eeysgmo.{\|lxwdm\|\|decuyewfazvorvwzysppgqexzwewf\|breb}rcgs}ypvoyax.srhqp`v\|punivgd.usbeftd}dztabcz~.kgub{\|g}pbtbv{~dbf~uu{.jw.ms`xpycg.kdfajpkuy

C:\Users\user\Documents\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.938072176856892
Encrypted:	false
SSDEEP:	12:nOqQ4Lwh74tvIBvXYchI5aakrlpxElnbB/AANQ4pu7VIwfeWDlgwZmXA6/1xsH4x:TQ4EDBvXfS5BEMnVze57GwdQL1bdV+HC
MD5:	FC5D88555A4781662E12D72620E6B4B6
SHA1:	73ED6C1F5B188D67E2705E88D3FFC9EE7D1B707D
SHA-256:	B61553C30E2EF648A00854F8CEBA3AC39C996E4B44BCEAA4DD221FEFD836AE99
SHA-512:	CD6347AE2245BF6770E3CE889099508642B5DD760C331EC410B5FDF1CC4E92253F7A77BB3A2E271999CF22FE99BD4CDB5DF17115F60F6D587DB2FAA7A00008FA
Malicious:	false
Preview:	g~osqdrbao`x`athpes.ew\|u`yopeow~r`nu~zr{`ccnxdtbtztqygphkfe{iw{~zxjb}qyvrnohwgy~\|e.c}{sxy}szp~z{zwz\|kbc.sd}{}`bpdvmkusgab~}tpfqopl~jcr.hfcywip\|bwxvnvv{vdx`yc.mtgjvsfztnfbmuf{wukqfqbu.ozgvr~mz\|ul\|gyuvgp.fr~b.x`wbvdgpubdbgsato{u}d{a~ye}rdqkysw~vzwhqvdwwexm{c{qv`~w\|vykcs}g~pudz{x`vq}u`zukadfgsd``te`qvw\|p~{gpmzpywaqpjt}bzhhh```u\|t`w~x}m.sd\|gykz.vugid{zkjpybs\|u.~vhv.{vkawybdnl}`gk.cvy{n{spbz`naeeb\|tgrigvfnxkvpvdiyudyuuseevqdpfb`zc~aurultfgvcatv{whogyg{k`wv{spstgyfqtgcxboramw~ch}ouwhlydsiuxfp~}ryqugajdf{p\|d\|`lb.ctqmt\|xcxcw`r.y}nm`kyz.zsxd`whxw}lxk}fgv.se}dthv{g.~q\|bp.qts{~qbw`kzsbxyq{prctrmzuqagwaxzsqmsxwoz{orru}mdkbfzeesntksgxbt\|~\|vztufx{.{`rwzvagpynfqjyt}ut}yaew}gaovcbrm\|wwx\|czctf~igzx}iumluxy\|gdcg.ue.a~dzyvdl}~hvtbecg\|hkpgqmdd`vqj~gau.eaabjqp}~d.ga\|u\|..hhxqwujxaoji}c`puggtk~ez}ec.c\|`\|qa~zbpc\|w`rz{crxavo`dfkajh}~kxrqn\|hzml`xf{~gws\|u{.rgb`lfblspmc~u}u}he`wsssafbf\|{brze{`g~~}pybfnqg\|z.mvustfzja~s{zgrcrxmky.t`t\|n\|tt{\|\|fi`{yy}`vjvsaqbux`g~gce}p~q~ziqy.xf\|cz{rsngaxa~zrjq~e~dk`cqzujx\|sj~}w{cjk{d

C:\Users\user\Documents\VLZDGUKUTZ.xlsx

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.938072176856892
Encrypted:	false
SSDEEP:	12:nOqQ4Lwh74tvIBvXYchI5aakrlpxElnbB/AANQ4pu7VIwfeWDlgwZmXA6/1xsH4x:TQ4EDBvXfS5BEMnVze57GwdQL1bdV+HC
MD5:	FC5D88555A4781662E12D72620E6B4B6
SHA1:	73ED6C1F5B188D67E2705E88D3FFC9EE7D1B707D
SHA-256:	B61553C30E2EF648A00854F8CEBA3AC39C996E4B44BCEAA4DD221FEFD836AE99
SHA-512:	CD6347AE2245BF6770E3CE889099508642B5DD760C331EC410B5FDF1CC4E92253F7A77BB3A2E271999CF22FE99BD4CDB5DF17115F60F6D587DB2FAA7A00008FA
Malicious:	false
Preview:	g~osqdrbao`x`athpes.ew\|u`yopeow~r`nu~zr{`ccnxdtbtztqygphkfe{iw{~zxjb}qyvrnohwgy~\|e.c}{sxy}szp~z{zwz\|kbc.sd}{}`bpdvmkusgab~}tpfqopl~jcr.hfcywip\|bwxvnvv{vdx`yc.mtgjvsfztnfbmuf{wukqfqbu.ozgvr~mz\|ul\|gyuvgp.fr~b.x`wbvdgpubdbgsato{u}d{a~ye}rdqkysw~vzwhqvdwwexm{c{qv`~w\|vykcs}g~pudz{x`vq}u`zukadfgsd``te`qvw\|p~{gpmzpywaqpjt}bzhhh```u\|t`w~x}m.sd\|gykz.vugid{zkjpybs\|u.~vhv.{vkawybdnl}`gk.cvy{n{spbz`naeeb\|tgrigvfnxkvpvdiyudyuuseevqdpfb`zc~aurultfgvcatv{whogyg{k`wv{spstgyfqtgcxboramw~ch}ouwhlydsiuxfp~}ryqugajdf{p\|d\|`lb.ctqmt\|xcxcw`r.y}nm`kyz.zsxd`whxw}lxk}fgv.se}dthv{g.~q\|bp.qts{~qbw`kzsbxyq{prctrmzuqagwaxzsqmsxwoz{orru}mdkbfzeesntksgxbt\|~\|vztufx{.{`rwzvagpynfqjyt}ut}yaew}gaovcbrm\|wwx\|czctf~igzx}iumluxy\|gdcg.ue.a~dzyvdl}~hvtbecg\|hkpgqmdd`vqj~gau.eaabjqp}~d.ga\|u\|..hhxqwujxaoji}c`puggtk~ez}ec.c\|`\|qa~zbpc\|w`rz{crxavo`dfkajh}~kxrqn\|hzml`xf{~gws\|u{.rgb`lfblspmc~u}u}he`wsssafbf\|{brze{`g~~}pybfnqg\|z.mvustfzja~s{zgrcrxmky.t`t\|n\|tt{\|\|fi`{yy}`vjvsaqbux`g~gce}p~q~ziqy.xf\|cz{rsngaxa~zrjq~e~dk`cqzujx\|sj~}w{cjk{d

C:\Users\user\Documents\VLZDGUKUTZ\DVWHKMNFNN.pdf

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.942242596232926
Encrypted:	false
SSDEEP:	24:Uk7SZOe50qYsxLDARVEaYUaqNfXDVE4mAATEAB:z7iOe502VeEaYVqNfXJE43AIa
MD5:	4E6FD14005C7648C313F96E925692446
SHA1:	D1909A64392809F5EC206F1D689E1155A40EC8F6
SHA-256:	616753A4356E5E612D99D25A9CA659CB58083A469B3A1C452F0A0925DDC7D8F6
SHA-512:	AA3AE4277C74DFA22374957B97E7AD10B5B868EAAAB1608E93BA52DC949DE66269018653B723530CA06161F273DACAFCCAD2C6968D121B23FEA8E8456A4ABAE2
Malicious:	false
Preview:	udb.}\|wq{{kked~`taafrceoezn.~ery.miekkq..s.ferv.ot\|q.awe}agtgsz~ggvu}ruzrzbch~vrhv~`nvjbd{kv~zqcadzjkea}zhtplwi{~~kgeh\|zauwmcv.xm{y~{elduesshvxy~voea`o}.}ojx\|f..fto`gotsqtdnpne\|.\|xctamwg\|femb{dq`bwz`eyb.mr\|}oel}yumoh}crdgbye}`ktlaykzzjp}g}crkoxcavu.`ousymktposs~o.pyvy\|`jv{~id~evzc{dt~yxdw`yardk{.x~jug~}uytzffo`rp~ztcxegkoxdfs~`t{kbbiyg.{hec\|\|rsoyozpynm}q}pn`.`\|{}tku}~bcaakc~zvacfe`uctmtqa\|y}q}dg`.sd}vcvcatrlicnz.zax.`}grxeat.sue`y.~}}oruetynisfdazwccwabtzvgc~{xej.zei~.mjkh.`tidspawvdvf~~\|w\|vzfxaypafwwhcmem{.qyyk`tax}qtubqeftrbrrjzqc{agdxb~fv.}drcd\|{\|y`{ycwfbn}c~lfow.\|ahd`\|\|pus{`e\|}d}}vzbmgwc\|a\|fwsnw~dgzbgydtqdfruku`bu`lr~{ubqulsfxeqcjdf{k`rct{wvlq~kbrxhf.xgfjqt.}t.}\|{j.\|tibtcxbxcep{zzfzh\|pohg.rgz\|or~vm\|o~otucddfbxcs\|ktlr`vtbl\|yke.h`lcfc}gvs.t\|ampjjdtwhp}u`k~gstpyyh.~{perke.{f`at\|hrvdpfcsnvbxb{erc~v\|`i.lvysyex{dpyqkmbaco`ym\|vk.`ayzt~b}lmm{wauxafpdtusewzegco{ouxnrh`tb{vrgf}cfw\|d.qiebbsabavbgfuo`cmb~}\|ev\|v`qnbsf\|zb}qsaojbb.ax{e.hgxlgskjsybbegn.wkcgsbura\|iau`vvqo.ibhfzdgbobse`nygrvscqzshzc

