Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
IUccGQLWI0.ps1

Overview

General Information

Sample name:IUccGQLWI0.ps1
renamed because original name is a hash value
Original sample name:36f48ef3776c01d63a2fd594d52dfb7402ea634162fd079b0d942367a2fbed56.ps1
Analysis ID:1579866
MD5:8015d634e9e5fd003885700bca4723d8
SHA1:ac4217259c16aefbec8c32024c66d74f99ceb48b
SHA256:36f48ef3776c01d63a2fd594d52dfb7402ea634162fd079b0d942367a2fbed56
Tags:lockbitlockbit40powershellps1ransomwareuser-TheRavenFile
Infos:

Detection

LockBit ransomware, Metasploit
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for dropped file
Found malware configuration
Found post-exploitation toolkit Empire
Found ransom note / readme
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected LockBit ransomware
Yara detected MetasploitPayload
AI detected suspicious sample
Changes the wallpaper picture
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Found Tor onion address
Found potential ransomware demand text
Hides threads from debuggers
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Modifies existing user documents (likely ransomware behavior)
Powershell drops PE file
Sigma detected: Suspicious PowerShell Parameter Substring
Writes a notice file (html or txt) to demand a ransom
Writes to foreign memory regions
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to clear windows event logs (to hide its activities)
Contains functionality to communicate with device drivers
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Enables debug privileges
Enables security privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Potentially Suspicious Desktop Background Change Via Registry
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • powershell.exe (PID: 4136 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\IUccGQLWI0.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)
    • conhost.exe (PID: 5472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powershell.exe (PID: 3228 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ex bypass -nonI C:\Users\user\Desktop\IUccGQLWI0.ps1 MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 5816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • splwow64.exe (PID: 7668 cmdline: C:\Windows\splwow64.exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)
      • 339E.tmp (PID: 8164 cmdline: "C:\ProgramData\339E.tmp" MD5: 294E9F64CB1642DD89229FFF0592856B)
  • ONENOTE.EXE (PID: 8180 cmdline: /insertdoc "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\{99BD1B98-4EF0-4608-B95D-29BBEDCA41A1}.xps" 133794275841470000 MD5: 0061760D72416BCF5F2D9FA6564F0BEA)
  • svchost.exe (PID: 7464 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • cleanup

Malware Configuration

Threatname: Lockbit

{"URL": "http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion", "Ransom Note": "~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~\r\n\r\n>>>>> You must pay us.\r\n\r\nTor Browser Links BLOG where the stolen infortmation will be published:\r\n( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )\r\nhttp://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/\r\nhttp://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/\r\nhttp://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/\r\nhttp://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/\r\nhttp://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/\r\nhttp://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/\r\nhttp://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/\r\n\r\n>>>>> What is the guarantee that we won't scam you? \r\nWe are the oldest extortion gang on the planet and nothing is more important to us than our reputation. We are not a politically motivated group and want nothing but financial rewards for our work. If we defraud even one client, other clients will not pay us. In 5 years, not a single client has been left dissatisfied after making a deal with us. If you pay the ransom, we will fulfill all the terms we agreed upon during the negotiation process. Treat this situation simply as a paid training session for your system administrators, because it was the misconfiguration of your corporate network that allowed us to attack you. Our pentesting services should be paid for the same way you pay your system administrators' salaries. You can get more information about us on Elon Musk's Twitter at https://twitter.com/hashtag/lockbit?f=live.\r\n\r\n>>>>> Warning! Do not delete or modify encrypted files, it will lead to irreversible problems with decryption of files!\r\n\r\n>>>>> Don't go to the police or the FBI for help and don't tell anyone that we attacked you. They will forbid you from paying the ransom and will not help you in any way, you will be left with encrypted files and your business will die.\r\n\r\n>>>>> When buying bitcoin, do not tell anyone the true purpose of the purchase. Some brokers, especially in the US, do not allow you to buy bitcoin to pay ransom. Communicate any other reason for the purchase, such as: personal investment in cryptocurrency, bitcoin as a gift, paying to buy assets for your business using bitcoin, cryptocurrency payment for consulting services, cryptocurrency payment for any other services, cryptocurrency donations, cryptocurrency donations for Donald Trump to win the election, buying bitcoin to participate in ICO and buy other cryptocurrencies, buying cryptocurrencies to leave an inheritance for your children, or any other purpose for buying cryptocurrency. Also you can use adequate cryptocurrency brokers who do not ask questions for what you buy cryptocurrency.\r\n\r\n>>>>> After buying cryptocurrency from a broker, store the cryptocurrency on a cold wallet, such as https://electrum.org/ or any other cold cryptocurrency wallet, more details on https://bitcoin.org By paying the ransom from your personal cold cryptocurrency wallet, you will avoid any problems from regulators, police and brokers.\r\n\r\n>>>>> Don't be afraid of any legal consequences, you were very scared, that's why you followed all our instructions, it's not your fault if you are very scared. Not a single company that paid us has had issues. Any excuses are just for insurance company to not pay on their obligation.\r\n\r\n>>>>> You need to contact us via TOR darknet sites with your personal ID\r\n\r\nDownload and install Tor Browser https://www.torproject.org/\r\nWrite to the chat room and wait for an answer, we'll guarantee a response from us. If you need a unique ID for correspondence with us that no one will know about, ask it in the chat, we will generate a secret chat for you and give you ID via private one-time memos service, no one can find out this ID but you. Sometimes you will have to wait some time for our reply, this is because we have a lot of work and we attack hundreds of companies around the world.\r\n\r\nTor Browser personal link for CHAT available only to you: \r\n( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )\r\nhttp://fmtvvg3x5rs7tagzcytmfmffnihnte6gllkljufyz534hfpqhfyg2dad.onion\r\n\r\nTor Browser Links for CHAT \r\n( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )\r\nhttp://lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion\r\nhttp://lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion\r\nhttp://lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion\r\nhttp://lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion\r\nhttp://lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion\r\n\r\n>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\r\n>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\r\n>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\r\n>>>>> Your personal identifier to communicate with us ID: 5150CB33290ED8C9162EF14B17D217D6 <<<<<\r\n>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\r\n>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\r\n>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\r\n\r\n>>>>> Want a lamborghini, a ferrari and lots of titty girls? Sign up and start your pentester billionaire journey in 5 minutes with us.\r\n( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )\r\nhttp://lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion\r\nhttp://lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion\r\nhttp://lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion\r\nhttp://lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion\r\nhttp://lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion\r\n\r\nVersion: LockBitBlack4.0-rc-001\r\n"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmpJoeSecurity_LockBit_ransomwareYara detected LockBit ransomwareJoe Security
    00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmpWindows_Ransomware_Lockbit_369e1e94unknownunknown
    • 0x153bd:$a2: 8B EC 53 56 57 33 C0 8B 5D 14 33 C9 33 D2 8B 75 0C 8B 7D 08 85 F6 74 33 55 8B 6D 10 8A 54 0D 00 02 D3 8A 5C 15 00 8A 54 1D 00
    • 0x8c:$a3: 53 51 6A 01 58 0F A2 F7 C1 00 00 00 40 0F 95 C0 84 C0 74 09 0F C7 F0 0F C7 F2 59 5B C3 6A 07 58 33 C9 0F A2 F7 C3 00 00 04 00 0F 95 C0 84 C0 74 09 0F C7 F8 0F C7 FA 59 5B C3 0F 31 8B C8 C1 C9 ...
    00000002.00000002.2233034724.0000000008D05000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_LockBit_ransomwareYara detected LockBit ransomwareJoe Security
      00000002.00000002.2179450701.0000000005AB4000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_LockBit_ransomwareYara detected LockBit ransomwareJoe Security
        00000002.00000002.2179450701.0000000005AB4000.00000004.00000800.00020000.00000000.sdmpWindows_Ransomware_Lockbit_369e1e94unknownunknown
        • 0x142a95:$a2: 8B EC 53 56 57 33 C0 8B 5D 14 33 C9 33 D2 8B 75 0C 8B 7D 08 85 F6 74 33 55 8B 6D 10 8A 54 0D 00 02 D3 8A 5C 15 00 8A 54 1D 00
        • 0x12e364:$a3: 53 51 6A 01 58 0F A2 F7 C1 00 00 00 40 0F 95 C0 84 C0 74 09 0F C7 F0 0F C7 F2 59 5B C3 6A 07 58 33 C9 0F A2 F7 C3 00 00 04 00 0F 95 C0 84 C0 74 09 0F C7 F8 0F C7 FA 59 5B C3 0F 31 8B C8 C1 C9 ...
        Click to see the 10 entries

        Sigma Signatures

        System Summary

        barindex
        Sigma detected: Suspicious PowerShell Parameter Substring
        Source: Process startedAuthor: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ex bypass -nonI C:\Users\user\Desktop\IUccGQLWI0.ps1 , CommandLine: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ex bypass -nonI C:\Users\user\Desktop\IUccGQLWI0.ps1 , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\IUccGQLWI0.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 4136, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ex bypass -nonI C:\Users\user\Desktop\IUccGQLWI0.ps1 , ProcessId: 3228, ProcessName: powershell.exe
        Sigma detected: Change PowerShell Policies to an Insecure Level
        Source: Process startedAuthor: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\IUccGQLWI0.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\IUccGQLWI0.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\IUccGQLWI0.ps1", ProcessId: 4136, ProcessName: powershell.exe
        Sigma detected: Potentially Suspicious Desktop Background Change Via Registry
        Source: Registry Key setAuthor: Nasreddine Bencherchali (Nextron Systems), Stephen Lincoln @slincoln-aiq (AttackIQ): Data: Details: C:\ProgramData\R4SZPhslZ.bmp, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3228, TargetObject: HKEY_CURRENT_USER\Control Panel\Desktop\WallPaper
        Sigma detected: Non Interactive PowerShell Process Spawned
        Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\IUccGQLWI0.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\IUccGQLWI0.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\IUccGQLWI0.ps1", ProcessId: 4136, ProcessName: powershell.exe
        Sigma detected: Windows Processes Suspicious Parent Directory
        Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7464, ProcessName: svchost.exe

        Suricata Signatures

        ⊘No Suricata rule has matched

        Joe Sandbox Signatures

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Antivirus detection for dropped file
        Source: C:\ProgramData\339E.tmpAvira: detection malicious, Label: TR/Crypt.ZPACK.Gen
        Found malware configuration
        Source: R4SZPhslZ.README.txt39.2.drMalware Configuration Extractor: Lockbit {"URL": "http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion", "Ransom Note": "~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~\r\n\r\n>>>>> You must pay us.\r\n\r\nTor Browser Links BLOG where the stolen infortmation will be published:\r\n( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )\r\nhttp://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/\r\nhttp://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/\r\nhttp://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/\r\nhttp://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/\r\nhttp://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/\r\nhttp://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/\r\nhttp://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/\r\n\r\n>>>>> What is the guarantee that we won't scam you? \r\nWe are the oldest extortion gang on the planet and nothing is more important to us than our reputation. We are not a politically motivated group and want nothing but financial rewards for our work. If we defraud even one client, other clients will not pay us. In 5 years, not a single client has been left dissatisfied after making a deal with us. If you pay the ransom, we will fulfill all the terms we agreed upon during the negotiation process. Treat this situation simply as a paid training session for your system administrators, because it was the misconfiguration of your corporate network that allowed us to attack you. Our pentesting services should be paid for the same way you pay your system administrators' salaries. You can get more information about us on Elon Musk's Twitter at https://twitter.com/hashtag/lockbit?f=live.\r\n\r\n>>>>> Warning! Do not delete or modify encrypted files, it will lead to irreversible problems with decryption of files!\r\n\r\n>>>>> Don't go to the police or the FBI for help and don't tell anyone that we attacked you. They will forbid you from paying the ransom and will not help you in any way, you will be left with encrypted files and your business will die.\r\n\r\n>>>>> When buying bitcoin, do not tell anyone the true purpose of the purchase. Some brokers, especially in the US, do not allow you to buy bitcoin to pay ransom. Communicate any other reason for the purchase, such as: personal investment in cryptocurrency, bitcoin as a gift, paying to buy assets for your business using bitcoin, cryptocurrency payment for consulting services, cryptocurrency payment for any other services, cryptocurrency donations, cryptocurrency donations for Donald Trump to win the election, buying bitcoin to participate in ICO and buy other cryptocurrencies, buying cryptocurrencies to leave an inheritance for your children, or any other purpose for buying cryptocurrency. Also you can use adequate cryptocurrency b
        Multi AV Scanner detection for dropped file
        Source: C:\ProgramData\339E.tmpReversingLabs: Detection: 86%
        Multi AV Scanner detection for submitted file
        Source: IUccGQLWI0.ps1ReversingLabs: Detection: 31%
        AI detected suspicious sample
        Source: Submited SampleIntegrated Neural Analysis Model: Matched 98.9% probability
        Machine Learning detection for dropped file
        Source: C:\ProgramData\339E.tmpJoe Sandbox ML: detected
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Videos\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Searches\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Saved Games\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Recent\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Pictures\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Pictures\Saved Pictures\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Pictures\Camera Roll\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\OneDrive\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Music\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Links\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Favorites\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Favorites\Links\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Downloads\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Documents\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Documents\YPSIACHYXW\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Documents\WUTJSCBCFX\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Documents\UOOJJOZIRH\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Documents\UMMBDNEQBN\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Documents\RAYHIWGKDI\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Documents\QNCYCDFIJJ\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Documents\PIVFAGEAAV\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Documents\LTKMYBSEYZ\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Documents\KATAXZVCPS\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Documents\IPKGELNTQY\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Documents\HTAGVDFUIE\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Documents\CURQNKVOIX\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Desktop\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Desktop\YPSIACHYXW\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Desktop\WUTJSCBCFX\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Desktop\UOOJJOZIRH\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Desktop\UMMBDNEQBN\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Desktop\SUAVTZKNFL\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Desktop\RAYHIWGKDI\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Desktop\KATAXZVCPS\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Desktop\IPKGELNTQY\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Desktop\HTAGVDFUIE\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Desktop\GAOBCVIQIJ\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Desktop\DVWHKMNFNN\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Desktop\CURQNKVOIX\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Contacts\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\3D Objects\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\.ms-ad\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\$WinREAgent\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\$WinREAgent\Scratch\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_092494BC FindFirstFileExW,GetFileAttributesW,DeleteFileW,FindNextFileW,2_2_092494BC
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_0924930C FindFirstFileExW,FindNextFileW,2_2_0924930C
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_09250F48 SetThreadPriority,FindFirstFileExW,FindNextFileW,2_2_09250F48
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_092493E0 FindFirstFileExW,2_2_092493E0
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_09247AC0 FindFirstFileW,FindClose,FindNextFileW,FindClose,2_2_09247AC0
        Source: C:\ProgramData\339E.tmpCode function: 13_2_0040227C FindFirstFileExW,13_2_0040227C
        Source: C:\ProgramData\339E.tmpCode function: 13_2_0040152C FindFirstFileExW,FindClose,FindNextFileW,FindClose,13_2_0040152C
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_0924BE00 GetLogicalDriveStringsW,2_2_0924BE00
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\RoamingJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.iniJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\userJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\MicrosoftJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppDataJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\WindowsJump to behavior