C:\Users\user\Documents\VLZDGUKUTZ\KATAXZVCPS.xlsx

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.941173070112748
Encrypted:	false
SSDEEP:	24:R926993Moyy/wIwMb5HjP84K0wFVIW8Oc/Jhp:R926X3Moy3MlDP8iw7yOchH
MD5:	3FEE51B980A650924530A248376C74A1
SHA1:	10C4D5D8F581ECEAB39989F1B547A76E45ABC373
SHA-256:	2231C12F39DB9271BC7BE48B948D342605012A5A68187F36FE37972DF6F38B0D
SHA-512:	C9F95A5EC80AF0D91BFFCCA1A081152053DCA9D27887A97819CA8E366BAC0F76E1DB92CFC62FA95076F2D227C8E2F00B4535C5377104EBBC442FEBE1DAC6E797
Malicious:	false
Preview:	zsavnkotef`wywjuf{rqy~au{`lqtlkdrytc}..}xyessr{tzlh~d`lzzbs{k\|rqqfzy``.zplhwpet`cyqpt~ngf{ugqmqzdk~dacr}owvv.xoefppda.nxajspx~lewwqeabu`beur}cmbupabstaad`{yejvq\|y.}lxualovqggujsuojusfq`vrua}vtr`tc{zgbxde~`yotfg\|fuq.w\|hzxbkd{d~sgo\|tvnnqtvssa.`r.wscydxhbzqnydweuesdb~da`~ll`b.mj.fdyagm}d.cxye..eg~pqzngv.gsf}{b\|\|~{qavte`v\|sgemzusb}\|u}`.u{ak~{pcrdzv{`wsmkvgsgtjsd}xtoyb{udaiyy~ydxc{attp\|dfnog.vydcaccygupd.eck~\|.`yi{dp.}fo\|.jtm..`g{eb}pfudkdtiab}\|bhstwbvfel~fq{c{}vgdp\|p.sopzsd.~}f.s`tomsyprmbv}mfrc~en}gg}cny.qqaaq.pjp`\|c`}pmg`wzbctr\|n{o`w\|qeifftxrzf.zkzcw~fux.v`ql~ezlvcfjjvgodx`s~~kltehvmb}jcygze.zbetk`pyiodl~tumumcxhsfsww.~vaf}ony`zmu~avif{p.w{zg\|zp\|gw`y\|deybprbwttdlp.}ge`{f`~y\|jz{.{`bw\|}bpnigszeg\|yd.ucq\|w.bbfl~kf\|uxtxp`dacemo{ke~id{gxqextroup{gpjvs}otw.~ctyo`xr}c\|elgxn`}hx~i\|u~n.zauy`je`vrzkt}s}uca.\|xs`ylganq}w{g}gxtxfbhtqsujgghu~p~aifbcck\|erw\|gt}j`d`c~vw{oncm.pf`bqaia`ubaucbpbvacfr\|j`}id}yvrp{t}.tlalvbkymnyb`eu\|ktarw}.bz.v\|utgbp..yw{~~}.}otpec~qcxp\|h~k\|xs}z~\|p{yudlfsauuzuzrec}qwt{cx`v.`hxw

C:\Users\user\Documents\VLZDGUKUTZ\NWTVCDUMOB.jpg

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.930818611892816
Encrypted:	false
SSDEEP:	24:C9qyd6NWxjwt5IcATJd/eA+gdSgHkuq9yWMfFP:/Wrxst5LATX/elgHxq8t
MD5:	35DA0E6A73175C1EBB4BBAC516DA1329
SHA1:	7438FE68FD89FA558D944A1C42BAF0C9E0E80729
SHA-256:	D0637AB4266F2191B69C41BE9909E67C2859234E5E3C5F5316A933D80341BEFF
SHA-512:	98B3FD1BFFEDCBBDFC169C4A8DF8A6924817C885F870CF7C9484C0417FE297F00E987799C73EEB88A78AA5754A0D03E54A824060326FC09BC13047C2CA89FCC8
Malicious:	false
Preview:	.eaauulzzwlceeibzjf\|x.rg\|imrxez}nxztycqetdr~e{jadgucznkskwnab}abw{.~ymtg\|r}dz~dq\|kprp}w}f}tgcr``fvyevjpq.vottbh~szm{qv~jvb}zsbr`fxmcy{~wdjqdbzf\|zro.davxs\|\|.v`}.dfpberxbtcueuywaky\|babonpd~osmo~`fyqytta~g}~b}lt}r~ir{qb\|q}v{}culxrsg{}ao{kbyae}yya}cv.rzzvu`xn\|fx`hdtevrf`~`qsrme`qh`q`dcdv{cm~zppfs`tu}en}xvzmwim{rc}tbwi~xhp}xwdny}nrxf.ibvoj}{uat.d{gg~ewamztr{wxuqdk`ot}{hrxtlvxzq.xyuivclsoiv{ygwdosaq\|qa`e.gme\|tdoms~ydkqxx}{z\|gv\|i~dyovx}fr`u.tsrpv~qeucs~vesbqzk~pb.jqa.gnuvevxy}~xsbfafvdfsu}\|{}nyeerfyqbqu}g`dt\|slanuv{ozb\|ogb\|t}ugatyyl}fduxczsy}t{fcksmo.r~zz\|\|uwuuvaaawvc}xfui.cry\|{vvvp`n{gxs~vn.ss~cwfbjiu`xcfauwev\|`r}`y.\|}a}m~yer}pgheo~.q{g\|qvvr~b}.ng\|zrg.jwa.y.\|fcclrazzqmf~s~.w.u}vsropk~vto~popopyyt`dysqx\|o\|qs~emmoywyug\|sq`rkab\|zw.txqsqwdwcp.ee\|a\|`fwxo~}{qqgbwef~eum\|ca\|evmke~`.dfxrtn`ty\|aiy.wz.aqsbfyxpwun~yyygxdnb{~ra`ut~fckbv.~gefkae{caz{b}ypmmzw}gmpzpes~zx}mtc`j~ydpb\|qbjet`g.dp`}kzpslhqsg\|patvjuhse~{{m\|rwitbmu}vbd.qq.}ztq}faxbg~aj}z.djonyblm{.iqounb}pcfs{{zexinz{tje.qz}\|\|gya`v\|fpvyzlivera\|f~x

C:\Users\user\Documents\VLZDGUKUTZ\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.938072176856892
Encrypted:	false
SSDEEP:	12:nOqQ4Lwh74tvIBvXYchI5aakrlpxElnbB/AANQ4pu7VIwfeWDlgwZmXA6/1xsH4x:TQ4EDBvXfS5BEMnVze57GwdQL1bdV+HC
MD5:	FC5D88555A4781662E12D72620E6B4B6
SHA1:	73ED6C1F5B188D67E2705E88D3FFC9EE7D1B707D
SHA-256:	B61553C30E2EF648A00854F8CEBA3AC39C996E4B44BCEAA4DD221FEFD836AE99
SHA-512:	CD6347AE2245BF6770E3CE889099508642B5DD760C331EC410B5FDF1CC4E92253F7A77BB3A2E271999CF22FE99BD4CDB5DF17115F60F6D587DB2FAA7A00008FA
Malicious:	false
Preview:	g~osqdrbao`x`athpes.ew\|u`yopeow~r`nu~zr{`ccnxdtbtztqygphkfe{iw{~zxjb}qyvrnohwgy~\|e.c}{sxy}szp~z{zwz\|kbc.sd}{}`bpdvmkusgab~}tpfqopl~jcr.hfcywip\|bwxvnvv{vdx`yc.mtgjvsfztnfbmuf{wukqfqbu.ozgvr~mz\|ul\|gyuvgp.fr~b.x`wbvdgpubdbgsato{u}d{a~ye}rdqkysw~vzwhqvdwwexm{c{qv`~w\|vykcs}g~pudz{x`vq}u`zukadfgsd``te`qvw\|p~{gpmzpywaqpjt}bzhhh```u\|t`w~x}m.sd\|gykz.vugid{zkjpybs\|u.~vhv.{vkawybdnl}`gk.cvy{n{spbz`naeeb\|tgrigvfnxkvpvdiyudyuuseevqdpfb`zc~aurultfgvcatv{whogyg{k`wv{spstgyfqtgcxboramw~ch}ouwhlydsiuxfp~}ryqugajdf{p\|d\|`lb.ctqmt\|xcxcw`r.y}nm`kyz.zsxd`whxw}lxk}fgv.se}dthv{g.~q\|bp.qts{~qbw`kzsbxyq{prctrmzuqagwaxzsqmsxwoz{orru}mdkbfzeesntksgxbt\|~\|vztufx{.{`rwzvagpynfqjyt}ut}yaew}gaovcbrm\|wwx\|czctf~igzx}iumluxy\|gdcg.ue.a~dzyvdl}~hvtbecg\|hkpgqmdd`vqj~gau.eaabjqp}~d.ga\|u\|..hhxqwujxaoji}c`puggtk~ez}ec.c\|`\|qa~zbpc\|w`rz{crxavo`dfkajh}~kxrqn\|hzml`xf{~gws\|u{.rgb`lfblspmc~u}u}he`wsssafbf\|{brze{`g~~}pybfnqg\|z.mvustfzja~s{zgrcrxmky.t`t\|n\|tt{\|\|fi`{yy}`vjvsaqbux`g~gce}p~q~ziqy.xf\|cz{rsngaxa~zrjq~e~dk`cqzujx\|sj~}w{cjk{d

C:\Users\user\Documents\VLZDGUKUTZ\YPSIACHYXW.png

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	zlib compressed data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.940902937007019
Encrypted:	false
SSDEEP:	24:eqgZ2xBD1HqbmGkvzZd+l3hf9jtf8vuMkMYPtlELF5bJNG:eix51qmGgMlx1OW9ZPtlUdI
MD5:	E3BB78DC32B75F14FEB47E950A968C42
SHA1:	12AF7D9E2A342319DAEC8F80AB9E59401E5A9D85
SHA-256:	6355754B2F78684A535AC85B21C4829A8CDCBED37FF9ED7E7BC7FBBD0B897804
SHA-512:	FE6E94FE71B78B7322560D0C28684A7559DFDF658E68F9A355EEDEBC09D175FB53E35C7D9B46F36F922256EBF44DC88582E26DF205D8879BA3A6B5CDA09D439F
Malicious:	false
Preview:	hbf~wrqnmb\|\|v{y~xq}ihy}\|{v`~owa.}gm~sfms}s~pbyr~oobcmyzsxtyaz`bp}y}rpltttfukjdxzrjeer~.acm\|udnv`~u{e.pddubo}m~p.brv}y`tqbddyc{}nb{ogysrkp{\|st`s~dfmmc`m}\|z{.gu\|d\|ag~`}.fao\|ed\|bfk`bb.boeeyptcehz`av}akes.dm.yw\|c~o\|g~qq}cztxfzqosuauoskd~r~~jfoaigw}uehdqrnrzesfgz}qpwqrsrnqzp\|pvutu\|yracu.g`t\|a.el`e{mhtb.{ag}{whk.c`turg`juydqxkyv`bnz\|fkpzf.dcuovvtlot`{eo}q.{nigx`fzygcupu{gv{mr\|{`g`gbezc{ectxott`d~byfp{{bid`ure.yb`i.gn}~wfot`bv`\|iketdq.vbnhtszwde`no~ktd{mj{gv~f\|oype.areiyvoh{dcaeefur{wvzsvqevtlyvzzyaqz\|g}wxbii\|rxl\|}}ku}fbe~tc}fp~yx}~`vrjzcg.}hgg{w{oyoe}~yymvhsb}ch}f\|snav`kbvqvegfevsgsbaxi}lctjsaqpxacdwufqtym\|\|mr}a~mkxudxkzxsy.v.wxtbs`pufb{igyrbnfqrlapg`{w.c}pewcread`ucbq.cfpps{}xkymyw``v\|ozcncohapsg.bg`qwa.{e~uz\|sqqweyfqavuzpamybqy{lpkvx`{plclfwdml`endpsug.riyegwwwmrb}xxvhjfq{rx}p~`furye`yv}vqvpre~{szxwndgqw}dsmq\|usj}{tq`.lfmouga~t{sqpuijpdwvk\|ver}c.bz..td{hv{a.myp.~ft{\|~dptzy{{`\|h{{gmkx{bs\|kug\|iu~r~\|adq~qrg\|juzpxsycp}f\|sr~guacxr\|k\|exubef}{qorlr~sawwa.uf{}w\|\|flbffbvfu.zs\|diwp}~lwadypvq{~oqzur}

C:\Users\user\Documents\WUTJSCBCFX.pdf

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.9507220049371385
Encrypted:	false
SSDEEP:	24:QsD5EROeoVH9txjTKr3YXxNkSQ1/Kite/vruQSenAgCfXJ:QshV5lLk9KiWruQSeCfXJ
MD5:	7B36984F9548618E7561EB00C5311C74
SHA1:	DD903AC81B25EFCB1E6553134085BEA95211DBF5
SHA-256:	747FA6767A71C82E19B8C9BE0082B717898874CF41EBC2D61B9CDFB825253183
SHA-512:	4B2C31F2DC25424024B38E034C07E2142E68F55AACC6B1894914C7AD6B6A4F9A0F28091102A216C07BAE14B4A7EE37F117FE204905E4A6C6DD8C1EF449683F8C
Malicious:	false
Preview:	fga}er{tsmv`rc.~eun.~ccara.ys`ucfurd\|jy{\|jdeycob\|la}fcy.}hcykbpvr~rreqtezz}\|t{~styzctgixqv}{az\|w.ftquudubdjesq{bxrbhcqdytyw}xc\|sllnuxl~~asafcvwxr`ibpdmivb.t~jxgbygcr`vna{hibrwbjt}`xhebl.hpetn.mew~hczusa\|sebjxv.vjesluwze\|ejydtizarwwzs.sw{g.`gxmq.sl\|}}pzm~`p\|aqfb{wb`uu}cdp.mevbydbivawnzuiafobzvs`dhycj\|}x.}{mttvt}~\|nhc}nxkgzt~\|msemo``c{fhyahdb.obdhal~n}u`w}jkd.`krxd~l}l\|izuxbjez`xbvqd.ukvdw~{qayaxxqzku.zn}r.xptiswzaswtr{glsz~wffllu~sjtjdnaicrxwh`fmsrbqdy`cb\|jp``qzwcvyeu\|orstssqahc.dthk{mfad~xspe\|y{.baorwqqvwlfrcaguwzrk.pq~.tuqg}.fqaty{qqcvbmyut.bmiqc}kazsrgkfcq\|crry\|zbfq`aetmevur\|lijgbz`jg{{qx{.~v}eap.nnoghgxcyucbafk~}goh{sdamu`rqdukxr`amrdymbq`p\|}}jxtyfa~}\|oyyi.ldhjsskcc\|xudesayg`z}prqvf\|~ubacewguts.drcv`bubqdsorbfygw`\|yftt.avvuxztucafz{yzvy.ki}~svtkqfewdrcx{n{oh~b~ih\|xaev\|r\|s.z}~{zg\|va}wgbwwt~~tgqyt`pjravvphg{whpebban}zuev~rpbay.~k}mpfpybprpqspy{}eeysgmo.{\|lxwdm\|\|decuyewfazvorvwzysppgqexzwewf\|breb}rcgs}ypvoyax.srhqp`v\|punivgd.usbeftd}dztabcz~.kgub{\|g}pbtbv{~dbf~uu{.jw.ms`xpycg.kdfajpkuy

C:\Users\user\Documents\YPSIACHYXW.png

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	zlib compressed data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.940902937007019
Encrypted:	false
SSDEEP:	24:eqgZ2xBD1HqbmGkvzZd+l3hf9jtf8vuMkMYPtlELF5bJNG:eix51qmGgMlx1OW9ZPtlUdI
MD5:	E3BB78DC32B75F14FEB47E950A968C42
SHA1:	12AF7D9E2A342319DAEC8F80AB9E59401E5A9D85
SHA-256:	6355754B2F78684A535AC85B21C4829A8CDCBED37FF9ED7E7BC7FBBD0B897804
SHA-512:	FE6E94FE71B78B7322560D0C28684A7559DFDF658E68F9A355EEDEBC09D175FB53E35C7D9B46F36F922256EBF44DC88582E26DF205D8879BA3A6B5CDA09D439F
Malicious:	false
Preview:	hbf~wrqnmb\|\|v{y~xq}ihy}\|{v`~owa.}gm~sfms}s~pbyr~oobcmyzsxtyaz`bp}y}rpltttfukjdxzrjeer~.acm\|udnv`~u{e.pddubo}m~p.brv}y`tqbddyc{}nb{ogysrkp{\|st`s~dfmmc`m}\|z{.gu\|d\|ag~`}.fao\|ed\|bfk`bb.boeeyptcehz`av}akes.dm.yw\|c~o\|g~qq}cztxfzqosuauoskd~r~~jfoaigw}uehdqrnrzesfgz}qpwqrsrnqzp\|pvutu\|yracu.g`t\|a.el`e{mhtb.{ag}{whk.c`turg`juydqxkyv`bnz\|fkpzf.dcuovvtlot`{eo}q.{nigx`fzygcupu{gv{mr\|{`g`gbezc{ectxott`d~byfp{{bid`ure.yb`i.gn}~wfot`bv`\|iketdq.vbnhtszwde`no~ktd{mj{gv~f\|oype.areiyvoh{dcaeefur{wvzsvqevtlyvzzyaqz\|g}wxbii\|rxl\|}}ku}fbe~tc}fp~yx}~`vrjzcg.}hgg{w{oyoe}~yymvhsb}ch}f\|snav`kbvqvegfevsgsbaxi}lctjsaqpxacdwufqtym\|\|mr}a~mkxudxkzxsy.v.wxtbs`pufb{igyrbnfqrlapg`{w.c}pewcread`ucbq.cfpps{}xkymyw``v\|ozcncohapsg.bg`qwa.{e~uz\|sqqweyfqavuzpamybqy{lpkvx`{plclfwdml`endpsug.riyegwwwmrb}xxvhjfq{rx}p~`furye`yv}vqvpre~{szxwndgqw}dsmq\|usj}{tq`.lfmouga~t{sqpuijpdwvk\|ver}c.bz..td{hv{a.myp.~ft{\|~dptzy{{`\|h{{gmkx{bs\|kug\|iu~r~\|adq~qrg\|juzpxsycp}f\|sr~guacxr\|k\|exubef}{qorlr~sawwa.uf{}w\|\|flbffbvfu.zs\|diwp}~lwadypvq{~oqzur}

C:\Users\user\Downloads\BPMLNOBVSB.png

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.936991678958394
Encrypted:	false
SSDEEP:	24:I8DfZBwyIBrVjixE9v8qRia70elZW1f33qhqt:lDHmN8Kv8qiP4iHqK
MD5:	B6A510A26480E97554818D3CD644B611
SHA1:	47E927CB000B69FE4C241E8199F841B7E1F72480
SHA-256:	A4AFCA894F2DEA2B8BE2BB3AAF8F9145257EC001941893A592AE4A0F3D5192FB
SHA-512:	43C50DF8C2FCFDBC9DAEC4123909B21BE8570EFDB27D29BF345085A1E6F27BEA64FAAB61C72C1E163F00A96030D1FAE55E89D667560DEF73EDD4BE53AB084C6A
Malicious:	false
Preview:	sbx{x~{afwjuggs~y`}ugzwe`dlx`bu~ssyzwtc.ivf}echuqdyw\|fys{.}rsj}}lb`pqrkq~~{pbv{sxbyp`dkdfrakfl{dwvn.ytcybfvdbtwwoemkacsjuys}o\|zfozyrgwvww{c{zctxl{upysljx}teg}dd{.wzcbqrdljapfy}{u.aiv\|od\|rgvl{zs{j{`uz\|bbtq.d{uzxhxtzmfd`xh`cxefa\|nacpte}oxcheu~zey.i.de`}ip.nxefyzgv}su~tcyv}}fypv{}q~}h{{fwttrdydynnzyycskx\|...pybz{bcyz~jynudj`b}rcv~zq}bxwaat.zbugy.ucmy`skd~s`c{gh~vvy{rnmpd}t}\|lywp\|syegt\|{\|~amtdesrg}k`cf\|sadia{awvfuraa\|ba{ys.vyzh~romzeqrqxyybgeptcs.bdcm`dqnthtpqv~o.b{pems..{`pqvxeabdwbbtwzxp{q\|zis}ftwdyvvcpwmffacbf.j{\|qtbxzd\|i.gedwx`ar\|u~xqruees}a~mdbiylmwxbqj``qo{fjppevgdej\|utnbc}gpyrk}~x{aqnhdvtsbuhv.ff`ymwy\|.lqqcbxxfj`ao\|\|vo`u.{zbcs}tsdyapu\|wm`xsf.qqggkqw\|a\|rcfv\|qcmgf\|j.adgawyo~zfu\|oyspv~pytzmzww.v.xcfb\|t.oyse~grdupbd}`vfdp{.awoxa{fhy\|qmwho~s{vjxnsuutm}xk`t~h.ycmm{\|n{}cp}qhexr}ahasbve~~`ktk.gitmdnuzdglq\|spoj\|gcqh\|zowgtvafavcak`xbnztcv~svqdmzwpvxszb`phw\|b.rdwymv`v{vspg.\|d{`{mt}ufb\|v`cvzuck`yggorxptpgtaudg.pj~gzielcutku.m{jz\|i.xbdfaevse}ub.oldsprvz{vthwauak.mdaaggchptv~fgatxpu}.x`uj{q~gg{\|s

C:\Users\user\Downloads\DVWHKMNFNN.pdf

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.942242596232926
Encrypted:	false
SSDEEP:	24:Uk7SZOe50qYsxLDARVEaYUaqNfXDVE4mAATEAB:z7iOe502VeEaYVqNfXJE43AIa
MD5:	4E6FD14005C7648C313F96E925692446
SHA1:	D1909A64392809F5EC206F1D689E1155A40EC8F6
SHA-256:	616753A4356E5E612D99D25A9CA659CB58083A469B3A1C452F0A0925DDC7D8F6
SHA-512:	AA3AE4277C74DFA22374957B97E7AD10B5B868EAAAB1608E93BA52DC949DE66269018653B723530CA06161F273DACAFCCAD2C6968D121B23FEA8E8456A4ABAE2
Malicious:	false
Preview:	udb.}\|wq{{kked~`taafrceoezn.~ery.miekkq..s.ferv.ot\|q.awe}agtgsz~ggvu}ruzrzbch~vrhv~`nvjbd{kv~zqcadzjkea}zhtplwi{~~kgeh\|zauwmcv.xm{y~{elduesshvxy~voea`o}.}ojx\|f..fto`gotsqtdnpne\|.\|xctamwg\|femb{dq`bwz`eyb.mr\|}oel}yumoh}crdgbye}`ktlaykzzjp}g}crkoxcavu.`ousymktposs~o.pyvy\|`jv{~id~evzc{dt~yxdw`yardk{.x~jug~}uytzffo`rp~ztcxegkoxdfs~`t{kbbiyg.{hec\|\|rsoyozpynm}q}pn`.`\|{}tku}~bcaakc~zvacfe`uctmtqa\|y}q}dg`.sd}vcvcatrlicnz.zax.`}grxeat.sue`y.~}}oruetynisfdazwccwabtzvgc~{xej.zei~.mjkh.`tidspawvdvf~~\|w\|vzfxaypafwwhcmem{.qyyk`tax}qtubqeftrbrrjzqc{agdxb~fv.}drcd\|{\|y`{ycwfbn}c~lfow.\|ahd`\|\|pus{`e\|}d}}vzbmgwc\|a\|fwsnw~dgzbgydtqdfruku`bu`lr~{ubqulsfxeqcjdf{k`rct{wvlq~kbrxhf.xgfjqt.}t.}\|{j.\|tibtcxbxcep{zzfzh\|pohg.rgz\|or~vm\|o~otucddfbxcs\|ktlr`vtbl\|yke.h`lcfc}gvs.t\|ampjjdtwhp}u`k~gstpyyh.~{perke.{f`at\|hrvdpfcsnvbxb{erc~v\|`i.lvysyex{dpyqkmbaco`ym\|vk.`ayzt~b}lmm{wauxafpdtusewzegco{ouxnrh`tb{vrgf}cfw\|d.qiebbsabavbgfuo`cmb~}\|ev\|v`qnbsf\|zb}qsaojbb.ax{e.hgxlgskjsybbegn.wkcgsbura\|iau`vvqo.ibhfzdgbobse`nygrvscqzshzc