        Networking

        barindex
        Found Tor onion address
        Source: powershell.exe, 00000002.00000002.2233034724.0000000008D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion=
        Source: powershell.exe, 00000002.00000002.2233034724.0000000008D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionq
        Source: powershell.exe, 00000002.00000002.2233034724.0000000008D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionl
        Source: powershell.exe, 00000002.00000002.2233034724.0000000008D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
        Source: powershell.exe, 00000002.00000002.2233034724.0000000008D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
        Source: powershell.exe, 00000002.00000002.2233034724.0000000008D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion7
        Source: powershell.exe, 00000002.00000002.2233034724.0000000008D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion
        Source: powershell.exe, 00000002.00000002.2233034724.0000000008E1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
        Source: powershell.exe, 00000002.00000002.2233034724.0000000008E1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
        Source: powershell.exe, 00000002.00000002.2233034724.0000000008E1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
        Source: splwow64.exe, 00000007.00000003.1972930661.000000000493D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,7947.36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/F9E92A3F-BD32-41F4-89D1-383D21643338.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1972930661.000000000493D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/F9E92A3F-BD32-41F4-89D1-383D21643338.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1972930661.000000000493D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/F9E92A3F-BD32-41F4-89D1-383D21643338.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1866058930.0000000004902000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,7947.36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/0AF3B488-70C1-4390-8088-D2E866B44856.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1866058930.0000000004902000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/0AF3B488-70C1-4390-8088-D2E866B44856.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1866058930.0000000004902000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/0AF3B488-70C1-4390-8088-D2E866B44856.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.2006077383.000000000494B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: ;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1966933971.0000000001339000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/F9E92A3F-BD32-41F4-89D1-383D21643338.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1966933971.0000000001339000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/F9E92A3F-BD32-41F4-89D1-383D21643338.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1869861702.0000000001378000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,7947.36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/0AF3B488-70C1-4390-8088-D2E866B44856.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1869861702.0000000001378000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/0AF3B488-70C1-4390-8088-D2E866B44856.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1869861702.0000000001378000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/0AF3B488-70C1-4390-8088-D2E866B44856.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1865185930.0000000001337000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,7947.36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/0AF3B488-70C1-4390-8088-D2E866B44856.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1865185930.0000000001337000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/0AF3B488-70C1-4390-8088-D2E866B44856.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1865185930.0000000001337000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/0AF3B488-70C1-4390-8088-D2E866B44856.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1890333250.00000000034E8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,7947.36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/83F5B0FC-7EDF-4D43-BE64-8404DFFEC286.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1856821488.0000000001337000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,7947.36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/1CBC6EFA-13CE-4877-8D24-7B946BCC44B6.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1856821488.0000000001337000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/1CBC6EFA-13CE-4877-8D24-7B946BCC44B6.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1856821488.0000000001337000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/1CBC6EFA-13CE-4877-8D24-7B946BCC44B6.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.2020922773.0000000001339000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/5F186FE1-9697-4173-AE90-D647F24472B9.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.2020922773.0000000001339000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/5F186FE1-9697-4173-AE90-D647F24472B9.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.2008715870.000000000494B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: ;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1870589082.00000000048F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: 36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/0AF3B488-70C1-4390-8088-D2E866B44856.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1870589082.00000000048F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/0AF3B488-70C1-4390-8088-D2E866B44856.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1870589082.00000000048F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/0AF3B488-70C1-4390-8088-D2E866B44856.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1899887682.0000000001337000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,7947.36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/83F5B0FC-7EDF-4D43-BE64-8404DFFEC286.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1899887682.0000000001337000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/83F5B0FC-7EDF-4D43-BE64-8404DFFEC286.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1899887682.0000000001337000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/83F5B0FC-7EDF-4D43-BE64-8404DFFEC286.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.2007426280.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionf,,R
        Source: splwow64.exe, 00000007.00000003.2007426280.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionf
        Source: splwow64.exe, 00000007.00000003.2007426280.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: ><Relationship Target="/Metadata/MXDC_Empty_PT.xml" Id="R0" Type="http://schemas.microsoft.com/xps/2005/06/printticket" />ips+xml" />ansform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/3119B11C-7394-4573-A98E-74D2182A87C0.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.2007426280.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/3119B11C-7394-4573-A98E-74D2182A87C0.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.2007426280.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: z><Relationship Target="/Metadata/MXDC_Empty_PT.xml" Id="R0" Type="http://schemas.microsoft.com/xps/2005/06/printticket" />ips+xml" />ansform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/3119B11C-7394-4573-A98E-74D2182A87C0.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.2007426280.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Override PartName="/Documents/1/Pages/_rels/42.fpage.rels" ContentType="application/vnd.openxmlformats-package.relationships+xml" />ansform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/0E9009E4-B0A0-4674-B281-2B1028C83AC7.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.2007426280.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/0E9009E4-B0A0-4674-B281-2B1028C83AC7.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.2007426280.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/0E9009E4-B0A0-4674-B281-2B1028C83AC7.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.2007426280.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,7947.36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/0E9009E4-B0A0-4674-B281-2B1028C83AC7.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.2007426280.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <?xml version="1.0" encoding="UTF-8"?><Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"hips+xml" />ansform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/3119B11C-7394-4573-A98E-74D2182A87C0.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.2007426280.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: y<?xml version="1.0" encoding="UTF-8"?><Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"hips+xml" />ansform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/3119B11C-7394-4573-A98E-74D2182A87C0.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1909744193.00000000034E3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/83F5B0FC-7EDF-4D43-BE64-8404DFFEC286.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1909744193.00000000034E3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/83F5B0FC-7EDF-4D43-BE64-8404DFFEC286.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1909744193.00000000034E3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,7947.36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/83F5B0FC-7EDF-4D43-BE64-8404DFFEC286.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1874155658.0000000004902000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,7947.36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/0AF3B488-70C1-4390-8088-D2E866B44856.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1998046536.0000000001339000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/0E9009E4-B0A0-4674-B281-2B1028C83AC7.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1998046536.0000000001339000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/0E9009E4-B0A0-4674-B281-2B1028C83AC7.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1943194645.0000000001339000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/3909338E-F9CD-475F-BB5B-969B074E79C6.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1943194645.0000000001339000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/3909338E-F9CD-475F-BB5B-969B074E79C6.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1915882429.0000000001337000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,7947.36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/CFEEDDE3-D75F-41BD-8D73-00D8323CA112.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1915882429.0000000001337000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/CFEEDDE3-D75F-41BD-8D73-00D8323CA112.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1915882429.0000000001337000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/CFEEDDE3-D75F-41BD-8D73-00D8323CA112.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1926937398.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,7947.36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/CFEEDDE3-D75F-41BD-8D73-00D8323CA112.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1926937398.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/CFEEDDE3-D75F-41BD-8D73-00D8323CA112.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1926937398.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/CFEEDDE3-D75F-41BD-8D73-00D8323CA112.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1926937398.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,7947.36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/83F5B0FC-7EDF-4D43-BE64-8404DFFEC286.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1986572859.0000000001339000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/3119B11C-7394-4573-A98E-74D2182A87C0.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1986572859.0000000001339000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/3119B11C-7394-4573-A98E-74D2182A87C0.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1907985075.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionf,,R
        Source: splwow64.exe, 00000007.00000003.1907985075.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionf
        Source: splwow64.exe, 00000007.00000003.1907985075.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionf|
        Source: splwow64.exe, 00000007.00000003.1870236230.0000000001381000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: ,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1870236230.0000000001381000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/0AF3B488-70C1-4390-8088-D2E866B44856.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1870236230.0000000001381000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/0AF3B488-70C1-4390-8088-D2E866B44856.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1857137469.00000000048F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: 36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/1CBC6EFA-13CE-4877-8D24-7B946BCC44B6.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1857137469.00000000048F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/1CBC6EFA-13CE-4877-8D24-7B946BCC44B6.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1857137469.00000000048F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/1CBC6EFA-13CE-4877-8D24-7B946BCC44B6.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1937328355.0000000001337000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,7947.36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/3909338E-F9CD-475F-BB5B-969B074E79C6.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1937328355.0000000001337000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/3909338E-F9CD-475F-BB5B-969B074E79C6.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1937328355.0000000001337000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/3909338E-F9CD-475F-BB5B-969B074E79C6.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1973521592.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionf,,R
        Source: splwow64.exe, 00000007.00000003.1973521592.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionfCFDD
        Source: splwow64.exe, 00000007.00000003.1973521592.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionf
        Source: splwow64.exe, 00000007.00000003.1973521592.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/F9E92A3F-BD32-41F4-89D1-383D21643338.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1973521592.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/F9E92A3F-BD32-41F4-89D1-383D21643338.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1973521592.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: ><Relationship Target="/Metadata/MXDC_Empty_PT.xml" Id="R0" Type="http://schemas.microsoft.com/xps/2005/06/printticket" />ips+xml" />ansform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/F9E92A3F-BD32-41F4-89D1-383D21643338.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1973521592.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: z><Relationship Target="/Metadata/MXDC_Empty_PT.xml" Id="R0" Type="http://schemas.microsoft.com/xps/2005/06/printticket" />ips+xml" />ansform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/F9E92A3F-BD32-41F4-89D1-383D21643338.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1973521592.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,7947.36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/D7980DA3-69EC-44A5-8C21-685D4DDC9DAE.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1973521592.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <?xml version="1.0" encoding="UTF-8"?><Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"as.microsoft.com/xps/2005/06/required-resource" />Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/F9E92A3F-BD32-41F4-89D1-383D21643338.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1973521592.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: y<?xml version="1.0" encoding="UTF-8"?><Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"as.microsoft.com/xps/2005/06/required-resource" />Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/F9E92A3F-BD32-41F4-89D1-383D21643338.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1973521592.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <PageContent Source="/Documents/1/Pages/32.fpage" /> xmlns="http://schemas.openxmlformats.org/package/2006/relationships">ips+xml" />ansform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/3909338E-F9CD-475F-BB5B-969B074E79C6.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1973521592.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/3909338E-F9CD-475F-BB5B-969B074E79C6.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1973521592.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: 4<PageContent Source="/Documents/1/Pages/32.fpage" /> xmlns="http://schemas.openxmlformats.org/package/2006/relationships">ips+xml" />ansform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/3909338E-F9CD-475F-BB5B-969B074E79C6.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1973521592.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,7947.36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/F9E92A3F-BD32-41F4-89D1-383D21643338.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1880957077.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionfh
        Source: splwow64.exe, 00000007.00000003.1880957077.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionf
        Source: splwow64.exe, 00000007.00000003.1880957077.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionf|
        Source: splwow64.exe, 00000007.00000003.1948734936.0000000001339000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/D7980DA3-69EC-44A5-8C21-685D4DDC9DAE.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1948734936.0000000001339000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/D7980DA3-69EC-44A5-8C21-685D4DDC9DAE.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1877767102.00000000034D4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: lyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,7947.36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/0AF3B488-70C1-4390-8088-D2E866B44856.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1877767102.00000000034D4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/0AF3B488-70C1-4390-8088-D2E866B44856.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1877767102.00000000034D4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/0AF3B488-70C1-4390-8088-D2E866B44856.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1853057416.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
        Source: splwow64.exe, 00000007.00000003.1853057416.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.oniond)
        Source: splwow64.exe, 00000007.00000003.1853057416.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionr|
        Source: splwow64.exe, 00000007.00000003.1959232402.0000000004926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,7947.36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/D7980DA3-69EC-44A5-8C21-685D4DDC9DAE.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1959232402.0000000004926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/D7980DA3-69EC-44A5-8C21-685D4DDC9DAE.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1959232402.0000000004926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/D7980DA3-69EC-44A5-8C21-685D4DDC9DAE.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1890333250.00000000034D4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: s RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,7947.36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/83F5B0FC-7EDF-4D43-BE64-8404DFFEC286.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1890333250.00000000034D4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/83F5B0FC-7EDF-4D43-BE64-8404DFFEC286.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1890333250.00000000034D4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/83F5B0FC-7EDF-4D43-BE64-8404DFFEC286.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1866593359.0000000004908000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: -0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,7947.36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/0AF3B488-70C1-4390-8088-D2E866B44856.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1866593359.0000000004908000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/0AF3B488-70C1-4390-8088-D2E866B44856.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1866593359.0000000004908000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/0AF3B488-70C1-4390-8088-D2E866B44856.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1909691654.000000000490D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,7947.36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/83F5B0FC-7EDF-4D43-BE64-8404DFFEC286.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1909691654.000000000490D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/83F5B0FC-7EDF-4D43-BE64-8404DFFEC286.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1909691654.000000000490D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/83F5B0FC-7EDF-4D43-BE64-8404DFFEC286.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1943642199.0000000004917000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/3909338E-F9CD-475F-BB5B-969B074E79C6.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1943642199.0000000004917000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/3909338E-F9CD-475F-BB5B-969B074E79C6.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1942313132.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,7947.36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/3909338E-F9CD-475F-BB5B-969B074E79C6.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1942313132.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Override PartName="/Documents/1/Pages/_rels/22.fpage.rels" ContentType="application/vnd.openxmlformats-package.relationships+xml" />ansform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/CFEEDDE3-D75F-41BD-8D73-00D8323CA112.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1942313132.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/CFEEDDE3-D75F-41BD-8D73-00D8323CA112.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1942313132.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/3909338E-F9CD-475F-BB5B-969B074E79C6.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1942313132.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/3909338E-F9CD-475F-BB5B-969B074E79C6.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1942313132.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: </Relationships>.0" encoding="UTF-8"?><Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"hips+xml" />ansform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/3909338E-F9CD-475F-BB5B-969B074E79C6.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1942313132.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,7947.36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/83F5B0FC-7EDF-4D43-BE64-8404DFFEC286.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1942313132.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Relationship Target="/Documents/1/Resources/Fonts/3909338E-F9CD-475F-BB5B-969B074E79C6.odttf" Id="R1" Type="http://schemas.microsoft.com/xps/2005/06/required-resource" />Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/3909338E-F9CD-475F-BB5B-969B074E79C6.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1942313132.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,7947.36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/CFEEDDE3-D75F-41BD-8D73-00D8323CA112.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1856444833.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionF2t
        Source: splwow64.exe, 00000007.00000003.1856444833.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionf
        Source: splwow64.exe, 00000007.00000003.1856444833.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionf
        Source: splwow64.exe, 00000007.00000003.1907555510.00000000034E3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/83F5B0FC-7EDF-4D43-BE64-8404DFFEC286.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1907555510.00000000034E3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/83F5B0FC-7EDF-4D43-BE64-8404DFFEC286.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1907555510.00000000034E3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,7947.36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/83F5B0FC-7EDF-4D43-BE64-8404DFFEC286.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1870122813.0000000001378000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,7947.36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/0AF3B488-70C1-4390-8088-D2E866B44856.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1870122813.0000000001378000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/0AF3B488-70C1-4390-8088-D2E866B44856.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1870122813.0000000001378000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/0AF3B488-70C1-4390-8088-D2E866B44856.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.2007994232.0000000004973000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: ,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.2007994232.0000000004973000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/0E9009E4-B0A0-4674-B281-2B1028C83AC7.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.2007994232.0000000004973000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/0E9009E4-B0A0-4674-B281-2B1028C83AC7.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1883115200.00000000034D4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: s RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,7947.36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/0AF3B488-70C1-4390-8088-D2E866B44856.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1883115200.00000000034D4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/0AF3B488-70C1-4390-8088-D2E866B44856.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1883115200.00000000034D4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/0AF3B488-70C1-4390-8088-D2E866B44856.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1854019734.00000000034F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,7947.36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/AC479D29-FD1C-403A-9092-5A6644CF95D4.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1854019734.00000000034F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/AC479D29-FD1C-403A-9092-5A6644CF95D4.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1854019734.00000000034F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/AC479D29-FD1C-403A-9092-5A6644CF95D4.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1959576177.0000000004939000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,7947.36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/D7980DA3-69EC-44A5-8C21-685D4DDC9DAE.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1959576177.0000000004939000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/D7980DA3-69EC-44A5-8C21-685D4DDC9DAE.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1959576177.0000000004939000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/D7980DA3-69EC-44A5-8C21-685D4DDC9DAE.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1870589082.0000000004902000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,7947.36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/0AF3B488-70C1-4390-8088-D2E866B44856.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1991987974.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Override PartName="/Documents/1/Pages/_rels/37.fpage.rels" ContentType="application/vnd.openxmlformats-package.relationships+xml" />ansform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/3119B11C-7394-4573-A98E-74D2182A87C0.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1991987974.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/3119B11C-7394-4573-A98E-74D2182A87C0.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1991987974.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Override PartName="/Documents/1/Pages/_rels/36.fpage.rels" ContentType="application/vnd.openxmlformats-package.relationships+xml" />.com/xps/2005/06/required-resource" />Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/3119B11C-7394-4573-A98E-74D2182A87C0.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1991987974.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,7947.36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/D7980DA3-69EC-44A5-8C21-685D4DDC9DAE.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1991987974.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,7947.36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/3119B11C-7394-4573-A98E-74D2182A87C0.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1991987974.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/3119B11C-7394-4573-A98E-74D2182A87C0.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1991987974.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,7947.36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/F9E92A3F-BD32-41F4-89D1-383D21643338.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1928423804.0000000004912000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/CFEEDDE3-D75F-41BD-8D73-00D8323CA112.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1928423804.0000000004912000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/CFEEDDE3-D75F-41BD-8D73-00D8323CA112.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1890333250.00000000034E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/83F5B0FC-7EDF-4D43-BE64-8404DFFEC286.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1890333250.00000000034E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/83F5B0FC-7EDF-4D43-BE64-8404DFFEC286.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1959073993.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/D7980DA3-69EC-44A5-8C21-685D4DDC9DAE.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1959073993.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/D7980DA3-69EC-44A5-8C21-685D4DDC9DAE.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1959073993.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,7947.36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/D7980DA3-69EC-44A5-8C21-685D4DDC9DAE.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1959073993.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,7947.36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/3909338E-F9CD-475F-BB5B-969B074E79C6.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1959073993.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: ><Relationship Target="/Metadata/MXDC_Empty_PT.xml" Id="R0" Type="http://schemas.microsoft.com/xps/2005/06/printticket" />ips+xml" />ansform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/3909338E-F9CD-475F-BB5B-969B074E79C6.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1959073993.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/3909338E-F9CD-475F-BB5B-969B074E79C6.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1959073993.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: z><Relationship Target="/Metadata/MXDC_Empty_PT.xml" Id="R0" Type="http://schemas.microsoft.com/xps/2005/06/printticket" />ips+xml" />ansform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/3909338E-F9CD-475F-BB5B-969B074E79C6.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1959073993.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <?xml version="1.0" encoding="UTF-8"?><Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"phs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/D7980DA3-69EC-44A5-8C21-685D4DDC9DAE.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1959073993.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: y<?xml version="1.0" encoding="UTF-8"?><Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"phs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/D7980DA3-69EC-44A5-8C21-685D4DDC9DAE.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1869970529.0000000001378000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,7947.36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/0AF3B488-70C1-4390-8088-D2E866B44856.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1869970529.0000000001378000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/0AF3B488-70C1-4390-8088-D2E866B44856.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1869970529.0000000001378000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/0AF3B488-70C1-4390-8088-D2E866B44856.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1853655878.0000000001337000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,7947.36 L 11982.7,7947.36 11982.7,8331.04 0,8331.04 z" FontUri="/Documents/1/Resources/Fonts/AC479D29-FD1C-403A-9092-5A6644CF95D4.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="8249.12" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;131,55;146,55;150,55;617,54;155,55;136,55;132,55;150,54;622,55;142,55;133,55;138,54;154,55;135,55;140,55;151,54;137,55;619,55;622,54;141,55;143,55;147,55;152,54;147,55;147,55;154,55;152,54;152,55;140,55;146,55;147,54;141,55;143,55;135,55;152,54;152,55;619,55;142,55;618,54;131,55;156,55;142,55;618,54;137,55;155,55;621,55;146,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1853655878.0000000001337000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/AC479D29-FD1C-403A-9092-5A6644CF95D4.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1853655878.0000000001337000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/AC479D29-FD1C-403A-9092-5A6644CF95D4.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1992257211.0000000004957000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: ;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion" />
        Source: splwow64.exe, 00000007.00000003.1992257211.0000000004957000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/3119B11C-7394-4573-A98E-74D2182A87C0.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1992257211.0000000004957000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/3119B11C-7394-4573-A98E-74D2182A87C0.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: splwow64.exe, 00000007.00000003.1853971739.00000000048F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9482.08 L 11982.7,9482.08 11982.7,9865.76 0,9865.76 z" FontUri="/Documents/1/Resources/Fonts/AC479D29-FD1C-403A-9092-5A6644CF95D4.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="9783.84" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;131,54;622,55;135,55;618,55;132,54;619,55;146,55;141,55;144,54;619,55;143,55;137,55;141,54;137,55;145,55;140,54;148,55;142,55;620,55;139,54;147,55;137,55;154,55;617,54;619,55;133,55;142,55;132,54;156,55;133,55;619,55;154,54;143,55;622,55;139,55;621,54;140,55;135,55;135,55;150,54;149,55;139,55;131,55;618,54;147,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion" />
        Source: splwow64.exe, 00000007.00000003.1853971739.00000000048F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" Clip="M 0,9865.76 L 11982.7,9865.76 11982.7,10249.4 0,10249.4 z" FontUri="/Documents/1/Resources/Fonts/AC479D29-FD1C-403A-9092-5A6644CF95D4.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="0" OriginY="10167.5" Indices="138,55;150,54;150,55;146,55;347,55;373,54;373,55;142,55;145,55;133,54;141,55;132,55;139,55;150,54;149,55;151,55;146,55;144,54;617,55;138,55;621,55;132,54;135,55;617,55;133,55;144,54;147,55;146,55;152,55;144,54;133,55;155,55;138,54;140,55;619,55;148,55;137,54;143,55;144,55;153,55;144,54;619,55;619,55;621,55;618,54;618,55;138,55;144,55;156,54;156,55;143,55;150,55;154,54;134,55;152,55;140,55;145,54;147,55;142,55;146,55;622,54;155,55;134,55;348,55;145,54;144,55;139,55;145,55;144" UnicodeString="http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion" />
        Source: R4SZPhslZ.README.txt39.2.drString found in binary or memory: http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/
        Source: R4SZPhslZ.README.txt39.2.drString found in binary or memory: http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/
        Source: R4SZPhslZ.README.txt39.2.drString found in binary or memory: http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/
        Source: R4SZPhslZ.README.txt39.2.drString found in binary or memory: http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/
        Source: R4SZPhslZ.README.txt39.2.drString found in binary or memory: http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/
        Source: R4SZPhslZ.README.txt39.2.drString found in binary or memory: http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/
        Source: R4SZPhslZ.README.txt39.2.drString found in binary or memory: http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/
        Source: R4SZPhslZ.README.txt39.2.drString found in binary or memory: http://fmtvvg3x5rs7tagzcytmfmffnihnte6gllkljufyz534hfpqhfyg2dad.onion
        Source: R4SZPhslZ.README.txt39.2.drString found in binary or memory: http://lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion
        Source: R4SZPhslZ.README.txt39.2.drString found in binary or memory: http://lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion
        Source: R4SZPhslZ.README.txt39.2.drString found in binary or memory: http://lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion
        Source: R4SZPhslZ.README.txt39.2.drString found in binary or memory: http://lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion
        Source: R4SZPhslZ.README.txt39.2.drString found in binary or memory: http://lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion
        Source: R4SZPhslZ.README.txt39.2.drString found in binary or memory: http://lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion
        Source: R4SZPhslZ.README.txt39.2.drString found in binary or memory: http://lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion
        Source: R4SZPhslZ.README.txt39.2.drString found in binary or memory: http://lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion
        Source: R4SZPhslZ.README.txt39.2.drString found in binary or memory: http://lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion
        Source: R4SZPhslZ.README.txt39.2.drString found in binary or memory: http://lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion
        Source: R4SZPhslZ.README.txt5.2.drString found in binary or memory: http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/
        Source: R4SZPhslZ.README.txt5.2.drString found in binary or memory: http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/
        Source: R4SZPhslZ.README.txt5.2.drString found in binary or memory: http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/
        Source: R4SZPhslZ.README.txt5.2.drString found in binary or memory: http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/
        Source: R4SZPhslZ.README.txt5.2.drString found in binary or memory: http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/
        Source: R4SZPhslZ.README.txt5.2.drString found in binary or memory: http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/
        Source: R4SZPhslZ.README.txt5.2.drString found in binary or memory: http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/
        Source: R4SZPhslZ.README.txt5.2.drString found in binary or memory: http://fmtvvg3x5rs7tagzcytmfmffnihnte6gllkljufyz534hfpqhfyg2dad.onion
        Source: R4SZPhslZ.README.txt5.2.drString found in binary or memory: http://lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion
        Source: R4SZPhslZ.README.txt5.2.drString found in binary or memory: http://lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion
        Source: R4SZPhslZ.README.txt5.2.drString found in binary or memory: http://lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion
        Source: R4SZPhslZ.README.txt5.2.drString found in binary or memory: http://lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion
        Source: R4SZPhslZ.README.txt5.2.drString found in binary or memory: http://lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion
        Source: R4SZPhslZ.README.txt5.2.drString found in binary or memory: http://lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion
        Source: R4SZPhslZ.README.txt5.2.drString found in binary or memory: http://lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion
        Source: R4SZPhslZ.README.txt5.2.drString found in binary or memory: http://lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion
        Source: R4SZPhslZ.README.txt5.2.drString found in binary or memory: http://lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion
        Source: R4SZPhslZ.README.txt5.2.drString found in binary or memory: http://lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion
        Source: R4SZPhslZ.README.txt1.2.drString found in binary or memory: http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/
        Source: R4SZPhslZ.README.txt1.2.drString found in binary or memory: http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/
        Source: R4SZPhslZ.README.txt1.2.drString found in binary or memory: http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/
        Source: R4SZPhslZ.README.txt1.2.drString found in binary or memory: http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/
        Source: R4SZPhslZ.README.txt1.2.drString found in binary or memory: http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/
        Source: R4SZPhslZ.README.txt1.2.drString found in binary or memory: http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/
        Source: R4SZPhslZ.README.txt1.2.drString found in binary or memory: http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/
        Source: R4SZPhslZ.README.txt1.2.drString found in binary or memory: http://fmtvvg3x5rs7tagzcytmfmffnihnte6gllkljufyz534hfpqhfyg2dad.onion
        Source: R4SZPhslZ.README.txt1.2.drString found in binary or memory: http://lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion
        Source: R4SZPhslZ.README.txt1.2.drString found in binary or memory: http://lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion
        Source: R4SZPhslZ.README.txt1.2.drString found in binary or memory: http://lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion
        Source: R4SZPhslZ.README.txt1.2.drString found in binary or memory: http://lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion
        Source: R4SZPhslZ.README.txt1.2.drString found in binary or memory: http://lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion
        Source: R4SZPhslZ.README.txt1.2.drString found in binary or memory: http://lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion
        Source: R4SZPhslZ.README.txt1.2.drString found in binary or memory: http://lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion
        Source: R4SZPhslZ.README.txt1.2.drString found in binary or memory: http://lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion
        Source: R4SZPhslZ.README.txt1.2.drString found in binary or memory: http://lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion
        Source: R4SZPhslZ.README.txt1.2.drString found in binary or memory: http://lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion
        Source: R4SZPhslZ.README.txt23.2.drString found in binary or memory: http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/
        Source: R4SZPhslZ.README.txt23.2.drString found in binary or memory: http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/
        Source: R4SZPhslZ.README.txt23.2.drString found in binary or memory: http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/
        Source: R4SZPhslZ.README.txt23.2.drString found in binary or memory: http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/
        Source: R4SZPhslZ.README.txt23.2.drString found in binary or memory: http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/
        Source: R4SZPhslZ.README.txt23.2.drString found in binary or memory: http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/
        Source: R4SZPhslZ.README.txt23.2.drString found in binary or memory: http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/
        Source: R4SZPhslZ.README.txt23.2.drString found in binary or memory: http://fmtvvg3x5rs7tagzcytmfmffnihnte6gllkljufyz534hfpqhfyg2dad.onion
        Source: R4SZPhslZ.README.txt23.2.drString found in binary or memory: http://lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion
        Source: R4SZPhslZ.README.txt23.2.drString found in binary or memory: http://lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion
        Source: R4SZPhslZ.README.txt23.2.drString found in binary or memory: http://lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion
        Source: R4SZPhslZ.README.txt23.2.drString found in binary or memory: http://lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion
        Source: R4SZPhslZ.README.txt23.2.drString found in binary or memory: http://lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion
        Source: R4SZPhslZ.README.txt23.2.drString found in binary or memory: http://lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion
        Source: R4SZPhslZ.README.txt23.2.drString found in binary or memory: http://lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion
        Source: R4SZPhslZ.README.txt23.2.drString found in binary or memory: http://lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion
        Source: R4SZPhslZ.README.txt23.2.drString found in binary or memory: http://lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion
        Source: R4SZPhslZ.README.txt23.2.drString found in binary or memory: http://lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion
        Source: R4SZPhslZ.README.txt25.2.drString found in binary or memory: http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/
        Source: R4SZPhslZ.README.txt25.2.drString found in binary or memory: http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/
        Source: R4SZPhslZ.README.txt25.2.drString found in binary or memory: http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/
        Source: R4SZPhslZ.README.txt25.2.drString found in binary or memory: http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/
        Source: R4SZPhslZ.README.txt25.2.drString found in binary or memory: http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/
        Source: R4SZPhslZ.README.txt25.2.drString found in binary or memory: http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/
        Source: R4SZPhslZ.README.txt25.2.drString found in binary or memory: http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/
        Source: R4SZPhslZ.README.txt25.2.drString found in binary or memory: http://fmtvvg3x5rs7tagzcytmfmffnihnte6gllkljufyz534hfpqhfyg2dad.onion
        Source: R4SZPhslZ.README.txt25.2.drString found in binary or memory: http://lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion
        Source: R4SZPhslZ.README.txt25.2.drString found in binary or memory: http://lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion
        Source: R4SZPhslZ.README.txt25.2.drString found in binary or memory: http://lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion
        Source: R4SZPhslZ.README.txt25.2.drString found in binary or memory: http://lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion
        Source: R4SZPhslZ.README.txt25.2.drString found in binary or memory: http://lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion
        Source: R4SZPhslZ.README.txt25.2.drString found in binary or memory: http://lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion
        Source: R4SZPhslZ.README.txt25.2.drString found in binary or memory: http://lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion
        Source: R4SZPhslZ.README.txt25.2.drString found in binary or memory: http://lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion
        Source: R4SZPhslZ.README.txt25.2.drString found in binary or memory: http://lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion
        Source: R4SZPhslZ.README.txt25.2.drString found in binary or memory: http://lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion
        Source: R4SZPhslZ.README.txt12.2.drString found in binary or memory: http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/
        Source: R4SZPhslZ.README.txt12.2.drString found in binary or memory: http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/
        Source: R4SZPhslZ.README.txt12.2.drString found in binary or memory: http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/
        Source: R4SZPhslZ.README.txt12.2.drString found in binary or memory: http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/
        Source: R4SZPhslZ.README.txt12.2.drString found in binary or memory: http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/
        Source: R4SZPhslZ.README.txt12.2.drString found in binary or memory: http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/
        Source: R4SZPhslZ.README.txt12.2.drString found in binary or memory: http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/
        Source: R4SZPhslZ.README.txt12.2.drString found in binary or memory: http://fmtvvg3x5rs7tagzcytmfmffnihnte6gllkljufyz534hfpqhfyg2dad.onion
        Source: R4SZPhslZ.README.txt12.2.drString found in binary or memory: http://lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion
        Source: R4SZPhslZ.README.txt12.2.drString found in binary or memory: http://lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion
        Source: R4SZPhslZ.README.txt12.2.drString found in binary or memory: http://lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion
        Source: R4SZPhslZ.README.txt12.2.drString found in binary or memory: http://lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion
        Source: R4SZPhslZ.README.txt12.2.drString found in binary or memory: http://lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion
        Source: R4SZPhslZ.README.txt12.2.drString found in binary or memory: http://lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion
        Source: R4SZPhslZ.README.txt12.2.drString found in binary or memory: http://lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion
        Source: R4SZPhslZ.README.txt12.2.drString found in binary or memory: http://lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion
        Source: R4SZPhslZ.README.txt12.2.drString found in binary or memory: http://lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion
        Source: R4SZPhslZ.README.txt12.2.drString found in binary or memory: http://lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion
        Source: R4SZPhslZ.README.txt2.2.drString found in binary or memory: http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/
        Source: R4SZPhslZ.README.txt2.2.drString found in binary or memory: http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/
        Source: R4SZPhslZ.README.txt2.2.drString found in binary or memory: http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/
        Source: R4SZPhslZ.README.txt2.2.drString found in binary or memory: http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/
        Source: R4SZPhslZ.README.txt2.2.drString found in binary or memory: http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/
        Source: R4SZPhslZ.README.txt2.2.drString found in binary or memory: http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/
        Source: R4SZPhslZ.README.txt2.2.drString found in binary or memory: http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/
        Source: R4SZPhslZ.README.txt2.2.drString found in binary or memory: http://fmtvvg3x5rs7tagzcytmfmffnihnte6gllkljufyz534hfpqhfyg2dad.onion
        Source: R4SZPhslZ.README.txt2.2.drString found in binary or memory: http://lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion
        Source: R4SZPhslZ.README.txt2.2.drString found in binary or memory: http://lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion
        Source: R4SZPhslZ.README.txt2.2.drString found in binary or memory: http://lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion
        Source: R4SZPhslZ.README.txt2.2.drString found in binary or memory: http://lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion
        Source: R4SZPhslZ.README.txt2.2.drString found in binary or memory: http://lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion
        Source: R4SZPhslZ.README.txt2.2.drString found in binary or memory: http://lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion
        Source: R4SZPhslZ.README.txt2.2.drString found in binary or memory: http://lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion
        Source: R4SZPhslZ.README.txt2.2.drString found in binary or memory: http://lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion
        Source: R4SZPhslZ.README.txt2.2.drString found in binary or memory: http://lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion
        Source: R4SZPhslZ.README.txt2.2.drString found in binary or memory: http://lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion
        Source: R4SZPhslZ.README.txt0.2.drString found in binary or memory: http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/
        Source: R4SZPhslZ.README.txt0.2.drString found in binary or memory: http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/
        Source: R4SZPhslZ.README.txt0.2.drString found in binary or memory: http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/
        Source: R4SZPhslZ.README.txt0.2.drString found in binary or memory: http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/
        Source: R4SZPhslZ.README.txt0.2.drString found in binary or memory: http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/
        Source: R4SZPhslZ.README.txt0.2.drString found in binary or memory: http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/
        Source: R4SZPhslZ.README.txt0.2.drString found in binary or memory: http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/
        Source: R4SZPhslZ.README.txt0.2.drString found in binary or memory: http://fmtvvg3x5rs7tagzcytmfmffnihnte6gllkljufyz534hfpqhfyg2dad.onion
        Source: R4SZPhslZ.README.txt0.2.drString found in binary or memory: http://lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion
        Source: R4SZPhslZ.README.txt0.2.drString found in binary or memory: http://lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion
        Source: R4SZPhslZ.README.txt0.2.drString found in binary or memory: http://lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion
        Source: R4SZPhslZ.README.txt0.2.drString found in binary or memory: http://lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion
        Source: R4SZPhslZ.README.txt0.2.drString found in binary or memory: http://lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion
        Source: R4SZPhslZ.README.txt0.2.drString found in binary or memory: http://lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion
        Source: R4SZPhslZ.README.txt0.2.drString found in binary or memory: http://lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion
        Source: R4SZPhslZ.README.txt0.2.drString found in binary or memory: http://lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion
        Source: R4SZPhslZ.README.txt0.2.drString found in binary or memory: http://lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion
        Source: R4SZPhslZ.README.txt0.2.drString found in binary or memory: http://lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion
        Source: R4SZPhslZ.README.txt42.2.drString found in binary or memory: http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/
        Source: R4SZPhslZ.README.txt42.2.drString found in binary or memory: http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/
        Source: R4SZPhslZ.README.txt42.2.drString found in binary or memory: http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/
        Source: R4SZPhslZ.README.txt42.2.drString found in binary or memory: http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/
        Source: R4SZPhslZ.README.txt42.2.drString found in binary or memory: http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/
        Source: R4SZPhslZ.README.txt42.2.drString found in binary or memory: http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/
        Source: R4SZPhslZ.README.txt42.2.drString found in binary or memory: http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/
        Source: R4SZPhslZ.README.txt42.2.drString found in binary or memory: http://fmtvvg3x5rs7tagzcytmfmffnihnte6gllkljufyz534hfpqhfyg2dad.onion
        Source: R4SZPhslZ.README.txt42.2.drString found in binary or memory: http://lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion
        Source: R4SZPhslZ.README.txt42.2.drString found in binary or memory: http://lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion
        Source: R4SZPhslZ.README.txt42.2.drString found in binary or memory: http://lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion
        Source: R4SZPhslZ.README.txt42.2.drString found in binary or memory: http://lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion
        Source: R4SZPhslZ.README.txt42.2.drString found in binary or memory: http://lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion
        Source: R4SZPhslZ.README.txt42.2.drString found in binary or memory: http://lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion
        Source: R4SZPhslZ.README.txt42.2.drString found in binary or memory: http://lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion
        Source: R4SZPhslZ.README.txt42.2.drString found in binary or memory: http://lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion
        Source: R4SZPhslZ.README.txt42.2.drString found in binary or memory: http://lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion
        Source: R4SZPhslZ.README.txt42.2.drString found in binary or memory: http://lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion
        Source: R4SZPhslZ.README.txt31.2.drString found in binary or memory: http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/
        Source: R4SZPhslZ.README.txt31.2.drString found in binary or memory: http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/
        Source: R4SZPhslZ.README.txt31.2.drString found in binary or memory: http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/
        Source: R4SZPhslZ.README.txt31.2.drString found in binary or memory: http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/
        Source: R4SZPhslZ.README.txt31.2.drString found in binary or memory: http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/
        Source: R4SZPhslZ.README.txt31.2.drString found in binary or memory: http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/
        Source: R4SZPhslZ.README.txt31.2.drString found in binary or memory: http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/
        Source: R4SZPhslZ.README.txt31.2.drString found in binary or memory: http://fmtvvg3x5rs7tagzcytmfmffnihnte6gllkljufyz534hfpqhfyg2dad.onion
        Source: R4SZPhslZ.README.txt31.2.drString found in binary or memory: http://lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion
        Source: R4SZPhslZ.README.txt31.2.drString found in binary or memory: http://lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion
        Source: R4SZPhslZ.README.txt31.2.drString found in binary or memory: http://lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion
        Source: R4SZPhslZ.README.txt31.2.drString found in binary or memory: http://lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion
        Source: R4SZPhslZ.README.txt31.2.drString found in binary or memory: http://lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion
        Source: R4SZPhslZ.README.txt31.2.drString found in binary or memory: http://lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion
        Source: R4SZPhslZ.README.txt31.2.drString found in binary or memory: http://lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion
        Source: R4SZPhslZ.README.txt31.2.drString found in binary or memory: http://lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion
        Source: R4SZPhslZ.README.txt31.2.drString found in binary or memory: http://lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion
        Source: R4SZPhslZ.README.txt31.2.drString found in binary or memory: http://lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion
        Source: R4SZPhslZ.README.txt33.2.drString found in binary or memory: http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/
        Source: R4SZPhslZ.README.txt33.2.drString found in binary or memory: http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/
        Source: R4SZPhslZ.README.txt33.2.drString found in binary or memory: http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/
        Source: R4SZPhslZ.README.txt33.2.drString found in binary or memory: http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/
        Source: R4SZPhslZ.README.txt33.2.drString found in binary or memory: http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/
        Source: R4SZPhslZ.README.txt33.2.drString found in binary or memory: http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/
        Source: R4SZPhslZ.README.txt33.2.drString found in binary or memory: http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/
        Source: R4SZPhslZ.README.txt33.2.drString found in binary or memory: http://fmtvvg3x5rs7tagzcytmfmffnihnte6gllkljufyz534hfpqhfyg2dad.onion
        Source: R4SZPhslZ.README.txt33.2.drString found in binary or memory: http://lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion
        Source: R4SZPhslZ.README.txt33.2.drString found in binary or memory: http://lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion
        Source: R4SZPhslZ.README.txt33.2.drString found in binary or memory: http://lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion
        Source: R4SZPhslZ.README.txt33.2.drString found in binary or memory: http://lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion
        Source: R4SZPhslZ.README.txt33.2.drString found in binary or memory: http://lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion
        Source: R4SZPhslZ.README.txt33.2.drString found in binary or memory: http://lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion
        Source: R4SZPhslZ.README.txt33.2.drString found in binary or memory: http://lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion
        Source: R4SZPhslZ.README.txt33.2.drString found in binary or memory: http://lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion
        Source: R4SZPhslZ.README.txt33.2.drString found in binary or memory: http://lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion
        Source: R4SZPhslZ.README.txt33.2.drString found in binary or memory: http://lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion
        Source: R4SZPhslZ.README.txt11.2.drString found in binary or memory: http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/
        Source: R4SZPhslZ.README.txt11.2.drString found in binary or memory: http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/
        Source: R4SZPhslZ.README.txt11.2.drString found in binary or memory: http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/
        Source: R4SZPhslZ.README.txt11.2.drString found in binary or memory: http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/
        Source: R4SZPhslZ.README.txt11.2.drString found in binary or memory: http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/
        Source: R4SZPhslZ.README.txt11.2.drString found in binary or memory: http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/
        Source: R4SZPhslZ.README.txt11.2.drString found in binary or memory: http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/
        Source: R4SZPhslZ.README.txt11.2.drString found in binary or memory: http://fmtvvg3x5rs7tagzcytmfmffnihnte6gllkljufyz534hfpqhfyg2dad.onion
        Source: R4SZPhslZ.README.txt11.2.drString found in binary or memory: http://lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion
        Source: R4SZPhslZ.README.txt11.2.drString found in binary or memory: http://lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion
        Source: R4SZPhslZ.README.txt11.2.drString found in binary or memory: http://lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion
        Source: R4SZPhslZ.README.txt11.2.drString found in binary or memory: http://lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion
        Source: R4SZPhslZ.README.txt11.2.drString found in binary or memory: http://lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion
        Source: R4SZPhslZ.README.txt11.2.drString found in binary or memory: http://lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion
        Source: R4SZPhslZ.README.txt11.2.drString found in binary or memory: http://lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion
        Source: R4SZPhslZ.README.txt11.2.drString found in binary or memory: http://lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion
        Source: R4SZPhslZ.README.txt11.2.drString found in binary or memory: http://lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion
        Source: R4SZPhslZ.README.txt11.2.drString found in binary or memory: http://lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion
        Source: R4SZPhslZ.README.txt45.2.drString found in binary or memory: http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/
        Source: R4SZPhslZ.README.txt45.2.drString found in binary or memory: http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/
        Source: R4SZPhslZ.README.txt45.2.drString found in binary or memory: http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/
        Source: R4SZPhslZ.README.txt45.2.drString found in binary or memory: http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/
        Source: R4SZPhslZ.README.txt45.2.drString found in binary or memory: http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/
        Source: R4SZPhslZ.README.txt45.2.drString found in binary or memory: http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/
        Source: R4SZPhslZ.README.txt45.2.drString found in binary or memory: http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/
        Source: R4SZPhslZ.README.txt45.2.drString found in binary or memory: http://fmtvvg3x5rs7tagzcytmfmffnihnte6gllkljufyz534hfpqhfyg2dad.onion
        Source: R4SZPhslZ.README.txt45.2.drString found in binary or memory: http://lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion
        Source: R4SZPhslZ.README.txt45.2.drString found in binary or memory: http://lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion
        Source: R4SZPhslZ.README.txt45.2.drString found in binary or memory: http://lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion
        Source: R4SZPhslZ.README.txt45.2.drString found in binary or memory: http://lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion
        Source: R4SZPhslZ.README.txt45.2.drString found in binary or memory: http://lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion
        Source: R4SZPhslZ.README.txt45.2.drString found in binary or memory: http://lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion
        Source: R4SZPhslZ.README.txt45.2.drString found in binary or memory: http://lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion
        Source: R4SZPhslZ.README.txt45.2.drString found in binary or memory: http://lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion
        Source: R4SZPhslZ.README.txt45.2.drString found in binary or memory: http://lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion
        Source: R4SZPhslZ.README.txt45.2.drString found in binary or memory: http://lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion
        Source: R4SZPhslZ.README.txt20.2.drString found in binary or memory: http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/
        Source: R4SZPhslZ.README.txt20.2.drString found in binary or memory: http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/
        Source: R4SZPhslZ.README.txt20.2.drString found in binary or memory: http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/
        Source: R4SZPhslZ.README.txt20.2.drString found in binary or memory: http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/
        Source: R4SZPhslZ.README.txt20.2.drString found in binary or memory: http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/
        Source: R4SZPhslZ.README.txt20.2.drString found in binary or memory: http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/
        Source: R4SZPhslZ.README.txt20.2.drString found in binary or memory: http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/
        Source: R4SZPhslZ.README.txt20.2.drString found in binary or memory: http://fmtvvg3x5rs7tagzcytmfmffnihnte6gllkljufyz534hfpqhfyg2dad.onion
        Source: R4SZPhslZ.README.txt20.2.drString found in binary or memory: http://lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion
        Source: R4SZPhslZ.README.txt20.2.drString found in binary or memory: http://lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion
        Source: R4SZPhslZ.README.txt20.2.drString found in binary or memory: http://lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion
        Source: R4SZPhslZ.README.txt20.2.drString found in binary or memory: http://lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion
        Source: R4SZPhslZ.README.txt20.2.drString found in binary or memory: http://lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion
        Source: R4SZPhslZ.README.txt20.2.drString found in binary or memory: http://lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion
        Source: R4SZPhslZ.README.txt20.2.drString found in binary or memory: http://lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion
        Source: R4SZPhslZ.README.txt20.2.drString found in binary or memory: http://lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion
        Source: R4SZPhslZ.README.txt20.2.drString found in binary or memory: http://lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion
        Source: R4SZPhslZ.README.txt20.2.drString found in binary or memory: http://lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion
        Source: R4SZPhslZ.README.txt16.2.drString found in binary or memory: http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/
        Source: R4SZPhslZ.README.txt16.2.drString found in binary or memory: http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/
        Source: R4SZPhslZ.README.txt16.2.drString found in binary or memory: http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/
        Source: R4SZPhslZ.README.txt16.2.drString found in binary or memory: http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/
        Source: R4SZPhslZ.README.txt16.2.drString found in binary or memory: http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/
        Source: R4SZPhslZ.README.txt16.2.drString found in binary or memory: http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/
        Source: R4SZPhslZ.README.txt16.2.drString found in binary or memory: http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/
        Source: R4SZPhslZ.README.txt16.2.drString found in binary or memory: http://fmtvvg3x5rs7tagzcytmfmffnihnte6gllkljufyz534hfpqhfyg2dad.onion
        Source: R4SZPhslZ.README.txt16.2.drString found in binary or memory: http://lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion
        Source: R4SZPhslZ.README.txt16.2.drString found in binary or memory: http://lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion
        Source: R4SZPhslZ.README.txt16.2.drString found in binary or memory: http://lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion
        Source: R4SZPhslZ.README.txt16.2.drString found in binary or memory: http://lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion
        Source: R4SZPhslZ.README.txt16.2.drString found in binary or memory: http://lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion
        Source: R4SZPhslZ.README.txt16.2.drString found in binary or memory: http://lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion
        Source: R4SZPhslZ.README.txt16.2.drString found in binary or memory: http://lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion
        Source: R4SZPhslZ.README.txt16.2.drString found in binary or memory: http://lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion
        Source: R4SZPhslZ.README.txt16.2.drString found in binary or memory: http://lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion
        Source: R4SZPhslZ.README.txt16.2.drString found in binary or memory: http://lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion
        Source: SPLC071.tmp.2.drString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
        Source: SPLC071.tmp.2.drString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
        Source: SPLC071.tmp.2.drString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
        Source: R4SZPhslZ.README.txt34.2.drString found in binary or memory: http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/
        Source: R4SZPhslZ.README.txt34.2.drString found in binary or memory: http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/
        Source: R4SZPhslZ.README.txt34.2.drString found in binary or memory: http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/
        Source: R4SZPhslZ.README.txt34.2.drString found in binary or memory: http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/
        Source: R4SZPhslZ.README.txt34.2.drString found in binary or memory: http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/
        Source: R4SZPhslZ.README.txt34.2.drString found in binary or memory: http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/
        Source: R4SZPhslZ.README.txt34.2.drString found in binary or memory: http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/
        Source: R4SZPhslZ.README.txt34.2.drString found in binary or memory: http://fmtvvg3x5rs7tagzcytmfmffnihnte6gllkljufyz534hfpqhfyg2dad.onion
        Source: R4SZPhslZ.README.txt34.2.drString found in binary or memory: http://lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion
        Source: R4SZPhslZ.README.txt34.2.drString found in binary or memory: http://lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion
        Source: R4SZPhslZ.README.txt34.2.drString found in binary or memory: http://lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion
        Source: R4SZPhslZ.README.txt34.2.drString found in binary or memory: http://lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion
        Source: R4SZPhslZ.README.txt34.2.drString found in binary or memory: http://lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion
        Source: R4SZPhslZ.README.txt34.2.drString found in binary or memory: http://lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion
        Source: R4SZPhslZ.README.txt34.2.drString found in binary or memory: http://lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion
        Source: R4SZPhslZ.README.txt34.2.drString found in binary or memory: http://lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion
        Source: R4SZPhslZ.README.txt34.2.drString found in binary or memory: http://lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion
        Source: R4SZPhslZ.README.txt34.2.drString found in binary or memory: http://lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion
        Source: R4SZPhslZ.README.txt.2.drString found in binary or memory: http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/
        Source: R4SZPhslZ.README.txt.2.drString found in binary or memory: http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/
        Source: R4SZPhslZ.README.txt.2.drString found in binary or memory: http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/
        Source: R4SZPhslZ.README.txt.2.drString found in binary or memory: http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/
        Source: R4SZPhslZ.README.txt.2.drString found in binary or memory: http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/
        Source: R4SZPhslZ.README.txt.2.drString found in binary or memory: http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/
        Source: R4SZPhslZ.README.txt.2.drString found in binary or memory: http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/
        Source: R4SZPhslZ.README.txt.2.drString found in binary or memory: http://fmtvvg3x5rs7tagzcytmfmffnihnte6gllkljufyz534hfpqhfyg2dad.onion
        Source: R4SZPhslZ.README.txt.2.drString found in binary or memory: http://lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion
        Source: R4SZPhslZ.README.txt.2.drString found in binary or memory: http://lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion
        Source: R4SZPhslZ.README.txt.2.drString found in binary or memory: http://lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion
        Source: R4SZPhslZ.README.txt.2.drString found in binary or memory: http://lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion
        Source: R4SZPhslZ.README.txt.2.drString found in binary or memory: http://lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion
        Source: R4SZPhslZ.README.txt.2.drString found in binary or memory: http://lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion
        Source: R4SZPhslZ.README.txt.2.drString found in binary or memory: http://lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion
        Source: R4SZPhslZ.README.txt.2.drString found in binary or memory: http://lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion
        Source: R4SZPhslZ.README.txt.2.drString found in binary or memory: http://lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion
        Source: R4SZPhslZ.README.txt.2.drString found in binary or memory: http://lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion
        Source: R4SZPhslZ.README.txt9.2.drString found in binary or memory: http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/
        Source: R4SZPhslZ.README.txt9.2.drString found in binary or memory: http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/
        Source: R4SZPhslZ.README.txt9.2.drString found in binary or memory: http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/
        Source: R4SZPhslZ.README.txt9.2.drString found in binary or memory: http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/
        Source: R4SZPhslZ.README.txt9.2.drString found in binary or memory: http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/
        Source: R4SZPhslZ.README.txt9.2.drString found in binary or memory: http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/
        Source: R4SZPhslZ.README.txt9.2.drString found in binary or memory: http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/
        Source: R4SZPhslZ.README.txt9.2.drString found in binary or memory: http://fmtvvg3x5rs7tagzcytmfmffnihnte6gllkljufyz534hfpqhfyg2dad.onion
        Source: R4SZPhslZ.README.txt9.2.drString found in binary or memory: http://lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion
        Source: R4SZPhslZ.README.txt9.2.drString found in binary or memory: http://lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion
        Source: R4SZPhslZ.README.txt9.2.drString found in binary or memory: http://lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion
        Source: R4SZPhslZ.README.txt9.2.drString found in binary or memory: http://lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion
        Source: powershell.exe, 00000002.00000002.2200278350.0000000006C98000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.microsoft
        Source: svchost.exe, 00000010.00000002.2962386550.00000243D90D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.ver)
        Source: svchost.exe, 00000010.00000003.2202011966.00000243DE818000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.16.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
        Source: svchost.exe, 00000010.00000003.2202011966.00000243DE818000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
        Source: qmgr.db.16.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
        Source: qmgr.db.16.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
        Source: svchost.exe, 00000010.00000003.2202011966.00000243DE818000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.16.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
        Source: svchost.exe, 00000010.00000003.2202011966.00000243DE818000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.16.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
        Source: svchost.exe, 00000010.00000003.2202011966.00000243DE84D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.16.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
        Source: qmgr.db.16.drString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
        Source: R4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drString found in binary or memory: http://fmtvvg3x5rs7tagzcytmfmffnihnte6gllkljufyz534hfpqhfyg2dad.onion
        Source: splwow64.exe, 00000007.00000003.1880465376.00000000034F4000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1973120740.0000000004926000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1975383908.0000000004929000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fontfabrik.com
        Source: R4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drString found in binary or memory: http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/
        Source: R4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drString found in binary or memory: http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/
        Source: R4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drString found in binary or memory: http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/
        Source: R4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drString found in binary or memory: http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/
        Source: R4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drString found in binary or memory: http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/
        Source: R4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drString found in binary or memory: http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/
        Source: R4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drString found in binary or memory: http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/
        Source: powershell.exe, 00000002.00000002.2233034724.0000000008D05000.00000004.00000020.00020000.00000000.sdmp, R4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drString found in binary or memory: http://lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion
        Source: R4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drString found in binary or memory: http://lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion
        Source: R4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drString found in binary or memory: http://lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion
        Source: splwow64.exe, 00000007.00000003.1959073993.0000000003460000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1869970529.0000000001378000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1853655878.0000000001337000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1992257211.0000000004957000.00000004.00000020.00020000.00000000.sdmp, SPLC071.tmp.2.drString found in binary or memory: http://lockbitapt.uz
        Source: splwow64.exe, 00000007.00000003.1959073993.0000000003460000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1869970529.0000000001378000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1853655878.0000000001337000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1992257211.0000000004957000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
        Source: SPLC071.tmp.2.drString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
        Source: splwow64.exe, 00000007.00000003.1853057416.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.oniond)
        Source: splwow64.exe, 00000007.00000003.2007426280.0000000003460000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1907985075.0000000003460000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1973521592.0000000003460000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1880957077.0000000003460000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1856444833.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionf
        Source: R4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drString found in binary or memory: http://lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion
        Source: R4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drString found in binary or memory: http://lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion
        Source: R4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drString found in binary or memory: http://lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion
        Source: R4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drString found in binary or memory: http://lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion
        Source: R4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drString found in binary or memory: http://lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion
        Source: R4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drString found in binary or memory: http://lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion
        Source: R4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drString found in binary or memory: http://lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion
        Source: splwow64.exe, 00000007.00000003.1991987974.0000000003460000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1928423804.0000000004912000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1890333250.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1959073993.0000000003460000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1869970529.0000000001378000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1853655878.0000000001337000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1992257211.0000000004957000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1853971739.00000000048F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
        Source: powershell.exe, 00000002.00000002.2233034724.0000000008D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion7
        Source: powershell.exe, 00000002.00000002.2233034724.0000000008D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion=
        Source: splwow64.exe, 00000007.00000003.1856444833.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionF2t
        Source: SPLC071.tmp.2.drString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
        Source: splwow64.exe, 00000007.00000003.2007426280.0000000003460000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1907985075.0000000003460000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1973521592.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionf
        Source: splwow64.exe, 00000007.00000003.1880957077.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionfh
        Source: powershell.exe, 00000002.00000002.2233034724.0000000008D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionl
        Source: splwow64.exe, 00000007.00000003.1853057416.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionr
        Source: splwow64.exe, 00000007.00000003.1959073993.0000000003460000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1869970529.0000000001378000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1853655878.0000000001337000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1992257211.0000000004957000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1853971739.00000000048F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
        Source: SPLC071.tmp.2.drString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
        Source: splwow64.exe, 00000007.00000003.1907985075.0000000003460000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1880957077.0000000003460000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1856444833.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionf
        Source: splwow64.exe, 00000007.00000003.1973521592.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionfCFDD
        Source: powershell.exe, 00000002.00000002.2233034724.0000000008D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionq
        Source: splwow64.exe, 00000007.00000003.1959073993.0000000003460000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1869970529.0000000001378000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1853655878.0000000001337000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1992257211.0000000004957000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1853971739.00000000048F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupp.uz
        Source: splwow64.exe, 00000007.00000003.1907985075.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupp.uz86.odttf
        Source: SPLC071.tmp.2.drString found in binary or memory: http://lockbitsupp.uzFFFFFFFFFFFFFFFFFFFFF
        Source: splwow64.exe, 00000007.00000003.1973120740.0000000004926000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1943642199.0000000004926000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1942313132.0000000003460000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1975383908.0000000004929000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1941944131.0000000004925000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupp.uzece
        Source: splwow64.exe, 00000007.00000003.1992348137.000000000494C000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1926937398.0000000003460000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1990115023.000000000494C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lockbitsupp.uzst.piece
        Source: powershell.exe, 00000000.00000002.1768389685.000001FCC76EA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1729620148.000001FCB8DF6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2179450701.00000000057A8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
        Source: powershell.exe, 00000002.00000002.2151702881.00000000048FA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
        Source: splwow64.exe, 00000007.00000003.1922822050.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1908444051.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1904641294.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1902932973.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1923928296.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1921272632.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1918809769.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1922227299.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1920021037.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1908642548.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1908339706.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1903476855.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1905407224.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1910928694.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1930515690.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1914643216.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1903651903.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1917600906.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1927419405.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1926546352.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1918941893.0000000001379000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.mic
        Source: splwow64.exe, 00000007.00000003.2001836213.0000000001374000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1869344780.000000000138C000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1848714194.000000000135F000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1862701053.0000000001372000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1845875156.0000000001352000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1846225583.0000000001358000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1850874425.000000000136C000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1851759609.000000000136D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.open
        Source: splwow64.exe, 00000007.00000003.1845875156.0000000001352000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.openformatrg/package/2006/content-t
        Source: splwow64.exe, 00000007.00000003.2001836213.0000000001374000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1869344780.000000000138C000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1848714194.000000000135F000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1862701053.0000000001372000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1846225583.0000000001358000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1850874425.000000000136C000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1851759609.000000000136D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.openformatrg/package/2006/r
        Source: powershell.exe, 00000002.00000002.2151702881.00000000048FA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
        Source: powershell.exe, 00000000.00000002.1729620148.000001FCB7471000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2151702881.0000000004631000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
        Source: powershell.exe, 00000002.00000002.2151702881.00000000048FA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
        Source: powershell.exe, 00000000.00000002.1729620148.000001FCB8727000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
        Source: powershell.exe, 00000002.00000002.2151702881.00000000048FA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
        Source: powershell.exe, 00000002.00000002.2233034724.0000000008D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.microsoft.coD
        Source: powershell.exe, 00000000.00000002.1729620148.000001FCB7471000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore68
        Source: powershell.exe, 00000002.00000002.2151702881.0000000004631000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore6lB
        Source: powershell.exe, 00000002.00000002.2151702881.00000000048FA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/winsvr-2022-pshelp
        Source: R4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drString found in binary or memory: https://bitcoin.org
        Source: powershell.exe, 00000002.00000002.2179450701.00000000057A8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
        Source: powershell.exe, 00000002.00000002.2179450701.00000000057A8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
        Source: powershell.exe, 00000002.00000002.2179450701.00000000057A8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
        Source: R4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drString found in binary or memory: https://electrum.org/
        Source: svchost.exe, 00000010.00000003.2202011966.00000243DE8C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.16.drString found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
        Source: svchost.exe, 00000010.00000003.2202011966.00000243DE856000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.16.drString found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
        Source: svchost.exe, 00000010.00000003.2202011966.00000243DE8C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.16.drString found in binary or memory: https://g.live.com/odclientsettings/ProdV2
        Source: svchost.exe, 00000010.00000003.2202011966.00000243DE8A3000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.16.drString found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
        Source: svchost.exe, 00000010.00000003.2202011966.00000243DE8C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
        Source: powershell.exe, 00000002.00000002.2151702881.00000000048FA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
        Source: powershell.exe, 00000000.00000002.1768389685.000001FCC76EA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1729620148.000001FCB8DF6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2179450701.00000000057A8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
        Source: svchost.exe, 00000010.00000003.2202011966.00000243DE8C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.16.drString found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
        Source: svchost.exe, 00000010.00000003.2202011966.00000243DE856000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
        Source: powershell.exe, 00000000.00000002.1729620148.000001FCB8727000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneget.org
        Source: powershell.exe, 00000000.00000002.1729620148.000001FCB8727000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneget.orgX
        Source: R4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drString found in binary or memory: https://twitter.com/hashtag/lockbit?f=live.
        Source: R4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drString found in binary or memory: https://www.torproject.org/