C:\Users\user\Downloads\DVWHKMNFNN.xlsx

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.942242596232926
Encrypted:	false
SSDEEP:	24:Uk7SZOe50qYsxLDARVEaYUaqNfXDVE4mAATEAB:z7iOe502VeEaYVqNfXJE43AIa
MD5:	4E6FD14005C7648C313F96E925692446
SHA1:	D1909A64392809F5EC206F1D689E1155A40EC8F6
SHA-256:	616753A4356E5E612D99D25A9CA659CB58083A469B3A1C452F0A0925DDC7D8F6
SHA-512:	AA3AE4277C74DFA22374957B97E7AD10B5B868EAAAB1608E93BA52DC949DE66269018653B723530CA06161F273DACAFCCAD2C6968D121B23FEA8E8456A4ABAE2
Malicious:	false
Preview:	udb.}\|wq{{kked~`taafrceoezn.~ery.miekkq..s.ferv.ot\|q.awe}agtgsz~ggvu}ruzrzbch~vrhv~`nvjbd{kv~zqcadzjkea}zhtplwi{~~kgeh\|zauwmcv.xm{y~{elduesshvxy~voea`o}.}ojx\|f..fto`gotsqtdnpne\|.\|xctamwg\|femb{dq`bwz`eyb.mr\|}oel}yumoh}crdgbye}`ktlaykzzjp}g}crkoxcavu.`ousymktposs~o.pyvy\|`jv{~id~evzc{dt~yxdw`yardk{.x~jug~}uytzffo`rp~ztcxegkoxdfs~`t{kbbiyg.{hec\|\|rsoyozpynm}q}pn`.`\|{}tku}~bcaakc~zvacfe`uctmtqa\|y}q}dg`.sd}vcvcatrlicnz.zax.`}grxeat.sue`y.~}}oruetynisfdazwccwabtzvgc~{xej.zei~.mjkh.`tidspawvdvf~~\|w\|vzfxaypafwwhcmem{.qyyk`tax}qtubqeftrbrrjzqc{agdxb~fv.}drcd\|{\|y`{ycwfbn}c~lfow.\|ahd`\|\|pus{`e\|}d}}vzbmgwc\|a\|fwsnw~dgzbgydtqdfruku`bu`lr~{ubqulsfxeqcjdf{k`rct{wvlq~kbrxhf.xgfjqt.}t.}\|{j.\|tibtcxbxcep{zzfzh\|pohg.rgz\|or~vm\|o~otucddfbxcs\|ktlr`vtbl\|yke.h`lcfc}gvs.t\|ampjjdtwhp}u`k~gstpyyh.~{perke.{f`at\|hrvdpfcsnvbxb{erc~v\|`i.lvysyex{dpyqkmbaco`ym\|vk.`ayzt~b}lmm{wauxafpdtusewzegco{ouxnrh`tb{vrgf}cfw\|d.qiebbsabavbgfuo`cmb~}\|ev\|v`qnbsf\|zb}qsaojbb.ax{e.hgxlgskjsybbegn.wkcgsbura\|iau`vvqo.ibhfzdgbobse`nygrvscqzshzc

C:\Users\user\Downloads\HTAGVDFUIE.png

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.943725656860274
Encrypted:	false
SSDEEP:	24:EiXcvQJYGCIgRpzVVh1E+oC0fS1EJKy+ZOUd7wZtOn:EiMvQJYXNl/h1oLRGwUdsZtO
MD5:	54F60EA10B28914C04BD866A48120434
SHA1:	9D317146F5E1936402871FF3CF1AE9896901EE4A
SHA-256:	13A012D89F7BEF0E6203E18706B6E8C134151D0043FDF3C5C9632A5895F3F103
SHA-512:	029CF1DCA30708B9944DB6FCFBC2B391315FBDC02560AA9316471FDB3A713A7A605EFB7C540B05669A07325A15878730118BBA3225F89B5AB891FA1E6B8291BE
Malicious:	false
Preview:	yftp`u.b\|pttmr{fhhpbbc\|duitx~f{rmqrdsbu`{ytu.krrrsytzsw{gb.`{}l~a\|o~~b{}b{ov.utvixdvx\|tx`yqeceiughaf~~o`thm.lzp~zbq.ffurrs\|py.wecpm~cwlqw.cgw\|qdgaqreyyumuska`xjz`dsckvbo\|syp~j{pxxty}`{\|ynfw\|r`v}a.j~q.btzrpzmfep}dq`~q{td\|yjfooi{`ae{dzw.bwfxcg~{\|orvysb{zbr}cy}`a.c~}exc\|{o`\|fcufx}pgup`qtz}o`eaj~lmf}bd.geya}xv\|sekksun.pgmyhkobge}{o\|uaes`~f}rz\|tb{y\|wg{yqpgnhyfzght~ruoes{z.wv`zjv\|.ohckxv\|snta{uqeqqxvdayiw}rqhh\|od{t{bp}q.bczjvfg\|leylsdb}m.tapi\|h`fnrmmz~ijo~ygvwadb}zfczc\|~p}\|vz.a{{`dddpp~ezxam{wcwb{tgvgu~b\|r.hc`t`qtfzywu.stbbcn~hawbszoxiwgq.xczx\|a~oawsw.yapa~~zx~}ssgrvadc{}\|.a}u\|giwzxg~iwgzay}n}.yajpiuywvsp`t{f\|vfflvhj\|e~{`x~~t}ev{wo\|rfj~\|`r~t\|zdwstsbeblspapvgd{wrgwxy}as.slppd~zrxjobfy.b\|}lvtshbw{cgx`ecgyssqgurfqjc.vxu}pzfettzxv{fgenvhjxvwkddsx}oqe~}\|f.kdgstyzdpfc.bstr\|\|`rau..gcjempam.`t{vxr}hgkxc{u.{pdm.aqoqga}fbtxgff{aquit}r.pngw`bke~chcqrxhmyrnkdnty.bsfzc`e{}jmqq`eyvhjyp{axywcwfunaoogqave~am`fgbu`sab.xzpq\|h.p{ew}ct`r`m}p}s\|pymfw{{hc}c.n.lxgaljzwuvu\|mirqvc.p{t~lhftshbggdrf~\|gokr~xgpuan{uvb\|j

C:\Users\user\Downloads\JSDNGYCOWY.jpg

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.9241713610950555
Encrypted:	false
SSDEEP:	24:6NrLFNtuG3tyDvGUGK6MUpB2ow5wKhfKrB7XydlKIj28Masaf:6NfFNtuG3ArGUXwpZSwO8XDaf
MD5:	442F7BCEBC7B69EEFA06CFBF9D214C0A
SHA1:	587CCE88520987CF47A5039E1C36E4AA2646B897
SHA-256:	4D9CA0A42CB5A9B1DC17E88E9430F748555966AE33BB7C3642D860757E302406
SHA-512:	268D8222D5AE68AD7A392F668B49652E0545178C295A77FF25100366563136A5E4CB3BBC3D4865306B966967D27353CC6B109B883559BEED4F8BEEB4FF8BD53F
Malicious:	false
Preview:	{aqyqhzxblpxd{otuq~uc`aqo{t{wykrz`}h`pbgw`mn.rpb}ovzzbtxjfqh`\|mvuc.`fpoyuqjcz~rrakmesrz`q.sz~{mu\|kf}vs}dz~i{yttrrp\|yxfx.rvrn.sv`oojv~qoajcewd~o~nw`y\|`u}czy~edvrydy\|s{uu~rwxonovaeede~afz.mmqlu`rwa.c{d~r\|\|v\|~nsvvu{`xqdtstazhmol{vdp{zy.n}~{dxspzqylvc~yskz{`ksxjsrws\|g~gqol}r{aynzydx}h}rp`xra.`nj{p~f{quskyfadukctykkqzuqb~p.vapu}ij.f}nwapsewzyys~ec{fpttt{eqchc\|{bf}tfvaavpq.~\|p``vz.cvf`palizvw.{xqm`xus.{ej{qzxp{axzac.yqf.xfupyt`h}ay{{wouy{\|fpsr`ogrevqvbbdc\|tqdued`bpu~d.nbyl.yaq}t~xeeq\|yltsbcyligd\|pdvru}qrqgb~}egrqrutc~hfqhsdecelv{vafm~}\|ew~ybv{bz}so.`hqf\|}xwga}z.pbgc}.meyia}~vguygiymnaxhf{.vazm{~x~.gtactxrhdm\|txee~akwsjbp}dzp`~bbweebnaegqupcezwax\|sv`uupqbyzgcwucx\|r\|rwttcaeswqpuerfdpgivftew\|nuhkcjyt}y.sdwhs\|yhz`f.vkfqeyao{\|xzzx`k`.sp\|~yyuukm}ea\|tcayvf`njsfx.usceyfwvevpwefzzdvagsuzdu{~sp{ytqwav{zv`sey}x~itdvhgd{pucczxts~et~{dp}y\|zs`xdk`zv~f~g{lxxlh}m`wtd\|y}c{cz~~zqoatgrpyuwjpzi~{ezbq}dr~{~~\|~xzx`a.sgotpoegipcf\|{kv}uyzf\|pskmxmti}v\|v}kth`xwtt`.emc{jt\|`yu\|sgtw`b}axpc}p\|orbjhw`gr}cdphc.\|ybyfestzq{b

C:\Users\user\Downloads\KATAXZVCPS.jpg

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.941173070112748
Encrypted:	false
SSDEEP:	24:R926993Moyy/wIwMb5HjP84K0wFVIW8Oc/Jhp:R926X3Moy3MlDP8iw7yOchH
MD5:	3FEE51B980A650924530A248376C74A1
SHA1:	10C4D5D8F581ECEAB39989F1B547A76E45ABC373
SHA-256:	2231C12F39DB9271BC7BE48B948D342605012A5A68187F36FE37972DF6F38B0D
SHA-512:	C9F95A5EC80AF0D91BFFCCA1A081152053DCA9D27887A97819CA8E366BAC0F76E1DB92CFC62FA95076F2D227C8E2F00B4535C5377104EBBC442FEBE1DAC6E797
Malicious:	false
Preview:	zsavnkotef`wywjuf{rqy~au{`lqtlkdrytc}..}xyessr{tzlh~d`lzzbs{k\|rqqfzy``.zplhwpet`cyqpt~ngf{ugqmqzdk~dacr}owvv.xoefppda.nxajspx~lewwqeabu`beur}cmbupabstaad`{yejvq\|y.}lxualovqggujsuojusfq`vrua}vtr`tc{zgbxde~`yotfg\|fuq.w\|hzxbkd{d~sgo\|tvnnqtvssa.`r.wscydxhbzqnydweuesdb~da`~ll`b.mj.fdyagm}d.cxye..eg~pqzngv.gsf}{b\|\|~{qavte`v\|sgemzusb}\|u}`.u{ak~{pcrdzv{`wsmkvgsgtjsd}xtoyb{udaiyy~ydxc{attp\|dfnog.vydcaccygupd.eck~\|.`yi{dp.}fo\|.jtm..`g{eb}pfudkdtiab}\|bhstwbvfel~fq{c{}vgdp\|p.sopzsd.~}f.s`tomsyprmbv}mfrc~en}gg}cny.qqaaq.pjp`\|c`}pmg`wzbctr\|n{o`w\|qeifftxrzf.zkzcw~fux.v`ql~ezlvcfjjvgodx`s~~kltehvmb}jcygze.zbetk`pyiodl~tumumcxhsfsww.~vaf}ony`zmu~avif{p.w{zg\|zp\|gw`y\|deybprbwttdlp.}ge`{f`~y\|jz{.{`bw\|}bpnigszeg\|yd.ucq\|w.bbfl~kf\|uxtxp`dacemo{ke~id{gxqextroup{gpjvs}otw.~ctyo`xr}c\|elgxn`}hx~i\|u~n.zauy`je`vrzkt}s}uca.\|xs`ylganq}w{g}gxtxfbhtqsujgghu~p~aifbcck\|erw\|gt}j`d`c~vw{oncm.pf`bqaia`ubaucbpbvacfr\|j`}id}yvrp{t}.tlalvbkymnyb`eu\|ktarw}.bz.v\|utgbp..yw{~~}.}otpec~qcxp\|h~k\|xs}z~\|p{yudlfsauuzuzrec}qwt{cx`v.`hxw

C:\Users\user\Downloads\KATAXZVCPS.xlsx

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.941173070112748
Encrypted:	false
SSDEEP:	24:R926993Moyy/wIwMb5HjP84K0wFVIW8Oc/Jhp:R926X3Moy3MlDP8iw7yOchH
MD5:	3FEE51B980A650924530A248376C74A1
SHA1:	10C4D5D8F581ECEAB39989F1B547A76E45ABC373
SHA-256:	2231C12F39DB9271BC7BE48B948D342605012A5A68187F36FE37972DF6F38B0D
SHA-512:	C9F95A5EC80AF0D91BFFCCA1A081152053DCA9D27887A97819CA8E366BAC0F76E1DB92CFC62FA95076F2D227C8E2F00B4535C5377104EBBC442FEBE1DAC6E797
Malicious:	false
Preview:	zsavnkotef`wywjuf{rqy~au{`lqtlkdrytc}..}xyessr{tzlh~d`lzzbs{k\|rqqfzy``.zplhwpet`cyqpt~ngf{ugqmqzdk~dacr}owvv.xoefppda.nxajspx~lewwqeabu`beur}cmbupabstaad`{yejvq\|y.}lxualovqggujsuojusfq`vrua}vtr`tc{zgbxde~`yotfg\|fuq.w\|hzxbkd{d~sgo\|tvnnqtvssa.`r.wscydxhbzqnydweuesdb~da`~ll`b.mj.fdyagm}d.cxye..eg~pqzngv.gsf}{b\|\|~{qavte`v\|sgemzusb}\|u}`.u{ak~{pcrdzv{`wsmkvgsgtjsd}xtoyb{udaiyy~ydxc{attp\|dfnog.vydcaccygupd.eck~\|.`yi{dp.}fo\|.jtm..`g{eb}pfudkdtiab}\|bhstwbvfel~fq{c{}vgdp\|p.sopzsd.~}f.s`tomsyprmbv}mfrc~en}gg}cny.qqaaq.pjp`\|c`}pmg`wzbctr\|n{o`w\|qeifftxrzf.zkzcw~fux.v`ql~ezlvcfjjvgodx`s~~kltehvmb}jcygze.zbetk`pyiodl~tumumcxhsfsww.~vaf}ony`zmu~avif{p.w{zg\|zp\|gw`y\|deybprbwttdlp.}ge`{f`~y\|jz{.{`bw\|}bpnigszeg\|yd.ucq\|w.bbfl~kf\|uxtxp`dacemo{ke~id{gxqextroup{gpjvs}otw.~ctyo`xr}c\|elgxn`}hx~i\|u~n.zauy`je`vrzkt}s}uca.\|xs`ylganq}w{g}gxtxfbhtqsujgghu~p~aifbcck\|erw\|gt}j`d`c~vw{oncm.pf`bqaia`ubaucbpbvacfr\|j`}id}yvrp{t}.tlalvbkymnyb`eu\|ktarw}.bz.v\|utgbp..yw{~~}.}otpec~qcxp\|h~k\|xs}z~\|p{yudlfsauuzuzrec}qwt{cx`v.`hxw

C:\Users\user\Downloads\NWTVCDUMOB.jpg

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.930818611892816
Encrypted:	false
SSDEEP:	24:C9qyd6NWxjwt5IcATJd/eA+gdSgHkuq9yWMfFP:/Wrxst5LATX/elgHxq8t
MD5:	35DA0E6A73175C1EBB4BBAC516DA1329
SHA1:	7438FE68FD89FA558D944A1C42BAF0C9E0E80729
SHA-256:	D0637AB4266F2191B69C41BE9909E67C2859234E5E3C5F5316A933D80341BEFF
SHA-512:	98B3FD1BFFEDCBBDFC169C4A8DF8A6924817C885F870CF7C9484C0417FE297F00E987799C73EEB88A78AA5754A0D03E54A824060326FC09BC13047C2CA89FCC8
Malicious:	false
Preview:	.eaauulzzwlceeibzjf\|x.rg\|imrxez}nxztycqetdr~e{jadgucznkskwnab}abw{.~ymtg\|r}dz~dq\|kprp}w}f}tgcr``fvyevjpq.vottbh~szm{qv~jvb}zsbr`fxmcy{~wdjqdbzf\|zro.davxs\|\|.v`}.dfpberxbtcueuywaky\|babonpd~osmo~`fyqytta~g}~b}lt}r~ir{qb\|q}v{}culxrsg{}ao{kbyae}yya}cv.rzzvu`xn\|fx`hdtevrf`~`qsrme`qh`q`dcdv{cm~zppfs`tu}en}xvzmwim{rc}tbwi~xhp}xwdny}nrxf.ibvoj}{uat.d{gg~ewamztr{wxuqdk`ot}{hrxtlvxzq.xyuivclsoiv{ygwdosaq\|qa`e.gme\|tdoms~ydkqxx}{z\|gv\|i~dyovx}fr`u.tsrpv~qeucs~vesbqzk~pb.jqa.gnuvevxy}~xsbfafvdfsu}\|{}nyeerfyqbqu}g`dt\|slanuv{ozb\|ogb\|t}ugatyyl}fduxczsy}t{fcksmo.r~zz\|\|uwuuvaaawvc}xfui.cry\|{vvvp`n{gxs~vn.ss~cwfbjiu`xcfauwev\|`r}`y.\|}a}m~yer}pgheo~.q{g\|qvvr~b}.ng\|zrg.jwa.y.\|fcclrazzqmf~s~.w.u}vsropk~vto~popopyyt`dysqx\|o\|qs~emmoywyug\|sq`rkab\|zw.txqsqwdwcp.ee\|a\|`fwxo~}{qqgbwef~eum\|ca\|evmke~`.dfxrtn`ty\|aiy.wz.aqsbfyxpwun~yyygxdnb{~ra`ut~fckbv.~gefkae{caz{b}ypmmzw}gmpzpes~zx}mtc`j~ydpb\|qbjet`g.dp`}kzpslhqsg\|patvjuhse~{{m\|rwitbmu}vbd.qq.}ztq}faxbg~aj}z.djonyblm{.iqounb}pcfs{{zexinz{tje.qz}\|\|gya`v\|fpvyzlivera\|f~x

C:\Users\user\Downloads\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.930565775245372
Encrypted:	false
SSDEEP:	24:wkwvcp6U1Bf7KdqI0qEdiDybFQ+WywU6yhOwy4:Mvcv1lWgdik1s9wy4
MD5:	37D4B66418541B22320B95DF35F5753A
SHA1:	AC699928F847B503DBF34F18553F24CDB16D0D4E
SHA-256:	F11CB588DD176BBD4FB6C047E740893CC039D8F1B59402C014A19B961C43709D
SHA-512:	73BBACFD99D469916E2C4FA145DF6F7E71E9CC157DB65B553B09DAAA61B76F8D25B97E2944C9857BEB575917DFA53F238F829AADC2DC54652998AEB93393A5CC
Malicious:	false
Preview:	~\|wfu}`de`zwve{{ukygizerx`w{.o.kt\|`a\|jm~rhwb~h}oepup}dyekcdfy.r\|~{lqssawvl\|sz}{.phpgbfccbq.cqx`..qo\|r{\|}yitag{ufz`qqdzfcf\|tp.hzfwzbi.{veepo{ug.ntcidy{~tcaqtf\|pztsaxnzqrsx}avebdp.fwzh`\|nu{zrgrwx{.sfhm{`.pm\|cnmctbageldebrdr{x{f\|`ybote{ljbgg\|\|.{xcouwn\|.lirrrv\|.`d~ts\|dcpyvg\|pqsrsx\|zi`zroqgqale}fqvvg{ubfvplf}xx}y\|nrtbqzwumyhyfeydkyrokpcaspytqsvbmvy.ispwqi}fsqtk.qevm{nhrpyb`qt\|rw`qe~\|ypd.\|{s{eucuc`adarqpgp\|svl~.wb.vqksth.}s~eg}\|wcotbz~mkz.e}rwfomez`ys.a`uftudzxgkgd.ndjd.pkzr.ph~f{y}.fz\|kqosb.yfzocqv{htewmfv{ccqnpgdmt~tp~k``\|\|~xy.c`eclt}c~qexdp`br{\|zwaizuwf{.f}{kgnzbv{ffyptx{tfdoszy.sxfhvpavk.}wcqvch}~crg}w{rqq\|bxvt\|\|shedlnea}`bopwdmpp`jzeps}}.vjpyf~xtsyvbgvqbkoqskn.lqtbsa{zxjz~\|f{trrty\|.ipds}c}uawhplg{ecuwswrtnu.ydq~t~zzqbmtd`\|aq.ttu}..eh~mufs`qg}ppm}ftkxg}kptqxzzr`siebvzgcc\|`~}bbakmmwnjzdytp~dgzaf\|tvntbw~vrnqshgmwtkxntban`vpvvx~x`apg`xxvt.h.foy}splk.d}{itsqrt\|yot.apbtztw{f~arcngvxes.pfpkte}n{z}lb~wnzmbh..rq{b}e}tx{xpht}gwyi{ml{}yrvxeesldrz\|bs.mlz}wabsihmfertf~qsuuwpx.bzjywy{xb`np.vqef`dp.gt