        Spam, unwanted Advertisements and Ransom Demands

        barindex
        Found ransom note / readme
        Source: C:\Users\user\Documents\RAYHIWGKDI\R4SZPhslZ.README.txtDropped file: ~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~>>>>> You must pay us.Tor Browser Links BLOG where the stolen infortmation will be published:( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/>>>>> What is the guarantee that we won't scam you? We are the oldest extortion gang on the planet and nothing is more important to us than our reputation. We are not a politically motivated group and want nothing but financial rewards for our work. If we defraud even one client, other clients will not pay us. In 5 years, not a single client has been left dissatisfied after making a deal with us. If you pay the ransom, we will fulfill all the terms we agreed upon during the negotiation process. Treat this situation simply as a paid training session for your system administrators, because it was the misconfiguration of your corporate network that allowed us to attack you. Our pentesting services should be paid for the same way you pay your system administrators' salaries. You can get more information about us on Elon Musk's Twitter at https://twitter.com/hashtag/lockbit?f=live.>>>>> Warning! Do not delete or modify encrypted files, it will lead to irreversible problems with decryption of files!>>>>> Don't go to the police or the FBI for help and don't tell anyone that we attacked you. They will forbid you from paying the ransom and will not help you in any way, you will be left with encrypted files and your business will die.>>>>> When buying bitcoin, do not tell anyone the true purpose of the purchase. Some brokers, especially in the US, do not allow you to buy bitcoin to pay ransom. Communicate any other reason for the purchase, such as: personal investment in cryptocurrency, bitcoin as a gift, paying to buy assets for your business using bitcoin, cryptocurrency payment for consulting services, cryptocurrency payment for any other services, cryptocurrency donations, cryptocurrency donations for Donald Trump to win the election, buying bitcoin to participate in ICO and buy other cryptocurrencies, buying cryptocurrencies to leave an inheritance for your children, or any other purpose for buying cryptocurrency. Also you can use adequate cryptocurrency brokers who do not ask questions for what you buy cryptocurrency.>>>>> After buying cryptocurrency from a broker, store the cryptocurrency on a Jump to dropped file
        Yara detected LockBit ransomware
        Source: Yara matchFile source: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000002.00000002.2233034724.0000000008D05000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000002.00000002.2179450701.0000000005AB4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3228, type: MEMORYSTR
        Changes the wallpaper picture
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeKey value created or modified: HKEY_CURRENT_USER\Control Panel\Desktop WallPaper C:\ProgramData\R4SZPhslZ.bmpJump to behavior
        Found potential ransomware demand text
        Source: powershell.exe, 00000002.00000002.2233034724.0000000008D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encrypted
        Source: powershell.exe, 00000002.00000002.2233034724.0000000008D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encryptedJhCS
        Source: powershell.exe, 00000002.00000002.2233034724.0000000008D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encrypted*k
        Source: powershell.exe, 00000002.00000002.2233034724.0000000008D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encryptedT
        Source: powershell.exe, 00000002.00000002.2233034724.0000000008D05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encryptedFkGRN
        Source: powershell.exe, 00000002.00000002.2233034724.0000000008E1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encrypted
        Source: splwow64.exe, 00000007.00000003.1972930661.000000000493D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : 3,55;148,55;155,54;146,55;150,55;135,54;134" UnicodeString="Your data are stolen and encrypted" />
        Source: splwow64.exe, 00000007.00000003.1866058930.0000000004902000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encryptedy
        Source: splwow64.exe, 00000007.00000003.1866058930.0000000004902000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" FontUri="/Documents/1/Resources/Fonts/0AF3B488-70C1-4390-8088-D2E866B44856.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="3139.2" OriginY="7098.08" Indices="28,55;145,54;151,55;148,55;3,55;134,54;131,55;150,55;131,55;3,54;131,55;148,55;135,55;3,54;149,55;150,55;145,55;142,54;135,55;144,55;3,55;131,54;144,55;134,55;3,55;135,54;144,55;133,55;148,55;155,54;146,55;150,55;135,54;134" UnicodeString="Your data are stolen and encrypted" />
        Source: splwow64.exe, 00000007.00000003.2006077383.000000000494B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encryptedb(/
        Source: splwow64.exe, 00000007.00000003.1869861702.0000000001378000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" FontUri="/Documents/1/Resources/Fonts/0AF3B488-70C1-4390-8088-D2E866B44856.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="3139.2" OriginY="7098.08" Indices="28,55;145,54;151,55;148,55;3,55;134,54;131,55;150,55;131,55;3,54;131,55;148,55;135,55;3,54;149,55;150,55;145,55;142,54;135,55;144,55;3,55;131,54;144,55;134,55;3,55;135,54;144,55;133,55;148,55;155,54;146,55;150,55;135,54;134" UnicodeString="Your data are stolen and encrypted" />
        Source: splwow64.exe, 00000007.00000003.1926937398.00000000034F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encryptedlz
        Source: splwow64.exe, 00000007.00000003.1865185930.0000000001337000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : codeString="Your data are stolen and encrypted" />
        Source: splwow64.exe, 00000007.00000003.1890333250.00000000034E8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" FontUri="/Documents/1/Resources/Fonts/83F5B0FC-7EDF-4D43-BE64-8404DFFEC286.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="3139.2" OriginY="7098.08" Indices="28,55;145,54;151,55;148,55;3,55;134,54;131,55;150,55;131,55;3,54;131,55;148,55;135,55;3,54;149,55;150,55;145,55;142,54;135,55;144,55;3,55;131,54;144,55;134,55;3,55;135,54;144,55;133,55;148,55;155,54;146,55;150,55;135,54;134" UnicodeString="Your data are stolen and encrypted" />
        Source: splwow64.exe, 00000007.00000003.1856821488.0000000001337000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : codeString="Your data are stolen and encrypted" />
        Source: splwow64.exe, 00000007.00000003.2008715870.000000000494B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encryptedb(/
        Source: splwow64.exe, 00000007.00000003.1883181951.0000000004902000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encrypted52,54;152,55;619,5={
        Source: splwow64.exe, 00000007.00000003.1890480792.0000000004902000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encrypted
        Source: splwow64.exe, 00000007.00000003.1899887682.0000000001337000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : codeString="Your data are stolen and encrypted" />
        Source: splwow64.exe, 00000007.00000003.1992348137.000000000494C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" FontUri="/Documents/1/Resources/Fonts/3119B11C-7394-4573-A98E-74D2182A87C0.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="3139.2" OriginY="7098.08" Indices="28,55;145,54;151,55;148,55;3,55;134,54;131,55;150,55;131,55;3,54;131,55;148,55;135,55;3,54;149,55;150,55;145,55;142,54;135,55;144,55;3,55;131,54;144,55;134,55;3,55;135,54;144,55;133,55;148,55;155,54;146,55;150,55;135,54;134" UnicodeString="Your data are stolen and encrypted" />
        Source: splwow64.exe, 00000007.00000003.2007426280.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" FontUri="/Documents/1/Resources/Fonts/0E9009E4-B0A0-4674-B281-2B1028C83AC7.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="3139.2" OriginY="7098.08" Indices="28,55;145,54;151,55;148,55;3,55;134,54;131,55;150,55;131,55;3,54;131,55;148,55;135,55;3,54;149,55;150,55;145,55;142,54;135,55;144,55;3,55;131,54;144,55;134,55;3,55;135,54;144,55;133,55;148,55;155,54;146,55;150,55;135,54;134" UnicodeString="Your data are stolen and encrypted" />
        Source: splwow64.exe, 00000007.00000003.1909744193.00000000034E3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" FontUri="/Documents/1/Resources/Fonts/83F5B0FC-7EDF-4D43-BE64-8404DFFEC286.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="3139.2" OriginY="7098.08" Indices="28,55;145,54;151,55;148,55;3,55;134,54;131,55;150,55;131,55;3,54;131,55;148,55;135,55;3,54;149,55;150,55;145,55;142,54;135,55;144,55;3,55;131,54;144,55;134,55;3,55;135,54;144,55;133,55;148,55;155,54;146,55;150,55;135,54;134" UnicodeString="Your data are stolen and encrypted" />
        Source: splwow64.exe, 00000007.00000003.1874155658.0000000004902000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encryptedntgEmSize=
        Source: splwow64.exe, 00000007.00000003.1874155658.0000000004902000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" FontUri="/Documents/1/Resources/Fonts/0AF3B488-70C1-4390-8088-D2E866B44856.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="3139.2" OriginY="7098.08" Indices="28,55;145,54;151,55;148,55;3,55;134,54;131,55;150,55;131,55;3,54;131,55;148,55;135,55;3,54;149,55;150,55;145,55;142,54;135,55;144,55;3,55;131,54;144,55;134,55;3,55;135,54;144,55;133,55;148,55;155,54;146,55;150,55;135,54;134" UnicodeString="Your data are stolen and encrypted" />
        Source: splwow64.exe, 00000007.00000003.1915882429.0000000001337000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : codeString="Your data are stolen and encrypted" />
        Source: splwow64.exe, 00000007.00000003.1926937398.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" FontUri="/Documents/1/Resources/Fonts/CFEEDDE3-D75F-41BD-8D73-00D8323CA112.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="3139.2" OriginY="7098.08" Indices="28,55;145,54;151,55;148,55;3,55;134,54;131,55;150,55;131,55;3,54;131,55;148,55;135,55;3,54;149,55;150,55;145,55;142,54;135,55;144,55;3,55;131,54;144,55;134,55;3,55;135,54;144,55;133,55;148,55;155,54;146,55;150,55;135,54;134" UnicodeString="Your data are stolen and encrypted" />
        Source: splwow64.exe, 00000007.00000003.1926937398.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" FontUri="/Documents/1/Resources/Fonts/83F5B0FC-7EDF-4D43-BE64-8404DFFEC286.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="3139.2" OriginY="7098.08" Indices="28,55;145,54;151,55;148,55;3,55;134,54;131,55;150,55;131,55;3,54;131,55;148,55;135,55;3,54;149,55;150,55;145,55;142,54;135,55;144,55;3,55;131,54;144,55;134,55;3,55;135,54;144,55;133,55;148,55;155,54;146,55;150,55;135,54;134" UnicodeString="Your data are stolen and encrypted" />
        Source: splwow64.exe, 00000007.00000003.1880539149.0000000004902000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encrypted52,54;152,55;619,5={
        Source: splwow64.exe, 00000007.00000003.1937328355.0000000001337000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : codeString="Your data are stolen and encrypted" />
        Source: splwow64.exe, 00000007.00000003.1973521592.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" FontUri="/Documents/1/Resources/Fonts/D7980DA3-69EC-44A5-8C21-685D4DDC9DAE.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="3139.2" OriginY="7098.08" Indices="28,55;145,54;151,55;148,55;3,55;134,54;131,55;150,55;131,55;3,54;131,55;148,55;135,55;3,54;149,55;150,55;145,55;142,54;135,55;144,55;3,55;131,54;144,55;134,55;3,55;135,54;144,55;133,55;148,55;155,54;146,55;150,55;135,54;134" UnicodeString="Your data are stolen and encrypted" />
        Source: splwow64.exe, 00000007.00000003.1973521592.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" FontUri="/Documents/1/Resources/Fonts/F9E92A3F-BD32-41F4-89D1-383D21643338.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="3139.2" OriginY="7098.08" Indices="28,55;145,54;151,55;148,55;3,55;134,54;131,55;150,55;131,55;3,54;131,55;148,55;135,55;3,54;149,55;150,55;145,55;142,54;135,55;144,55;3,55;131,54;144,55;134,55;3,55;135,54;144,55;133,55;148,55;155,54;146,55;150,55;135,54;134" UnicodeString="Your data are stolen and encrypted" />
        Source: splwow64.exe, 00000007.00000003.1880957077.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encrypted
        Source: splwow64.exe, 00000007.00000003.1959232402.0000000004926000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" FontUri="/Documents/1/Resources/Fonts/D7980DA3-69EC-44A5-8C21-685D4DDC9DAE.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="3139.2" OriginY="7098.08" Indices="28,55;145,54;151,55;148,55;3,55;134,54;131,55;150,55;131,55;3,54;131,55;148,55;135,55;3,54;149,55;150,55;145,55;142,54;135,55;144,55;3,55;131,54;144,55;134,55;3,55;135,54;144,55;133,55;148,55;155,54;146,55;150,55;135,54;134" UnicodeString="Your data are stolen and encrypted" />
        Source: splwow64.exe, 00000007.00000003.1942313132.00000000034F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encrypted
        Source: splwow64.exe, 00000007.00000003.1909691654.000000000490D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" FontUri="/Documents/1/Resources/Fonts/83F5B0FC-7EDF-4D43-BE64-8404DFFEC286.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="3139.2" OriginY="7098.08" Indices="28,55;145,54;151,55;148,55;3,55;134,54;131,55;150,55;131,55;3,54;131,55;148,55;135,55;3,54;149,55;150,55;145,55;142,54;135,55;144,55;3,55;131,54;144,55;134,55;3,55;135,54;144,55;133,55;148,55;155,54;146,55;150,55;135,54;134" UnicodeString="Your data are stolen and encrypted" />
        Source: splwow64.exe, 00000007.00000003.1942313132.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encryptedls}
        Source: splwow64.exe, 00000007.00000003.1942313132.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" FontUri="/Documents/1/Resources/Fonts/3909338E-F9CD-475F-BB5B-969B074E79C6.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="3139.2" OriginY="7098.08" Indices="28,55;145,54;151,55;148,55;3,55;134,54;131,55;150,55;131,55;3,54;131,55;148,55;135,55;3,54;149,55;150,55;145,55;142,54;135,55;144,55;3,55;131,54;144,55;134,55;3,55;135,54;144,55;133,55;148,55;155,54;146,55;150,55;135,54;134" UnicodeString="Your data are stolen and encrypted" />
        Source: splwow64.exe, 00000007.00000003.1942313132.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" FontUri="/Documents/1/Resources/Fonts/83F5B0FC-7EDF-4D43-BE64-8404DFFEC286.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="3139.2" OriginY="7098.08" Indices="28,55;145,54;151,55;148,55;3,55;134,54;131,55;150,55;131,55;3,54;131,55;148,55;135,55;3,54;149,55;150,55;145,55;142,54;135,55;144,55;3,55;131,54;144,55;134,55;3,55;135,54;144,55;133,55;148,55;155,54;146,55;150,55;135,54;134" UnicodeString="Your data are stolen and encrypted" />
        Source: splwow64.exe, 00000007.00000003.1942313132.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" FontUri="/Documents/1/Resources/Fonts/CFEEDDE3-D75F-41BD-8D73-00D8323CA112.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="3139.2" OriginY="7098.08" Indices="28,55;145,54;151,55;148,55;3,55;134,54;131,55;150,55;131,55;3,54;131,55;148,55;135,55;3,54;149,55;150,55;145,55;142,54;135,55;144,55;3,55;131,54;144,55;134,55;3,55;135,54;144,55;133,55;148,55;155,54;146,55;150,55;135,54;134" UnicodeString="Your data are stolen and encrypted" />
        Source: splwow64.exe, 00000007.00000003.1856444833.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encryptedsy
        Source: splwow64.exe, 00000007.00000003.1907555510.00000000034E3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" FontUri="/Documents/1/Resources/Fonts/83F5B0FC-7EDF-4D43-BE64-8404DFFEC286.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="3139.2" OriginY="7098.08" Indices="28,55;145,54;151,55;148,55;3,55;134,54;131,55;150,55;131,55;3,54;131,55;148,55;135,55;3,54;149,55;150,55;145,55;142,54;135,55;144,55;3,55;131,54;144,55;134,55;3,55;135,54;144,55;133,55;148,55;155,54;146,55;150,55;135,54;134" UnicodeString="Your data are stolen and encrypted" />
        Source: splwow64.exe, 00000007.00000003.1870122813.0000000001378000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" FontUri="/Documents/1/Resources/Fonts/0AF3B488-70C1-4390-8088-D2E866B44856.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="3139.2" OriginY="7098.08" Indices="28,55;145,54;151,55;148,55;3,55;134,54;131,55;150,55;131,55;3,54;131,55;148,55;135,55;3,54;149,55;150,55;145,55;142,54;135,55;144,55;3,55;131,54;144,55;134,55;3,55;135,54;144,55;133,55;148,55;155,54;146,55;150,55;135,54;134" UnicodeString="Your data are stolen and encrypted" />
        Source: splwow64.exe, 00000007.00000003.2008183090.000000000496E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" FontUri="/Documents/1/Resources/Fonts/0E9009E4-B0A0-4674-B281-2B1028C83AC7.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="3139.2" OriginY="7098.08" Indices="28,55;145,54;151,55;148,55;3,55;134,54;131,55;150,55;131,55;3,54;131,55;148,55;135,55;3,54;149,55;150,55;145,55;142,54;135,55;144,55;3,55;131,54;144,55;134,55;3,55;135,54;144,55;133,55;148,55;155,54;146,55;150,55;135,54;134" UnicodeString="Your data are stolen and encrypted" />
        Source: splwow64.exe, 00000007.00000003.1854019734.00000000034F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" FontUri="/Documents/1/Resources/Fonts/AC479D29-FD1C-403A-9092-5A6644CF95D4.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="3139.2" OriginY="7098.08" Indices="28,55;145,54;151,55;148,55;3,55;134,54;131,55;150,55;131,55;3,54;131,55;148,55;135,55;3,54;149,55;150,55;145,55;142,54;135,55;144,55;3,55;131,54;144,55;134,55;3,55;135,54;144,55;133,55;148,55;155,54;146,55;150,55;135,54;134" UnicodeString="Your data are stolen and encrypted" />
        Source: splwow64.exe, 00000007.00000003.1959576177.0000000004939000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : 54;146,55;150,55;135,54;134" UnicodeString="Your data are stolen and encrypted" />
        Source: splwow64.exe, 00000007.00000003.1870589082.0000000004902000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : Your data are stolen and encrypteds
        Source: splwow64.exe, 00000007.00000003.1870589082.0000000004902000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" FontUri="/Documents/1/Resources/Fonts/0AF3B488-70C1-4390-8088-D2E866B44856.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="3139.2" OriginY="7098.08" Indices="28,55;145,54;151,55;148,55;3,55;134,54;131,55;150,55;131,55;3,54;131,55;148,55;135,55;3,54;149,55;150,55;145,55;142,54;135,55;144,55;3,55;131,54;144,55;134,55;3,55;135,54;144,55;133,55;148,55;155,54;146,55;150,55;135,54;134" UnicodeString="Your data are stolen and encrypted" />
        Source: splwow64.exe, 00000007.00000003.1991987974.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" FontUri="/Documents/1/Resources/Fonts/D7980DA3-69EC-44A5-8C21-685D4DDC9DAE.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="3139.2" OriginY="7098.08" Indices="28,55;145,54;151,55;148,55;3,55;134,54;131,55;150,55;131,55;3,54;131,55;148,55;135,55;3,54;149,55;150,55;145,55;142,54;135,55;144,55;3,55;131,54;144,55;134,55;3,55;135,54;144,55;133,55;148,55;155,54;146,55;150,55;135,54;134" UnicodeString="Your data are stolen and encrypted" />
        Source: splwow64.exe, 00000007.00000003.1991987974.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" FontUri="/Documents/1/Resources/Fonts/3119B11C-7394-4573-A98E-74D2182A87C0.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="3139.2" OriginY="7098.08" Indices="28,55;145,54;151,55;148,55;3,55;134,54;131,55;150,55;131,55;3,54;131,55;148,55;135,55;3,54;149,55;150,55;145,55;142,54;135,55;144,55;3,55;131,54;144,55;134,55;3,55;135,54;144,55;133,55;148,55;155,54;146,55;150,55;135,54;134" UnicodeString="Your data are stolen and encrypted" />
        Source: splwow64.exe, 00000007.00000003.1991987974.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" FontUri="/Documents/1/Resources/Fonts/F9E92A3F-BD32-41F4-89D1-383D21643338.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="3139.2" OriginY="7098.08" Indices="28,55;145,54;151,55;148,55;3,55;134,54;131,55;150,55;131,55;3,54;131,55;148,55;135,55;3,54;149,55;150,55;145,55;142,54;135,55;144,55;3,55;131,54;144,55;134,55;3,55;135,54;144,55;133,55;148,55;155,54;146,55;150,55;135,54;134" UnicodeString="Your data are stolen and encrypted" />
        Source: splwow64.exe, 00000007.00000003.1959073993.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" FontUri="/Documents/1/Resources/Fonts/D7980DA3-69EC-44A5-8C21-685D4DDC9DAE.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="3139.2" OriginY="7098.08" Indices="28,55;145,54;151,55;148,55;3,55;134,54;131,55;150,55;131,55;3,54;131,55;148,55;135,55;3,54;149,55;150,55;145,55;142,54;135,55;144,55;3,55;131,54;144,55;134,55;3,55;135,54;144,55;133,55;148,55;155,54;146,55;150,55;135,54;134" UnicodeString="Your data are stolen and encrypted" />
        Source: splwow64.exe, 00000007.00000003.1959073993.0000000003460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" FontUri="/Documents/1/Resources/Fonts/3909338E-F9CD-475F-BB5B-969B074E79C6.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="3139.2" OriginY="7098.08" Indices="28,55;145,54;151,55;148,55;3,55;134,54;131,55;150,55;131,55;3,54;131,55;148,55;135,55;3,54;149,55;150,55;145,55;142,54;135,55;144,55;3,55;131,54;144,55;134,55;3,55;135,54;144,55;133,55;148,55;155,54;146,55;150,55;135,54;134" UnicodeString="Your data are stolen and encrypted" />
        Source: splwow64.exe, 00000007.00000003.1869970529.0000000001378000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : <Glyphs RenderTransform="0.062437,-0,0,0.0625521,0,0" Fill="#ff000000" FontUri="/Documents/1/Resources/Fonts/0AF3B488-70C1-4390-8088-D2E866B44856.odttf" FontRenderingEmSize="327.68" StyleSimulations="None" OriginX="3139.2" OriginY="7098.08" Indices="28,55;145,54;151,55;148,55;3,55;134,54;131,55;150,55;131,55;3,54;131,55;148,55;135,55;3,54;149,55;150,55;145,55;142,54;135,55;144,55;3,55;131,54;144,55;134,55;3,55;135,54;144,55;133,55;148,55;155,54;146,55;150,55;135,54;134" UnicodeString="Your data are stolen and encrypted" />
        Source: splwow64.exe, 00000007.00000003.1853655878.0000000001337000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory : codeString="Your data are stolen and encrypted" />
        Source: SPLC071.tmp.2.drString found in binary or memory : Your data are stolen and encryptedFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
        Modifies existing user documents (likely ransomware behavior)
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile moved: C:\Users\user\Desktop\NWTVCDUMOB.mp3Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile moved: C:\Users\user\Desktop\DVWHKMNFNN\IPKGELNTQY.mp3Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile moved: C:\Users\user\Desktop\NWTVCDUMOB.pdfJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile moved: C:\Users\user\Desktop\CURQNKVOIX.jpgJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile moved: C:\Users\user\Desktop\DVWHKMNFNN.xlsxJump to behavior
        Writes a notice file (html or txt) to demand a ransom
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile dropped: C:\Users\user\Documents\RAYHIWGKDI\R4SZPhslZ.README.txt -> decryption of files!>>>>> don't go to the police or the fbi for help and don't tell anyone that we attacked you. they will forbid you from paying the ransom and will not help you in any way, you will be left with encrypted files and your business will die.>>>>> when buying bitcoin, do not tell anyone the true purpose of the purchase. some brokers, especially in the us, do not allow you to buy bitcoin to pay ransom. communicate any other reason for the purchase, such as: personal investment in cryptocurrency, bitcoin as a gift, paying to buy assets for your business using bitcoin, cryptocurrency payment for consulting services, cryptocurrency payment for any other services, cryptocurrency donations, cryptocurrency donations for donald trump to win the election, buying bitcoin to participate in ico and buy other cryptocurrencies, buying cryptocurrencies to leave an inheritance for your children, or any other purpose for buying cryptocurrency. also you can use adequate cryptocurrency brokers who do not aJump to dropped file
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile dropped: C:\Users\user\Documents\QNCYCDFIJJ\R4SZPhslZ.README.txt -> decryption of files!>>>>> don't go to the police or the fbi for help and don't tell anyone that we attacked you. they will forbid you from paying the ransom and will not help you in any way, you will be left with encrypted files and your business will die.>>>>> when buying bitcoin, do not tell anyone the true purpose of the purchase. some brokers, especially in the us, do not allow you to buy bitcoin to pay ransom. communicate any other reason for the purchase, such as: personal investment in cryptocurrency, bitcoin as a gift, paying to buy assets for your business using bitcoin, cryptocurrency payment for consulting services, cryptocurrency payment for any other services, cryptocurrency donations, cryptocurrency donations for donald trump to win the election, buying bitcoin to participate in ico and buy other cryptocurrencies, buying cryptocurrencies to leave an inheritance for your children, or any other purpose for buying cryptocurrency. also you can use adequate cryptocurrency brokers who do not aJump to dropped file
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile dropped: C:\Users\user\Documents\PIVFAGEAAV\R4SZPhslZ.README.txt -> decryption of files!>>>>> don't go to the police or the fbi for help and don't tell anyone that we attacked you. they will forbid you from paying the ransom and will not help you in any way, you will be left with encrypted files and your business will die.>>>>> when buying bitcoin, do not tell anyone the true purpose of the purchase. some brokers, especially in the us, do not allow you to buy bitcoin to pay ransom. communicate any other reason for the purchase, such as: personal investment in cryptocurrency, bitcoin as a gift, paying to buy assets for your business using bitcoin, cryptocurrency payment for consulting services, cryptocurrency payment for any other services, cryptocurrency donations, cryptocurrency donations for donald trump to win the election, buying bitcoin to participate in ico and buy other cryptocurrencies, buying cryptocurrencies to leave an inheritance for your children, or any other purpose for buying cryptocurrency. also you can use adequate cryptocurrency brokers who do not aJump to dropped file
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile dropped: C:\Users\user\Documents\LTKMYBSEYZ\R4SZPhslZ.README.txt -> decryption of files!>>>>> don't go to the police or the fbi for help and don't tell anyone that we attacked you. they will forbid you from paying the ransom and will not help you in any way, you will be left with encrypted files and your business will die.>>>>> when buying bitcoin, do not tell anyone the true purpose of the purchase. some brokers, especially in the us, do not allow you to buy bitcoin to pay ransom. communicate any other reason for the purchase, such as: personal investment in cryptocurrency, bitcoin as a gift, paying to buy assets for your business using bitcoin, cryptocurrency payment for consulting services, cryptocurrency payment for any other services, cryptocurrency donations, cryptocurrency donations for donald trump to win the election, buying bitcoin to participate in ico and buy other cryptocurrencies, buying cryptocurrencies to leave an inheritance for your children, or any other purpose for buying cryptocurrency. also you can use adequate cryptocurrency brokers who do not aJump to dropped file
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile dropped: C:\Users\user\Documents\KATAXZVCPS\R4SZPhslZ.README.txt -> decryption of files!>>>>> don't go to the police or the fbi for help and don't tell anyone that we attacked you. they will forbid you from paying the ransom and will not help you in any way, you will be left with encrypted files and your business will die.>>>>> when buying bitcoin, do not tell anyone the true purpose of the purchase. some brokers, especially in the us, do not allow you to buy bitcoin to pay ransom. communicate any other reason for the purchase, such as: personal investment in cryptocurrency, bitcoin as a gift, paying to buy assets for your business using bitcoin, cryptocurrency payment for consulting services, cryptocurrency payment for any other services, cryptocurrency donations, cryptocurrency donations for donald trump to win the election, buying bitcoin to participate in ico and buy other cryptocurrencies, buying cryptocurrencies to leave an inheritance for your children, or any other purpose for buying cryptocurrency. also you can use adequate cryptocurrency brokers who do not aJump to dropped file
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile dropped: C:\R4SZPhslZ.README.txt -> decryption of files!>>>>> don't go to the police or the fbi for help and don't tell anyone that we attacked you. they will forbid you from paying the ransom and will not help you in any way, you will be left with encrypted files and your business will die.>>>>> when buying bitcoin, do not tell anyone the true purpose of the purchase. some brokers, especially in the us, do not allow you to buy bitcoin to pay ransom. communicate any other reason for the purchase, such as: personal investment in cryptocurrency, bitcoin as a gift, paying to buy assets for your business using bitcoin, cryptocurrency payment for consulting services, cryptocurrency payment for any other services, cryptocurrency donations, cryptocurrency donations for donald trump to win the election, buying bitcoin to participate in ico and buy other cryptocurrencies, buying cryptocurrencies to leave an inheritance for your children, or any other purpose for buying cryptocurrency. also you can use adequate cryptocurrency brokers who do not aJump to dropped file
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile dropped: C:\Users\R4SZPhslZ.README.txt -> decryption of files!>>>>> don't go to the police or the fbi for help and don't tell anyone that we attacked you. they will forbid you from paying the ransom and will not help you in any way, you will be left with encrypted files and your business will die.>>>>> when buying bitcoin, do not tell anyone the true purpose of the purchase. some brokers, especially in the us, do not allow you to buy bitcoin to pay ransom. communicate any other reason for the purchase, such as: personal investment in cryptocurrency, bitcoin as a gift, paying to buy assets for your business using bitcoin, cryptocurrency payment for consulting services, cryptocurrency payment for any other services, cryptocurrency donations, cryptocurrency donations for donald trump to win the election, buying bitcoin to participate in ico and buy other cryptocurrencies, buying cryptocurrencies to leave an inheritance for your children, or any other purpose for buying cryptocurrency. also you can use adequate cryptocurrency brokers who do not aJump to dropped file
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile dropped: C:\Users\user\R4SZPhslZ.README.txt -> decryption of files!>>>>> don't go to the police or the fbi for help and don't tell anyone that we attacked you. they will forbid you from paying the ransom and will not help you in any way, you will be left with encrypted files and your business will die.>>>>> when buying bitcoin, do not tell anyone the true purpose of the purchase. some brokers, especially in the us, do not allow you to buy bitcoin to pay ransom. communicate any other reason for the purchase, such as: personal investment in cryptocurrency, bitcoin as a gift, paying to buy assets for your business using bitcoin, cryptocurrency payment for consulting services, cryptocurrency payment for any other services, cryptocurrency donations, cryptocurrency donations for donald trump to win the election, buying bitcoin to participate in ico and buy other cryptocurrencies, buying cryptocurrencies to leave an inheritance for your children, or any other purpose for buying cryptocurrency. also you can use adequate cryptocurrency brokers who do not aJump to dropped file
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile dropped: C:\Users\user\Videos\R4SZPhslZ.README.txt -> decryption of files!>>>>> don't go to the police or the fbi for help and don't tell anyone that we attacked you. they will forbid you from paying the ransom and will not help you in any way, you will be left with encrypted files and your business will die.>>>>> when buying bitcoin, do not tell anyone the true purpose of the purchase. some brokers, especially in the us, do not allow you to buy bitcoin to pay ransom. communicate any other reason for the purchase, such as: personal investment in cryptocurrency, bitcoin as a gift, paying to buy assets for your business using bitcoin, cryptocurrency payment for consulting services, cryptocurrency payment for any other services, cryptocurrency donations, cryptocurrency donations for donald trump to win the election, buying bitcoin to participate in ico and buy other cryptocurrencies, buying cryptocurrencies to leave an inheritance for your children, or any other purpose for buying cryptocurrency. also you can use adequate cryptocurrency brokers who do not aJump to dropped file
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile dropped: C:\Users\user\Documents\IPKGELNTQY\R4SZPhslZ.README.txt -> decryption of files!>>>>> don't go to the police or the fbi for help and don't tell anyone that we attacked you. they will forbid you from paying the ransom and will not help you in any way, you will be left with encrypted files and your business will die.>>>>> when buying bitcoin, do not tell anyone the true purpose of the purchase. some brokers, especially in the us, do not allow you to buy bitcoin to pay ransom. communicate any other reason for the purchase, such as: personal investment in cryptocurrency, bitcoin as a gift, paying to buy assets for your business using bitcoin, cryptocurrency payment for consulting services, cryptocurrency payment for any other services, cryptocurrency donations, cryptocurrency donations for donald trump to win the election, buying bitcoin to participate in ico and buy other cryptocurrencies, buying cryptocurrencies to leave an inheritance for your children, or any other purpose for buying cryptocurrency. also you can use adequate cryptocurrency brokers who do not aJump to dropped file