C:\Users\user\Downloads\UMMBDNEQBN.docx

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.936865080324893
Encrypted:	false
SSDEEP:	24:YhFkSGZ7zL9NitoPJLQ2aeSqEnrlHrQ8Gzc5ttEdJa:YIDHL9qoPq2fKprBG4Ca
MD5:	C9AEBF8842AACD9B7E568D86FE5802C4
SHA1:	01FAF29DC6C1CCD27E8B962847C57502A1BA85BA
SHA-256:	42A564C57A9E954C435EC0C3F81CE5775BF609BF2A040181D33A06B4060C37E8
SHA-512:	AD7E3F2A402589AD2465E9F358EDC31E5718AB813D5CD0C45D960330F98C2EE098AAFC6ED3408F4D10F3064E1DB778AF8CA729075B5E9A98E9867EF7406B4A47
Malicious:	false
Preview:	d.xur.\|fw{nzzvvuzkmssym`{`s\|l\|kgvzk`\|tohsyt{.x\|zpbyufqhfw.msxjmy{`{pzmo`smksey~iax\|cxc\|zcg`cg~btgfzwc`gpbrqaypoeb~.hwgff~\|dawr\|qbomp~u~jbtphxgzxtk\|rxrud}eqwyy~shx.`wwl\|loyyrsmcyus`cbmtyfpgwgmt.c\|th~pczhct~gogry}uysqd~pa~p}cowa~vat\|yu}ifp\|}wfjgdshrtfcb\|d`{pzkqxdvp`xv\|~svnardbvhvmbxfsr`wzfdbrjmlhgyx`xeer`wbm\|qvyercb}{uqjy`bt\|soeyqota.hspqfe~zd~{}lq`ratzd.bw.dbabfpax~eceztm}o~\|waiwt.uu\|{dmcyqyfvjg~tddstywi}.~owtawvchzzbsw{`beufccuw{zzwez{`kzxgrvk{.byb}pr`qecvf{z{wdkevfuu}{{tvybwa~agwsxem~hpelw{zzabfjt\|qyvcly{vfeakvyaj`al{up\|prwi~z~.a\|x`rexmd`pu~{{j.bfub\|uqhyxga\|xrf.f\|.y}wju{ptwvvxbv~oxqtgsmk{yqz`g{{sriafvpipeaz~tw`}h.frqdq~~\|.fn{u}ja\|.ed{bxvnbslsjezbj}}ccckm{lykmm{}w}avbkuyyxhfg``{xywjaec.v.c`ee`fmas`zm{u.\|x~\|he}fuvez\|~accwujelvctuu\|d`~q.dx..w~uozocvke\|ksqnq\|\|c{m}\|oxwxykf`tk}b`e.pmdltgezehccfwjoqcghrgdbytmabtpn..scqr~uc{g.dfm.aketgdegrb{cpc.uvqelkb}{..doqdtoxgxzb}{{~}s{s{z}t~`j.~ym}u}jz`pdab.pezzrqarpff.jbt{~u}hoankoy}vqbnm`\|.xyc~hz~dv~}~`okywoa\|qq}vc\|f`.ra\|rjp{g\|ecbrt}aycqskogautqcacaq{~

C:\Users\user\Downloads\UMMBDNEQBN.pdf

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.936865080324893
Encrypted:	false
SSDEEP:	24:YhFkSGZ7zL9NitoPJLQ2aeSqEnrlHrQ8Gzc5ttEdJa:YIDHL9qoPq2fKprBG4Ca
MD5:	C9AEBF8842AACD9B7E568D86FE5802C4
SHA1:	01FAF29DC6C1CCD27E8B962847C57502A1BA85BA
SHA-256:	42A564C57A9E954C435EC0C3F81CE5775BF609BF2A040181D33A06B4060C37E8
SHA-512:	AD7E3F2A402589AD2465E9F358EDC31E5718AB813D5CD0C45D960330F98C2EE098AAFC6ED3408F4D10F3064E1DB778AF8CA729075B5E9A98E9867EF7406B4A47
Malicious:	false
Preview:	d.xur.\|fw{nzzvvuzkmssym`{`s\|l\|kgvzk`\|tohsyt{.x\|zpbyufqhfw.msxjmy{`{pzmo`smksey~iax\|cxc\|zcg`cg~btgfzwc`gpbrqaypoeb~.hwgff~\|dawr\|qbomp~u~jbtphxgzxtk\|rxrud}eqwyy~shx.`wwl\|loyyrsmcyus`cbmtyfpgwgmt.c\|th~pczhct~gogry}uysqd~pa~p}cowa~vat\|yu}ifp\|}wfjgdshrtfcb\|d`{pzkqxdvp`xv\|~svnardbvhvmbxfsr`wzfdbrjmlhgyx`xeer`wbm\|qvyercb}{uqjy`bt\|soeyqota.hspqfe~zd~{}lq`ratzd.bw.dbabfpax~eceztm}o~\|waiwt.uu\|{dmcyqyfvjg~tddstywi}.~owtawvchzzbsw{`beufccuw{zzwez{`kzxgrvk{.byb}pr`qecvf{z{wdkevfuu}{{tvybwa~agwsxem~hpelw{zzabfjt\|qyvcly{vfeakvyaj`al{up\|prwi~z~.a\|x`rexmd`pu~{{j.bfub\|uqhyxga\|xrf.f\|.y}wju{ptwvvxbv~oxqtgsmk{yqz`g{{sriafvpipeaz~tw`}h.frqdq~~\|.fn{u}ja\|.ed{bxvnbslsjezbj}}ccckm{lykmm{}w}avbkuyyxhfg``{xywjaec.v.c`ee`fmas`zm{u.\|x~\|he}fuvez\|~accwujelvctuu\|d`~q.dx..w~uozocvke\|ksqnq\|\|c{m}\|oxwxykf`tk}b`e.pmdltgezehccfwjoqcghrgdbytmabtpn..scqr~uc{g.dfm.aketgdegrb{cpc.uvqelkb}{..doqdtoxgxzb}{{~}s{s{z}t~`j.~ym}u}jz`pdab.pezzrqarpff.jbt{~u}hoankoy}vqbnm`\|.xyc~hz~dv~}~`okywoa\|qq}vc\|f`.ra\|rjp{g\|ecbrt}aycqskogautqcacaq{~

C:\Users\user\Downloads\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.938072176856892
Encrypted:	false
SSDEEP:	12:nOqQ4Lwh74tvIBvXYchI5aakrlpxElnbB/AANQ4pu7VIwfeWDlgwZmXA6/1xsH4x:TQ4EDBvXfS5BEMnVze57GwdQL1bdV+HC
MD5:	FC5D88555A4781662E12D72620E6B4B6
SHA1:	73ED6C1F5B188D67E2705E88D3FFC9EE7D1B707D
SHA-256:	B61553C30E2EF648A00854F8CEBA3AC39C996E4B44BCEAA4DD221FEFD836AE99
SHA-512:	CD6347AE2245BF6770E3CE889099508642B5DD760C331EC410B5FDF1CC4E92253F7A77BB3A2E271999CF22FE99BD4CDB5DF17115F60F6D587DB2FAA7A00008FA
Malicious:	false
Preview:	g~osqdrbao`x`athpes.ew\|u`yopeow~r`nu~zr{`ccnxdtbtztqygphkfe{iw{~zxjb}qyvrnohwgy~\|e.c}{sxy}szp~z{zwz\|kbc.sd}{}`bpdvmkusgab~}tpfqopl~jcr.hfcywip\|bwxvnvv{vdx`yc.mtgjvsfztnfbmuf{wukqfqbu.ozgvr~mz\|ul\|gyuvgp.fr~b.x`wbvdgpubdbgsato{u}d{a~ye}rdqkysw~vzwhqvdwwexm{c{qv`~w\|vykcs}g~pudz{x`vq}u`zukadfgsd``te`qvw\|p~{gpmzpywaqpjt}bzhhh```u\|t`w~x}m.sd\|gykz.vugid{zkjpybs\|u.~vhv.{vkawybdnl}`gk.cvy{n{spbz`naeeb\|tgrigvfnxkvpvdiyudyuuseevqdpfb`zc~aurultfgvcatv{whogyg{k`wv{spstgyfqtgcxboramw~ch}ouwhlydsiuxfp~}ryqugajdf{p\|d\|`lb.ctqmt\|xcxcw`r.y}nm`kyz.zsxd`whxw}lxk}fgv.se}dthv{g.~q\|bp.qts{~qbw`kzsbxyq{prctrmzuqagwaxzsqmsxwoz{orru}mdkbfzeesntksgxbt\|~\|vztufx{.{`rwzvagpynfqjyt}ut}yaew}gaovcbrm\|wwx\|czctf~igzx}iumluxy\|gdcg.ue.a~dzyvdl}~hvtbecg\|hkpgqmdd`vqj~gau.eaabjqp}~d.ga\|u\|..hhxqwujxaoji}c`puggtk~ez}ec.c\|`\|qa~zbpc\|w`rz{crxavo`dfkajh}~kxrqn\|hzml`xf{~gws\|u{.rgb`lfblspmc~u}u}he`wsssafbf\|{brze{`g~~}pybfnqg\|z.mvustfzja~s{zgrcrxmky.t`t\|n\|tt{\|\|fi`{yy}`vjvsaqbux`g~gce}p~q~ziqy.xf\|cz{rsngaxa~zrjq~e~dk`cqzujx\|sj~}w{cjk{d

C:\Users\user\Downloads\VLZDGUKUTZ.xlsx

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.938072176856892
Encrypted:	false
SSDEEP:	12:nOqQ4Lwh74tvIBvXYchI5aakrlpxElnbB/AANQ4pu7VIwfeWDlgwZmXA6/1xsH4x:TQ4EDBvXfS5BEMnVze57GwdQL1bdV+HC
MD5:	FC5D88555A4781662E12D72620E6B4B6
SHA1:	73ED6C1F5B188D67E2705E88D3FFC9EE7D1B707D
SHA-256:	B61553C30E2EF648A00854F8CEBA3AC39C996E4B44BCEAA4DD221FEFD836AE99
SHA-512:	CD6347AE2245BF6770E3CE889099508642B5DD760C331EC410B5FDF1CC4E92253F7A77BB3A2E271999CF22FE99BD4CDB5DF17115F60F6D587DB2FAA7A00008FA
Malicious:	false
Preview:	g~osqdrbao`x`athpes.ew\|u`yopeow~r`nu~zr{`ccnxdtbtztqygphkfe{iw{~zxjb}qyvrnohwgy~\|e.c}{sxy}szp~z{zwz\|kbc.sd}{}`bpdvmkusgab~}tpfqopl~jcr.hfcywip\|bwxvnvv{vdx`yc.mtgjvsfztnfbmuf{wukqfqbu.ozgvr~mz\|ul\|gyuvgp.fr~b.x`wbvdgpubdbgsato{u}d{a~ye}rdqkysw~vzwhqvdwwexm{c{qv`~w\|vykcs}g~pudz{x`vq}u`zukadfgsd``te`qvw\|p~{gpmzpywaqpjt}bzhhh```u\|t`w~x}m.sd\|gykz.vugid{zkjpybs\|u.~vhv.{vkawybdnl}`gk.cvy{n{spbz`naeeb\|tgrigvfnxkvpvdiyudyuuseevqdpfb`zc~aurultfgvcatv{whogyg{k`wv{spstgyfqtgcxboramw~ch}ouwhlydsiuxfp~}ryqugajdf{p\|d\|`lb.ctqmt\|xcxcw`r.y}nm`kyz.zsxd`whxw}lxk}fgv.se}dthv{g.~q\|bp.qts{~qbw`kzsbxyq{prctrmzuqagwaxzsqmsxwoz{orru}mdkbfzeesntksgxbt\|~\|vztufx{.{`rwzvagpynfqjyt}ut}yaew}gaovcbrm\|wwx\|czctf~igzx}iumluxy\|gdcg.ue.a~dzyvdl}~hvtbecg\|hkpgqmdd`vqj~gau.eaabjqp}~d.ga\|u\|..hhxqwujxaoji}c`puggtk~ez}ec.c\|`\|qa~zbpc\|w`rz{crxavo`dfkajh}~kxrqn\|hzml`xf{~gws\|u{.rgb`lfblspmc~u}u}he`wsssafbf\|{brze{`g~~}pybfnqg\|z.mvustfzja~s{zgrcrxmky.t`t\|n\|tt{\|\|fi`{yy}`vjvsaqbux`g~gce}p~q~ziqy.xf\|cz{rsngaxa~zrjq~e~dk`cqzujx\|sj~}w{cjk{d

C:\Users\user\Downloads\WUTJSCBCFX.pdf

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.9507220049371385
Encrypted:	false
SSDEEP:	24:QsD5EROeoVH9txjTKr3YXxNkSQ1/Kite/vruQSenAgCfXJ:QshV5lLk9KiWruQSeCfXJ
MD5:	7B36984F9548618E7561EB00C5311C74
SHA1:	DD903AC81B25EFCB1E6553134085BEA95211DBF5
SHA-256:	747FA6767A71C82E19B8C9BE0082B717898874CF41EBC2D61B9CDFB825253183
SHA-512:	4B2C31F2DC25424024B38E034C07E2142E68F55AACC6B1894914C7AD6B6A4F9A0F28091102A216C07BAE14B4A7EE37F117FE204905E4A6C6DD8C1EF449683F8C
Malicious:	false
Preview:	fga}er{tsmv`rc.~eun.~ccara.ys`ucfurd\|jy{\|jdeycob\|la}fcy.}hcykbpvr~rreqtezz}\|t{~styzctgixqv}{az\|w.ftquudubdjesq{bxrbhcqdytyw}xc\|sllnuxl~~asafcvwxr`ibpdmivb.t~jxgbygcr`vna{hibrwbjt}`xhebl.hpetn.mew~hczusa\|sebjxv.vjesluwze\|ejydtizarwwzs.sw{g.`gxmq.sl\|}}pzm~`p\|aqfb{wb`uu}cdp.mevbydbivawnzuiafobzvs`dhycj\|}x.}{mttvt}~\|nhc}nxkgzt~\|msemo``c{fhyahdb.obdhal~n}u`w}jkd.`krxd~l}l\|izuxbjez`xbvqd.ukvdw~{qayaxxqzku.zn}r.xptiswzaswtr{glsz~wffllu~sjtjdnaicrxwh`fmsrbqdy`cb\|jp``qzwcvyeu\|orstssqahc.dthk{mfad~xspe\|y{.baorwqqvwlfrcaguwzrk.pq~.tuqg}.fqaty{qqcvbmyut.bmiqc}kazsrgkfcq\|crry\|zbfq`aetmevur\|lijgbz`jg{{qx{.~v}eap.nnoghgxcyucbafk~}goh{sdamu`rqdukxr`amrdymbq`p\|}}jxtyfa~}\|oyyi.ldhjsskcc\|xudesayg`z}prqvf\|~ubacewguts.drcv`bubqdsorbfygw`\|yftt.avvuxztucafz{yzvy.ki}~svtkqfewdrcx{n{oh~b~ih\|xaev\|r\|s.z}~{zg\|va}wgbwwt~~tgqyt`pjravvphg{whpebban}zuev~rpbay.~k}mpfpybprpqspy{}eeysgmo.{\|lxwdm\|\|decuyewfazvorvwzysppgqexzwewf\|breb}rcgs}ypvoyax.srhqp`v\|punivgd.usbeftd}dztabcz~.kgub{\|g}pbtbv{~dbf~uu{.jw.ms`xpycg.kdfajpkuy

C:\Users\user\Downloads\YPSIACHYXW.png

Download File

Process:	C:\Users\user\Desktop\run.exe
File Type:	zlib compressed data
Category:	modified
Size (bytes):	1026
Entropy (8bit):	4.940902937007019
Encrypted:	false
SSDEEP:	24:eqgZ2xBD1HqbmGkvzZd+l3hf9jtf8vuMkMYPtlELF5bJNG:eix51qmGgMlx1OW9ZPtlUdI
MD5:	E3BB78DC32B75F14FEB47E950A968C42
SHA1:	12AF7D9E2A342319DAEC8F80AB9E59401E5A9D85
SHA-256:	6355754B2F78684A535AC85B21C4829A8CDCBED37FF9ED7E7BC7FBBD0B897804
SHA-512:	FE6E94FE71B78B7322560D0C28684A7559DFDF658E68F9A355EEDEBC09D175FB53E35C7D9B46F36F922256EBF44DC88582E26DF205D8879BA3A6B5CDA09D439F
Malicious:	false
Preview:	hbf~wrqnmb\|\|v{y~xq}ihy}\|{v`~owa.}gm~sfms}s~pbyr~oobcmyzsxtyaz`bp}y}rpltttfukjdxzrjeer~.acm\|udnv`~u{e.pddubo}m~p.brv}y`tqbddyc{}nb{ogysrkp{\|st`s~dfmmc`m}\|z{.gu\|d\|ag~`}.fao\|ed\|bfk`bb.boeeyptcehz`av}akes.dm.yw\|c~o\|g~qq}cztxfzqosuauoskd~r~~jfoaigw}uehdqrnrzesfgz}qpwqrsrnqzp\|pvutu\|yracu.g`t\|a.el`e{mhtb.{ag}{whk.c`turg`juydqxkyv`bnz\|fkpzf.dcuovvtlot`{eo}q.{nigx`fzygcupu{gv{mr\|{`g`gbezc{ectxott`d~byfp{{bid`ure.yb`i.gn}~wfot`bv`\|iketdq.vbnhtszwde`no~ktd{mj{gv~f\|oype.areiyvoh{dcaeefur{wvzsvqevtlyvzzyaqz\|g}wxbii\|rxl\|}}ku}fbe~tc}fp~yx}~`vrjzcg.}hgg{w{oyoe}~yymvhsb}ch}f\|snav`kbvqvegfevsgsbaxi}lctjsaqpxacdwufqtym\|\|mr}a~mkxudxkzxsy.v.wxtbs`pufb{igyrbnfqrlapg`{w.c}pewcread`ucbq.cfpps{}xkymyw``v\|ozcncohapsg.bg`qwa.{e~uz\|sqqweyfqavuzpamybqy{lpkvx`{plclfwdml`endpsug.riyegwwwmrb}xxvhjfq{rx}p~`furye`yv}vqvpre~{szxwndgqw}dsmq\|usj}{tq`.lfmouga~t{sqpuijpdwvk\|ver}c.bz..td{hv{a.myp.~ft{\|~dptzy{{`\|h{{gmkx{bs\|kug\|iu~r~\|adq~qrg\|juzpxsycp}f\|sr~guacxr\|k\|exubef}{qorlr~sawwa.uf{}w\|\|flbffbvfu.zs\|diwp}~lwadypvq{~oqzur}

Static File Info

General

File type:	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.623184548175158
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	run.exe
File size:	6'138'219 bytes
MD5:	cd860c78e0374dec3a2b1a73507fce4a
SHA1:	3f3bfa99784864377725873c23a13bb1045c92ae
SHA256:	ad3129449969566ca74bbfe8a4e2a0a551d2725b1d1f9d5bcce4e9dd476927b5
SHA512:	951cd4c4eb66a0b49f3308550c2fbb867f20644551eb042ba97b94bdd05f7c127c856f71af31582f465bde23535bdbf0308bbdfeb3c93c6a8a5db1e8901c4922
SSDEEP:	98304:Dovppi1bEY4yNd0kJ4P5rzGz+sULgfvINhm/r4O:6pJM0Gzu4Izo
TLSH:	4A568D03F5A4186CC99BD234475FA336B7397C894632FEBB06B197312D12A92AF1C758
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....{Og..F.;L....&....+..1...F................@..............................G.....W~^...`... ............................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x1400013f0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x674F7BE8 [Tue Dec 3 21:45:12 2024 UTC]
TLS Callbacks:	0x402b45f0, 0x1, 0x402fc190, 0x1, 0x402fc160, 0x1
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	0beb20580cf4d48132eb5e44756f3352

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [003EF8A5h]
mov dword ptr [eax], 00000000h
call 00007FA5E086460Fh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
call 00007FA5E0B5F4A4h
dec eax
cmp eax, 01h
sbb eax, eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007FA5E0864869h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push esi
push edi
push ebx
dec eax
sub esp, 20h
dec eax
mov esi, ecx
dec eax
test edx, edx
je 00007FA5E08648F0h
dec esp
mov edi, eax
dec eax
mov ebx, edx
dec ecx
cmp dword ptr [ecx+08h], 00000000h
je 00007FA5E08648BAh
dec ecx
mov edx, dword ptr [ecx+10h]
dec eax
test edx, edx
je 00007FA5E08648B1h
dec ecx
mov ecx, dword ptr [ecx]
dec ecx
mov eax, ebx
dec ecx
mov ecx, edi
call 00007FA5E0870402h
dec eax
test eax, eax
je 00007FA5E08648BDh
dec eax
mov dword ptr [esi+08h], eax
dec eax
mov dword ptr [esi+10h], edi
xor eax, eax
jmp 00007FA5E08648C8h
dec eax
test edi, edi
je 00007FA5E08648CEh
dec eax
mov eax, dword ptr [003EF878h]
movzx eax, byte ptr [eax]
dec eax
mov ecx, edi
dec eax
mov edx, ebx
call 00007FA5E08703B7h
dec eax
test eax, eax
jne 00007FA5E0864867h
dec eax
mov dword ptr [esi+08h], ebx