        System Summary

        barindex
        Malicious sample detected (through community Yara rule)
        Source: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Lockbit_369e1e94 Author: unknown
        Source: 00000002.00000002.2179450701.0000000005AB4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Lockbit_369e1e94 Author: unknown
        Source: 00000002.00000002.2179450701.0000000005A19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Detection for Invoke-Mimikatz Author: unknown
        Source: 00000002.00000002.2179450701.0000000005A19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects Empire component - from files Invoke-DCSync.ps1, Invoke-PSInject.ps1, Invoke-ReflectivePEInjection.ps1 Author: Florian Roth
        Source: 00000002.00000002.2179450701.0000000005A19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects Empire component - from files Invoke-CredentialInjection.ps1, Invoke-PSInject.ps1, Invoke-ReflectivePEInjection.ps1 Author: Florian Roth
        Source: Process Memory Space: powershell.exe PID: 3228, type: MEMORYSTRMatched rule: Detection for Invoke-Mimikatz Author: unknown
        Source: Process Memory Space: powershell.exe PID: 3228, type: MEMORYSTRMatched rule: Detects Empire component - from files Invoke-DCSync.ps1, Invoke-PSInject.ps1, Invoke-ReflectivePEInjection.ps1 Author: Florian Roth
        Source: Process Memory Space: powershell.exe PID: 3228, type: MEMORYSTRMatched rule: Detects Empire component - from files Invoke-CredentialInjection.ps1, Invoke-PSInject.ps1, Invoke-ReflectivePEInjection.ps1 Author: Florian Roth
        Source: Process Memory Space: powershell.exe PID: 3228, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
        Powershell drops PE file
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\ProgramData\339E.tmpJump to dropped file
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_0924AD80 RtlAdjustPrivilege,NtSetInformationThread,2_2_0924AD80
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_0924CDF0 NtSetInformationThread,2_2_0924CDF0
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_0924B5D0 NtQuerySystemInformation,2_2_0924B5D0
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_09249C7C NtQuerySystemInformation,2_2_09249C7C
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_0924D0A8 NtSetInformationProcess,NtSetInformationProcess,NtSetInformationProcess,2_2_0924D0A8
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_0924FBB8 NtTerminateProcess,2_2_0924FBB8
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_0924CFE8 NtQueryInformationToken,2_2_0924CFE8
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_09248614 NtSetInformationThread,2_2_09248614
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_0924D660 GetTempFileNameW,CreateFileW,WriteFile,CreateProcessW,NtQueryInformationProcess,NtWriteVirtualMemory,NtDuplicateObject,CreateNamedPipeW,ResumeThread,ConnectNamedPipe,2_2_0924D660
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_09248AFC NtQueryInformationToken,2_2_09248AFC
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_09249EDC NtQueryDefaultUILanguage,2_2_09249EDC
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_0924AD7E RtlAdjustPrivilege,NtSetInformationThread,2_2_0924AD7E
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_09249C7A NtQuerySystemInformation,2_2_09249C7A
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_09249CAE NtQuerySystemInformation,2_2_09249CAE
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_09249CC7 NtQuerySystemInformation,2_2_09249CC7
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_0924B622 NtQuerySystemInformation,2_2_0924B622
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_0924B609 NtQuerySystemInformation,2_2_0924B609
        Source: C:\ProgramData\339E.tmpCode function: 13_2_00402760 CreateFileW,ReadFile,NtClose,13_2_00402760
        Source: C:\ProgramData\339E.tmpCode function: 13_2_0040286C NtSetInformationProcess,NtSetInformationProcess,NtSetInformationProcess,13_2_0040286C
        Source: C:\ProgramData\339E.tmpCode function: 13_2_00402F18 CreateFileW,NtAllocateVirtualMemory,WriteFile,SetFilePointerEx,SetFilePointerEx,NtFreeVirtualMemory,NtClose,DeleteFileW,13_2_00402F18
        Source: C:\ProgramData\339E.tmpCode function: 13_2_0040362E GetLogicalDriveStringsW,GetDriveTypeW,CreateThread,NtClose,Sleep,13_2_0040362E
        Source: C:\ProgramData\339E.tmpCode function: 13_2_00401DC2 NtProtectVirtualMemory,13_2_00401DC2
        Source: C:\ProgramData\339E.tmpCode function: 13_2_00401D94 NtSetInformationThread,13_2_00401D94
        Source: C:\ProgramData\339E.tmpCode function: 13_2_004016B4 NtAllocateVirtualMemory,NtAllocateVirtualMemory,13_2_004016B4
        Source: C:\ProgramData\339E.tmpCode function: 13_2_004032E8: SetThreadPriority,GetDiskFreeSpaceW,GetDiskFreeSpaceExW,GetTempFileNameW,CreateFileW,DeviceIoControl,CreateIoCompletionPort,13_2_004032E8
        Source: C:\Windows\splwow64.exeFile created: C:\Windows\system32\spool\PRINTERS\00002.SPLJump to behavior
        Source: C:\Windows\System32\svchost.exeFile created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_09249EDC2_2_09249EDC
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_092470B42_2_092470B4
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_092504DC2_2_092504DC
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_09246BA42_2_09246BA4
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_09246B9F2_2_09246B9F
        Source: Joe Sandbox ViewDropped File: C:\ProgramData\339E.tmp 917E115CC403E29B4388E0D175CBFAC3E7E40CA1742299FBDB353847DB2DE7C2
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: SecurityJump to behavior
        Source: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Lockbit_369e1e94 reference_sample = d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee, os = windows, severity = x86, creation_date = 2022-07-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = 9cf4c112c0ee708ae64052926681e8351f1ccefeb558c41e875dbd9e4bdcb5f2, id = 369e1e94-3fbb-4828-bb78-89d26e008105, last_modified = 2022-07-18
        Source: 00000002.00000002.2179450701.0000000005AB4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Lockbit_369e1e94 reference_sample = d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee, os = windows, severity = x86, creation_date = 2022-07-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = 9cf4c112c0ee708ae64052926681e8351f1ccefeb558c41e875dbd9e4bdcb5f2, id = 369e1e94-3fbb-4828-bb78-89d26e008105, last_modified = 2022-07-18
        Source: 00000002.00000002.2179450701.0000000005A19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Hacktool_Mimikatz_355d5d3a reference_sample = 945245ca795e0a3575ee4fdc174df9d377a598476c2bf4bf0cdb0cde4286af96, os = windows, severity = x86, description = Detection for Invoke-Mimikatz, creation_date = 2021-04-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Hacktool.Mimikatz, fingerprint = 9a23845ec9852d2490171af111612dc257a6b21ad7fdfd8bf22d343dc301d135, id = 355d5d3a-e50e-4614-9a84-0da668c40852, last_modified = 2021-08-23
        Source: 00000002.00000002.2179450701.0000000005A19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Empire_Invoke_Gen date = 2016-11-05, hash3 = eaff29dd0da4ac258d85ecf8b042d73edb01b4db48c68bded2a8b8418dc688b5, hash2 = 61e5ca9c1e8759a78e2c2764169b425b673b500facaca43a26c69ff7e09f62c4, author = Florian Roth, description = Detects Empire component - from files Invoke-DCSync.ps1, Invoke-PSInject.ps1, Invoke-ReflectivePEInjection.ps1, reference = https://github.com/adaptivethreat/Empire, super_rule = a3428a7d4f9e677623fadff61b2a37d93461123535755ab0f296aa3b0396eb28
        Source: 00000002.00000002.2179450701.0000000005A19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Empire_PowerShell_Framework_Gen5 date = 2016-11-05, hash3 = eaff29dd0da4ac258d85ecf8b042d73edb01b4db48c68bded2a8b8418dc688b5, hash2 = 61e5ca9c1e8759a78e2c2764169b425b673b500facaca43a26c69ff7e09f62c4, author = Florian Roth, description = Detects Empire component - from files Invoke-CredentialInjection.ps1, Invoke-PSInject.ps1, Invoke-ReflectivePEInjection.ps1, reference = https://github.com/adaptivethreat/Empire, super_rule = 1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8
        Source: Process Memory Space: powershell.exe PID: 3228, type: MEMORYSTRMatched rule: Windows_Hacktool_Mimikatz_355d5d3a reference_sample = 945245ca795e0a3575ee4fdc174df9d377a598476c2bf4bf0cdb0cde4286af96, os = windows, severity = x86, description = Detection for Invoke-Mimikatz, creation_date = 2021-04-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Hacktool.Mimikatz, fingerprint = 9a23845ec9852d2490171af111612dc257a6b21ad7fdfd8bf22d343dc301d135, id = 355d5d3a-e50e-4614-9a84-0da668c40852, last_modified = 2021-08-23
        Source: Process Memory Space: powershell.exe PID: 3228, type: MEMORYSTRMatched rule: Empire_Invoke_Gen date = 2016-11-05, hash3 = eaff29dd0da4ac258d85ecf8b042d73edb01b4db48c68bded2a8b8418dc688b5, hash2 = 61e5ca9c1e8759a78e2c2764169b425b673b500facaca43a26c69ff7e09f62c4, author = Florian Roth, description = Detects Empire component - from files Invoke-DCSync.ps1, Invoke-PSInject.ps1, Invoke-ReflectivePEInjection.ps1, reference = https://github.com/adaptivethreat/Empire, super_rule = a3428a7d4f9e677623fadff61b2a37d93461123535755ab0f296aa3b0396eb28
        Source: Process Memory Space: powershell.exe PID: 3228, type: MEMORYSTRMatched rule: Empire_PowerShell_Framework_Gen5 date = 2016-11-05, hash3 = eaff29dd0da4ac258d85ecf8b042d73edb01b4db48c68bded2a8b8418dc688b5, hash2 = 61e5ca9c1e8759a78e2c2764169b425b673b500facaca43a26c69ff7e09f62c4, author = Florian Roth, description = Detects Empire component - from files Invoke-CredentialInjection.ps1, Invoke-PSInject.ps1, Invoke-ReflectivePEInjection.ps1, reference = https://github.com/adaptivethreat/Empire, super_rule = 1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8
        Source: Process Memory Space: powershell.exe PID: 3228, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
        Source: 339E.tmp.2.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
        Source: classification engineClassification label: mal100.rans.troj.spyw.evad.winPS1@11/726@0/1
        Source: C:\ProgramData\339E.tmpCode function: 13_2_004032E8 SetThreadPriority,GetDiskFreeSpaceW,GetDiskFreeSpaceExW,GetTempFileNameW,CreateFileW,DeviceIoControl,CreateIoCompletionPort,13_2_004032E8
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutant created: \Sessions\1\BaseNamedObjects\Global\1f9fd7d5b2844adb0946f9e123528d7c
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
        Source: C:\ProgramData\339E.tmpMutant created: \Sessions\1\BaseNamedObjects\Global\{649F4E29-16CB-DD42-8922-9FFF0592856B}
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5472:120:WilError_03
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5816:120:WilError_03
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5b0e4k3q.qig.ps1Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Users\desktop.iniJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
        Source: IUccGQLWI0.ps1ReversingLabs: Detection: 31%
        Source: unknownProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\IUccGQLWI0.ps1"
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ex bypass -nonI C:\Users\user\Desktop\IUccGQLWI0.ps1
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\ProgramData\339E.tmp "C:\ProgramData\339E.tmp"
        Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE /insertdoc "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\{99BD1B98-4EF0-4608-B95D-29BBEDCA41A1}.xps" 133794275841470000
        Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ex bypass -nonI C:\Users\user\Desktop\IUccGQLWI0.ps1 Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\ProgramData\339E.tmp "C:\ProgramData\339E.tmp"Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appresolver.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcp47langs.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: slc.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sppc.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: linkinfo.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntshrui.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cscapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: policymanager.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msvcp110_win.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: taskflowdataengine.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wintypes.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cdp.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: umpdc.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dsreg.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecorecommonproxystub.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: edputil.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.staterepositoryps.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kdscli.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wtsapi32.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rstrtmgr.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netapi32.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wkscli.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: samcli.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: logoncli.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: activeds.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: adsldpc.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntmarta.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: textshaping.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscms.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: coloradapterclient.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: apphelp.dllJump to behavior
        Source: C:\ProgramData\339E.tmpSection loaded: apphelp.dllJump to behavior
        Source: C:\ProgramData\339E.tmpSection loaded: rstrtmgr.dllJump to behavior
        Source: C:\ProgramData\339E.tmpSection loaded: ncrypt.dllJump to behavior
        Source: C:\ProgramData\339E.tmpSection loaded: ntasn1.dllJump to behavior
        Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: qmgr.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: bitsperf.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: firewallapi.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: esent.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: dnsapi.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: iphlpapi.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: fwbase.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: flightsettings.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: netprofm.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: bitsigd.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: upnp.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: ssdpapi.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: urlmon.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: iertutil.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: srvcli.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: appxdeploymentclient.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: wsmauto.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: miutils.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: wsmsvc.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: dsrole.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: pcwum.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: mi.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: gpapi.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: wkscli.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: msv1_0.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: ntlmshared.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: cryptdll.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: webio.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: mswsock.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: winnsi.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: fwpuclnt.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: rasadhlp.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: rmclient.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: usermgrcli.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: execmodelclient.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: propsys.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: coremessaging.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: twinapi.appcore.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: onecorecommonproxystub.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: execmodelproxy.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: resourcepolicyclient.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: vssapi.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: vsstrace.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: samcli.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: samlib.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: es.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: bitsproxy.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc6.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: schannel.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: mskeyprotect.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: ntasn1.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: ncrypt.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: ncryptsslp.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: msasn1.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: rsaenh.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: dpapi.dll
        Source: C:\Windows\System32\svchost.exeSection loaded: mpr.dll
        Source: Window RecorderWindow detected: More than 3 window changes detected
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\CommonJump to behavior
        Source: 339E.tmp.2.drStatic PE information: real checksum: 0x8fd0 should be: 0x4f26
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 0_2_00007FFD9B7E00AD pushad ; iretd 0_2_00007FFD9B7E00C1
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_0922B3A2 pushfd ; ret 2_2_0922B3B1
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_0922B38C pushad ; ret 2_2_0922B3A1
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_09222580 push esp; ret 2_2_0922258D
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_0922F440 pushad ; ret 2_2_0922F453
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_0922F4C0 pushad ; ret 2_2_0922F453
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_09226787 push FFFFFF8Bh; ret 2_2_09226791
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_09226E7D pushad ; ret 2_2_09226E83
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_09245408 push 0000006Ah; retf 2_2_092454E0
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_09248012 pushfd ; iretd 2_2_09248016
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_0924546F push 0000006Ah; retf 2_2_092454E0
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_09245471 push 0000006Ah; retf 2_2_092454E0
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_0930037D push 8BD68B50h; retf 2_2_09300382
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_09303788 pushad ; retf 2_2_09303789
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_09303BD4 push esp; retf 2_2_09303BD5
        Source: 339E.tmp.2.drStatic PE information: section name: .text entropy: 7.985216639497568
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\ProgramData\339E.tmpJump to dropped file
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\ProgramData\339E.tmpJump to dropped file
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Videos\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Searches\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Saved Games\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Recent\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Pictures\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Pictures\Saved Pictures\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Pictures\Camera Roll\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\OneDrive\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Music\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Links\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Favorites\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Favorites\Links\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Downloads\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Documents\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Documents\YPSIACHYXW\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Documents\WUTJSCBCFX\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Documents\UOOJJOZIRH\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Documents\UMMBDNEQBN\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Documents\RAYHIWGKDI\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Documents\QNCYCDFIJJ\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Documents\PIVFAGEAAV\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Documents\LTKMYBSEYZ\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Documents\KATAXZVCPS\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Documents\IPKGELNTQY\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Documents\HTAGVDFUIE\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Documents\CURQNKVOIX\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Desktop\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Desktop\YPSIACHYXW\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Desktop\WUTJSCBCFX\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Desktop\UOOJJOZIRH\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Desktop\UMMBDNEQBN\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Desktop\SUAVTZKNFL\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Desktop\RAYHIWGKDI\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Desktop\KATAXZVCPS\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Desktop\IPKGELNTQY\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Desktop\HTAGVDFUIE\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Desktop\GAOBCVIQIJ\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Desktop\DVWHKMNFNN\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Desktop\CURQNKVOIX\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Contacts\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\3D Objects\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\.ms-ad\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\$WinREAgent\R4SZPhslZ.README.txtJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\$WinREAgent\Scratch\R4SZPhslZ.README.txtJump to behavior

        Hooking and other Techniques for Hiding and Protection

        barindex
        Loading BitLocker PowerShell Module
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_0924AFE0 RegCreateKeyExW,RegCreateKeyExW,RegSetValueExW,RegSetValueExW,OpenEventLogW,ClearEventLogW,RegCreateKeyExW,OpenEventLogW,ClearEventLogW,2_2_0924AFE0
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
        Source: C:\ProgramData\339E.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior

        Malware Analysis System Evasion

        barindex
        Contains functionality to detect hardware virtualization (CPUID execution measurement)
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_0924108C 2_2_0924108C
        Source: C:\ProgramData\339E.tmpCode function: 13_2_00401E28 13_2_00401E28
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_0924108C rdtsc 2_2_0924108C
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3483Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2134Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6614Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3035Jump to behavior
        Source: C:\ProgramData\339E.tmpWindow / User API: threadDelayed 394Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6564Thread sleep time: -2767011611056431s >= -30000sJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2844Thread sleep time: -922337203685477s >= -30000sJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1456Thread sleep time: -3689348814741908s >= -30000sJump to behavior
        Source: C:\ProgramData\339E.tmp TID: 8168Thread sleep count: 394 > 30Jump to behavior
        Source: C:\ProgramData\339E.tmp TID: 8168Thread sleep time: -39400s >= -30000sJump to behavior
        Source: C:\Windows\System32\svchost.exe TID: 7552Thread sleep time: -30000s >= -30000s
        Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0
        Source: C:\ProgramData\339E.tmpLast function: Thread delayed
        Source: C:\ProgramData\339E.tmpLast function: Thread delayed
        Source: C:\ProgramData\339E.tmpFile Volume queried: C:\6127FE87 FullSizeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_092494BC FindFirstFileExW,GetFileAttributesW,DeleteFileW,FindNextFileW,2_2_092494BC
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_0924930C FindFirstFileExW,FindNextFileW,2_2_0924930C
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_09250F48 SetThreadPriority,FindFirstFileExW,FindNextFileW,2_2_09250F48
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_092493E0 FindFirstFileExW,2_2_092493E0
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_09247AC0 FindFirstFileW,FindClose,FindNextFileW,FindClose,2_2_09247AC0
        Source: C:\ProgramData\339E.tmpCode function: 13_2_0040227C FindFirstFileExW,13_2_0040227C
        Source: C:\ProgramData\339E.tmpCode function: 13_2_0040152C FindFirstFileExW,FindClose,FindNextFileW,FindClose,13_2_0040152C
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_0924BE00 GetLogicalDriveStringsW,2_2_0924BE00
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\splwow64.exeThread delayed: delay time: 120000Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\RoamingJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.iniJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\userJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\MicrosoftJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppDataJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\WindowsJump to behavior
        Source: powershell.exe, 00000002.00000002.2208486002.0000000007BF4000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Get-NetEventVmNetworkAdapter@\^q
        Source: powershell.exe, 00000002.00000002.2208486002.0000000007BF4000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Remove-NetEventVmNetworkAdapter@\^q
        Source: ModuleAnalysisCache.2.drBinary or memory string: Remove-NetEventVmNetworkAdapter
        Source: powershell.exe, 00000002.00000002.2200278350.0000000006D06000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Microsoft-Windows-Hyper-V-Hypervisor-Admin~
        Source: ModuleAnalysisCache.2.drBinary or memory string: Add-NetEventVmNetworkAdapter
        Source: svchost.exe, 00000010.00000002.2964611950.00000243DA65E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
        Source: powershell.exe, 00000002.00000002.2208486002.0000000007BF4000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Add-NetEventVmNetworkAdapter@\^q
        Source: ModuleAnalysisCache.2.drBinary or memory string: Get-NetEventVmNetworkAdapter
        Source: svchost.exe, 00000010.00000002.2961612081.00000243D902B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior

        Anti Debugging

        barindex
        Hides threads from debuggers
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread information set: HideFromDebuggerJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread information set: HideFromDebuggerJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread information set: HideFromDebuggerJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread information set: HideFromDebuggerJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread information set: HideFromDebuggerJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread information set: HideFromDebuggerJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread information set: HideFromDebuggerJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread information set: HideFromDebuggerJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread information set: HideFromDebuggerJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread information set: HideFromDebuggerJump to behavior
        Source: C:\ProgramData\339E.tmpThread information set: HideFromDebuggerJump to behavior
        Source: C:\ProgramData\339E.tmpThread information set: HideFromDebuggerJump to behavior
        Source: C:\ProgramData\339E.tmpThread information set: HideFromDebuggerJump to behavior
        Source: C:\ProgramData\339E.tmpThread information set: HideFromDebuggerJump to behavior
        Source: C:\ProgramData\339E.tmpThread information set: HideFromDebuggerJump to behavior
        Source: C:\ProgramData\339E.tmpThread information set: HideFromDebuggerJump to behavior
        Source: C:\ProgramData\339E.tmpThread information set: HideFromDebuggerJump to behavior
        Source: C:\ProgramData\339E.tmpThread information set: HideFromDebuggerJump to behavior
        Source: C:\ProgramData\339E.tmpThread information set: HideFromDebuggerJump to behavior
        Source: C:\ProgramData\339E.tmpThread information set: HideFromDebuggerJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_0924108C rdtsc 2_2_0924108C
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_092478BC LdrLoadDll,2_2_092478BC
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior

        HIPS / PFW / Operating System Protection Evasion

        barindex
        Writes to foreign memory regions
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\ProgramData\339E.tmp base: 401000Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ex bypass -nonI C:\Users\user\Desktop\IUccGQLWI0.ps1 Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\ProgramData\339E.tmp "C:\ProgramData\339E.tmp"Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_0924108C cpuid 2_2_0924108C
        Source: C:\ProgramData\339E.tmpCode function: EntryPoint,GetModuleHandleW,GetCommandLineW,GetModuleHandleA,GetCommandLineW,GetLocaleInfoW,GetLastError,FreeLibrary,FreeLibrary,GetProcAddress,CreateWindowExW,DefWindowProcW,GetWindowTextW,LoadMenuW,LoadMenuW,DefWindowProcW,SetTextColor,GetTextCharset,TextOutW,SetTextColor,GetTextColor,CreateFontW,GetTextColor,CreateDIBitmap,SelectObject,GetTextColor,CreateFontW,13_2_00403983
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_0924D660 GetTempFileNameW,CreateFileW,WriteFile,CreateProcessW,NtQueryInformationProcess,NtWriteVirtualMemory,NtDuplicateObject,CreateNamedPipeW,ResumeThread,ConnectNamedPipe,2_2_0924D660

        Remote Access Functionality

        barindex
        Found post-exploitation toolkit Empire
        Source: powershell.exe, 00000002.00000002.2179450701.0000000005A19000.00000004.00000800.00020000.00000000.sdmpMemory string: $Shellcode1 += 0x48
        Source: powershell.exe, 00000002.00000002.2179450701.0000000005A19000.00000004.00000800.00020000.00000000.sdmpMemory string: $PEHandle = [IntPtr]::Zero
        Yara detected MetasploitPayload
        Source: Yara matchFile source: 00000002.00000002.2179450701.0000000005A19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3228, type: MEMORYSTR

        Mitre Att&ck Matrix

        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
        PowerShell        		1
        DLL Side-Loading        		112
        Process Injection        		11
        Masquerading        		OS Credential Dumping321
        Security Software Discovery        		Remote Services1
        Archive Collected Data        		1
        Encrypted Channel        		Exfiltration Over Other Network Medium2
        Data Encrypted for Impact
        CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
        DLL Side-Loading        		131
        Virtualization/Sandbox Evasion        		LSASS Memory1
        Process Discovery        		Remote Desktop ProtocolData from Removable Media1
        Proxy        		Exfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)112
        Process Injection        		Security Account Manager131
        Virtualization/Sandbox Evasion        		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
        Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook2
        Obfuscated Files or Information        		NTDS1
        Application Window Discovery        		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
        Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script2
        Software Packing        		LSA Secrets4
        File and Directory Discovery        		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
        Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
        Indicator Removal        		Cached Domain Credentials144
        System Information Discovery        		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
        DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
        DLL Side-Loading        		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

        Behavior Graph

        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Is Windows Process
        • Number of created Registry Values
        • Number of created Files
        • Visual Basic
        • Delphi
        • Java
        • .Net C# or VB.NET
        • C, C++ or other language
        • Is malicious
        • Internet
        behaviorgraph top1 signatures2 2 Behavior Graph ID: 1579866 Sample: IUccGQLWI0.ps1 Startdate: 23/12/2024 Architecture: WINDOWS Score: 100 40 Found malware configuration 2->40 42 Malicious sample detected (through community Yara rule) 2->42 44 Multi AV Scanner detection for submitted file 2->44 46 7 other signatures 2->46 7 powershell.exe 15 2->7         started        9 svchost.exe 2->9         started        12 ONENOTE.EXE 135 388 2->12         started        process3 dnsIp4 14 powershell.exe 2 75 7->14         started        18 conhost.exe 7->18         started        38 127.0.0.1 unknown unknown 9->38 process5 file6 30 C:\ProgramData\339E.tmp, PE32 14->30 dropped 32 C:\Users\user\Videos\R4SZPhslZ.README.txt, ASCII 14->32 dropped 34 C:\Users\user\R4SZPhslZ.README.txt, ASCII 14->34 dropped 36 9 other malicious files 14->36 dropped 60 Found post-exploitation toolkit Empire 14->60 62 Found potential ransomware demand text 14->62 64 Found Tor onion address 14->64 66 8 other signatures 14->66 20 339E.tmp 2 14->20         started        24 splwow64.exe 1 14->24         started        26 conhost.exe 14->26         started        signatures7 process8 file9 28 C:\Users\user\Desktop\IUccGQLWI0.ps1, data 20->28 dropped 48 Antivirus detection for dropped file 20->48 50 Multi AV Scanner detection for dropped file 20->50 52 Machine Learning detection for dropped file 20->52 58 2 other signatures 20->58 54 Found potential ransomware demand text 24->54 56 Found Tor onion address 24->56 signatures10

        Screenshots

        Thumbnails

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


        windows-stand

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        SourceDetectionScannerLabelLink
        IUccGQLWI0.ps132%ReversingLabsScript-PowerShell.Trojan.Lockbit

        Dropped Files

        SourceDetectionScannerLabelLink
        C:\ProgramData\339E.tmp100%AviraTR/Crypt.ZPACK.Gen
        C:\ProgramData\339E.tmp100%Joe Sandbox ML
        C:\ProgramData\339E.tmp87%ReversingLabsWin32.Trojan.Malgent

        Unpacked PE Files

        ⊘No Antivirus matches

        Domains

        ⊘No Antivirus matches

        URLs

        ⊘No Antivirus matches

        Domains and IPs

        Contacted Domains

        ⊘No contacted domains info

        URLs from Memory and Binaries

        NameSourceMaliciousAntivirus DetectionReputation
        http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionlpowershell.exe, 00000002.00000002.2233034724.0000000008D05000.00000004.00000020.00020000.00000000.sdmptrue
          		unknown
          http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/R4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drtrue
            		unknown
            http://lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onionR4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drtrue
              		unknown
              http://schemas.micsplwow64.exe, 00000007.00000003.1922822050.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1908444051.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1904641294.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1902932973.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1923928296.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1921272632.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1918809769.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1922227299.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1920021037.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1908642548.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1908339706.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1903476855.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1905407224.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1910928694.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1930515690.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1914643216.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1903651903.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1917600906.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1927419405.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1926546352.0000000001379000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1918941893.0000000001379000.00000004.00000020.00020000.00000000.sdmpfalse
                		high
                http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionfsplwow64.exe, 00000007.00000003.2007426280.0000000003460000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1907985075.0000000003460000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1973521592.0000000003460000.00000004.00000020.00020000.00000000.sdmptrue
                  		unknown
                  http://crl.microsoftpowershell.exe, 00000002.00000002.2200278350.0000000006C98000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    http://schemas.openformatrg/package/2006/content-tsplwow64.exe, 00000007.00000003.1845875156.0000000001352000.00000004.00000020.00020000.00000000.sdmpfalse
                      		unknown
                      http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionfsplwow64.exe, 00000007.00000003.1907985075.0000000003460000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1880957077.0000000003460000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1856444833.0000000003460000.00000004.00000020.00020000.00000000.sdmptrue
                        		unknown
                        https://contoso.com/Licensepowershell.exe, 00000002.00000002.2179450701.00000000057A8000.00000004.00000800.00020000.00000000.sdmpfalse
                          		high
                          https://electrum.org/R4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drtrue
                            		unknown
                            https://g.live.com/odclientsettings/ProdV2.C:svchost.exe, 00000010.00000003.2202011966.00000243DE8A3000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.16.drfalse
                              		high
                              http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionqpowershell.exe, 00000002.00000002.2233034724.0000000008D05000.00000004.00000020.00020000.00000000.sdmptrue
                                		unknown
                                https://www.torproject.org/R4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drfalse
                                  		high
                                  http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.oniond)splwow64.exe, 00000007.00000003.1853057416.0000000003460000.00000004.00000020.00020000.00000000.sdmptrue
                                    		unknown
                                    http://schemas.opensplwow64.exe, 00000007.00000003.2001836213.0000000001374000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1869344780.000000000138C000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1848714194.000000000135F000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1862701053.0000000001372000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1845875156.0000000001352000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1846225583.0000000001358000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1850874425.000000000136C000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1851759609.000000000136D000.00000004.00000020.00020000.00000000.sdmptrue
                                      		unknown
                                      https://bitcoin.orgR4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drfalse
                                        		high
                                        http://lockbitapt.uzsplwow64.exe, 00000007.00000003.1959073993.0000000003460000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1869970529.0000000001378000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1853655878.0000000001337000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1992257211.0000000004957000.00000004.00000020.00020000.00000000.sdmp, SPLC071.tmp.2.drfalse
                                          		unknown
                                          http://www.microsoft.coDpowershell.exe, 00000002.00000002.2233034724.0000000008D05000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		unknown
                                            https://g.live.com/odclientsettings/Prod.C:svchost.exe, 00000010.00000003.2202011966.00000243DE856000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.16.drfalse
                                              		high
                                              http://fontfabrik.comsplwow64.exe, 00000007.00000003.1880465376.00000000034F4000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1973120740.0000000004926000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1975383908.0000000004929000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                https://g.live.com/odclientsettings/ProdV2svchost.exe, 00000010.00000003.2202011966.00000243DE8C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.16.drfalse
                                                  		high
                                                  http://lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onionR4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drtrue
                                                    		unknown
                                                    http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionF2tsplwow64.exe, 00000007.00000003.1856444833.0000000003460000.00000004.00000020.00020000.00000000.sdmptrue
                                                      		unknown
                                                      https://aka.ms/pscore6lBpowershell.exe, 00000002.00000002.2151702881.0000000004631000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        		high
                                                        http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionsplwow64.exe, 00000007.00000003.1959073993.0000000003460000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1869970529.0000000001378000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1853655878.0000000001337000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1992257211.0000000004957000.00000004.00000020.00020000.00000000.sdmptrue
                                                          		unknown
                                                          http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionfCFDDsplwow64.exe, 00000007.00000003.1973521592.0000000003460000.00000004.00000020.00020000.00000000.sdmptrue
                                                            		unknown
                                                            https://contoso.com/powershell.exe, 00000002.00000002.2179450701.00000000057A8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://nuget.org/nuget.exepowershell.exe, 00000000.00000002.1768389685.000001FCC76EA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1729620148.000001FCB8DF6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2179450701.00000000057A8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                		high
                                                                http://lockbitsupp.uzst.piecesplwow64.exe, 00000007.00000003.1992348137.000000000494C000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1926937398.0000000003460000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1990115023.000000000494C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		unknown
                                                                  http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/R4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drtrue
                                                                    		unknown
                                                                    http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion=powershell.exe, 00000002.00000002.2233034724.0000000008D05000.00000004.00000020.00020000.00000000.sdmptrue
                                                                      		unknown
                                                                      https://oneget.orgXpowershell.exe, 00000000.00000002.1729620148.000001FCB8727000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onionR4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drtrue
                                                                          		unknown
                                                                          http://lockbitsupp.uzFFFFFFFFFFFFFFFFFFFFFSPLC071.tmp.2.drfalse
                                                                            		unknown
                                                                            https://twitter.com/hashtag/lockbit?f=live.R4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drfalse
                                                                              		high
                                                                              http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion7powershell.exe, 00000002.00000002.2233034724.0000000008D05000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                		unknown
                                                                                http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionfsplwow64.exe, 00000007.00000003.2007426280.0000000003460000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1907985075.0000000003460000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1973521592.0000000003460000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1880957077.0000000003460000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1856444833.0000000003460000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                  		unknown
                                                                                  http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000000.00000002.1729620148.000001FCB7471000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2151702881.0000000004631000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    http://fmtvvg3x5rs7tagzcytmfmffnihnte6gllkljufyz534hfpqhfyg2dad.onionR4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drtrue
                                                                                      		unknown
                                                                                      http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/R4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drtrue
                                                                                        		unknown
                                                                                        https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6svchost.exe, 00000010.00000003.2202011966.00000243DE8C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.16.drfalse
                                                                                          		high
                                                                                          http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionsplwow64.exe, 00000007.00000003.1991987974.0000000003460000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1928423804.0000000004912000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1890333250.00000000034E4000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1959073993.0000000003460000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1869970529.0000000001378000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1853655878.0000000001337000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1992257211.0000000004957000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1853971739.00000000048F1000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                            		unknown
                                                                                            http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFSPLC071.tmp.2.drtrue
                                                                                              		unknown
                                                                                              http://lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onionpowershell.exe, 00000002.00000002.2233034724.0000000008D05000.00000004.00000020.00020000.00000000.sdmp, R4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drtrue
                                                                                                		unknown
                                                                                                http://nuget.org/NuGet.exepowershell.exe, 00000000.00000002.1768389685.000001FCC76EA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1729620148.000001FCB8DF6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2179450701.00000000057A8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  http://www.apache.org/licenses/LICENSE-2.0powershell.exe, 00000000.00000002.1729620148.000001FCB8727000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://aka.ms/winsvr-2022-pshelppowershell.exe, 00000002.00000002.2151702881.00000000048FA000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      http://lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onionR4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drtrue
                                                                                                        		unknown
                                                                                                        http://lockbitsupp.uzecesplwow64.exe, 00000007.00000003.1973120740.0000000004926000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1943642199.0000000004926000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1942313132.0000000003460000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1975383908.0000000004929000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1941944131.0000000004925000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          		unknown
                                                                                                          http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000002.00000002.2151702881.00000000048FA000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFSPLC071.tmp.2.drtrue
                                                                                                              		unknown
                                                                                                              http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onionsplwow64.exe, 00000007.00000003.1959073993.0000000003460000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1869970529.0000000001378000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1853655878.0000000001337000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1992257211.0000000004957000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1853971739.00000000048F1000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                		unknown
                                                                                                                http://schemas.xmlsoap.org/soap/encoding/powershell.exe, 00000002.00000002.2151702881.00000000048FA000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  http://lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onionR4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drtrue
                                                                                                                    		unknown
                                                                                                                    http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000002.00000002.2151702881.00000000048FA000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/R4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drtrue
                                                                                                                        		unknown
                                                                                                                        http://lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onionR4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drtrue
                                                                                                                          		unknown
                                                                                                                          https://contoso.com/Iconpowershell.exe, 00000002.00000002.2179450701.00000000057A8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onionFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFSPLC071.tmp.2.drtrue
                                                                                                                              		unknown
                                                                                                                              http://crl.ver)svchost.exe, 00000010.00000002.2962386550.00000243D90D0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/R4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drtrue
                                                                                                                                  		unknown
                                                                                                                                  http://lockbitsupp.uz86.odttfsplwow64.exe, 00000007.00000003.1907985075.0000000003460000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    		unknown
                                                                                                                                    https://github.com/Pester/Pesterpowershell.exe, 00000002.00000002.2151702881.00000000048FA000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      http://lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onionR4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drtrue
                                                                                                                                        		unknown
                                                                                                                                        http://lockbitsupp.uzsplwow64.exe, 00000007.00000003.1959073993.0000000003460000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1869970529.0000000001378000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1853655878.0000000001337000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1992257211.0000000004957000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1853971739.00000000048F1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          		unknown
                                                                                                                                          http://schemas.openformatrg/package/2006/rsplwow64.exe, 00000007.00000003.2001836213.0000000001374000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1869344780.000000000138C000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1848714194.000000000135F000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1862701053.0000000001372000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1846225583.0000000001358000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1850874425.000000000136C000.00000004.00000020.00020000.00000000.sdmp, splwow64.exe, 00000007.00000003.1851759609.000000000136D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            		unknown
                                                                                                                                            http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionfhsplwow64.exe, 00000007.00000003.1880957077.0000000003460000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                              		unknown
                                                                                                                                              http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/R4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drtrue
                                                                                                                                                		unknown
                                                                                                                                                https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96svchost.exe, 00000010.00000003.2202011966.00000243DE8C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/R4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drtrue
                                                                                                                                                    		unknown
                                                                                                                                                    http://schemas.xmlsoap.org/wsdl/powershell.exe, 00000002.00000002.2151702881.00000000048FA000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      https://aka.ms/pscore68powershell.exe, 00000000.00000002.1729620148.000001FCB7471000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        http://lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onionR4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drtrue
                                                                                                                                                          		unknown
                                                                                                                                                          http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onionrsplwow64.exe, 00000007.00000003.1853057416.0000000003460000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                            		unknown
                                                                                                                                                            https://oneget.orgpowershell.exe, 00000000.00000002.1729620148.000001FCB8727000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              http://lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onionR4SZPhslZ.README.txt39.2.dr, R4SZPhslZ.README.txt5.2.dr, R4SZPhslZ.README.txt1.2.dr, R4SZPhslZ.README.txt23.2.dr, R4SZPhslZ.README.txt25.2.dr, R4SZPhslZ.README.txt12.2.dr, R4SZPhslZ.README.txt2.2.dr, R4SZPhslZ.README.txt0.2.dr, R4SZPhslZ.README.txt42.2.dr, R4SZPhslZ.README.txt31.2.dr, R4SZPhslZ.README.txt33.2.dr, R4SZPhslZ.README.txt11.2.dr, R4SZPhslZ.README.txt45.2.dr, R4SZPhslZ.README.txt20.2.dr, R4SZPhslZ.README.txt16.2.dr, R4SZPhslZ.README.txt34.2.dr, R4SZPhslZ.README.txt.2.dr, R4SZPhslZ.README.txt9.2.dr, R4SZPhslZ.README.txt26.2.dr, R4SZPhslZ.README.txt24.2.drtrue
                                                                                                                                                                		unknown

                                                                                                                                                                World Map of Contacted IPs

                                                                                                                                                                • No. of IPs < 25%
                                                                                                                                                                • 25% < No. of IPs < 50%
                                                                                                                                                                • 50% < No. of IPs < 75%
                                                                                                                                                                • 75% < No. of IPs

                                                                                                                                                                Public IPs

                                                                                                                                                                IPDomainCountryFlagASNASN NameMalicious

                                                                                                                                                                Private

                                                                                                                                                                IP
                                                                                                                                                                127.0.0.1

                                                                                                                                                                General Information

                                                                                                                                                                Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                Analysis ID:1579866
                                                                                                                                                                Start date and time:2024-12-23 12:38:35 +01:00
                                                                                                                                                                Joe Sandbox product:CloudBasic
                                                                                                                                                                Overall analysis duration:0h 7m 43s
                                                                                                                                                                Hypervisor based Inspection enabled:false
                                                                                                                                                                Report type:full
                                                                                                                                                                Cookbook file name:default.jbs
                                                                                                                                                                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                Number of analysed new started processes analysed:21
                                                                                                                                                                Number of new started drivers analysed:0
                                                                                                                                                                Number of existing processes analysed:0
                                                                                                                                                                Number of existing drivers analysed:0
                                                                                                                                                                Number of injected processes analysed:0
                                                                                                                                                                Technologies:
                                                                                                                                                                • HCA enabled
                                                                                                                                                                • EGA enabled
                                                                                                                                                                • AMSI enabled
                                                                                                                                                                Analysis Mode:default
                                                                                                                                                                Sample name:IUccGQLWI0.ps1
                                                                                                                                                                renamed because original name is a hash value
                                                                                                                                                                Original Sample Name:36f48ef3776c01d63a2fd594d52dfb7402ea634162fd079b0d942367a2fbed56.ps1
                                                                                                                                                                Detection:MAL
                                                                                                                                                                Classification:mal100.rans.troj.spyw.evad.winPS1@11/726@0/1
                                                                                                                                                                EGA Information:
                                                                                                                                                                • Successful, ratio: 66.7%
                                                                                                                                                                HCA Information:
                                                                                                                                                                • Successful, ratio: 100%
                                                                                                                                                                • Number of executed functions: 102
                                                                                                                                                                • Number of non-executed functions: 35
                                                                                                                                                                Cookbook Comments:
                                                                                                                                                                • Found application associated with file extension: .ps1

                                                                                                                                                                Warnings

                                                                                                                                                                • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, printfilterpipelinesvc.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, VSSVC.exe, svchost.exe
                                                                                                                                                                • Excluded IPs from analysis (whitelisted): 52.109.76.240, 52.109.89.19, 52.113.194.132, 23.218.208.109, 20.189.173.15, 4.175.87.197, 13.107.246.63, 20.190.147.3
                                                                                                                                                                • Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, weu-azsc-000.roaming.officeapps.live.com, eur.roaming1.live.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, osiprod-weu-buff-azsc-000.westeurope.cloudapp.azure.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, officeclient.microsoft.com, prod.fs.microsoft.com.akadns.net, onedscolprdwus14.westus.cloudapp.azure.com, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, otelrules.azureedge.net, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, fe3cr.delivery.mp.microsoft.com, neu-azsc-config.officeapps.live.com, s-0005.s-msedge.net, config.officeapps.live.com, ecs.office.trafficmanager.net, europe.configsvc1.live.com.akadns.net
                                                                                                                                                                • Execution Graph export aborted for target powershell.exe, PID 4136 because it is empty
                                                                                                                                                                • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                • Report size getting too big, too many NtCreateFile calls found.
                                                                                                                                                                • Report size getting too big, too many NtCreateKey calls found.
                                                                                                                                                                • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                                                                                                                                • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                                                                                                                • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                                                                • VT rate limit hit for: IUccGQLWI0.ps1

                                                                                                                                                                Simulations

                                                                                                                                                                Behavior and APIs

                                                                                                                                                                TimeTypeDescription
                                                                                                                                                                06:39:31API Interceptor45x Sleep call for process: powershell.exe modified
                                                                                                                                                                06:39:42API Interceptor346x Sleep call for process: splwow64.exe modified
                                                                                                                                                                06:40:19API Interceptor2x Sleep call for process: svchost.exe modified
                                                                                                                                                                06:41:12API Interceptor258x Sleep call for process: 339E.tmp modified

                                                                                                                                                                Joe Sandbox View / Context

                                                                                                                                                                IPs

                                                                                                                                                                ⊘No context

                                                                                                                                                                Domains

                                                                                                                                                                ⊘No context

                                                                                                                                                                ASNs

                                                                                                                                                                ⊘No context

                                                                                                                                                                JA3 Fingerprints

                                                                                                                                                                ⊘No context

                                                                                                                                                                Dropped Files

                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                C:\ProgramData\339E.tmp22V6t8mgjo.ps1Get hashmaliciousLockBit ransomware, MetasploitBrowse
                                                                                                                                                                  e93wY5kRY0.ps1Get hashmaliciousLockBit ransomware, MetasploitBrowse
                                                                                                                                                                    zhbEGHo55P.exeGet hashmaliciousLockBit ransomwareBrowse
                                                                                                                                                                      LB3.exeGet hashmaliciousLockBit ransomwareBrowse
                                                                                                                                                                        LBB.exeGet hashmaliciousLockBit ransomwareBrowse
                                                                                                                                                                          ggjLV4w8Ya.exeGet hashmaliciousLockBit ransomwareBrowse
                                                                                                                                                                            yEB1xvr2rZ.exeGet hashmaliciousLockBit ransomwareBrowse
                                                                                                                                                                              71p2xmx6rP.exeGet hashmaliciousLockBit ransomwareBrowse
                                                                                                                                                                                98ST13Qdiy.exeGet hashmaliciousLockBit ransomwareBrowse
                                                                                                                                                                                  c8JakemodH.exeGet hashmaliciousLockBit ransomwareBrowse

                                                                                                                                                                                    Created / dropped Files

                                                                                                                                                                                    C:\$WinREAgent\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\$WinREAgent\Scratch\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\ProgramData\339E.tmp

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):14336
                                                                                                                                                                                    Entropy (8bit):7.4998500975364095
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:5cFP7VtpK4p+31Mzh79W5vM+ZyUgGq4BtMvAxXCRsi:A7Vf9p+qQ02y5HW6kX
                                                                                                                                                                                    MD5:294E9F64CB1642DD89229FFF0592856B
                                                                                                                                                                                    SHA1:97B148C27F3DA29BA7B18D6AEE8A0DB9102F47C9
                                                                                                                                                                                    SHA-256:917E115CC403E29B4388E0D175CBFAC3E7E40CA1742299FBDB353847DB2DE7C2
                                                                                                                                                                                    SHA-512:B87D531890BF1577B9B4AF41DDDB2CDBBFA164CF197BD5987DF3A3075983645A3ACBA443E289B7BFD338422978A104F55298FBFE346872DE0895BDE44ADC89CF
                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: Avira, Detection: 100%
                                                                                                                                                                                    • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 87%
                                                                                                                                                                                    Joe Sandbox View:
                                                                                                                                                                                    • Filename: 22V6t8mgjo.ps1, Detection: malicious, Browse
                                                                                                                                                                                    • Filename: e93wY5kRY0.ps1, Detection: malicious, Browse
                                                                                                                                                                                    • Filename: zhbEGHo55P.exe, Detection: malicious, Browse
                                                                                                                                                                                    • Filename: LB3.exe, Detection: malicious, Browse
                                                                                                                                                                                    • Filename: LBB.exe, Detection: malicious, Browse
                                                                                                                                                                                    • Filename: ggjLV4w8Ya.exe, Detection: malicious, Browse
                                                                                                                                                                                    • Filename: yEB1xvr2rZ.exe, Detection: malicious, Browse
                                                                                                                                                                                    • Filename: 71p2xmx6rP.exe, Detection: malicious, Browse
                                                                                                                                                                                    • Filename: 98ST13Qdiy.exe, Detection: malicious, Browse
                                                                                                                                                                                    • Filename: c8JakemodH.exe, Detection: malicious, Browse
                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....YPb.................,...........9.......@....@..........................p.......................@......................A..P....`...............................@......................`@.......................@..`............................text....*.......,.................. ..`.rdata.......@.......0..............@..@.data...`....P.......4..............@....rsrc........`.......6..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                    C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                    File Type:Extensible storage engine DataBase, version 0x620, checksum 0xcb84acae, page size 16384, DirtyShutdown, Windows version 10.0
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1310720
                                                                                                                                                                                    Entropy (8bit):0.4221909713410296
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:hSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:haza/vMUM2Uvz7DO
                                                                                                                                                                                    MD5:1BCA72B7B9E35B204381FE76099E5092
                                                                                                                                                                                    SHA1:890BCA31E55F2B370D6ED7A6D83C2E3767B6B354
                                                                                                                                                                                    SHA-256:4BF503AFD76DEE6088B5261DFB91B6095F0C19B19E48E887B91AEAAF7E3F7772
                                                                                                                                                                                    SHA-512:95DE66229A6C9A1DCDBD057166DA5F70EF1B3040E1AE77003E0984865833D97F3795291989E44857B2882216C1AC5CFC109A731B5D7CF7441AF499E35C8E6335
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:...... .......A.......X\...;...{......................0.!..........{A..(...|w.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................*)...(...|...................CJf.(...|w..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                    C:\ProgramData\R4SZPhslZ.bmp

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:PC bitmap, Windows 3.x format, 1280 x 1024 x 16, image size 2621440, cbSize 2621494, bits offset 54
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2621494
                                                                                                                                                                                    Entropy (8bit):0.20386902944493035
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:GKm71jTv37T1BNrdVRd3fF3bdJf7vhpnzBxD1fJ/tBfJvTLtFFdF9tlFNtnvDdFv:2
                                                                                                                                                                                    MD5:05C478246441EA79035033291E709320
                                                                                                                                                                                    SHA1:2B2B39333F5B36BECC4DF19A906C2E3BB9D7230D
                                                                                                                                                                                    SHA-256:EF3A8A9EC29B83FE02EB21E4C86DFB98E82CD55F7C781D8F347CAF1AF6033218
                                                                                                                                                                                    SHA-512:B395FFA1215AB817ED5C2FCC467F2747BC9351A471F1EFA3A71ECEE616A1F6226C18007E2D56F320ECAC7FF66D384A0475644DF817BF74E2C4BC30DF146CB90A
                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                    Preview:BM6.(.....6...(.....................(...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                    C:\ProgramData\R4SZPhslZ.ico

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):15086
                                                                                                                                                                                    Entropy (8bit):4.262047636092361
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:jpBaAlHSa2vU9G/8MMBD7O1lXFMB8VMJP7:jpjmkMYD7IFMRx7
                                                                                                                                                                                    MD5:88D9337C4C9CFE2D9AFF8A2C718EC76B
                                                                                                                                                                                    SHA1:CE9F87183A1148816A1F777BA60A08EF5CA0D203
                                                                                                                                                                                    SHA-256:95E059EF72686460884B9AEA5C292C22917F75D56FE737D43BE440F82034F438
                                                                                                                                                                                    SHA-512:ABAFEA8CA4E85F47BEFB5AA3EFEE9EEE699EA87786FAFF39EE712AE498438D19A06BB31289643B620CB8203555EA4E2B546EF2F10D3F0087733BC0CEACCBEAFD
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......%............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                    C:\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\.curlrc.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):239
                                                                                                                                                                                    Entropy (8bit):7.115979883131624
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:vRS5XVbrCQDVB3DB+uRKPXh6RMpth6bAL8hteb3:5SJVb/5XCgu6bAkteD
                                                                                                                                                                                    MD5:8F17D92736AFB7A94D191F9A4D55467B
                                                                                                                                                                                    SHA1:FFBF34A68D242FEC70CCE6378F7AE7BBC4BD90DA
                                                                                                                                                                                    SHA-256:210637AACAA790EECAE5CE4BA539095A82033128D6B5B69AD2754DDEFB508D6D
                                                                                                                                                                                    SHA-512:F595B524850910C415B4524712B203301414F06F7B794854F922AB6DCE60BB759CA319097A259DA10C916B6D93B77E6DB64AAA53825064961D11DCA2087B1342
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.g..+.o...|.o.V.hr.F.6.[.h..B.5.I*O..+.Bk.v7.~.....~(.gN.2..p.._.....5......~..(........a.y!.F..Q..a...0E]c.h...1.............H_...p.0H...Xa*r..Z...5ho*2..p.88......4i..(.@.... .;.U..!.Y.PKv..M.6...5.y..N..`....[v..]>..<Xy.=._w.]

                                                                                                                                                                                    C:\Users\user\.ms-ad\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\3D Objects\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\8B343601-3A8E-4DE5-842E-26B371E9BA43

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):183024
                                                                                                                                                                                    Entropy (8bit):5.293735737138491
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:hrVwfRAqpbH4wglEpLe7HWKQjj/o/NMOcAZl1p5ihs7EXXbEADwaKBIa5YdGVF8M:Z8e7HWKQjj/o/aXotTB
                                                                                                                                                                                    MD5:63455815AC3588EE19EA77F9AC6754EB
                                                                                                                                                                                    SHA1:57BE16FA2222C8CA36F27B45EE0B912A030175D5
                                                                                                                                                                                    SHA-256:E4C536C4225A394DBA465474BBBFE4379EC8D942F9A12606E4BE8730BAB4350D
                                                                                                                                                                                    SHA-512:3B4246A83FC7F8AFE977DDF01733D0DECDA6342AB64AB144940D3C54F5E33BCC6A9C401AB1831A853560907430B06FB588557167CC9E641B59D064DB1476D45C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-12-23T11:40:22">.. Build: 16.0.18406.40129-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results?fullframe=yes</o:url>.. <o:ticket o:policy="DELEGATION" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Bearer {}" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[MAX.Resourc

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Office\OTele\onenote.exe.db-journal

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:SQLite Rollback Journal
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4616
                                                                                                                                                                                    Entropy (8bit):0.13760166725504608
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:7FEG2l+Zs/l/FllkpMRgSWbNFl/sl+ltlslVlllfllj:7+/lyKg9bNFlEs1EP/T
                                                                                                                                                                                    MD5:C77A4088527DE1E3E07FD8D8C8C7CF3A
                                                                                                                                                                                    SHA1:469263EC44A50DBAC69B660D756BB44058EFEB81
                                                                                                                                                                                    SHA-256:938E1C0AAAE436593936710558761B380625965A93CEA75E8FA45DA880EA7F60
                                                                                                                                                                                    SHA-512:92408A01ABB7AA2E193FA0D4940CDB1BD9EB5E7A7CCFC75817A28CF978437D96F103F30C9A56D18C314CB99779B12BE525F377C86074BB5EBC1DF1E795789A07
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.... .c.......#.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ .......................................................................... .................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000001.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):0.04401584019170665
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:RRk//:Lk
                                                                                                                                                                                    MD5:CD74ABACE8A00B17BD8107BC5982C21E
                                                                                                                                                                                    SHA1:D53193CF8A43D766FBFA52976192F44D6B0F79B2
                                                                                                                                                                                    SHA-256:B670BC07C9CB554511180DCF3F6A2C7818E8CE6E67B84784F0EA4D35EC61D516
                                                                                                                                                                                    SHA-512:1B48A37FCF0F9FB9ED9B31A8F3E36596689BF1EEC6F41F5EFA3C728121944919CE7A81F0379A108D80AA051CFEF07DC296F9C0691FC8855983B2F29EC15C7FEF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000002.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):0.4971149941647013
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:vldawlAuil8xt/l2l32k/qz/NGrGulHVjHNGrGNl/OkdIMl2hliJw5Y9r7jxzElB:NTcLzRaYl5GwJ/fj9w1EV7e
                                                                                                                                                                                    MD5:A32C1D9A9DE87230F2D28E8BB5431F01
                                                                                                                                                                                    SHA1:CF147650C5781E6696D14D65869D3764E78E7BF5
                                                                                                                                                                                    SHA-256:41237956811B4251FDD7CCB56A4215B62DD5641A942806B9829AD2314B90BB80
                                                                                                                                                                                    SHA-512:6BBA21C6221F53ACAE1EEEBFE77B573B6A3C61AC58637848C7B33BB0020DC568FCB95366E1445059FEAB1C390129B7ACB84829CFAB8A1DE84D1B20CCCA1222E4
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>...........~.....................................................................................................................................................................................................B..0w..................................B..0w........................................................................................................................P..............................................................................5........m;.H....7.5N..........Fq/U.........9.]@{FE..K....A....N...^............................................................................................................9.]@{FE..K....A............................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000003.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.5321830350265895
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:/0N5LYr3+xz3LRhxyw0L1/4NtBlkw0La/SCLBwEwLq096B6ggPxXb:/u5LYr3+xj1hxyL94NtgLu/SCWEwu1
                                                                                                                                                                                    MD5:B783C213FD7FBBA8C9C010C5AEA86603
                                                                                                                                                                                    SHA1:124BCEE86AC2776D87BD830FB32420DD977150FC
                                                                                                                                                                                    SHA-256:A6314C848EEE13CC99B48C50455DE1F5B0CD74BFADB3DD8332CDB0B71AFBAA3D
                                                                                                                                                                                    SHA-512:880FBBFB06F00E3DFA8F104B9AF65EEF99F8FC115794257C67DBEB21BF8EA5580400AE79F39E4E6C6F27B2F38CE91928B98388CAD5F38DE087A3AA48EC339A8A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:j......@0.......................................................................?.......................................................................j......@h..................................................`-"S.2XS..tJ..TE......TE...I.8.Oz...t.V....&....o..t..(...T.;.8..,_.{.(......`-"S.2XS..tJ.........................................................................(.......(...T.;.8..,_.{..TE......TE...I.8.Oz..2...^............... ...:...........(....TE..t..N...........................X.........5..............."...J.T$......T%q.....T.Q.......TE.....8....c..,0...e...B4.$..........C@RQ.H..B......Y.....................Rs......Rs...H..!..B...t.......t.V....&....o......D.5D.........J.2T..F......N).J.....t...F....e.ZK........>..................`-"S.2XS..tJ.8..:.Y.=,....W...t...F....e.ZKN.......N..X...J..0.2=............t...F....e.Z...............t...c..,0...e...B4.$...........I...M.....0...............................0...........e....4..................T.i.t.l.e.......|{

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000004.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8192
                                                                                                                                                                                    Entropy (8bit):4.716064569068485
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:DsLar9soNGNNPLX2UsRiwcWLPyjgLha9gPww4OR:4kkNNPjXsRiGa0higPL4o
                                                                                                                                                                                    MD5:B9BE20B82BF19DD14C66013CC15CA2C1
                                                                                                                                                                                    SHA1:0A9972865DA395596FDD34C15D6462F00F76EAF8
                                                                                                                                                                                    SHA-256:7D44DECCB3E714DDFA34E0C418DD54392F2AEFFC2E29E09908711A2816F74498
                                                                                                                                                                                    SHA-512:768DB30EAAE3C9BFB28DEC74784C406AAAA127ECF8EF1A85AFBAF339DDD18AE3B109BB033CAF09533E0ED6EFC782A850271BF8C338023626000FE046AA59239D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......t...v...h...................................................................................................................................2...>...P.......v................................I.......I.qk..B.....LZ....4......~..N...j*[i>....~..N...j*[i>......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............5.U..5V.8..w..r.....N...^...................O`.K....C@.............>...............................$....I.qk..B.....LZ............5.U..5V.8..w..r.........5.U..5V.8..w..r.........................................................................j.......T%;...............W.....H.........+.......S...............Z4...........................................4../4......p...............C.a.l.i.b.r.i.....................:...k.....z...y.. x.. ...........$...........7...7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.3

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000005.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):40884
                                                                                                                                                                                    Entropy (8bit):7.545929039957292
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:MCBOA4d+ElOXJ/3pI7cRBiL7L6qERqGz65WXzZqJsKQSbIsTT6XB:hIAU+2cGdLX6qBG4WDZl4Ihx
                                                                                                                                                                                    MD5:7379775A1E2AB7FAB95CFFCE01AE05F3
                                                                                                                                                                                    SHA1:3D3DDFD8AC7E07203561BAE423D66F0806833AB3
                                                                                                                                                                                    SHA-256:9301DB6D2D87282FCEE450189AEACE16D85F64273BF62713A3044992B6B7A9E9
                                                                                                                                                                                    SHA-512:4B5006E620E80D3A146944649CF4CA619782CAD7E8C4CD0D1DE0EBCA0FA05EACB7378DAFCEED3E26F5698B07F19604614D906C8F51F898660E2F129D8DEC6F62
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1A.....Qaq....".....2....BR#S..br...3T...C$.7(Hx....4D.G..Xh.cs..'..t...%...8.....................1...!AQ..a...q"2.4Tt.......R3S....Br...#s...Uu.bc.de..$D..6..C%E..............?...z...;sB.yv...........]t.\...n...../....m....M.=.3G+..x+.....S).*&.J../..8..O/+..sG...p...<!....~.c..C.w..,[oHom.wc-.J.~.......L[..6...'..i_..S;...!Y.z.q].EK..M.x...i.x.+.;.+...}....#......f.)........e6V..p.;........s.)..Ml.J......IU.6...<9+9.^..l..Y...[._...2..^..j.ia...._..3.;...~..<3...;......z.^.......]..Qk.,...Yk...3.3Jy^p.}....q...I...&..t.......;..9.g.GH;..'...%...)..[..y..../...zCn..>...'...1e.Y..;....]..7...N>t..m-.j.............H^..T\.q.ru...}...eTn]I'r.^].#..wOY....v

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000006.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12288
                                                                                                                                                                                    Entropy (8bit):4.440739445740616
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:Lsq41qBGLkh2gUMUA8Le0egr8oDdTgbRiu38AOwXivRkLRDCe0RNmGL9fQfRB:wFsalgt4e0B3DdcJn9ivRkLoe0R75e
                                                                                                                                                                                    MD5:70F889BF5A9B2631D97F9183939E5C6A
                                                                                                                                                                                    SHA1:5887C99AB23F07DB275F6070A01EAB1744195360
                                                                                                                                                                                    SHA-256:30BE8DE7FC8BC71BF6C6CB1ED060336E6047756AA7A870C0BA48CA5B5735C960
                                                                                                                                                                                    SHA-512:3F1CE48CFB3AE113915E280D8155D1764E85BDFCB848362228F305465359CCE4DD30FEB2EE28615A04935AFCB3E8C19841565C67C2ADAC9993DE220138DE9E99
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>...........v........ ...)..2...>...B.......v.......@....(...........................................................................................................................................I.......I.qk..B.....LZ...H.....7.`&.&..-.l,...7.`&.&..-.l,.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............}%"..w.1Pw...9m....N...^...................*.E..TF|X.B............................................"....I.qk..B.....LZ.............}%"..w.1Pw...9m............................................................................................j."....T...............T........... .A........... ..........3..:..8....z...y.. x.. ........ ..$...$........D..........7...7.........*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.1.5........................Z4...........................................4../4......p.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000007.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:19:29], progressive, precision 8, 221x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):24268
                                                                                                                                                                                    Entropy (8bit):6.946124661664625
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:d2wiieoHTRh5a1HAteZCWOZIM+L7WhNjYn:8wHFHJ+/OZIKhNO
                                                                                                                                                                                    MD5:3CD906D179F59DDFA112510C7E996351
                                                                                                                                                                                    SHA1:48CDB3685606EDD79D5BCDF0D7267B8B1CCBD5A8
                                                                                                                                                                                    SHA-256:1591FD26E7FFF5BE97431D0ED3D0ADE5CFC5FA74E3D7EC282FD242160CE68C1F
                                                                                                                                                                                    SHA-512:2048CBA13AF532FF2BCC7B8B40541993234BD1A8AB6DE47B889AF3F3E4571F9C5A22996D0B1C16DD6603233F6066A1A2A97C16A6020BEDD0826B83BAD0075512
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:19:29.....................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................$.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....)......[]t.\Z..g......A....&D.$LH._..X..Xl...`....cZ.X.........>......f.Z.X...]..~L.S..@..I$..I.IO.....x...s.g.[f.h{9..

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000008.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12288
                                                                                                                                                                                    Entropy (8bit):4.643813499819591
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:PsiiQIbCO1uxqoqNhjjCg2Ss/nO7+b9GXRfTRptIkv5Nq72wB9dMZMw:EiHKCO9X3jGgQ/n/xYRfTRpxNQ2wrda
                                                                                                                                                                                    MD5:4F28F119A9646001202CAC029D795317
                                                                                                                                                                                    SHA1:1E8B3A5A26B28CC77FC35AFEDDB6F7FDC881FD93
                                                                                                                                                                                    SHA-256:7110978FB28B6CAF683085A6DD43EAF6D37D52694A76A5367CC8D87BFAC1B293
                                                                                                                                                                                    SHA-512:E7DFBBD44690AD91562700CD7EEC2930F3D7EA02F2CEEAA5E22988DF89B64140C719BDC96046EE26CAEC9348B889BA6750E152C028C8ACDFC1C6C061E893AA58
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>...6...z...v...N.... ..X,..2...>...........v.......@...H+...........................................................................................................................................I.......I.qk..B.....LZ1.5.N...1.5.a.6.8....I..1.5.a.6.8....I..1.5..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............<e.......(+V......N...^...............c..He.>I.B.H.S{5............P....................................I.qk..B.....LZ..............<e.......(+V...................................1.5.....1.5.....1.5.........................................1.5j.9..1.5T....1.5.....1.5..s..1.5H....1.5..0..1.5..`.&1.5.........1.531.5:1.5A1.581.5..z...y.. x.. ........ ..$...$...............7...7.........*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.1.1................Z4...........................................4../4......p.........

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000009.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):39010
                                                                                                                                                                                    Entropy (8bit):7.362726513389497
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:6tCjwO+E+KW0ZtOgepcoWW4pAWQ6/KWcR474HOAZaDfK:68j+E+KW0HOgep/72/NKWcRNefK
                                                                                                                                                                                    MD5:9700DE02720CDB5A45EDE51F1A4647EC
                                                                                                                                                                                    SHA1:CF72A73E1181719B1CC45C2FE0A6B619081E115E
                                                                                                                                                                                    SHA-256:7E6A7714A69688D9FFDF16AA942B66064A0C77FCD9B3E469F89730B4B9290C3E
                                                                                                                                                                                    SHA-512:5438921467D62376472007B9EBF3C35C9D9FE3EDE04D99A990129332D53EBC8EE2555C0319A4F7C0DF63516F29CEDF2171D8B6DC34C9FCD075C2CA41EB728660
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!1..A...Qaq..".......2BR#...b%&6..'w.r.3f7W8.s5EUeF.g....CS$4.Vv..Tdt..G..(c..u.Hhx.......................!1.AQa..2.q....".s...3.4BRr.#......b.$c............?........uf.....t...;..[...W.h.....-.k.f..i.u..KQ..b.F...rM%/.8n.S..=9.....G$O;.f.}L..N..U._i.[.X...3.~....S.~..+t$...c.5......{..X/..#.G...}s....6......^....o~.$.\WA?...^*w[O.~..6..~....a....~..:..0.......{O...|.s.u._w.........i...........{K...._.?.../{.....A..8....<g.iu..<..................X......|]v....D..9.k.w.|-IF.Tv.-.&.........."'.4.b....z.._.Z.....G...u.xyt./_.q..m>..S.V.Xdc.bw.T.W......g..........}s.._..?....U]_.......`......>.|'.~xH....,...?........?.q....o../..R..;...Y.G....A"?......?.<..1...w..o.M.........tco.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000A.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12288
                                                                                                                                                                                    Entropy (8bit):3.9601337984542515
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:Qns+Q9vUWIQaR71EgReksXX0K4AeAXABXz83wqQaL8Yoii5TFYXXuELWP:LJvHsRphReJk2AFzWwqQS8bzJCXs
                                                                                                                                                                                    MD5:BA293FFEA163D1AC2C41708BF085FD72
                                                                                                                                                                                    SHA1:6FD1DBF4F6C3E7C1A8612DC3856CFE8F94849A18
                                                                                                                                                                                    SHA-256:3811AF7FE9C646822D5EC01B1735DB77A3A950A3251CF2ADF3A77F26154CD569
                                                                                                                                                                                    SHA-512:E5BA36D6FAFC47E6BB6423F11201B2370651E16A47F92774BB5787411D4477CD52FAE683DD3F72E2D0A98C2924B8CC449DE86FEB0EDB5513199575FE6D2654EE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:....>.......B...v.......0 ..x#......>...........v...^...@...h"...........................................................................................................................................I.......I.qk..B.....LZ9{S.....9{S.rr^...-C!.H.....&o.-....H.@....9{S.rr^...-C!.HW9{S..I.qk..B.....LZ.I............I.......I...................................................I.t.....I................................................................4..'...'.............A.........'.... ....N...^................_F..X(G..8.+.S........b...8....................................I.qk..B.....LZ............A.........'.... .................................9{S.....9{S.....9{S........................................9{S.....9{S.rr^...-C!.HW....8.......&o.-....H.@2................................I...............................9{Sj.#..9{ST.G..9{S.....9{S..Q.....H...............$.7................!.....z...,4. ............................"......$...7...............T.u.e.s.d.a.y.,. .J.u.l.y. .2.8.,.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000B.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):59707
                                                                                                                                                                                    Entropy (8bit):7.858445368171059
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:k76rvGc8WKC2/UX1uEgVRY/jvv9CblyL/T:k77Z5C2/Ow1e9CblCT
                                                                                                                                                                                    MD5:47ADB0DF6FDA756920225A099B722322
                                                                                                                                                                                    SHA1:851946B8C2BD0BB351BAEECA9E5BB6648A87D7CA
                                                                                                                                                                                    SHA-256:EC8CD7250F3D82E900E99114869777EE859EC73EFFABED108815F65742078C3A
                                                                                                                                                                                    SHA-512:85A9920E1CE4A2FCCEBAFA425C925DF33580FA3C3C00178F058539B2FBC0163866DB8A41B320E2EF2CD217F00FFA06A1A831C728D3F9F910C9EAC58B5DA76E2D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..A..Qaq"....2........B#..R.b3$..8xrC4&'W.%e.(.c.d.5E6Ff..h..SsTt..u...Gg..H.....................!.1..AQ.aq.".......2..st.BR..56.r#3.b.S.4c%...$d.CT............?....3.7...G:../P....z..K.:6..w......6....... .z7...~.....{gdF60...9....{...'[N....m.........z...g{.......7...4..1..=.z...._..p...m..Icd.~.v..9.P..0Z(.<j.......R6zm.....v.z...>x..)=g........zo{..w..f..y.t.....%.D..#.}.I.>).H.QM..cLD..x.../.^y.{.............y.=^.......I.T.......U..0_?...u..og..3.ky..K....6w...Dc......~........ik.z....N...en......_.....x....._u...4.{..P...>.....}.......>.R.....m.....[mt.....}.........|.....m......~....B.F.]C.36..q....yg...{]...+.DZv.9<.o..;..N.n&im.,....w.3...V.s...Y..e#$.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000C.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12288
                                                                                                                                                                                    Entropy (8bit):3.8499469520377754
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:0s1gWu9R5tzKO07ZKXplRlYkrCWVYq9nCuAmwwhg:J1g3OO0lEplRljCVynlW
                                                                                                                                                                                    MD5:4AACA71047E812FF9E1DAB4B638B2A56
                                                                                                                                                                                    SHA1:53DBC5CE39C53054470312497F65E810DE253DAE
                                                                                                                                                                                    SHA-256:F863886FBA1B9B3E90DB411147C4E2A94753B6364611191B34EC1C64A9E9B175
                                                                                                                                                                                    SHA-512:4DC885CE272AE2628D3BFD36A44ECA23EE50CABA28B9DCB64F42E3752425CF965F6DC632AFE6A3B6BDB86996E2409C33A516A90819EDDE5312089A570A8C43E2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>...........v........ .. "..2...>...d...<...v.......@....!..........................................................................................................................................0...<...0..q..k..k...6..I.......I.qk..B.....LZ0..q..k..k...6.0....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............s[o.%Y.(..h}.......N...^..............._.>...E.V.C................................................D....I.qk..B.....LZ............s[o.%Y.(..h}....................................0.......0.......0...........................................0..j....0..T.T..0.......0....|..0....;..0....h..0.......0.. .W.....'0..20....z...,4. ...."......$>........4..p..7......S.u.m.m.a.r.y........................0..30..80....z...y.. x.. ...........$...........7...7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.9.............0..