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x467000	0x2124	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x41e000	0x15d98	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x46c000	0x4128	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x3f0880	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x4677f0	0x6d8	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x31cf28	0x31d000	a748db36c8d23677fc6a78df81b4c7b4	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x31e000	0x6d0	0x800	a1e16c024876d4561360f8d9981f2cd0	False	0.23779296875	data	3.0078000585778706	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x31f000	0xfe060	0xfe200	548448098b5e46cf432dd0ad859eda29	False	0.5148276100590261	data	6.571909107804565	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pdata	0x41e000	0x15d98	0x15e00	6182c2834acb5deb2ef8fb642ad262fe	False	0.5369866071428572	data	6.31256185529977	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xdata	0x434000	0x31d54	0x31e00	24f2638703b98c2b55350f37823355df	False	0.34884085213032584	data	5.598172589272297	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x466000	0x300	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x467000	0x2124	0x2200	3e9a2577cc47d16a6dfe34948ac79428	False	0.2751608455882353	data	4.309001678495831	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x46a000	0x70	0x200	74e87cc4ed396c71e2435d0dd2d99450	False	0.087890625	data	0.4682536837112152	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x46b000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x46c000	0x4128	0x4200	3f647b1dc6c90fa355c29b202b2b3d7d	False	0.4470880681818182	data	5.450550687495717	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
advapi32.dll	GetTokenInformation, GetUserNameW, OpenProcessToken, RegCloseKey, RegCreateKeyExW, RegDeleteValueW, RegEnumKeyExW, RegEnumValueW, RegOpenKeyExW, RegQueryInfoKeyW, RegSetValueExW, SystemFunction036
bcrypt.dll	BCryptGenRandom
kernel32.dll	AddVectoredExceptionHandler, CancelIo, CloseHandle, CompareStringOrdinal, CopyFileExW, CreateDirectoryW, CreateEventW, CreateFileMappingA, CreateFileW, CreateHardLinkW, CreateNamedPipeW, CreateProcessA, CreateProcessW, CreateSymbolicLinkW, CreateThread, CreateToolhelp32Snapshot, CreateWaitableTimerExW, DeleteFileW, DeleteProcThreadAttributeList, DeviceIoControl, DuplicateHandle, ExitProcess, FileTimeToSystemTime, FindClose, FindFirstFileW, FindNextFileW, FlushFileBuffers, FormatMessageW, FreeEnvironmentStringsW, FreeLibrary, GetCommandLineW, GetComputerNameExW, GetConsoleMode, GetConsoleScreenBufferInfo, GetCurrentDirectoryW, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetEnvironmentStringsW, GetEnvironmentVariableW, GetExitCodeProcess, GetFileAttributesW, GetFileInformationByHandle, GetFileInformationByHandleEx, GetFileType, GetFinalPathNameByHandleW, GetFullPathNameW, GetLastError, GetModuleFileNameA, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleW, GetOverlappedResult, GetProcAddress, GetProcessHeap, GetProcessId, GetStdHandle, GetSystemDefaultUILanguage, GetSystemDirectoryW, GetSystemInfo, GetSystemTimePreciseAsFileTime, GetTempPathW, GetTimeZoneInformationForYear, GetWindowsDirectoryW, HeapAlloc, HeapFree, HeapReAlloc, InitOnceBeginInitialize, InitOnceComplete, InitializeProcThreadAttributeList, IsDebuggerPresent, LoadLibraryExW, LocalFree, MapViewOfFile, Module32FirstW, Module32NextW, MoveFileExW, MultiByteToWideChar, OpenProcess, QueryPerformanceCounter, QueryPerformanceFrequency, ReadConsoleW, ReadFile, ReadFileEx, RemoveDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, SetConsoleMode, SetConsoleTextAttribute, SetCurrentDirectoryW, SetEnvironmentVariableW, SetFileAttributesW, SetFileInformationByHandle, SetFilePointerEx, SetFileTime, SetHandleInformation, SetLastError, SetThreadStackGuarantee, SetUnhandledExceptionFilter, SetWaitableTimer, Sleep, SleepEx, SwitchToThread, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnmapViewOfFile, UpdateProcThreadAttribute, WaitForMultipleObjects, WaitForSingleObject, WideCharToMultiByte, WriteConsoleW, WriteFileEx
ntdll.dll	NtCreateFile, NtReadFile, NtWriteFile, RtlNtStatusToDosError
psapi.dll	EnumProcessModules, EnumProcesses, GetModuleBaseNameW
secur32.dll	GetUserNameExW
shell32.dll	CommandLineToArgvW, ShellExecuteA
userenv.dll	GetUserProfileDirectoryW
ws2_32.dll	WSACleanup, WSADuplicateSocketW, WSAGetLastError, WSARecv, WSASend, WSASocketW, WSAStartup, accept, bind, closesocket, connect, freeaddrinfo, getaddrinfo, getpeername, getsockname, getsockopt, ioctlsocket, listen, recv, recvfrom, select, send, sendto, setsockopt, shutdown
api-ms-win-core-synch-l1-2-0.dll	WaitOnAddress, WakeByAddressAll, WakeByAddressSingle
bcryptprimitives.dll	ProcessPrng
KERNEL32.dll	DeleteCriticalSection, EnterCriticalSection, InitializeCriticalSection, LeaveCriticalSection, RaiseException, RtlUnwindEx, VirtualProtect, VirtualQuery, __C_specific_handler
msvcrt.dll	__getmainargs, __initenv, __iob_func, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _commode, _fmode, _fpreset, _initterm, _onexit, _wtoi64, abort, calloc, exit, fprintf, free, fwrite, malloc, memcmp, memcpy, memmove, memset, signal, strlen, strncmp, vfprintf

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 21, 2024 13:15:01.925441980 CET	49731	80	192.168.2.4	91.208.206.195
Dec 21, 2024 13:15:02.045876980 CET	80	49731	91.208.206.195	192.168.2.4
Dec 21, 2024 13:15:02.046124935 CET	49731	80	192.168.2.4	91.208.206.195
Dec 21, 2024 13:15:02.046375036 CET	49731	80	192.168.2.4	91.208.206.195
Dec 21, 2024 13:15:02.046375036 CET	49731	80	192.168.2.4	91.208.206.195
Dec 21, 2024 13:15:02.166758060 CET	80	49731	91.208.206.195	192.168.2.4
Dec 21, 2024 13:15:02.166799068 CET	80	49731	91.208.206.195	192.168.2.4
Dec 21, 2024 13:15:03.385826111 CET	80	49731	91.208.206.195	192.168.2.4
Dec 21, 2024 13:15:03.386100054 CET	49731	80	192.168.2.4	91.208.206.195
Dec 21, 2024 13:15:03.506309032 CET	80	49731	91.208.206.195	192.168.2.4
Dec 21, 2024 13:15:03.506392002 CET	49731	80	192.168.2.4	91.208.206.195

HTTP Request Dependency Graph

91.208.206.195

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	91.208.206.195	80	7316	C:\Users\user\Desktop\run.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 13:15:02.046375036 CET	159	OUT	POST /store HTTP/1.1 Host: 91.208.206.195 User-Agent: ureq/2.10.1 Accept: / Content-Type: application/json accept-encoding: gzip Content-Length: 47
Dec 21, 2024 13:15:02.046375036 CET	47	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 37 38 30 38 34 22 2c 22 65 6d 61 69 6c 22 3a 22 31 32 35 37 36 31 39 37 35 35 38 33 37 34 38 32 32 32 37 30 22 7d Data Ascii: {"name":"78084","email":"12576197558374822270"}
Dec 21, 2024 13:15:03.385826111 CET	179	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 12:15:03 GMT Server: Apache/2.4.62 (Debian) Content-Length: 39 Content-Type: application/json Data Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 22 44 61 74 61 20 73 74 6f 72 65 64 20 73 75 63 63 65 73 73 66 75 6c 6c 79 22 7d 0a Data Ascii: {"message":"Data stored successfully"}

Target ID:	0
Start time:	07:15:00
Start date:	21/12/2024
Path:	C:\Users\user\Desktop\run.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\run.exe"
Imagebase:	0x7ff7460a0000
File size:	6'138'219 bytes
MD5 hash:	CD860C78E0374DEC3A2B1A73507FCE4A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Rust
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:15:00
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 00007FF7460A13F0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1698671621.00007FF7460A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7460A0000, based on PE: true

Associated: 00000000.00000002.1698654798.00007FF7460A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1698907683.00007FF7463BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1698925738.00007FF7463BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1698925738.00007FF7464BE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699039377.00007FF746507000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699055754.00007FF746508000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699070807.00007FF74650C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7460a0000_run.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3414cada1574162cf82e41b3d68a30d92ad2cffa160ba48225f91e421ef25120
Instruction ID: 5750f9b77bf389485b284fa0ec2ca4bdcd4fdeb443f65f7a2e35b5735f7ee9b1
Opcode Fuzzy Hash: 3414cada1574162cf82e41b3d68a30d92ad2cffa160ba48225f91e421ef25120
Instruction Fuzzy Hash: C4B0122490C205C4E7043F15EC41729E2206F25BC1FD04030C40C03361CF3C90008730

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report run.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\Desktop\BPMLNOBVSB.png

C:\Users\user\Desktop\DVWHKMNFNN.pdf

C:\Users\user\Desktop\DVWHKMNFNN.xlsx

C:\Users\user\Desktop\HTAGVDFUIE.png

C:\Users\user\Desktop\JSDNGYCOWY.jpg

C:\Users\user\Desktop\KATAXZVCPS.jpg

C:\Users\user\Desktop\KATAXZVCPS.xlsx

C:\Users\user\Desktop\NWTVCDUMOB.jpg

C:\Users\user\Desktop\ONBQCLYSPU.docx

C:\Users\user\Desktop\ONBQCLYSPU\HTAGVDFUIE.png

C:\Users\user\Desktop\ONBQCLYSPU\KATAXZVCPS.jpg

C:\Users\user\Desktop\ONBQCLYSPU\ONBQCLYSPU.docx

C:\Users\user\Desktop\ONBQCLYSPU\UMMBDNEQBN.pdf

C:\Users\user\Desktop\ONBQCLYSPU\VLZDGUKUTZ.xlsx

C:\Users\user\Desktop\UMMBDNEQBN.docx

C:\Users\user\Desktop\UMMBDNEQBN.pdf

C:\Users\user\Desktop\UMMBDNEQBN\BPMLNOBVSB.png

C:\Users\user\Desktop\UMMBDNEQBN\DVWHKMNFNN.xlsx

C:\Users\user\Desktop\UMMBDNEQBN\JSDNGYCOWY.jpg

C:\Users\user\Desktop\UMMBDNEQBN\UMMBDNEQBN.docx

C:\Users\user\Desktop\UMMBDNEQBN\WUTJSCBCFX.pdf

C:\Users\user\Desktop\VLZDGUKUTZ.docx

Windows Analysis Report
run.exe