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000D.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:18:09], progressive, precision 8, 164x641, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):27862
                                                                                                                                                                                    Entropy (8bit):7.238903610770013
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:LTawAZvhbrXzDc6LERLQ/b5vXOl6pXQ/wD5OUMrdRUUhCplQg0ESSz:6wm/vT/b4wxoqbdUhWnSs
                                                                                                                                                                                    MD5:E62F2908FA5F7189ED8EEBD413928DEE
                                                                                                                                                                                    SHA1:CA249B4A70924B73BDA52972E9C735AEC35A0C5D
                                                                                                                                                                                    SHA-256:20ABE389C885E42B6EBE9E902976229BB6FD63C8C34CB61AA70B8B746209F90A
                                                                                                                                                                                    SHA-512:EE8D1821A918BE8714F431895E7223D08036E88A4FDB9A5485EFF246640EE969A69A8AA4E2E9DDC35BA75FB6D4E95092A286E90B477BD6998C313639C2C31F25
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:18:09......................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................!.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..P.v..+..n(a..Q..S\6....Y....D......} w#.b..]l.5.RU..k...... ]$.$.........f........?.z@2uU...7....?..|.Q..I.&.. ......"T4)wdH.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000E.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):20480
                                                                                                                                                                                    Entropy (8bit):5.418876134442375
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:CA+A2BMOzCgUSxylP3N+LQDIb0VVNAabYPWy0188CtDjn/Z9d6F1yKDPfgXXg:NsebITIc
                                                                                                                                                                                    MD5:F43DABD75B415A43449764A3EDA6FCF4
                                                                                                                                                                                    SHA1:3F91000F9F4C8ED09F387C0A8ACDC0E9FAB6F9A6
                                                                                                                                                                                    SHA-256:7756C6CD41347132D5EC694E38FF3FCE5FF47DF6276D2B50B3B369895A0E5AF2
                                                                                                                                                                                    SHA-512:259706E832115CCC1F11E2D76C93893FE4D9245FFD75F337E3FD138EF68955732D45D493FE47B31A814EEF502117FAFE21C4F2FD6F6A40B72C8EE436DCE0B2F8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:...@j..@................X@..@!...M.........@j..@@................L..@!...L.................................................................................@j..@X...............`L..@!...L.........................q..$.>?..[.Q.............:.....Mr6B......t..,j.{..pQ.......%.}...\......z..|.;...8..JYx.z............".5.....".5..................................................m(T%..._.*T".....+T!...}.,T'....S2T.*..".5.....".5.....".5..............0...........e....4.........................A..:4E.2..p1......(...`.i.....(...(...B.a.c.k.g.r.o.u.n.d. .-. .Y.e.l.l.o.w...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.r...P.a.g.e.V.e.r.C.o.m.m.e.n.t...P.a.g.e.O.v.e.r.i.d.e...P.a.g.e.N.a.m.e...2...0.0.0.1.9...1.....0...U.n.t.i.t.l.e.d. .p.a.g.e....P7......P7..$<I....Zl..UK......UK..o@...4L..2...:....... .......0.......X...............v&..m(...+.}.,...............0...........e....4........................yf.....F.Q.........(...pO;.....(.......S.t.a.t.e.m.e.n.t...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.r...P.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000F.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.085781209145456
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:bnPEPnsp6ND6mGDtTt8Eau8nXH29HZM1hUTo0rdHrrzEIcdXIAc9uh:4saGmGDP8EauWXW9IUTRRLmKs
                                                                                                                                                                                    MD5:058D63E50E4A9441791AE48A967EA4FE
                                                                                                                                                                                    SHA1:38A4AA73741A9A1C240D403E7E3FE352F2BA612B
                                                                                                                                                                                    SHA-256:477648957FDADD24C292ED06A70A7465CEE3B0CC87452202A8A28BFAF34F4783
                                                                                                                                                                                    SHA-512:CB28BF93F95445FEBC11E1275E29A03960598AC7EA00288AFC5A375E881E6E4CF22639580463B4BC2C72B55FA6EFFF3DA39D74613D9608130E424B99FAAB5DF1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>....... ...v....................................................?....?.............................................................................2...>.......|...v...H............................I.......I.qk..B.....LZ.........OtG.......~...OtG.......~.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............2|..o.......<.%`....N...^..................@..@I.~.8.:M.........f........................................I.qk..B.....LZ............2|..o.......<.%`........2|..o.......<.%`....................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4......7...7........................;........4...4...4......................#..............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000G.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.081681212632871
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:dsoItwjEZ6XlkEIXk944u/TTRyT4gerwFmvtvpvgvRNo:ds7Z4xIXk9nu/fRyTg
                                                                                                                                                                                    MD5:2F4DC3428075ECC6CB71193FBCD33D15
                                                                                                                                                                                    SHA1:7815DD4D67E50DB23EAF7E87A9A198901A833E54
                                                                                                                                                                                    SHA-256:3B072A60926E2670B7B02136BDC3CB01B3F1600AD427F7DB9E1AE18B86E25FD1
                                                                                                                                                                                    SHA-512:B6B8DABB062A665EF5A729E7EA05F0CBC13802E743D4215C9BA862927F20BF1DCBE94965F5DC9CA65727FE55336722517830122AC6ACAF5C6CA0A0B022384457
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZ#.g.....#.g.HW].-.Y.....#.g.HW].-.Y.....#.g..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................|........tM....N...^...............k....T.H.h(.#...........f........................................I.qk..B.....LZ................|........tM............|........tM.........#.g.....#.g.....#.g.........................................#.gj....#.gT.]..#.g.....#.g..B..#.gH....#.g..B..#.g..>.)#.g..J...................;........4...4...4.."..............#.g.#.g.#.g..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........#.g.....#.g....##.g............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000H.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.078981515830449
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:dsDJGyCBBAaZLSt0pSE3p6Xw9FGbToCrd6rfI3dX1LpBKEZr+wnog:dsWtlSqSE3sXw9gbTvRiA93o
                                                                                                                                                                                    MD5:798ACCFB9CCA8BB0700802B1FA93E950
                                                                                                                                                                                    SHA1:47C95BFE7C279F987AE4B76330EE38557B5BD9E8
                                                                                                                                                                                    SHA-256:BBDADC421D95E048865C8FF76E5F66E1B688B1DD76421474EFAB525DABA7050C
                                                                                                                                                                                    SHA-512:0477AFC2898E97654C7F38EEBAB35A2BF1EA24A47E71F662D002165E6BC1FAC94C6E14019FE5E508D26874087499D13EA4BE088D3868234F19F9DCAAC7479AA8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......$...v.......................................................................................................................................2...>...........v...L............................I.......I.qk..B.....LZ../......./.g}e.)..6.d.../.g}e.)..6.d.../..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............]..n......qT.y.....N...^.................S.x.F."..BK..........f........................................I.qk..B.....LZ............]..n......qT.y.........]..n......qT.y............/......./......./.........................................../j....../T.]..../......./..B..../H....../..B..../..>.)../..J...................;........4...4...4.."................/.../.../..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........../......./....#../............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000I.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.053572946564372
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:DVsP4m6HAb2t+XqoqEliKX5K9g+0TosrdnrwIddX9pPue0g:DVst2Ab2QVqEbXE9gxTNRrzD0
                                                                                                                                                                                    MD5:BBD7C16163156488DED83100AF1068A5
                                                                                                                                                                                    SHA1:E28D5898AD76E2AAAC35496EA3A5102052F988FA
                                                                                                                                                                                    SHA-256:873232A397E6536F2D9846264DAB95D3F2D6D4C18AF6F17D124830B3C35F073D
                                                                                                                                                                                    SHA-512:8BDF531F8473C52810310AC3E5EEC658DB6E2486A8F9F2CA9CA10C15D9FB0B56401A914B383A8C4E8D2CDFFFAEBE41EA0840CD076DA699F3572AE21470EB0507
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......$...v.......................................................................................................................................2...>...........v...L............................I.......I.qk..B.....LZ..........h;..2-ig.g8....h;..2-ig.g8.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................L.,......$c.!....N...^...................\_\M..PB.?.Y........f........................................I.qk..B.....LZ...............L.,......$c.!...........L.,......$c.!....................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4......7...7........................;........4...4...4......................#..............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000J.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.05292204036164
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:Fs7EsTLqCtt36BIEHhHcXzc9reCgBITo/rdqrZIqxdXQH2Wkg:FsFLqC73EH9cXzc9rcBITqRy9Gk
                                                                                                                                                                                    MD5:A8838559053300BE9F5B8A3FEA97D6F2
                                                                                                                                                                                    SHA1:96E707DC6EE5B63B71FA3BF57ED8FCA30104E87D
                                                                                                                                                                                    SHA-256:08C160C92E34B650A162059B231C64FC124C186E673B67BCBD6176C03BBC2B7F
                                                                                                                                                                                    SHA-512:EF874D15D4133D027F290C6018B39764ED05D05C7F02D5C6AA3DF782DC309B90796AC3A4E45A15426070B4D6E99FDA59233F89B3A65F32A4DA7FC8343090825F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......$...v.......................................................................................................................................2...>...........v...L............................I.......I.qk..B.....LZ<.m.....<.ms.W6.!.X.;Z(<.ms.W6.!.X.;Z(<.m..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............cu..;".(.A<..."....N...^.....................J.:Jp..,.........f........................................I.qk..B.....LZ.............cu..;".(.A<...".........cu..;".(.A<...".........<.m.....<.m.....<.m.........................................<.mj....<.mT.]..<.m.....<.m..B..<.mH....<.m..B..<.m..>.)<.m..J...................;........4...4...4.."..............<.m.<.m.<.m..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........<.m.....<.m....#<.m............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000K.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.069236555948024
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:Y1sLSCUAIY+t6DWEEDTX8vT9TjZHIrJTojxrdDrGIudX+1RIOh:+s5IJ/E2Xs9xHCT4RPmm
                                                                                                                                                                                    MD5:26C792757C5A52B53CAE30CC671F7015
                                                                                                                                                                                    SHA1:154692AF598772953BD1B3AE380084001A973BE4
                                                                                                                                                                                    SHA-256:E6EE4445E07AA1581E4FC42EA747CA18970532B37F674D9969548EAEF2E2571F
                                                                                                                                                                                    SHA-512:1E29C905F60404854357E81B7D131DF6DD07E55EB28F7058165EA9FD5AC0F208E146FBAA4F3BE5C6F2F1CDED59E21A34CD2089B50ACD9492F567A1789265D55F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ_"Y....._"YN..........Y._"YN..........Y._"Y..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............5.9wP.9..J..<D....N...^..................?..O.X.4...........f........................................I.qk..B.....LZ..............5.9wP.9..J..<D..........5.9wP.9..J..<D........._"Y....._"Y....._"Y........................................._"Yj...._"YT.].._"Y....._"Y..B.._"YH...._"Y..B.._"Y..>.)_"Y..J...................;........4...4...4..".............._"Y._"Y._"Y..z...y.. x.. ...........$........4......7...7........................;........4...4...4........._"Y....._"Y....#_"Y............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000L.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.081804607040545
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:YlsFqWqqWP6A7tnt1lU7aEYwDWXRW9XlHHraGToqrdmr7ITjjdXciDpRFqet3ZxN:esutnpUOEYqWXRW91HHWGTDR2Kj6w
                                                                                                                                                                                    MD5:CCEA01B6787443ED4D82D855E2CADB09
                                                                                                                                                                                    SHA1:5445476340D04C5EF8131DCB386938BA04EF8FEB
                                                                                                                                                                                    SHA-256:6C62CD30227931F0A390808342006C006786A7AE780C38228FDBBBF0B258535B
                                                                                                                                                                                    SHA-512:0AFC137767143A1B8F988F54C3974EAA96107243B4C9FEF06127A5FF08F533F27E117C6375FF3C4DEA45FE60575E9951EDE41F246C218385CEDD392C30F0BF6C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ._......._.....,......._.....,......._...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............mK(.b....L........N...^................x..\..N......xH........f........................................I.qk..B.....LZ............mK(.b....L............mK(.b....L.............._......._......._..........................................._.j....._.T.]..._......._...B..._.H....._...B..._...>.)._...J...................;........4...4...4.."..............._..._..._...z...y.. x.. ...........$........4......7...7........................;........4...4...4.........._......._.....#._.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000M.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.0883644648665305
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:YpUkscZg+4zQAltudHGEn6rRXg91zhXVqJToJrdvlxrsIGdXob920R14Ih3D2ASK:yUksO4kAlYAE8Xg959VqJTcRHAK4s
                                                                                                                                                                                    MD5:2528BA328337F168F0D786D7FDFC8F1B
                                                                                                                                                                                    SHA1:3B9A8C8EB2528555349A98073DCFF95AABFBCCD6
                                                                                                                                                                                    SHA-256:619ABA08E91DB224154858D2334E082EC4DA323A0C2F4445893AF30DA38B7CD8
                                                                                                                                                                                    SHA-512:5A0E00E0D00368D5E6CF15F79B521731F1C5357EE204E5405C4A85573F09CCECE1EFD2DC8055543EE9D83C215441299D73F77FDFF8E2F47837FCF0505B37DD29
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ.............d....6.<. ......d....6.<. ......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............y...9."%/..^......N...^................O(..\.D...N..e+........f........................................I.qk..B.....LZ............y...9."%/..^..........y...9."%/..^..........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000N.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.041935142515289
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:81sOdMQCIEXgmXI9ZGT4RjTHHG/GH+lw:qssMPXgmXI9ZGcRjT
                                                                                                                                                                                    MD5:555029F930B721F4278B3836AA6A2427
                                                                                                                                                                                    SHA1:C5F0B90DFDE763CF28F67F6EBF3C2D220FC1DD11
                                                                                                                                                                                    SHA-256:4D2248B975D587624F7E324D6A491BEFDF44DAA43D35ECFB1DC01ACE1F76902F
                                                                                                                                                                                    SHA-512:720AC9EDE633B2F3B0EDF8A4E849F5FE7137538EB9E6F1B3DE86C954667EDE8B62CFCDDA70B2D4C1D229452001ECEC3AC7EACD2CCC3E4D657F1DEF29E60409B7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ`e......`e...m.......G.r`e...m.......G.r`e...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............)..:f.3...DxI.....N...^................k.j..O..W.............f........................................I.qk..B.....LZ..............)..:f.3...DxI...........)..:f.3...DxI..........`e......`e......`e..........................................`e.j....`e.T.]..`e......`e...B..`e.H....`e...B..`e...>.)`e...J...................;........4...4...4.."..............`e..`e..`e...z...y.. x.. ...........$........4......7...7........................;........4...4...4.........`e......`e.....#`e.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000O.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.068840383544555
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:YFjs1aH+E6SItwz2E8SXE9NUToq0rdQrKIwdXEDKFK3RTl3CVNFKlVnr:ysQeSIjEDXE9NUTCRIUYKQhl3+NQlVn
                                                                                                                                                                                    MD5:2E7D24125D0F0C5DC122165D432EF00C
                                                                                                                                                                                    SHA1:601090A7BFCA82280D54EEE9E5C1EDE039B298B9
                                                                                                                                                                                    SHA-256:2A3F8C9C4A1FC26FB351E90CEC332753FD440716CC50C7076F11E376FE8C3B5E
                                                                                                                                                                                    SHA-512:54512477582FC1976DEA365BCA9FCD51649FCC42DAFEA53C0D2F2EA9E8E0C4737B30AD560F2738FA08ADB376C840DE6D0D7A0238030105B998697A8BAA120EE1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ...........:n.4bz{...q....:n.4bz{...q....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................Wg'.(.f........N...^...............'...o..@...............f........................................I.qk..B.....LZ................Wg'.(.f................Wg'.(.f........................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4......7...7........................;........4...4...4......................#..............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000P.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.090825837310026
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:isH9w949Fs/yTJ+hlEfBXY9d0TORfu38949j989b9p9mQ:isHs/yTfZXY9d0yRfu
                                                                                                                                                                                    MD5:FE7ABF381E9AA057EF48A4F10AA98283
                                                                                                                                                                                    SHA1:0FC4F6E727B9FB86AF322669D5DD5879A591B704
                                                                                                                                                                                    SHA-256:A57BD982C5A3A1437EC8C563D8A5E3915A29E7E97DE8DBF9474E31265E233AD1
                                                                                                                                                                                    SHA-512:FA4F06F2D05C90F1541A4A271E62688A96288BB224D3AF814672EEF947B380150469D9FABA8D7E94170EFDFAD09730DCFBF37C0E1BF29F1644BF93D5EDA69829
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ6.[.....6.[{....!z.9.m.6.[{....!z.9.m.6.[..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............H.q.eU.:..^...\....N...^...................,?.K...).X..........f........................................I.qk..B.....LZ.............H.q.eU.:..^...\.........H.q.eU.:..^...\.........6.[.....6.[.....6.[.........................................6.[j....6.[T.]..6.[.....6.[..B..6.[H....6.[..B..6.[..>.)6.[..J...................;........4...4...4.."..............6.[.6.[.6.[..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........6.[.....6.[....#6.[............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000Q.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.060346548709925
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:Y5sijj4ro7htS2EFnUXs9Gh/ZoOTohrd2tr4IKdXOD5TR+hSxV:KsLro7hPEFUXs9GoOTYRe02P
                                                                                                                                                                                    MD5:A63E0083A3AB97D74827024F4267624A
                                                                                                                                                                                    SHA1:A486612FD9C1B54BDBFB82AC8CC94FB167321D65
                                                                                                                                                                                    SHA-256:65727C5E08DEFA11A7E368DD9695B13952F8C3102C49D02326C02FF0350DD9FE
                                                                                                                                                                                    SHA-512:582248E58F88A7536538DCEFC9E0CFB8E0120123B25939E892DF400CF904BE19E67CF01065237BEE3B21DB00349BD64C4C6A230CA4D46F8401C80E6789A517EB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ............rb/.....\.....rb/.....\......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............9E.UCy.+.;v8.-....N...^.....................L................f........................................I.qk..B.....LZ.............9E.UCy.+.;v8.-.........9E.UCy.+.;v8.-........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000R.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.129803646565962
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:gOsI9F+xtQmOmtsEtdXE9Idxd/0ToTrdfokrJIQdXoekW08a:gOsA+xGEsE3XE9I98TmRfH9lG8
                                                                                                                                                                                    MD5:3DEE5BCE63C033C4700540CA523964B7
                                                                                                                                                                                    SHA1:B6181C197F4DBA1FDEB188D58BA113098D844AB3
                                                                                                                                                                                    SHA-256:9217D7E0990A6E0F88AC9E25BCA19101F4F1D02AA39D4F341E46348E9CC90417
                                                                                                                                                                                    SHA-512:5A695A02B92ED8E020A90E4AF6C443D0B10BEAF4D66FF429B1470A71A54D2117CFD055FCAAE2E5C9ABDEC8B725FD82B0E4CB4C742A0A67CE9EE6E123A651D6DD
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZ`:......`:.........;..`:.........;..`:...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............X....m........;....N...^...............9.3...sB..+...........f........................................I.qk..B.....LZ............X....m........;........X....m........;.........`:......`:......`:..........................................`:.j....`:.T.]..`:......`:..B..`:.H....`:...B..`:...>.)`:...J...................;........4...4...4.."..............`:..`:..`:...z...y.. x.. ...........$........4......7...7........................;........4...4...4.........`:......`:.....#`:.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000S.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.0701043913931345
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:uyBsStbzFjgt9t4Eno3aXWUQd94t9ToMrdlrSIJdXnh/AkqiuYyt0/V8aya:uyBs+jgd4E1XE94t9TBRp98WA
                                                                                                                                                                                    MD5:817677D145BB6534E1BCC317268F2FA2
                                                                                                                                                                                    SHA1:C412824BE208EB2AB2B5C7EA74A48C48F1F7A779
                                                                                                                                                                                    SHA-256:03B3E538EB5A46805E672877AC61388AAE4C47E77E3969F74B6D4FF1ABC8F4B9
                                                                                                                                                                                    SHA-512:8AAC4610CDB30B0D495A423153E4A7E6B9055B5084E0DF9C6E296C8F2820EF2875A4E376145FF3D3035065DF4A2A069305267E4BE4DA04AA85955C09FDFEE5EF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZ............ia...M........ia...M.........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............G.......!..h..W ....N...^...............d....h.A.<.J.O..........f........................................I.qk..B.....LZ............G.......!..h..W ........G.......!..h..W ........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000T.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.084272442868918
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:Rs4A78ImjLJsE7pXep9+5zeDT8RRL9zwC5EHkwCEdKZ:RsL78RJJ7pXep9kzeDoRRL9X
                                                                                                                                                                                    MD5:DAE46C9667A6DE0AF762E0D8C17D667B
                                                                                                                                                                                    SHA1:CBCCFCC1BF118071B714AA91A8137C156C120840
                                                                                                                                                                                    SHA-256:1AF3A73029FC81C95052D0B32882737B7116B9D5221767552673B8F7E558E67F
                                                                                                                                                                                    SHA-512:38EC1EBE84CE261186E4CBE70B001A56F1B77B0F57864DF331A89C60B8FCE8517A6EF23248FFFCDD6907A5FBC9CC137BCE8E6417850FC0C82132113296BDF072
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................}.......}...._.:f......I.......I.qk..B.....LZ.}...._.:f......}...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............y..Ty<..!.w....X....N...^...............W..d...K.....t.#........f........................................I.qk..B.....LZ............y..Ty<..!.w....X........y..Ty<..!.w....X..........}.......}.......}...........................................}.j.....}.T.]...}.......}...B...}.H.....}...B...}...>.).}...J...................;........4...4...4.."...............}...}...}...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........}.......}.....#.}.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000U.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.125702731831653
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:/esUxJaMHrc0tr5qEt4XU9qSBToYrdjrWIddXTYHyO9wR8aig:/esErc0yEiXU9qSBTZRvFK1wR8
                                                                                                                                                                                    MD5:8996E6F9172C2BBC4BDD8EA5AED52491
                                                                                                                                                                                    SHA1:7F5843B4329895607EA6486C0389A33086DBC65A
                                                                                                                                                                                    SHA-256:718F73412ABE657E9E1F67E8AA6D428998A80D581A9F2568FC230E11D613DC95
                                                                                                                                                                                    SHA-512:691C89C53AC03287BAF87C0DFDEEFA48B28F1D1EB2616DF5D92B435EDBEFB72B332E947F072327BA5916F00C8CA316AFE5B5A26BF2D860C7F872155A74B7A948
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......0...v...$.................................................?....?............................................................................2...>...........v...X............................s.......s....D."..V./.~.I.......I.qk..B.....LZ.s....D."..V./.~.s...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............jb....$.u#m.:,....N...^................Q.....A..(.............f........................................I.qk..B.....LZ.............jb....$.u#m.:,.........jb....$.u#m.:,..........s.......s.......s...........................................s.j.....s.T.]...s.......s...B...s.H.....s...B...s...>.).s...J...................;........4...4...4.."...............s...s...s...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........s.......s.....#.s.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000V.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.169629179330101
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:IQasNwf/V1qHSYtCOt8EPlOMcXHc9MypLx7TozrdQrSZIHdXx3UkRig:IQasqt1lY18EPUX89J7TmRIpN
                                                                                                                                                                                    MD5:A6AB7264B78DCDC873B9549BA97580CF
                                                                                                                                                                                    SHA1:3D02BEE7383DB0F66FA6955B9DF084688480A3B4
                                                                                                                                                                                    SHA-256:BB28D85FB98D33EB217C05F087F9460E5025F62995779BF3C53676276A7EE64F
                                                                                                                                                                                    SHA-512:599734BF5969BF09D0BE736D2E77F238FD121231A520C6FCFC984232C350CA6F2A6DA073D018699B9E90A0114890578A9B9E2212E6C3193164664D0C2C7CD3F4
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......0...v...$.................................................?....?............................................................................2...>...........v...X............................I.......I.qk..B.....LZ5.U.....5.UrB.........-x5.UrB.........-x5.U..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................v..#...F......N...^................ rQ...J...e.,.*........f........................................I.qk..B.....LZ................v..#...F..............v..#...F...........5.U.....5.U.....5.U.........................................5.Uj....5.UT.]..5.U.....5.U..B..5.UH....5.U..B..5.U..>.)5.U..J...................;........4...4...4.."..............5.U.5.U.5.U..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........5.U.....5.U....#5.U............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000010.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.121273422706357
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:ds1epNuP27I5hEBA7CXM92NT0RKt27NwYouPt:dsd2s0ACXM9cYRKt2D
                                                                                                                                                                                    MD5:ABCC5B8B594E1A358456E0910B0B4C6A
                                                                                                                                                                                    SHA1:26D3CC64113487BC9A81E415447335310DE11A3B
                                                                                                                                                                                    SHA-256:6166D2EEEE837421CAB6C3B454420EE0998C9B3F170DD0144B0FF9B83CE69A28
                                                                                                                                                                                    SHA-512:0BA97EACCC4067436519BE7098855E28048B85C485AAD1D7FF913D1E7D6D5408E7F1A735E1CDD7D948B0AEB27D04A17BF117F5F9252915E1F274BBB989804C38
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ..P.......Pbp.W.9....g..Pbp.W.9....g..P..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................?k.M.&..cD.}=....N...^...............02.4.aC...6..1i........f........................................I.qk..B.....LZ...............?k.M.&..cD.}=...........?k.M.&..cD.}=...........P.......P.......P...........................................Pj......PT.]....P.......P..B....PH......P..B....P..>.)..P..J...................;........4...4...4.."................P...P...P..z...y.. x.. ...........$........4......7...7........................;........4...4...4...........P.......P....#..P............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000011.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.128383493579288
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:9sFmlP3MVwtwOE7CW/Xs9nSMTiWToCrdSreIJRdX52TrqgB9:9sFHVwVE71Xs9SMlTvRK34
                                                                                                                                                                                    MD5:F371746CE67C0BC7D9B402CBC7741DFC
                                                                                                                                                                                    SHA1:0E7EFDF3F98012C0CC74630666768836D2CABC35
                                                                                                                                                                                    SHA-256:E9B2BBD13DD218DE513474398CE6CD00E76D01BB840A3CBBA07671216456A457
                                                                                                                                                                                    SHA-512:BA217410111BAF8B41C1FDB308E62F8FB1F531E94FEAEE1CF1264A9193C1F9F05EA39330FC1A54E9D44CA494ED1A3F35EBFE34AE5A78BA55AA777BFA549D1017
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZS.7.....S.7>I4...3I.....S.7>I4...3I.....S.7..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............{'}........j.O?.....N...^...................W..B...(............f........................................I.qk..B.....LZ............{'}........j.O?.........{'}........j.O?..........S.7.....S.7.....S.7.........................................S.7j....S.7T.]..S.7.....S.7..B..S.7H....S.7..B..S.7..>.)S.7..J...................;........4...4...4.."..............S.7.S.7.S.7..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........S.7.....S.7....#S.7............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000012.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.133280681170083
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:Fsdl9ry9EEEBXgB9SkTZRKmznEqoBEeyrj:FsBrbRXU9HdRKmL
                                                                                                                                                                                    MD5:B1D5D1FF4DFE0CC38D2D5BA94561637F
                                                                                                                                                                                    SHA1:2F6DF114B0BB315E29E31AAE667B5556F3B33034
                                                                                                                                                                                    SHA-256:718F348F5E351022D6758CB46CC83E935AB1A116BB4BCCFB0F9CA4AD16A3DB89
                                                                                                                                                                                    SHA-512:E723FA19FC5E822362FF9B9FD48F373A2FAEF32684374D3A143B6A6DB5E68CC094E3F005A9D45E9E657C3911A66E2ADFD15F6CAA21FC5BED58B8BF4979EC0B35
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZm.'.....m.'...%....q..m.'...%....q..m.'..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............j.`..n.8.k.X.3U....N...^.................|....O..LR..7U........f........................................I.qk..B.....LZ............j.`..n.8.k.X.3U........j.`..n.8.k.X.3U.........m.'.....m.'.....m.'.........................................m.'j....m.'T.]..m.'.....m.'..B..m.'H....m.'..B..m.'..>.)m.'..J...................;........4...4...4.."..............m.'.m.'.m.'..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........m.'.....m.'....#m.'............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000013.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.10247100185701
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:Fs3pQE1vTCtwyqGE2CHMXk9fAWTokrdSrJEImZEdX7mUqF:FsR1vTCBE2hXk9YWT9RKCZEW
                                                                                                                                                                                    MD5:F36578EA05B818A55B33051188A1C39D
                                                                                                                                                                                    SHA1:4110A178B76CBE73E9B3CA9A2E79EAA7AE67C719
                                                                                                                                                                                    SHA-256:08803027417B28B87761C4FB5AA262ECEC855C6A0DBCA087766647FB5AFBED14
                                                                                                                                                                                    SHA-512:9657F1160EA6F8FD0A46F365A4E676272C3931849314CA15D92C393534DA4D3CECC166DD9789A93F919B62FECB370689EA35598265FCB5DCE90E64CBFCA3B158
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ...........}]hz..| .)..K...}]hz..| .)..K.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............*A,a.W,....G.7h....N...^................B....M.[...Y.Q........f........................................I.qk..B.....LZ............*A,a.W,....G.7h........*A,a.W,....G.7h........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000014.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.123945634168215
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:EmsHOvHEl1tI+EG9CCZmoXMIo9XV7B5ToATrdSrdIHdXJqkZQleG:Emsfl1dEi3XMN9VTTPRK2Ele
                                                                                                                                                                                    MD5:AAAB750A68F59567BBDE50C0242A6DFC
                                                                                                                                                                                    SHA1:45314C7D24384189946070B650D388B41C205F4E
                                                                                                                                                                                    SHA-256:99A3BA7C13060386A6147640401C441DEBDBA69600D76C1A2497935B941DD3B3
                                                                                                                                                                                    SHA-512:8AE8F6C2B30363ACE1BE411D770320842139C5E6A2B197C81E6EC2DE65D5405056FC68843EA7273A548ECD6C205FA204E6B4E3647C3835B8CB1FFEFA143613EE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.ap......ap9..`..L.....M.ap9..`..L.....M.ap..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............(.Y..i.....&......N...^..................I..fF.....Q.M........f........................................I.qk..B.....LZ............(.Y..i.....&..........(.Y..i.....&............ap......ap......ap..........................................apj.....apT.]...ap......ap..B...apH.....ap..B...ap..>.).ap..J...................;........4...4...4.."...............ap..ap..ap..z...y.. x.. ...........$........4......7...7........................;........4...4...4..........ap......ap....#.ap............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000015.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.09398174852761
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:RsDGsaZTG7S2qs5tG9ryEnpDCZPiX49ixCNGTo/rdSrxIx2dXYLY5ANjDIr3qhq:Rsbqs50ME1hX49ixBT6RKV7
                                                                                                                                                                                    MD5:5CEF8A82EA1AFA32BE033EDF2E8FE6B4
                                                                                                                                                                                    SHA1:A7D63648A007CA00B83E332C23CDB0D55083CABA
                                                                                                                                                                                    SHA-256:C17F5664A910271F8F05923EE54E3BDDA14F41E620CB9E27AAC3039B333817CF
                                                                                                                                                                                    SHA-512:94F9273198A7F9E446F55FB71067260F7A3DB3AF7E587842257EF4C6ABE08CFBA47E755DA553C40AF2EF2BAF780CA4A31338E6435875682B5645E369A6F6CCC8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R...........................y.......y..M<......x.....I.......I.qk..B.....LZy..M<......x....y....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............._.......<L...I....N...^................U$.:fHO..3...j........f........................................I.qk..B.....LZ.............._.......<L...I.........._.......<L...I.........y.......y.......y...........................................y..j....y..T.]..y.......y....B..y..H....y....B..y....>.)y....J...................;........4...4...4.."..............y...y...y....z...y.. x.. ...........$........4......7...7........................;........4...4...4.........y.......y......#y..............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000016.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.149134405928681
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:BsmJ/kW5NtltM+EmCKBXc9kRvcuToDrdSrYIgdXYG4Op:BsDW3H1Em/Xc9kRzTuRKOz
                                                                                                                                                                                    MD5:45328B1167149DD486F52AE245CC2ADB
                                                                                                                                                                                    SHA1:BC661CD0BF1233633BC37FEACE962441999E88DC
                                                                                                                                                                                    SHA-256:78B8F2FFBB965F0035B9F25BB20DE3B737AF06B90F41F5E2264200A1ADE88683
                                                                                                                                                                                    SHA-512:B61773B6E819BE1AE0DDAD5FE0163FEBF5216CDB21C80010D498115CD29673912291BE57D26CCF42F2628BD619117375FCC167A9298CAB856A4EA3320623629F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZd.......d...g#......9.Z.d...g#......9.Z.d....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............4....N.6."..,[.....N...^.................J...H..7M............f........................................I.qk..B.....LZ............4....N.6."..,[.........4....N.6."..,[..........d.......d.......d...........................................d..j....d..T.]..d.......d...B..d..H....d....B..d....>.)d....J...................;........4...4...4.."..............d...d...d....z...y.. x.. ...........$........4......7...7........................;........4...4...4.........d.......d......#d..............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000017.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.109025073675677
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:KAsYWGI9QZh/BpKtBQcElCC5gXQ9eoiTogrdSrKIK2dXzam50QTmDC/9mrvPp:KAsVQrBpKL5ElCrXQ9gTJRKZ4
                                                                                                                                                                                    MD5:2BBD847D1F5730EDFD037015C40E1891
                                                                                                                                                                                    SHA1:11464F674EBED92452B994488228AFA5F3677878
                                                                                                                                                                                    SHA-256:A53534C74BC571EA6A3C476E8CB91AEED0178AF015E55E44A8099CB5069027E0
                                                                                                                                                                                    SHA-512:EEF8F052C818DC4AD1E6553C5980A978A7E0D96F1F5DF7F118AB0326308C87BD48DFB407D4C4256F65F0ECA5B2D4F42CC1C157EE81E1FE2614D1096E59DDE95F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......,...v... ...................................................................................................................................2...>...........v...T............................I.......I.qk..B.....LZ.H.......H.8.&.....W.C@.H.8.&.....W.C@.H...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............$..B.....P....h....N...^...............k......C..].*.C.........f........................................I.qk..B.....LZ............$..B.....P....h........$..B.....P....h..........H.......H.......H...........................................H.j.....H.T.]...H.......H..B...H.H.....H...B...H...>.).H...J...................;........4...4...4.."...............H...H...H...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........H.......H.....#.H.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000018.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.140339212486329
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:KnU7BsduU0ei1trIivKYE6tiC+GPXA9iuTonrdSrHIsdX4hEmZ0QkEWEJmLjjJ:KnUlsPi1NE6c7YXA99TyRKTMY
                                                                                                                                                                                    MD5:5A367554E7A91F5770F7B38471CA18A0
                                                                                                                                                                                    SHA1:FF933A6191B59A16C5CE14119D25386C0A8645C4
                                                                                                                                                                                    SHA-256:5E436649314C2A29BBF4EAE1D8A272827A3B7B1346A783E850DE22CD0DB514CA
                                                                                                                                                                                    SHA-512:86FA8E320E6AB8B670ADD25796984F7E4BD98DFC836D3D9535367A790CE8DF3C4E5A8286CB3F041D0464A7FD43916ADA69E8B5D656144E48B8CE9DB5E23403A7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......,...v... ...................................................................................................................................2...>...........v...T............................I.......I.qk..B.....LZV.......V.......#..O...V.......#..O...V....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............^.z;..=...C.X......N...^...................OI...5.>~........f........................................I.qk..B.....LZ............^.z;..=...C.X..........^.z;..=...C.X...........V.......V.......V...........................................V..j....V..T.]..V.......V....B..V..H....V....B..V....>.)V....J...................;........4...4...4.."..............V...V...V....z...y.. x.. ...........$........4......7...7........................;........4...4...4.........V.......V......#V..............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000019.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.148813157485757
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:QfXsV3ZUr9A/Ji9Gdhet0gxkEIWCCYuXI9L0xToOrdSruIDdXRrZr9qCNSAtt:QfXsMCsGdheGfEPFXI9LoT7RKj99
                                                                                                                                                                                    MD5:381A7235176F9AD59750064D4CFB7B14
                                                                                                                                                                                    SHA1:D646C641415E135DDF281D9990703BE9BB9E11E7
                                                                                                                                                                                    SHA-256:B2F51631508F3A8BACD6A8A1A01989D3B27F916816CABA03224897417F9D438F
                                                                                                                                                                                    SHA-512:7EB827408288BBCD9DCFFE006EE99C214C2AF0CEED77813EE8854BD682091B1777445906ADEAEA9D2FAC3E7949C8580EA17F1670B568486AEE71947CB08AFAD6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>...........v..."...................................................................................................................................2...>...........v...V............................I.......I.qk..B.....LZ.nb......nb....n2...Q..nb....n2...Q..nb..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...................d...8.@.......N...^....................kBK.ZK.J...........f........................................I.qk..B.....LZ..................d...8.@.................d...8.@.............nb......nb......nb..........................................nbj.....nbT.]...nb......nb..B...nbH.....nb..B...nb..>.).nb..J...................;........4...4...4.."...............nb..nb..nb..z...y.. x.. ...........$........4......7...7........................;........4...4...4..........nb......nb....#.nb............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001A.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.102208147053059
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:RsiwjgP86JoilYE3tQ2W+EVC/9Xvw970GEToxrdSrEdIedXCKK86uAZKWold:RspVwoiln3SaEV4Xo9YDT4RKEbX0s
                                                                                                                                                                                    MD5:D34160352A7F937E425C1145B873EBFB
                                                                                                                                                                                    SHA1:E6400ABB0AA90E568D067A9CB0025748B77292E0
                                                                                                                                                                                    SHA-256:9445C3895388DF94E154A3DFD28CDAC2312FA967E7B17B962B1315D061FC5E12
                                                                                                                                                                                    SHA-512:D0A118B01D1AF0CB810B76E4E170C8B7E9915D86C7797B3B66A34ED6278C2A99E84B5B326B5A8BBD91A657BF524AE151DE698A628FCA7C7957BD3C6117231DCC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ............W...0.h`.Ct<....W...0.h`.Ct<.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................b........t..2....N...^.................b...7A.............f........................................I.qk..B.....LZ...............b........t..2...........b........t..2........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001B.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.132131849301043
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:9sAhH2hU3BEsWM6X7s9eT2RKhMHYDBA2H:9s7hUO86X7s9eCRKh3
                                                                                                                                                                                    MD5:7D14CCFF6FDC86DA3CB9F117ED31D6CB
                                                                                                                                                                                    SHA1:34930881AE5EE6C9F2E6F45D6D85C1BD73B109B7
                                                                                                                                                                                    SHA-256:E6A214B45969EDA48CD84B42FC1BB4E088FD50E32B33A3E3E41867A5FDF462C1
                                                                                                                                                                                    SHA-512:26D8CB8287D2D97DFB3F99038829351299F3EF1AA90A0021930E42BFA9FD112955EF9F7B54E4DCCC3B42424D5997293884A87F91303DDA7889E4809CFBB7AD01
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZH.%.....H.%.;z...../..%bH.%.;z...../..%bH.%..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............ob..As...)....W....N...^................fF...O....3}..........f........................................I.qk..B.....LZ.............ob..As...)....W.........ob..As...)....W.........H.%.....H.%.....H.%.........................................H.%j....H.%T.]..H.%.....H.%..B..H.%H....H.%..B..H.%..>.)H.%..J...................;........4...4...4.."..............H.%.H.%.H.%..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........H.%.....H.%....#H.%............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001C.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.125685654281997
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:0d2sSiBYxghJ0b56tngKER35uCAZYXWt9XOQNpTomrdSrGIGqdX5C7laJkdRZaQx:pszs56xER3c+XY9XZTTDRKTAa
                                                                                                                                                                                    MD5:DBA0DECB4B2BBBDA4927431AEA35DB60
                                                                                                                                                                                    SHA1:3B89557EE998E5D788ED2C00BAC20815CAA8F91C
                                                                                                                                                                                    SHA-256:67A3D4761DD623FAC350D1DC9759D2BEA678233CAB6DB4802801F63C90DAE8A1
                                                                                                                                                                                    SHA-512:F08370CE3F164D02B8FE1E8BA051F90393E99286A5089935D5BA9250ED13B2160AB1C12CEA25CA15D1420C77DB676E6F4CD87DFD5CA815CB35A20CB3289EDBBE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ...........w.,8..T..l....w.,8..T..l......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............<.. .......H.6.....N...^.................;x*2.F.o.....o........f........................................I.qk..B.....LZ.............<.. .......H.6..........<.. .......H.6.........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001D.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.160442418314265
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:NsVrUaLP/6Uy0t0zqENAIWCp2hdXM9/zToq9rdSrskIddX7Hy3ZolOFyMiL8:NsL/6UHxENA1s2TXM97Tf9RKsH2
                                                                                                                                                                                    MD5:101D59F2E02D98B7978B2DE3F3DC32C6
                                                                                                                                                                                    SHA1:DD9F6869C4B98874C8AE8A375533BD92C5A5740C
                                                                                                                                                                                    SHA-256:E5A32EAAE0DCA71545965F4E8DA0BE8529F850BF98A58618C31D10DFCC0A2432
                                                                                                                                                                                    SHA-512:27176C1306AA5D47DADBDCC575D3C86DE85B5162EB8ACFDED284EBB86DEBC1CDB038AE3E41EEE12720D288224414D19DFA5EF7E6B8B9653C956E31EB964C095C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ................#.H...;R........#.H...;R.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............P..:.1W...9........N...^...............ZM....@.I..X.Q........f........................................I.qk..B.....LZ............P..:.1W...9............P..:.1W...9............................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001E.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.131111306769516
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:KEsFgoUmgsgugMNjF5tXiMEyrCQKX3A9eGv61ToWrdSrdIQSdXVl0Qagsg5gENgj:KEsNgMNjTpDEyr6XQ9eRTfRKjSzK
                                                                                                                                                                                    MD5:3E948E10EC7D62E82223E29C7EDEF128
                                                                                                                                                                                    SHA1:3A2A49C2287BDAAB753AAECB08C4C8519D99DFCE
                                                                                                                                                                                    SHA-256:E281D79BEB1AC6B7709C987C91DB1E8341BEAED55C84748F7956BDFA7C228A60
                                                                                                                                                                                    SHA-512:A3981CE40656DE4E358BD180884C50B58D2D1057250D6DA905A33E35A26D0380B8CB9427B47ECA6328AFD5BA84B80DE50AE1D13F0B3815C722479D52510FA812
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......,...v... ...................................................................................................................................2...>...........v...T............................I.......I.qk..B.....LZ................;cY..........;cY.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............>&.. .:z.G.P....N...^..................a..VM...}..N........f........................................I.qk..B.....LZ..............>&.. .:z.G.P..........>&.. .:z.G.P........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001F.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.136494884632802
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:Dsx/7pmaEXpXu95C3THRK2fZ4ZvRdZfYZbZ4ZO6ZJZg:Dsxpe5Xu9ADRK2fipRdaViz3
                                                                                                                                                                                    MD5:80056FCD2EDAD4C9A7B338CA274F9807
                                                                                                                                                                                    SHA1:562FD8F70A3D7AAF39E3F4A8B7DA0F8EDAC7ABD4
                                                                                                                                                                                    SHA-256:7FB621AB3C252A9F652C39212ABBA1FD38DEB19500CCDEBA7119010798C267CA
                                                                                                                                                                                    SHA-512:E992EBB4BBF0015721B56B3C888F84082E45E63DE986E284432AFEA27573B8DFDF1B6F9C61B865BBE5CA14D0AD34205550F70C7F9772688C959DDE40459A5432
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......(...v.......................................................................................................................................2...>...........v...P............................I.......I.qk..B.....LZw.U.....w.U1....J.....Xw.U1....J.....Xw.U..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................r.8P.>..v.....N...^..................2.bCJ....).1.........f........................................I.qk..B.....LZ.................r.8P.>..v..............r.8P.>..v..........w.U.....w.U.....w.U.........................................w.Uj....w.UT.]..w.U.....w.U..B..w.UH....w.U..B..w.U..>.)w.U..J...................;........4...4...4.."..............w.U.w.U.w.U..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........w.U.....w.U....#w.U............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001G.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8192
                                                                                                                                                                                    Entropy (8bit):3.6614931871154197
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:WKmi9F8/CKIiLCdj5NGEq3tfEGEG4IZOmEGd1BbAc4I8OgggH4I3YWfZ:79qKpiWV9qWjOYGhAU8cgX3n
                                                                                                                                                                                    MD5:262F900D11DACDF6EC021A5E505CFC29
                                                                                                                                                                                    SHA1:785A8DD955CD10A3DCED751A613C809E595A9A73
                                                                                                                                                                                    SHA-256:871C0C353CF4915545DBAA4420851C6640BE1C372EC22B4B7ABDA57D4B43EF8B
                                                                                                                                                                                    SHA-512:921A986B4AC795A1586D0DCEE314D0A73381DD21D17CC0869B235EA172F1205430EDCABC853B41F4DB757E4B8D54AA1C3AFA6F94C2701D337AFB4011C21DA331
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:....8............... .....................................................................................?.................................................8...............H.......................................D..F......:'..$.......$.4...>..p.....8wShx).*G..'..A.8w./Mck@d!...q.0`.%/Mc...$.4...>..p......$............$.......$................................................30B.....30Bz....!.i.aO../Mc...../Mck@d!...q.0`..2...\...^...l.........................$.30B./Mc.{e.......z..........T).....$.......$X......$..G....$.."....$..".....T)......T.v............../Mc..c..,0...e...B4.$...........GP..A..}.....J..................../.r...../.r.t.Q@.. 1.]}c...........I@R.@...E.D..J..a.....F./...J...6.....$.&.[ZA\..6.../.r.t.Q@.. 1.]}c/.r.....>.......x......./Mck@d!...q.0`.%30Bz....!.i.aO.....X.1\A...k............0...........e....4.............."...P.r.o.j.e.c.t. .O.v.e.r.v.i.e.w.......B.^....F...r.QH.....(...........(..."...P.r.o.j.e.c.t. .O.v.e.r.v.i.e.w...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001H.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):20480
                                                                                                                                                                                    Entropy (8bit):4.589550479137745
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:pUdRoYkCAorNfvmiDEIURtDnIByuAm7q44bDotbu6DSNexOFeJxmIvLumUeI:pUdGYkCAorlvmAEIURZnIo5me44bDotQ
                                                                                                                                                                                    MD5:1251AC262B31C0D3FA71C613623FF80D
                                                                                                                                                                                    SHA1:32E0079C915A3D565B3249A53FAA8572D8DB31D5
                                                                                                                                                                                    SHA-256:FF6EA6FF8827A3931A3C0A59D0FE1CA25437A6802AE684BBD99742A77531F6C7
                                                                                                                                                                                    SHA-512:E0F0769504A4B19BDD675923123AB7F65E69B3F5A9516510944910097640BCF818C431376819063CD41494BAD9304EECE4CC66D4F0D80767A18A128B058DF022
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:....>...........v.......P@..` ...I..........>...T.......v.......PH..` ...H..................................................................................>...`.......v........H..` ...I...............I.......I.qk..B.....LZ..v.......vk....>...u.L.....l.a.&'..@3........vk....>...u.LZ..v..I.qk..B.....LZ.I............I.......I...................................................I.t.....I................................................................4..'...'.............Q5j......Z#.E......N...^...............+..J. HI......7B............J....................................I.qk..B.....LZ............Q5j......Z#.E.....................................v.......v.......v...........................................vj......vT.<....v.......v..S....vH.`....v....&..v....'..v..8........v3..v8..v..z...y.. x.. ...........$........!..7!..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.3..............Z4...........................................4../4......p...............C.a.l.i.b.r.i.....

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001I.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:06:24], progressive, precision 8, 38x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):22203
                                                                                                                                                                                    Entropy (8bit):6.977175130747846
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:5q3R1VBvq3R1Flrk6Q0QPJJrR39joOVMJ25d1NkMhIwobbtAAAqYnLJZMJYZ2AC:xw6Q0WJR3FoOVMJIIlAAAqYnMJdD
                                                                                                                                                                                    MD5:2D3128554F6286809B2C8E99DE5FD3F6
                                                                                                                                                                                    SHA1:FC42CB04151D36F448093BDEFE33031A9B8D797D
                                                                                                                                                                                    SHA-256:14FA2D16310485AA1CE41F6D774A3D637E8CF8B03C4F72990155DF274FDB6BD9
                                                                                                                                                                                    SHA-512:D8531247A6E89ECABEA9C4A78F596CCE3493334EDF71AE4F7998FDDD0F80705948609C89756AB56FDFAB6D04DEC5F699A693801A772CA2EE2465BDD2CE5D2D5A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....XExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:06:24............................&.........................................................(.....................&...........*.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...H.....Go.Kxn.b..g...........%?_....O......q......7G......%%.V..8zm.].v?...jJ~._..>.......O;........o..rI.A.....n.a.........

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001J.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8192
                                                                                                                                                                                    Entropy (8bit):3.963285632405391
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:Xs7D0NI/kNbC5oAX17ETflR/CmfbpUeW9wPh6daMA3UFAjL:cickNbrK17elR/jbpUeGwPMd
                                                                                                                                                                                    MD5:71E20AD178CBBD0152FDCB74732D9743
                                                                                                                                                                                    SHA1:BFB1363807590283690349CDE5F160A0C1CB44BF
                                                                                                                                                                                    SHA-256:4454BFA098AA659EC9F1057A3F18896CC0B25F5877D03BBDCDEBD95962321BC9
                                                                                                                                                                                    SHA-512:8C13133E59F08F93D151129C1D7A22F01D5152A24FF6260F03298160CF11827491ED2D185A25DCCC48A5955C42A0C3BB9BEA4EE961645640D1DADC818FF19CF7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>...........v.......................................................................................................................................2...>.......Z...v...&............................I.......I.qk..B.....LZ.>..)....>..D...:V..S..>..D...:V..S..>...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................".2..O..1.....N...^................g.....I.p.D.dq.................................................I.qk..B.....LZ.................".2..O..1..............".2..O..1...........>.......>.......>...........................................>.j.h...>.T)....>.......>..L...>.H.]...>.......>...H...>...}.......Z4...........................................4../4......p...............C.a.l.i.b.r.i...................>...>...>...z...y.. x.. ...........$........4...!..7!..7................>.:.>.F.>.G.>...z...y.. x.. ...........$..

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001K.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):52945
                                                                                                                                                                                    Entropy (8bit):7.6490972666456765
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:cjvqR0XvFaGCTJffi0tgybmWDoTw71kHUAnjvawrlp2+NUO8dWSNl3PF2PjK/q09:cyRffflgybmWoTw1UUADHUbU21MjpAD
                                                                                                                                                                                    MD5:AD003F032F32FAC4672D4CE237FA5C5B
                                                                                                                                                                                    SHA1:AE234931B452F0D649D91291763B919CF350EA49
                                                                                                                                                                                    SHA-256:ADB1EBBE18D6CD8FF08AA9BF5C83CDB83BF9AA179698E34E93DBCDDE12F04D32
                                                                                                                                                                                    SHA-512:ECA25FA657ECE3A66D3E650628E0F65D3BADD38864C028AB6553950A1A66D7D55482C85E9E565573E9E5AAFA91C2D53235971C644A266D41EB69F8E72E3A843B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQ..aq....".....2....BR#r.b3$...C.Sc%...s5E......................!1.A..Q.aq"...2...#...B...Rb3..$..CSr...6............?......y_N.e.H7?........W..w....k|...S..d.4.>.RW5z.$.i.)V.O....>o...c..*&1.D..O..".ufbb..1...t..u=..K...m...~.....F..-.fb:i..=f..C.w.[{..~.7k....;..:..3....4.....$..m]...}....~q...9T.#..7.~..8...q.N;c..ffo.w...W..d........../t_........lWJE..).>..v;:=....Rrw#.m.n.n...E...vm.J}2N*..|.4...80.#..e....t.J..ZQ.x|g/....F..e....k+vK...M..W.X.e.L..~...j.....kz....=...n:O.:..[.L,.+R...Y..zKNI....,..{e..U.'...}.......|..t.]...~...b4......_.i..../.......m...a..n...v.j.?..Rc.$G|.31..#..$?.........h.w....-... .a.%z..u......u.A....Fm..J.......G..[...w.....:....w/.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001L.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12288
                                                                                                                                                                                    Entropy (8bit):3.5413940373627337
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:iseZq4a8Z/1NjKfbFjXg4RUAmnwRtchPJCruCxpl+1Il0G1F14239MFfEA8MZArj:vqxZBjKfbFbgYUPwRtiRguC3lEed1F15
                                                                                                                                                                                    MD5:BEDA8BE7E8A6F2735C5AF154B3EE3B13
                                                                                                                                                                                    SHA1:DC21D89E226B74E3F693D0A78009A99B11368AA2
                                                                                                                                                                                    SHA-256:9A42924EE1DF4C58EC65023322A96FD659703ABBC8CE82B27016B33AADAFAADC
                                                                                                                                                                                    SHA-512:82818804F8785E6A4FFB164DDCAAA13F4BC941E49DE49F70A0F13E830856FAA2676CB9D98A8675AB0D5B01B38A18344591FF2CB8AC6BE0EBF74AA39D9AA1C8C6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>...........v.......................................................................................................................................2...>.......@...v................................I.......I.qk..B.....LZ...9.....S..c...Gh..]N..S..c...Gh..]N....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'............./k.\.'..2..H.g......N...^.................W:GdL.......I............................................r....I.qk..B.....LZ............/k.\.'..2..H.g........../k.\.'..2..H.g......................................................................j......T.H.............\....H........3......O..............Z4...........................................4../4......p...............C.a.l.i.b.r.i............................z...y.. x.. ...........$........4...!..7!..7.................:..F....z...y.. x.. ...........$......

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001M.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):25622
                                                                                                                                                                                    Entropy (8bit):7.058784902089801
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:EhK81gTCyJ/Gf9Aw3t8w8EtdPeGDh6bEi1Ie1u4ZbvgwTwrSRh7ZKNpIGY:IjcRXwdJvtdGsUbEi1IeY8vgwTyC1+Y
                                                                                                                                                                                    MD5:F8CCFC24DEB1D991EBE085E1B2D7D9BF
                                                                                                                                                                                    SHA1:AF76C22A765434AEDA134924C517C84107F4FED5
                                                                                                                                                                                    SHA-256:7354001527AB554C44E7D6981B86DD933B7DC2E0D3DC8512AD3EECD843245C52
                                                                                                                                                                                    SHA-512:818BC3690B01B30BC571E4CF45EC8D1AFCAECBAB003532644381F1CF730A5B3486862D08F7579B2D3D89167AD7DF35028881245C9550B0DA23D1F81A720A9704
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!...1A.Qaq.........."2Rr.#.t6..B..3S$4..v.b..Cs.%5..8..cUV.(.DEe.&Ff...T.d.......................!.1A..Qaq...s4....2r..S"BR.3....b#C$.....c............?..D.."}:......&&...?3..W.q*.......]...m.Y.k1......K).J...uV.b.../.0.E.H..4..W_T.[t.V.w.9.x.qe.L..o.oL.....d.\.....6.|.o...}..H{Yn..E...6Y3.l.e..D.:,.n.%...t...m.........,+,..|..n.....6.*...f........6.../$../Vi..H...e.f.F.zn.).n.E..2sTn.i...Yb?6+H&...Bf..*....z.o.^7[..u.:o....t.s=.....(.s.....f.g....q9o.u1L.N...smzE..[>...+\O....j.<....j.c.W.............U..+.F/.'..W...T./W...>i01./....j.s."..Q...{...a._~OW...Rp.)*.e..W..Q4)<..'..W...q...'..U..z..g......U}...O....w....0F:.N..V.3W.|..'z0.]...j..U[v..g$D.Lc[.e...UW.m0+

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001N.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):20480
                                                                                                                                                                                    Entropy (8bit):3.1920134110609144
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:mMsBf98eOWwuKtjaUoKQYfRS76ip7+yKwbv:mMsBf98YwuKtjLoKQYfR46ip7+yKwbv
                                                                                                                                                                                    MD5:F8AE28B71F88894B649DDD4A788540FF
                                                                                                                                                                                    SHA1:085AF6E9B74EA95BDEECA983253302C23F9F5917
                                                                                                                                                                                    SHA-256:21075F61C1D31E382B543AEC5675A8029B693A16310CDBA53C183F5591B636A8
                                                                                                                                                                                    SHA-512:EE57FE8B0E7F986AB85A69E0A756D514A2044047C9A66B82A7ED1EF541B13008AAE48AEB38B4BCEF671ACD2E4FB14444872AE7F8F32947861EF592F60E845E4F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>...........v.......0 .../..............+r.....................+r..........I.qk..B.....LZ................................2...>.......B...v........-..............v........-..8....................I.......I.qk..B.....LZ....T..........;...@........;...@......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.....................+r.........N...^................l.&.k*H.L|.tCz.................................+r..............l.&.k*H.L|.tCz.....................+r.....................................................................................................j.e.....T.........................a..................... .H.......z.......R...................!..7......}.....W.i.n.g.d.i.n.g.s. .3.......................Z4...........................................4../4......p...............C.a.l.i.b.r.i.......................z... ..$..............

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001O.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):15740
                                                                                                                                                                                    Entropy (8bit):6.0674556182683945
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:Elv3GG8/OOs+GouFdxMlxjoPyerzkpuOo2vPMc62PaJseZC+BJoS/:EtNiwdxMlZoPhzkpuOo2PMc6rX8+B6+
                                                                                                                                                                                    MD5:FFA5EC40DC9A0FD10EB9E6355142D6A6
                                                                                                                                                                                    SHA1:3D3D6A7E086B3C610C08F1F3E3F883604F06F2A4
                                                                                                                                                                                    SHA-256:D74C3973C8D1F7C77274691AFB1AA934940674341D7EEE563BE75E563281BDFD
                                                                                                                                                                                    SHA-512:6FAF2A24D06E6008F3579C7CEC90C2887462BDF83FAD7372FBB74B8DE90340B580E9836F309B68A9794597A598F7DCDA661C9A58DA6D8187C69083B7A17C9CD9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!.1.....AQ..aq.g..8...."r....2.FG..#.E..7.Rb..Cc..D.v.B..3s..$d.%5Uu..&6fW'w........................!....1Aa...d..5e.6.q...Q..."2b.c..r3DE..BRs4U.#C.S.T............?...u.&0...cV.T.I...1..=4....Ce_.g.q.=F.M:>)...k..pm..h..=........S....)Ja8x...b.).=5.q..0......k.M.....1?-.G.b&.5..Ep.8t...'...R)..ta.F$bXO]tW.b.6#.t.XWN..ZW......].....G....x&&f..'L.....7...\...'.8...~`.sa...............................................X........qo...SMk...'.V...i..hb.}&?/.k.:>l.^....>Y...<}...&.jY.Gn.MKejyV......D......gf.0....t.nw..XQ...H.B.....=8.UkR.....Hm..w..]...k...#Z...F../.gjWvf.....w.aZ].2..5..^...VZv..._.7..a.|...:.B...,f...............~....m.;_.....-.e.y.w.[m.].bu.b.f+.E++\.....Y..7

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001P.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12288
                                                                                                                                                                                    Entropy (8bit):3.796762349876588
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:9sMnYz10rmNI41yXUaNNpRtGjy96hZW7KD64X/iEV91zAwCcTd:COQ0rmzmUKNpRtsyohgmxX/R31zA
                                                                                                                                                                                    MD5:44FD44FF537D0C703D49111124FA052B
                                                                                                                                                                                    SHA1:372622241B32C95F827D08B0904D9F9A925469D5
                                                                                                                                                                                    SHA-256:E541EEF912F99E55B1ED6F35066F3C991BA322A197A0BA174D62C330449A3A2D
                                                                                                                                                                                    SHA-512:CCAAE346986777BD63D5839B03233879A1F503FEBFE632033C5717F1702FA6041EF9C46AF1A1361E55E264A0F7664200082223D31EF1D5FCFE98C8BA69D6794D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>...x.......v........ ..`!..2...>...........v.......@................................................................................................................................................I.......I.qk..B.....LZ.w.9....w.....,.-.'.&..w.....,.-.'.&..w..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............g...F/.4..:.+.....N...^.................p..`.M.....`...................................................I.qk..B.....LZ.............g...F/.4..:.+...................................w......w......w..........................................wj.....wT.Q...w......w..n...wH.....w..9...w..V...w..........Z4...........................................4../4......p...............C.a.l.i.b.r.i...................w..w..w..z...y.. x.. ...........$........4...!..7!..7..............'.w%.w..w..z...,4. ...........$>........4

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001Q.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):55804
                                                                                                                                                                                    Entropy (8bit):7.433623355028275
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:gVvci05lhVbfBcWvBLeynluexaWqzww/u5:gVUZhHDljaHww/u5
                                                                                                                                                                                    MD5:4126992F65FE53D3E3E78F6B27FD49DC
                                                                                                                                                                                    SHA1:BC0D76B69310DA9B909D3EE4CECBFE5F386BFB45
                                                                                                                                                                                    SHA-256:3FBE3C1C238BD7DBC67F8CFF5F3BDDFD513C96A9851B9616477947D21DFF4B2E
                                                                                                                                                                                    SHA-512:624853F5E56D224C8188F122B2C4724F867D4099E7FAAFB9C945BE7E2907900ADCF4AE97AB08909CF94E96FB6F381E3B6396D560D93EB2731E4E69CBFE628F10
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d..............................................................................................!1...AQ.aq"2.....BR..8x..r#..9b....3....CS$.'.cs.......7Gw.(.4%5&..Wg.h......tEVfv..H..........................!1A..Qa.q...."2..u6....BRr.#...b..3s..d...7.Cc.$Tt..S4.5Ue..&..%.................?...,...8..{..S.y.N....%..q.8..H[5....o..xg........)c(.eO.YO..._D..x.U.....%.S.r.r._.^..Su.h.Q.t.:.#?....x..B.S...Q.....oqF..%..8'.qx....%.2JKjF..{y.w0.*a.RMb.c.Q{%....eW'..[IV..'ZW3...[...MN.....rO.:....$.i..7....Vrrr...I.r..M..Qo..j....q.^...N...J......%.J..)F...>$.....u........o...+......[...*..t....R}.I..R..S..GB..:......).6_[^Xft...F.1.....zP....,.#....MG.T..Q.F.....)Fi../.I...,%.voEb.b.Z..V3..FT.}..[Z{....wd.z.e.....QwW(.).t..\..'....:)<W.<..&k...caRT.X(..K.....:f...]...q..

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001R.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12288
                                                                                                                                                                                    Entropy (8bit):4.707148354513743
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:1ieTs4SHBCNNAAVtfCLa3JwqoiQyHG6HVtd/yXH9GqjFRtyMKT1D5iv7s9LWi:1if4YBCnAALfC+5wqoidfVtJMdRRtrKT
                                                                                                                                                                                    MD5:217B6B014E20CF5063525B35522A7D71
                                                                                                                                                                                    SHA1:FA5E2B0A9463C890F33ADEE5AF26A92F5D8F38C1
                                                                                                                                                                                    SHA-256:1E171F3A78144913A5EF6754612AADCF6A8D4A7C0C22E1B8917C6FA29253D0CB
                                                                                                                                                                                    SHA-512:9EA3D0836D6036A226DCEED96DB1BEE2B087A19D78D5F30936229F86841944BD13059988B6B2F169F71ECB6562E8BB7B0AD8BAE29365BA6ED50864472B66B621
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:....>.......^...v...2...0 ...+......>...........v...z...@....*...........................................................................................................................................I.......I.qk..B.....LZ............V...9{..x.......V...9{..x..c.....I.qk..B.....LZ.I..{.2`.I.M..F|..}.{.2...........I.......I...................................................I.t.....I................................................................4..'...'..............P.moG.@./p1.......N...^................e....O.!g.q....................................................I.qk..B.....LZ.............P.moG.@./p1...................................................................................................j.N.....T)................f............. .<............. .......'...8.....z...,4. ...."......$>........4.."..7......A.g.e.n.d.a.:.........................Z4...........................................4../4......p...............C.a.l.i.b.r.i...............................z...y.. x.. ..

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001S.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):41893
                                                                                                                                                                                    Entropy (8bit):7.52654558351485
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:pZvVQkUbOHxx3pvVmO5rsP5gUdXwFMuv53knzyncaXgRDqPU:pZkijV5wScXwFMYknzucaXgRyU
                                                                                                                                                                                    MD5:F25427EFECFEE786D5A9F630726DD140
                                                                                                                                                                                    SHA1:BC612A86FF985AB569ED1A1EA5FFC4FDB18FC605
                                                                                                                                                                                    SHA-256:5A36960DF32817E8426BD40A88F88B04FB55B84BAEF60F1E71E0872217FDB134
                                                                                                                                                                                    SHA-512:B102F34385196D630F198667E874F25ADBC737426FDAE0747EC799B33632E5DC92999C7C715DC84D904342738930267AB1709870BDAA842243E4C283FE5E1554
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................!.1AQ....aq......"......2...Xx..9BRr#.b3$..&..g.8....%F'G.(H.Ss..D5E..v..W..Cc.deu..7w.h.).....................!.1....A..Qaq...Ttu.6..."R..5...2B..S....bcs.Dd%&r3C...#$...Ue.............?..R...%.R...t.MQ*.l...v...V]..n...Zw....M....4..F.&&bb0.:]l......ay.r<..3.l.Q^.........I54.N2.8..2s...w..r6.......[1Zh....O...9..>...B......x]...r.\.\..v..~....y.QT.3.......=....r..}.l.....o;....M..C1....w)...+o1f.]...MoA.E..s5..i.\....miGsy..m\.Zj....I'YU.\tU6La5v.>.K..m.]1.......k..0....</5v.V7lY.e.vV.+./[....f..u{....s.}.Rb.Z.....Y.6]..m....V.\...Mr.=r...K...l..%..m^.......X.(..fG..[F*ly.jL.a4..vs..o.e..q.9km..w1.yg.....r_.*h.n..5i.-.{Y.l...<...'Or.s..Z....../JP.....\FV.S..............m

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001T.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12288
                                                                                                                                                                                    Entropy (8bit):4.578416856012263
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:PsAl7PU9J2FXdF9l8/6h2dU9+eOCkba9+Ho0XZ4ZO/EwHRtyWlchzexIkk9VmF8:EA9FXdHe/6WU9Clba9ujSo7Rt2hzexI9
                                                                                                                                                                                    MD5:62BDAC26D77C0BE799503611FFFE6D43
                                                                                                                                                                                    SHA1:194DEB9BB23AF24823DD71EE83928FB5DC383C4D
                                                                                                                                                                                    SHA-256:BD8B7708725D85F7B30F57C417ECAA0B6A12EE1E48128A5348BBA70218604175
                                                                                                                                                                                    SHA-512:A6B5B30F1C6EFA5677679A9707FBDEB1E8DEE95696DCC0C18D59741519EB440915E7DE1C66112E28491C2756367EE56001B840D97245A1A892D81FEC10B0958F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......,...v....... .. +..2...>.......|...v...H...@....*...........................................................................................................................................I.......I.qk..B.....LZ~...G...~...8V:..s.[x.b[~...8V:..s.[x.b[~....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............I."$.h....8."h......N...^...............|..,~..H..xjWI..........V...x....................................I.qk..B.....LZ............I."$.h....8."h...................................~.......~.......~...........................................~..j.A..~..T....~.......~....r..~.......~.. .7..~.......~.. .........Z4...........................................4../4......p...............C.a.l.i.b.r.i..................~...~...~....z...y.. x.. ...........$........4...!..7!..7...............~..;~...~....z...y.. x.. ...........$......

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001U.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):14177
                                                                                                                                                                                    Entropy (8bit):5.705782002886174
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:EbgGcV/hlvpfal7rgYa8S7auAxwfuSTmCSNoFQ6NO7L:EbgGcVnpwimnd38FdQL
                                                                                                                                                                                    MD5:7CDCE7EEBF795998DA6CAC11D363291C
                                                                                                                                                                                    SHA1:183B4CC25B50A80D3EC7CCE4BF445BCFBAA6F224
                                                                                                                                                                                    SHA-256:DE35AF949D4F83E97EE22F817AFE2531CC4B59FF9EE6026DCA7ECEBC5CF2737F
                                                                                                                                                                                    SHA-512:560FB15A9C12758D11BB40B742A6EAD755F15AD10D6C5DEBA67F7BC8A2AE67C860831914CBCBCDED9E6B2D1D5F26A636B9BCEF178151F70B4D027316F94F27E1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!.1..A....Qa".q..2.....&...B%6.'..R#3.$E.r457bS.DUFV.Wg(.......................1...3.Q..2Rr....s.4.!Aq.S.aC5B$%............?...n.Liq.}.{#....3/gg.1.M +..~3...q..+=..:.g.i1;P)7.....q..n.s"p...wx........v.t.f;..L/..~....y.r[.r.....n.n3..6i..g..}../........3..x.L.i?We..l.......~..<.;..6..o.....N.t.o6.l..~.......<...m.V...Q.7k.u./wq.t..;.I...}..{...>.L..3m..a....yd......6~.f..~Y..}+..<.[w..'-..?.v.7...v.u..4.......1];..u.MO.......s..p..ms.'.O-o...O......m.k.e....)t....i>..E|....,iOyD|.{......g.n...cu....=..........h.\.Q:?g/?.I.3._...t...d.n.0.%y....S.Q....S.&K.w..&wY<....%.g.v.....$y..#,i;.=...t...I6..yO..o.d..w\k...~......)..rK.......].u....N....e.s..kU.u..'}

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001V.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):49152
                                                                                                                                                                                    Entropy (8bit):4.645595810107098
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:1lXg3kXN9qLuVqFkG/ufQnLEB0vP6S8zmKXpbZ1SQT8otVXMRsQNjMWDMs5xRytb:c0NkQ8OHtxDQNjMZieGBE3pQNfu
                                                                                                                                                                                    MD5:04E6941414896F9B3BE95F73A09C2361
                                                                                                                                                                                    SHA1:BFD96679656EE371410CB5B7DB24281F6A553A52
                                                                                                                                                                                    SHA-256:3E1F5BEBEA9E0D268407062200ED20E36CA49687FC3102D6D52CD54DAD706F0D
                                                                                                                                                                                    SHA-512:7CB6488DB1E9B90F4E9BF282BC98387B42028CA5A09732EE1DAE4A665E6637EB2D44C3895D7F044166918337C2974A1619B1B1DA19F71F0282AC97431B400233
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:x...r....&......r%...&..8.... ..H@.. `.........x...r....%......r%..J&....... ..H@.. `..................................................................x...r....%......r%......x.... ..H@.. `.....................eV.M...N..L:.p.......p...]..$....iG.]...o@.).3.R..]........J'.?.....h....X:.X.<..J0..k.X:..........p3......p3.....................................................T.......T.....\.T$&..&..T#...bU.T....D..T....6..T.f.... T#E...........0...........e....4........................u.^s.Q.@.).~b.......(...@kO.....(..."...P.l.a.i.n. .a.n.d. .S.i.m.p.l.e...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.r...P.a.g.e.V.e.r.C.o.m.m.e.n.t...P.a.g.e.O.v.e.r.i.d.e...P.a.g.e.N.a.m.e...2...0.0.0.5.2...1.....0...U.n.t.i.t.l.e.d. .p.a.g.e.......................>F....i.hX.. ....... ...&N...S....2...n...h...........*.......h....p...........V...\.... .. #..........D.......u....c..,0...e...B4.$........{p.....G...^...?@kO.................... #...... #.."..,.7.I.-..e......eJ]..N.>...*....+.F....s.G....+..p..

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000020.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.351554167526851
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:Dosty+2uEYtUlwE8owXtCqF9iuQcfrdhSrgdYtX8eASF9biLHAFPZr:UsIu7OwE8VXtCqF9BQKRAOYx
                                                                                                                                                                                    MD5:8CD19441E5AC54A6BABD3756007B397C
                                                                                                                                                                                    SHA1:B64305354BCEF669B22046E8F7C9F03040D2AF9E
                                                                                                                                                                                    SHA-256:67E15F3BEBC665C70E492EF64A174D8CC2D8E673B756E37EFF66EDB6A81677B4
                                                                                                                                                                                    SHA-512:95B98F7F9287E1E85978F497C99038EF7BC9C0678F66519AC02D3047EA600892C6E26033FBE40DF194BEFB96D173DDFFED550B90C6751B79E9C4CD10D0F36D1B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZlQq.....lQq..A.....lf*.NlQq..A.....lf*.NlQq..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............f..U......D[J.....N...^...............\...m.jJ.....V..........f........................................I.qk..B.....LZ............f..U......D[J.........f..U......D[J..........lQq.....lQq.....lQq.........................................lQqj....lQqT.]..lQq.....lQq..B..lQqH....lQq..B..lQq..>.)lQq..J...................;........4...4...4.."..............lQq.lQq.lQq..z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4.........lQq.....lQq....#lQq............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000021.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 814x105, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12654
                                                                                                                                                                                    Entropy (8bit):7.745439197485533
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:JheN2cq6MLu6MLGu54cHeNzhcmhcDu53eNE3UPkhrxvu:Ji2Wix7fzVsbE3Zm
                                                                                                                                                                                    MD5:4BCCCDBB4273ECEBE216C84930A8D0B2
                                                                                                                                                                                    SHA1:FFBF617787E27BC94D9BAF89F2FE34A2BD42794B
                                                                                                                                                                                    SHA-256:474F9A8C25D5E21192315397EA995B1E11E2C1608157C6E0277688091BFD136A
                                                                                                                                                                                    SHA-512:DAD73A8C0E293B88685C0C71EF15E0DC95EE39B7FC9F849DE5D634173FD9FA0AF0AA96742D9E94BE03556AA4A817D5001C95A6736EAD5D5DF03661876785EB74
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....C....................................................................C.......................................................................i..............................................E.....................U....V...f..ASTc.......de.1Qq...!Rb....Ca."r.................................B....................b....Ra.....!Qc.....AS.1U.."C...2Bq...$#3%&.............?......3.....~......:..g..s"......:..g..s"..ic..Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. ..0...Q_..X..V5E~..c..X...@u...cTW...0...Q_..;.m.....@w...Q.+....*.4W...lUFh....v..._..wn...dW....y._..v..E~...*...@wn...dW....y._...v..U..@wn...d..{`;.|U.2g...*.3...:.0?ViN.z.@w...4.M.:m..`~..i7...q...I....J.`l...W..n..PQTiB...6....+..sj.*."...6....+..WA...x..A........(.N6`..AD.q.....'S...t.Q:.l.......f.]..N..0.. .u8..A........_W..Y...}.C...~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~.v..?U..^.r..}..Bep

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000022.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.324173927867155
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:/UXsfiRjZtAfFDatrymWbxEp8GXmCmt9B4cNrdhSrHYJcxtXtcD9RZ4oPh:0smtAfFGpWxEp/Xet9B4wRAaigyoP
                                                                                                                                                                                    MD5:89E6CF08240D8615E211A58D80F3F466
                                                                                                                                                                                    SHA1:2C1D92EADC311EE8AB62502AF2BD77C9F3235BF2
                                                                                                                                                                                    SHA-256:9DDC2E69D09C5B5D21FD491B1E1913DAFC9F4288A53B9DD338D8D9FE4830B591
                                                                                                                                                                                    SHA-512:4F8C9C6AED0A16F5CF9B073D72EB781755EB2BAE02F3BE9CB5BD083C0908E69613D693662DEEE3D2BDF1F0C6393E7B38E5C602ADA11F406EA4FA2F053B326D1C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.N)......N)-.......#.Jv.N)-.......#.Jv.N)..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............Y.....;.(..w.~.....N...^.................5....J.&2;..X.........f........................................I.qk..B.....LZ............Y.....;.(..w.~.........Y.....;.(..w.~...........N)......N)......N)..........................................N)j.....N)T.]...N)......N)..B...N)H.....N)..B...N)..>.).N)..J...................;........4...4...4.."...............N)..N)..N)..z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4..........N)......N)....#.N)............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000023.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 728x77, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2695
                                                                                                                                                                                    Entropy (8bit):7.434963358385164
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:N9YMsguOZgKAz2vcaQU4R8r4BU0/Rc4nbIQdsohw13ZmFLY6KsVvMdBL2mr:/hsEgNz2v5T/rQC67SoWniHK4EdBH
                                                                                                                                                                                    MD5:B23DE98D5B4AFC269ED7EBFDDECE9716
                                                                                                                                                                                    SHA1:10AF507A8079293A9AE0E3B96CF63A949B4588AA
                                                                                                                                                                                    SHA-256:646586CB71742A2369A529876B41AF6A472C35CC508D1AE5D8395D55784814F2
                                                                                                                                                                                    SHA-512:BBACBE205EC0A4F4E3AB7E2B1DEE36FCF087DDF77C7D18B53AEA4B15984A47C64E19F9B8D8FA568620619CEA0361D94FE7ABEA6E502EC6ECAEFE957F42ED7EE8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......M....".......................................,.......................1....!ABQRq.2a."CbS.......................................................Qa1A............?....{............i........l..-D.q.~..|cS.S...R\..d.8,!.....]f$....Q..di.;~5......vj......MqCe..=.*.f^..=.}.Cm]qCd..s=..u.e..v..t'.,.....S.s..N...>.d4'.,..k...N...d..9....G...y....6J.Y.l.{Vf...^B..i.3.z....:5W#4@.S\fj.%..Mb.5.v.5......S.E..#.v.I.....I......m..H....D..|.Y|...W.Wf..o..U.0.E..@.T.....................................'.S../...Z......!J..1K..rI...T.f.>.+.N..o.....\..^u........e..q.qK.GXP..-...F8".;5J...]Y......j.a.,R.......J.N........z}<qu..J.)`.}X:..}.............B...[. ......,B.).b.......(Y.O....c\.o.e&.W.#Bo..N|..N8.#J.>1D.1..b.&....q.#..UT%,.d.....m&..^...VXA..b.nbTV~.....^........q..#./.I..=Q..=..Y.*.Ib...VZ+......Y.........'.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000024.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.3354780409918
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:ksjM9Cp0o3Btm5ZE/ErfWXl1VW9FK7cxrdhSrhdaztXdc9rrYs:ksrp0oRsbE/yfWXlTW9FK70RAWz2
                                                                                                                                                                                    MD5:C54DC9B8DF739B5CCD36FDCF110DAE82
                                                                                                                                                                                    SHA1:C805EF84FE7B03789816D19AA66971CA99459FC7
                                                                                                                                                                                    SHA-256:579CA4E2ACCE33888FB5C8EE971DF901B84CA0743D5354287040FE4BE3E96DE2
                                                                                                                                                                                    SHA-512:FEE12DB7857EFBC75A8B1057FF2FAF8FAAC1B5F775019C9254DBA31F6313018823300BDA7534884F77E324E035F14DC04B3736E1C3691C28D0375AA703449B28
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.{.......{.j.B.....D.....{.j.B.....D.....{...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............*...h./....C......N...^.................sA...A.aD.a...........f........................................I.qk..B.....LZ..............*...h./....C............*...h./....C............{.......{.......{...........................................{.j.....{.T.]...{.......{...B...{.H.....{...B...{...>.).{...J...................;........4...4...4.."...............{...{...{...z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4..........{.......{.....#.{.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000025.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 69x630, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):11040
                                                                                                                                                                                    Entropy (8bit):7.929583162638891
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:u99+91V42ho91V42ho91V42ho91V4235z9pUkDCyixxo4PS6b8tEy3BcWWhhSy0b:ubKD4/D4/D4/D4uzX38u4PNYJ2zhhmb
                                                                                                                                                                                    MD5:02775A1E41CF53AC771D820003903913
                                                                                                                                                                                    SHA1:2951A94A05ECF65E86D44C3C663B9B44BAD2BC9D
                                                                                                                                                                                    SHA-256:83245F217DEAE4A4143B565E13C045DBB32A9063E8C6B2E43BB15CD76C5F9219
                                                                                                                                                                                    SHA-512:5A1FCC24BDD5EE16BC2C9BACF45BCECF35ED895EAC22D2C4EE99C1B7E79C8E8B9E5186E3D026BA08FF70E08113F0A88FBF5E61C57AF4F3EA9BA80CE9F33410E9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....C....................................................................C.......................................................................v.E.............................................S..........................Aa..!12Qqw.....3568rv........".....4Btu.....#Rs.(W..bg.................................D.....................1..2.!4Aqrs....Qa......t..."3BRb....#.$S.Cc..............?...K/h._+.N6.-.a...5...;.r....,...0B.s(..zp..4.%r|q..E.Q^.../...C.R..?u.q8XN.>.e..:..gJ...._.n>.70G,..(........3b.&.5m...Q../...7Ie..k....e.l6..&..`Gt.P.Y^r...=..Y.e...N.B...O.#..J+........u.V;G.'.....V.]8..C.]..........E.....c..w&lX..f..\T.J?...F.,..m|..93........,.....+.R..WG...%.....(@.....p].iEz<.8.^...J.h.....a8P.1......(z..y~.........H.Z^.>..<.....L.k..IG...R.(.%..m....&u...B|.....@]ey.W.J...!d..R.8...[..>8....(.G......!.)X.....,'..F2.Z.t..Aw./..Z..#..i.kK.......b.i...qR.(....RE.............O.XP.#..(...9J..]...,.2.[w....KrW'...tY.......{~.:.+..

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000026.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.502749958427735
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:GRlsAl2cY1lglxs0PJc+otUEP3F7OXS9vtckHcWZrdHr7XtXmqfKlglnl4Il/loE:WsN2fPdoWEP3FqXS9GunZRLD2Q
                                                                                                                                                                                    MD5:A05D6654C2AD114E9C0B217A129F9528
                                                                                                                                                                                    SHA1:0EC08073C1FCD4445690C7FFD1186D32B8B3A303
                                                                                                                                                                                    SHA-256:802A1EB6955772020E1C6DB486C607B2CBB12FE00A370FB839EE6B31DAFD0A65
                                                                                                                                                                                    SHA-512:0F5499803B9F887A25C7AD36ED27C5B54E153D4513A009A62F26D1219F73901A6E9DEF133256038695541EC1D5917F40F2E69115D0E38CAFD7FB0418C45CE82A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......p...v...d.....................................................?....?........................................................................2...>...L.......v................................I.......I.qk..B.....LZ./......./...b....xW.._./...b....xW.._./...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............,,..S.&.O.*|m=....N...^.................d.2..N.?u.............Z................................... ....I.qk..B.....LZ.............,,..S.&.O.*|m=.........,,..S.&.O.*|m=........../......./......./.........................................../.j...../.T%c.../......./...G.../...H.../...>.../......./. .3...................;........4...4...4..".............../.../.../...z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4........../......./.....#./.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000027.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 105x441, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2268
                                                                                                                                                                                    Entropy (8bit):7.384274251000273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:N9YMn9H5gXlM26vroVXWxyNnl1LmLR+rn4FOeewGhDbby:/h9SlMdgm09ll8R2/rby
                                                                                                                                                                                    MD5:09A7AE94AA8E517298A9618A13D6E0E2
                                                                                                                                                                                    SHA1:FA5181A7414BA32F816BF0C4278EC20C615E8B1A
                                                                                                                                                                                    SHA-256:3C68C7EE798E62A4A99C740153F3980D7DF029605C843410942C7F85E794823B
                                                                                                                                                                                    SHA-512:074E9A2BE2039D0AFEAD360157550B934FABD0CB86B5AF476C1FBC885EE60331F5A68EAF70BF76E23C8248A20FB900346839F4AA8892370B5889E64948DCC6E2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........i..".......................................3......................!.A..1Q."q.2BRa.b...#$................................... .......................!12AqQ.............?..D.z.4....;.....7...3.t<!..d.O.....+O+.;.z6.4cz7E.........U.Z)-..@..y...........}(W...<.xv/...5.ew......yN....n.Tk.Tm.Ty.vA=...T..U....h...e.8.5%....'......e^......L.g.$.~e..O.._...... .F`.....xnL.<.......]jfv...}..\G..c.......-%...#.C.|.].`..^..W..c..B..5D.QSTaZ.5A=....BU..z%.4.h.6..=..U...W.$..l...7.:...........IPQT_...~..i..x....~.l.|.n.J..TV.21.Tg.....................j.z!+.-............"j.j...)*..TT...."....T.Tc.**j..............j.z!*.h...&.&.&..e.%..TksTW%G.?".l+$..c._9..[x...TU..........i~X..#'.qm?ttO.....}*.i...q.....9..r..?..W..d.w...f;..q...tZh..0.....2.......OD%Q-.......$......56.K.O...y._..*_C.k..p9.p..O..vu...'........0v

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000028.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 76x97, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):784
                                                                                                                                                                                    Entropy (8bit):6.962539208465222
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:869YM8fij0W/xfuCp7ovv1bidiMn3bGi6AETQcdH8SADjoZgV6v9jUEvS3/g:N9YMWeI424diMn3yinsQeHvADu9QEvJ
                                                                                                                                                                                    MD5:14105A831FE32590E52C2E2E41879624
                                                                                                                                                                                    SHA1:078FA63FC7DB5830E9059DF02D56882240429D90
                                                                                                                                                                                    SHA-256:D0A3A1C3CD63C4023FE5716CBE2C211307D0E277E444D9EF76C7FC097A845FD4
                                                                                                                                                                                    SHA-512:8FC0ED24E8EC14C46EA523D9265DE28F85C5FC57AA54AD5B9CA162E95F79221E2AD3DD67D1293CF756B67F3D3DECAE122254134EA8D4D00DDED02114B5383947
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......a.L..".......................................-........................!A."1.Qbq....2Ba.........................................................1............?.....3.Ty\......vs....>.>..a.W..s89.d...Z}......rz...`...Z.r.do....u.W.%....gf.>.L..xz....B8=w...g.~g."HD...$..IKJ......nn..*ly..I....L...\q...Q;6.KrxZ.,...j$..ZQ..)f...q`.*..C1..cZ2]-..\.~..J.....^..(.f..9m?..C.NI.UL..X.fy.Z.........+n....r."Z...d..R./\.#...kd.D.5.!...h.3*s-+.......Xjt..}i..rK..y.../>u..]N.....Y..J......1.x./.....F6.......I...._3...k.sM.+..v;.%|.f.~.......:y....S....UKovh...W'........lF... .................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000029.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8192
                                                                                                                                                                                    Entropy (8bit):2.737856157895753
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:e0sPAYCznMcdPknXb9kLuRCPwrggxBg/TT:eJPAtnRZ6JkKRCP0ggxBg/n
                                                                                                                                                                                    MD5:5D8D938837F1351783DF19038B8E4288
                                                                                                                                                                                    SHA1:3C2EA729FC3979C168A21191E6515C9AFD5B0E71
                                                                                                                                                                                    SHA-256:0AC1643073CB60A10FBEFE0AA061B5C419A6EF385FFCA1C2F2E0C71BF0DD9765
                                                                                                                                                                                    SHA-512:571C8ECBC0B03D00882D3AA862AE39DC69BAFF551B3B6271317AC9BA515318D0325733AF80E4A27F5858F023E808307EBD5E1F4D01477EE34923C50029B47A6A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>...........v.......................................................................................................................................2...>...........v................................I.......I.qk..B.....LZ...............&.1....A.......&.1....A.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............2t....>.4FD...iP....N...^...............U{..R.H..y.{...............................................^....I.qk..B.....LZ............2t....>.4FD...iP........2t....>.4FD...iP........................................................................j.......T.l...............Q.......Q.......>............. .3...................;........4...4...4.."...........................z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4........................#...............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002A.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 95x498, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3009
                                                                                                                                                                                    Entropy (8bit):7.493528353751471
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:aRCTf+0hagMrbAZMJShPdvF/5OzlQFlDF7npkDdWvVBTEnBLT6NrgCX0:D+0YgMrApL553JtEdEVcL2NcX
                                                                                                                                                                                    MD5:D9BD80D40B458EDB2A318F639561579A
                                                                                                                                                                                    SHA1:83BA01519F3C7C1525C2EA4C2D9B40F28B2F2E5E
                                                                                                                                                                                    SHA-256:509A6945FACFB3DDC7BE6EE8B82797AD0C72DB5755486EE878125A959CC09B59
                                                                                                                                                                                    SHA-512:C368499667028180A922DD015980C29865AEF4A890C83E87AE29F6A27DC323DD729E6FB1C34A2168A148E6A7A972F65A5FC8ACE6981AF1D4E7057D99681CB366
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....C....................................... ! ..''**''555556666666666...C......................&.....&,$ $,(+&&&+(//,,//666666666666666........_.........................................:.......................r.!12BQ...3Aaq.."CRb.....#4$c.S.....................................................1A............?..p..-.....u0$.......l......)..o.FTd..DG....... .t*e..jO..Z.U......r..j.O.,..VD./.....V5D.&......A..Zi....E.N....*..........#..M<|.2.Y.../QO.x.cTM4......+.F;V.x.de*....]e..O.x.c\Y........r..j.O.,..T...hw..k.^.[B..J.sEl.w.x.m.5%zzt0..T.......b..<\.3Q..W</..!.xh6..Z..\.+M.o.Y..1............#.........|.a.l.KR>..U......e....@...\.1Z...Y...[....F.6.t.#..Z,.x.Q..[`.X......#........W</..TM..-H...V....Tf..........r..j.x.df.f.....#..l.KR>..U......e....@...\.1Z...Y..Y.us....D.)....Uh....FkYm.m`P...W .V.g..FjVj.\..1Q6.t.#..Z,.x.Q..[`.X......#........W</..TM..-H...V....Tf..........r..j.x.df.f.....#..l.KR>..U......e....@...\.1Z...Y..Y.us....D.)....

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002B.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 700x114, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2266
                                                                                                                                                                                    Entropy (8bit):5.563021222358941
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:TuRCTP9rSTfIEe1HbcVY1YbDXq8eCI0bf2QQe0GVDQAzZw:aRCTN7HbcW1YbDXq+I07Ien0AVw
                                                                                                                                                                                    MD5:DB8A181E3F0EAD4A9472099E42ED6BE3
                                                                                                                                                                                    SHA1:92096AF05CC6167B1AA816811A1160B809393FA2
                                                                                                                                                                                    SHA-256:E9746B4E9AE9CE7B3B0068779DB3E113E2DFC9880F25373D745D0E700E69A906
                                                                                                                                                                                    SHA-512:A9E246E10E28D057090BA9F034ECE6131780D7F794C5C9421523388997C7EDFBB49BC32B863B6C6668911B359C304AA54969B48CB9234950D5CECD2A6F3EFFF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....C....................................... ! ..''**''555556666666666...C......................&.....&,$ $,(+&&&+(//,,//666666666666666......r...........................................5.......................!1AQ..2a...."Rq..#3BSr..C..................................................................?...X.....U...j...F.W.V]'KV.uWt.iT...{.......`.(.....V%..=.....z......V..ct+.U.B...@.............................................{.....5.........0...x4....c..;...........+......|.7E.%.9.1+}..d.........+.V#.P.HUL.E...g.li...8.>U.";0pi.]5.\..zo..."@.........................................y.6.mLN..S.....@...i..A..p.......~|V9.+.Xy.........+,L.....7Z7..p...-X...\.....:-...i....v.1...-..H....9.zk....l....^.......:.."^.t.Q.F...X..B..$............................................a.%f&3..1.5+.X..'b7bwr.).e.x....!...H...aa_..kD...b..g..p..K^.k..qX.[,.........Q...U..x...YMvj...w..:k.....j.W.8..4....c.u.}m.....o.=@.......j.S.t.|.....5h.y.%.~...G

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002C.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.350710158249168
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:Yul0si0Glqo0OgGtKY/EgjqBXoiqB9SOol7rdQqrqBtZ0BXAFc4l:Y+0sWlZ0OgGl/EwKXoiK9SOkRQy20E
                                                                                                                                                                                    MD5:9B9E2F138EF16ACA97883105F97345D5
                                                                                                                                                                                    SHA1:DA860F8F55A25DCE9813A0E91E4A4E7D45406BC3
                                                                                                                                                                                    SHA-256:006DF665A30AB6D30BBE11528C0B7C6372A2FB0F6F2654761BA6AAA9015C2A09
                                                                                                                                                                                    SHA-512:C2E5B1096241885B92AD165CC468A2984FCD4A69FC1F9C5C574687D3EDCDBFCD9A2147DB8A6CE008CA7A2CCCDA6E58DD6403FA154193FF17659EA1C2E641E935
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZO.......O....1R.1......O....1R.1......O....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............]..8v....."`u;......N...^..................3E..p..JI........f........................................I.qk..B.....LZ............]..8v....."`u;..........]..8v....."`u;...........O.......O.......O...........................................O..j....O..T.]..O.......O....B..O..H....O....B..O....>.)O....J...................;........4...4...4.."..............O...O...O....z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........O.......O......#O..............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002D.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 813 x 99, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):99293
                                                                                                                                                                                    Entropy (8bit):7.9690121496708555
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:Moq1jVORV5NO5xLCBaaNk4vhpCr1CH/DATOQlWvHMHojiaAMrxArLFRZPj19AWFz:eVEbouBaIk4T8uDGOQlVHvaAMkhDh95V
                                                                                                                                                                                    MD5:EA45266A770EEA27A24A5BB3BE688B14
                                                                                                                                                                                    SHA1:9F0B23B3C8EBA4FC3C521E875EF876FBE018F3C8
                                                                                                                                                                                    SHA-256:EDAD0F03E6FF99FEF9EF8E8B834CE74F26CD23C5F8C067F5CEE66F304181E64D
                                                                                                                                                                                    SHA-512:D4EE36BDA897BBD643A699A0332DD00DE9CDCC6F46D861789BAD259A4BF87868AE3B4CFAAB6DFAF29941C7055B77A95D76BAA86A4A0DB2BF3BAF7E3317F03EB9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...-...c............sBIT....|.d.....pHYs...........~.....tEXtSoftware.Macromedia Fireworks 8.h.x....tEXtCreation Time.05/15/06.8.p....prVWx..[Oh\E...y3kv........`.%m.R..6.1.4).o..Ki...D.......P!.].=..K...C[....f.}o7VPJIg...{3.|....d.....i..=.4.u0...n y......@j..Q..f)..mQ...4-SJ..9.d.?..5\-....:b.W..i...c.5..{..pj#.....B1C/.I.......].Su.k?.2..:.9Q...5.U...UZ...e..U.c],..2.}...1..)W./..Epr.Zt.....K.=..{......e..."...v..B.4.#....A.V1.".V}t..[..2f..Y..V9.".6.......(..gbm.P.....Y%2.c.z.:Q.2.<tYF.....u.@..KJ.;u.q:.].....$.....V....Hqk..DW.l.e.j.Z.YP?:'R..*.<........6...m@..r..j2..HK"|..L.Nc..D..y.9..B4$.......`.3.m1LE....7(OU\+./.O...%6T..w......h....).I.&n...*......#..W.41...5.#.`..I...<.?.|..*+Q.....#i........$,..n...`.s....[..E. T.w..j.,&-.r..;a....#.>(.P......f...MU\3*..;B....)..5....z..(....-...a.....}y.l..E...z>......&..g.$.....*T...N....E:./.>..#...^..E.0..%......(..@..W.X.NDM.<~.]A.>..fW.O.y.'...Z...h..).F..

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002E.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.346149369648355
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:YuUecsEzNkK2a9tVk/cEVpydXnc96iolrdQqrW/2BX2D1oDyJp:YLecs+0a9PNEPyXc96iURQy5c7
                                                                                                                                                                                    MD5:602E4AEB04DD3B2532E97D5344E8A722
                                                                                                                                                                                    SHA1:9D5992C051C2ABA323A945FF79912319D457D528
                                                                                                                                                                                    SHA-256:C1A355EED0E833B485C0AA9365E1D4556143B6D85A3A317E980754A5D3BD5F48
                                                                                                                                                                                    SHA-512:988AACDA3E852B102E03E47E4771B702136A9AF112F94C60EADAABB212DDD4B054EC05ACB8B3A930BC1550E7B042984E80F492DF407F56476C2545018C87CE0E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ.-.......-.,....(.Fd.WP3.-.,....(.Fd.WP3.-...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................>.J..<..S.~G.....N...^...............e2~/Q#.E....:........f........................................I.qk..B.....LZ...............>.J..<..S.~G............>.J..<..S.~G...........-.......-.......-...........................................-.j.....-.T.]...-.......-..B...-.H.....-...B...-...>.).-...J...................;........4...4...4.."...............-...-...-...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........-.......-.....#.-.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002F.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 780x107, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2898
                                                                                                                                                                                    Entropy (8bit):7.551512280854713
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:N9YMTXc4gpw+EIWnqQ5G+NE9VTzRFvS4+Xh+AKrNx+JuCluc3Eeky8etajhDCFex:/hDc4rPIoNEzbS4+XhOrGJu1cUHeoVey
                                                                                                                                                                                    MD5:7C7D9922101488124D2E4666709198AC
                                                                                                                                                                                    SHA1:00CC44A1B84D4D94A0ACE8834491EB5F65D04619
                                                                                                                                                                                    SHA-256:20016E5FA1A32DCE5AF4E92872597E36432185A7BB2E61C91F362BD68484529B
                                                                                                                                                                                    SHA-512:882944B2CF040485899128E03B7499C540D481E45FE8017DBF4FE0330157B2D8ABB7334DDB31C112BA0EFE3722A554883917C54155A7F60044D2D7F3D848260F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......k....".......................................2...........................c.....TUb...Sa...QRqr..............................!.....................Q...R..!..............?...$.)m.1...%%bV.J..H....-.%a[...I"WJ..:.X.:TT.$.......N.-NR.E..-NR.E...9..E....$.k.....B.I,I)..J...kr..+)..I,Yj..YbI..+,J..e..Z..V.e.$V..TV.X..V.YQZ.EQ..U%PY[.[.R.EP............................| F.. ...j*...!m.!j.I%.j.$...YeEYYEEUE..eY[.hEEUeEil.....%..el...V..TUYA.U.UTTUT.Z..UQQUQE...V.,...UlE.U[.lEP.P.@......................................R1...AR1m.....#..$:.T.p..IJ.t.....A..AH.,5..]F!a.XJFaa. ..a.!*.aa. X.e.......bB.b..,HX[,!..,,.c0.,..U..X..(,,...B(.,..4..B.`..".a..-......"...........................>D..IKEb...t.....)u.....)K.%+L\.J]i)*b.JR.IIL\i)u....T............T.....qs.it.iJ...])ZJb.....X....U.A...V1..B.R1....X...,.c...,%X...,%#0...,H

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002G.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.323811415538564
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:6xsgrLnMnlWwESh0WXHYW9C8RQyRzp+PLnOICoKhY:6xsgrrMnQXWX4W9C8RJRV+PrOICo
                                                                                                                                                                                    MD5:705BEEEE524F2EC56CBCFD94E178511E
                                                                                                                                                                                    SHA1:74EDBC9D7810D8A55F9102D60023DB189E87E112
                                                                                                                                                                                    SHA-256:642E068798245FE9BFE048C9F5D6955CC2FCF0DDF0C03162FB258B316A64FB8A
                                                                                                                                                                                    SHA-512:6306C969179814A55197D4E65C36751BACED5204AC20BFC478404515CFC401373DF573A69F0BAF1FDA2009B091AE681BE3C97DDFBADF74E0E3000918F20E5329
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ>.......>...C`......>.>...C`......>.>....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............aq.$z.....7........N...^..................?...N.....L..........f........................................I.qk..B.....LZ............aq.$z.....7............aq.$z.....7.............>.......>.......>...........................................>..j....>..T.]..>.......>....B..>..H....>....B..>....>.)>....J...................;........4...4...4.."..............>...>...>....z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........>.......>......#>..............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002H.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 613x144, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):29187
                                                                                                                                                                                    Entropy (8bit):7.971308326749753
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:RwjBOlCk+nYnGagKJWJhwMJiRO22ZIm4VXvXx1tA6BQs:i8snY3JW7uROlEfbtVL
                                                                                                                                                                                    MD5:DF99CAAAB9A7DE97B63343E60A699AB6
                                                                                                                                                                                    SHA1:B84334135CFB73BC6EF55F85926770D5AC6DFEA8
                                                                                                                                                                                    SHA-256:74C131777E7C437FD654427417097BC01B0813BA8E1E50E4B937BD50A1BEBCDB
                                                                                                                                                                                    SHA-512:5D15AAAA8B71DDFE01A7C0ADE16D9E1F5E9AAE484BCD711B38CCB103ED9564CAAC23A0031471167B660E15972D70179C2A387509B213C05D60261042A0456025
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....C....................................................................C.........................................................................e..............................................`.............................!1Qq...2ARa..."#.....3BSbr...$4C...Tcs......%&DUd...E....56Fe....................................H........................!1Qa..Aq..."b....2R...BSr..#...3..Cc....$%4...............?...b.d.8T1.;#.S.DO...~.R.......3.xe...z.6..."m..k...;*.'.f.5^.....m..<$....8.R.j.D.v..>...*dT..vGbt...I......sEWp.r3.. ..G...6.....w...l.S..q...b.....-R....^Zu5+u6...A..Z].:...5..Uzn.,l.L.....?%.*.S.+zVg7.=.s.Q.....8..:,c.......ZE...>'IF..W.0.d.......c.e.d.V.t..S$.DNR.[....g..#i.$. .U.SK2.....k...J5u u\R.....T.[4..A.O..,.T..................] .i...B.m.^f....._...{S.....<......:..|D...+...NA....Y.^f.1|..%K~1..B..^...S..v=.c..g.tX[..kTJ..t.gr....R..@.F....5j..2.K.9..g.1N.....*.U...^w......>+.l.v...@N....%Qd...t.Ni.....0;lggm...K".+!.,.....[J...>..?f.]._;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002I.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.354986804394009
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:Esk/qAr/r/DEgM+tuiIhqEYYOt7lOkXGiIqbk9CioprdQqrMhIquBXcbk90/ry/D:EsBgM+XEYY64kXbk99QRQyZv
                                                                                                                                                                                    MD5:755A2CFE763C7C0E98C9D3118FBAF2DF
                                                                                                                                                                                    SHA1:6C1D53CB7BEED9B351CE4271619A60BBFCA3A8EA
                                                                                                                                                                                    SHA-256:C5BF4D153B480E60CD847D3971D6064506D0BF4634A30DBDED367C6F7B4339DA
                                                                                                                                                                                    SHA-512:695F2B17EF2C235F4062B9E64FD3FF33AC3B02DE6CB1110D6004DE013330F06AD4F246F25348F48C75D7109936CCC10DD7A292B568E091DDA2C22AB62F291A1C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZz.......z..k.../.".$Z$.z..k.../.".$Z$.z....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................^..p...e.fH./....N...^..............."Fju.ScK.v.t..}.........f........................................I.qk..B.....LZ...............^..p...e.fH./...........^..p...e.fH./.........z.......z.......z...........................................z..j....z..T.]..z.......z...B..z..H....z....B..z....>.)z....J...................;........4...4...4.."..............z...z...z....z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........z.......z......#z..............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002J.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 276x139, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4819
                                                                                                                                                                                    Entropy (8bit):7.874649683222419
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:/hnQiz+ET2/hDi+tv34VtpWfowTHgegb6hhLT1NTS:5nQ6TAhLtvIzMvbi6hhF0
                                                                                                                                                                                    MD5:5D6C1F361BC04403555BE945E28E53FC
                                                                                                                                                                                    SHA1:00C254F7B3BC0289590C2BBDBB39C8EC2E2B2821
                                                                                                                                                                                    SHA-256:131D637CDC5D0B094FB9FAD17F4D2A1ACE0D03613588155AACAA2D1CB4E16DA9
                                                                                                                                                                                    SHA-512:34D2C0929FCC3CC10D0A2121BD55BFA9A07062C2A7B8F101071164C946895DBCB2777641E79DE4193D57A3F0778DD4F1351FAF333B7E4B4DBE31A32DD69C51F9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222...........".......................................<........................!1..AQaq"...2B...#Rb..r..$3CS.cs..................................................!1A............?.............u....p.p($.Y...9,j...V.*..S86yh.G.#m.5..9...6Y.."C.R:.[..-.7U3c:..].;.....f.?%..<T...&F.Lh.N...m]..x.D.g<B.....k..S........>j.K....#U..Z....<e.:..8....o..xq.[..4v..U..y...k... k....A#..A...pn.jJ.I.7:..{.b..ns.t,...8.Td.I....m.I.5Z.).-.. ]..X.Do%.....?..4jV.`llt.E...5...u.|..\F.=.F.r<...5dV....xc.%..&...4,...f...3..H.<......eQ...P.J....7...lLc..?..-.fR..7.#.6.......}:.]'.ny..........e;u.Y..$0...i..-....f..9(....}..T,.Inb...+=Cca7....WULA1@.s...4uY5.N.f.c..].ks.....3v..~..k..m)...f gNE`S......#.....Z..6.uc.m...#k.s.f*.l.$6..?..xC.Cm.`...N2..&H...._.&.E...[....f.Z./...!.a{K..#.V.5..v.B....1...9..B.&....%s.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002K.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.362692090950811
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:2sCqGS1uWkPmV0REVCBXab0T9DkRQyUADodGL/Tdt:2sN1uWkPKZ8BXgk9DkRJXo
                                                                                                                                                                                    MD5:C6B8178AC658AAF54FA16CD99BD7CF18
                                                                                                                                                                                    SHA1:A544DA63667D428A40C50320AA2486E102EB9341
                                                                                                                                                                                    SHA-256:9B67CC664CF62D7C5A838425F8E810FDBCC1EDB9079ABBCB7AD8CAEEAD8372D9
                                                                                                                                                                                    SHA-512:8823589D90BC9A61EEB04788ECA9FF7178EF50DAFF6D25FEB8E7F858C7D7A2289A61CF0DCBFCDF985ED998905DD70386CA07DC7B64F213F05E06D32160C9986B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......V...v...J...................................................................................................................................2...>...2.......v...~............................I.......I.qk..B.....LZ..@.......@...E.-........@...E.-........@..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............D.:.....7..Qz.j(....N...^..................`.G.SZ.............f........................................I.qk..B.....LZ............D.:.....7..Qz.j(........D.:.....7..Qz.j(...........@.......@.......@...........................................@j......@T.]....@.......@..B....@H......@..B....@..>.)..@..J...................;........4...4...4.."................@...@...@..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4...........@.......@....#..@............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002L.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 814x45, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1717
                                                                                                                                                                                    Entropy (8bit):7.154087739587035
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:N9YMzO6BOfqH/dAIWpdAIWpdAIWpdAIWUtr/SD:/hzJgfqHaPYPYPYPUt/i
                                                                                                                                                                                    MD5:943371B39CA847674998535110462220
                                                                                                                                                                                    SHA1:5CA79B7BD7E0E93271463FAEF3280F1644CBA073
                                                                                                                                                                                    SHA-256:9C552717E8D5079BBB226948641FF13532DF3D7BE434C6CE545F1692FA57D45A
                                                                                                                                                                                    SHA-512:812541836C8B6F356A4D530E5CCF1CFDCC4CA54AF048CAC19FE86707CE5EA0F41D73C501821AC627AD330291EF58C040DFC017923A7886CEEC308048DA2CE7C9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......-...."........................................&.....................U.....1T..S.R.Q.................................................R....Q.a............?..d.. ...............................................+A...Z+E...V+E...U..R.....}........Q..Ah....Ah..b.AX..b.PZ+A...V+E...V..J*....Q...b.Q..Ah....Ah..b.Ah..b.PZ*.(.@z.?.`;2.......................................................Q...b.Q..EZ*.(..Z>.G.....`Z+E......J*....F+D...F+E.......b.Q...h....PZ+E...V+E......J*....F+D...F+E..............[u#...a-...f<.9^[...l0..H..6.Kn.t...&..3a...GG...[u#..8.y6.q..%.R:8....6a.+.3..a-....l0..H..9^M..f..m..3a...GM.q..m..6.Kn.tq..%.R:l.W.lg...[u#...a-...f.r..c8.....f..m..0.....l0..H..6.Kn.t...&..3a...GG...[u#..8.y6.q..%.R:8....6a.+.3..a-....l0..H..9^M..f..m..3a...GM.q..m..6.Kn.tq..%.R:l.W.lg...[u#...a-...f.r..c8.....f..m.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002M.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.362155719104064
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:o1zzsMPuMGhVnt2O5EKd79hSBXk0B9OXoFrdQqraqmcBXR8Y83og:SsvhJUmEKd5hSBXk0B9IERQyaPcteo
                                                                                                                                                                                    MD5:9A4047FAAE18CBA1AB0064F7A41FF9A2
                                                                                                                                                                                    SHA1:DCF1BE01DD4F38B5EA28B000765FE1964D73A3AA
                                                                                                                                                                                    SHA-256:DC08F8E146EF70417879371F1F44266A3170F8D22CCDA17D270BB1E14641E25C
                                                                                                                                                                                    SHA-512:A5084BF1A9FA2BD95EB58DF124A589ECE995552118CBA257258D409BA3575679CF2D3B705CE6324C4B9FEB025CF29ACBF4DF2699002D8421F4C86199EDB5B4DB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ............_.$....tw......_.$....tw.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.......................[..$D.....N...^...............YW.wG.;D.....#!.........f........................................I.qk..B.....LZ......................[..$D...................[..$D.....................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4......................#..............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002N.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 262x277, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3555
                                                                                                                                                                                    Entropy (8bit):7.686253071499049
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:/h3JeYCQV5Hn++9HBdAjU78S/mjLLwqnqahJD:53Je8b+EBdAjm8S/mjLLRnphJD
                                                                                                                                                                                    MD5:8A5444524F467A45A5A10245F89C855A
                                                                                                                                                                                    SHA1:ACE68D567B02B68275E0345C86DB1139C0EC1386
                                                                                                                                                                                    SHA-256:7D2B01F17354D9237A6AB99D5B9AFDF0E1CC43687125848B0C2DEDFB44CE3843
                                                                                                                                                                                    SHA-512:8151B447B60D110C32EC1EF286B941FFC09B99140F41BBACF5A1650A385FF4D13C0DDB2878E9A470FC7CFCC95A1AB6E44F6DE72562B0FFE093DC8A3C3C7FCC14
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222...........".......................................2........................!1AQ.a."2q.B..#R...3C................................ .......................!1.AQBq............?........)&vD.)3Hn*..X+....r...tmL.k..(.E...R. .Z..&...,fJ...!...6..S\t3.=...g&..Bqe.)_U.....1......-..fl.................J...u.i.mU..K..v.w.0O..E.h..D~K.(..9.,8..E.}.............i.\.....t."v..q..C............<..|3.........................*Q..../c.....f.}8....D..|k..Z......0..~..c..e..m(...|.c..'.5.5............==bx.5x.8...T;....=.--.pc...I;.V.m..,(....}...NH.ho....Q..U.E$.~...w.t>.S\....'f.{.+.g._.t....;>.....P...........-..G.h..2...J.% !.E97Ir.D..N....j...oE._...._...".?.......#".S.........Q.Tc.I..*I..k.......=$.........sk1Jp.\K.....F.3.Q..q..J....N..[l.&....OR4bB|..2ul....J...B.$&H..9#j.f.n./........?R~....B.I.@..........m

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002O.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.366888658407293
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:IstnmJR+1in+EWXE7l9s+ERQyESJoyU22XUOGt:IsVU+MLWXEp9PERJS
                                                                                                                                                                                    MD5:81A1400FA40D33C2ED1C6E051CB71812
                                                                                                                                                                                    SHA1:7A11692D57572C3BBF6B35488D2E51602A13D06F
                                                                                                                                                                                    SHA-256:B90CE6FF48DD2A4A7875F5435BD240CB944BC5E94732C845BCD7D5E05C7C2BB9
                                                                                                                                                                                    SHA-512:22681A4070593D281ABD59265060EFD92F2F6AC4BBED978BC410A08DA91218F429E64EACF5CE9AC525C1AAA67F81086C7FED1C5D9CB97E25BA996395109F9511
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ...............m.PD.4]........m.PD.4]....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............JND.#.:.0...N......N...^..................G..D..9....-........f........................................I.qk..B.....LZ............JND.#.:.0...N..........JND.#.:.0...N......................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4......................#..............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002P.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 70x626, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3428
                                                                                                                                                                                    Entropy (8bit):7.766473352510893
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:/hdu7isPwAp7zesusUyYAatNG87llTONQYS:5di5tfuQ9atNZlaC
                                                                                                                                                                                    MD5:EE9E2DF458733B61333E8A82F7A2613D
                                                                                                                                                                                    SHA1:A86704C969F51B86D6A05ED51C6C60214ED9FA89
                                                                                                                                                                                    SHA-256:BE4F0E6C89FCE91B9EBD2623567F7DFC259E0E3C77C9158742B8F64B724DF673
                                                                                                                                                                                    SHA-512:BFB5D6DD6B66EE21E946E90D1E482384CD10244308562DDA814189602681DADDE5752B80519E5B8515F115A71BD6BB4317A59BE65B8B5E3474AED119F8303569
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......r.F.."........................................H............................!Qaq.."12.....#3ARbr...$B...cd...&CSu.....................................+.......................12..aAQ.!#q.."................?...#...3.Za......rV.5&...../"..i.t...j..W........d.FL.V.2K....]t.f.d.NK..:.....f...... ......2.[...#..D...ZK....p.z.E.N..T..L.-....1....2.\.6FIr2..zS\U#..........fB\t..5J..~q...D....A.......!....MY..../.HY..../e.M.Y.n.~..,....'..Pc...l...d2..m.f.it$..qx-z*...._..].cOO....n..&.....FIA.....2J2..d:<qc..6.I.G.N....f.K..Dx.-.......`....2.FZ."K7.r}..<.P.Z.da.Y.....8..s....G.....b.e..g .S.......FL.Z,&..q.MG.J+..x\..m...qN=.....)..`...&Y...S....u6{.z.g.....@......FL.ZL&.Iv.w..8....U..v...*.q.B.v_./A..#.#.g.j........*J;...u...W.Ao...%....#$.....M..^\{W.SO...s,.N.....c).,.B.Gv...."k..z."..S]H.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002Q.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.321488175455504
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:ABsocp7o3RJFt7p5a7EXNrx78XB292dooardQqro28M9BXT1u9cuF1:4so2o3/Fb2EXNrx4XM9qtaRQyoZiTcF
                                                                                                                                                                                    MD5:CA09F196767BC39D7D9FEBCF5529C3BE
                                                                                                                                                                                    SHA1:DF307C1DC0A7965123F6CB8EB982CF1B076AC126
                                                                                                                                                                                    SHA-256:EC190478598B4C9D082101C962669E9445E711487CEFF28B797689FFC20B9894
                                                                                                                                                                                    SHA-512:CEBFC55AF852BF82CC5EB0666345F90A43602005CD5D28D31F4F07E531FB2143B6B9FA8F78325626A3F3928270E1CAF87DB6E76CBB61577CEA33750DAAF95201
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ~.S.....~.S\...2.%`.a.~.S\...2.%`.a.~.S..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............C`...Ad..)..........N...^...............X....T.D.$..-...........f........................................I.qk..B.....LZ............C`...Ad..)..............C`...Ad..)...............~.S.....~.S.....~.S.........................................~.Sj....~.ST.]..~.S.....~.S..B..~.SH....~.S..B..~.S..>.)~.S..J...................;........4...4...4.."..............~.S.~.S.~.S..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........~.S.....~.S....#~.S............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002R.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 177 x 123, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):65589
                                                                                                                                                                                    Entropy (8bit):7.960181939300061
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:2Hlrjw3xL//DPgff+9j6yPWvHMHjkbfnwHO3AW3GL:2H2zDUU+yPVHITwNfL
                                                                                                                                                                                    MD5:8B48DA9F89264D14B83FF9969F869577
                                                                                                                                                                                    SHA1:E1BD58E2D80FEEF56DC514F3F0B3AB9669F22F95
                                                                                                                                                                                    SHA-256:62AD3C277E54F03F1ADB44062407346F789E63859B7AFABFD64BE6AF5E9F66EC
                                                                                                                                                                                    SHA-512:03B783EC968DF3F648504D068D64DD1AE110E28110FE5B3401C9D04F44897DBE0CBB5680D42CA4C665FA94A6CED4B559106EB3C06C9BF2C5B14951ECBFFAC8AE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR.......{.....;Za.....sBIT....|.d.....pHYs...........~.....tEXtSoftware.Macromedia Fireworks 8.h.x....tEXtCreation Time.05/15/06.8.p....prVWx..Y=.+I....t.y...,^vv....;. "|. .i7.....$.2g..']pH@p..]b....H.H.......d'@ B...U.xm..3{3k?..5n.._}U...3......~..>...g.....f..t...t:...p>..Si..d:..k:.Lf..t6.K.i....d<...x.8\.8.+lc...)i.$.r.....x.t.BG.R.cm.c...p.:&.6.4..K.......^...~b].0....oBYv..u.'.=.K.Q.g)6.....4.!.M......4.=....G.%.Sr........nxC.F..t.U........1...J.t..eQ....".... |...81.$D.!.>...........$...^.vY..EY8tb..'.P.g#O....S*..0'.V....x.W..........k.......s.C.S...J%.iVb..].........3....j.}*.z....+.s..@..K.....\x.C..e.Qq.....;N.....;....,....^.*..$F..{G...8.#....8'..&....8..5.....3(P._....S......|".....u.cr....+a-....&V..x...iI-<|a.{E.c.X.......?..&.C....'........(.x....>...M.?.9..#X......l...0...Z.F..<.z.0}Q..Z1..........?h..`E$K.2o.A*c^.......*..D..uL=.}.#*0.. M!.A.C......|_..(.Y........!E... .O...`;....M+..x.u~g...q>...N."D^..K..x..D.`.!.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002S.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.358954476008653
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:GBsZR8SKKWWuAgEmd9XCG9/cRQyGyowSNJl36:GBsbsKWtA9mzXV9/cRJVo
                                                                                                                                                                                    MD5:CC58116ADF0CB31E6AEB9B82736F88BB
                                                                                                                                                                                    SHA1:9CA41F8A0EDC7E73D46ED4EE0E3805203088D323
                                                                                                                                                                                    SHA-256:EE2FD46E5864BA247524AEA159C4D960503D86CDE264412C027D4A89A7E99336
                                                                                                                                                                                    SHA-512:9A4C3ECAAF5582C966CE6179D291ED6A8A9A7C07E919D087EA9EDB1F373628D2351D0779269E0220C245899029C4877778D6EE18F7E110D61FB304E9545B3528
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......V...v...J...................................................................................................................................2...>...2.......v...~............................I.......I.qk..B.....LZ.x;......x;....-.o<d.J..x;....-.o<d.J..x;..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............VY..]...7.....N....N...^.....................@._!/.z..........f........................................I.qk..B.....LZ............VY..]...7.....N........VY..]...7.....N..........x;......x;......x;..........................................x;j.....x;T.]...x;......x;..B...x;H.....x;..B...x;..>.).x;..J...................;........4...4...4.."...............x;..x;..x;..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........x;......x;....#.x;............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002T.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 17x608, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1873
                                                                                                                                                                                    Entropy (8bit):7.534961703340853
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:N9YMw9kGzE4xTdow1C3kyIkyM66KeJY3fOxJ:/h8HzE4xTdoUCUyxyD6LCvSJ
                                                                                                                                                                                    MD5:4FC8500BD304AD127AF4B5E269DFF59B
                                                                                                                                                                                    SHA1:9A5E3432358A0FCDECE86AEB967319B93A65D14A
                                                                                                                                                                                    SHA-256:B4DAA90D5A53FCBC85119050B5B76962443C4DD18D7F42CDC6D4E0AD8EFAD872
                                                                                                                                                                                    SHA-512:E5E07054A522EB91EFD39722AFB3776389632B8F5F923C1D29796716D68CEC93BE5E44F79913804CEC7ED631FF520CBBBAAB841E01FB90AF8E8ADF84DCD47481
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......`...."........................................>.......................tu.....45.!#$%1s."fr...2Fq..AQe.Eav............................... .........................!AQR.............?..e4.bbu."m.G......u.S.-Qq.b.a..'#..E.......u.|:.f[O..jS.S.&....=.....[.....S...N.~~...'...q....N.T.Oyf..a.6..%.I.1j.e~.4..[5.WW.Y..Xp.gn...u.......Gb.O.W..k.!mJgfq....~.F.......m..}bn4.5........s,F...z.b)..O..*...5).-.-\....=`.fP....%...A..Q.&..9.....QQbD.%.:u.f...r$.10..W.F.T..MI...9...ZQH._..).....D..n.F].........*.:.j...!6Z..S....0...B.6..Ga..S.O.....U8S_.J.>...i..?..<.P..........M..F.T.C..7.E...`.4BKcMh1j....4y...+.|.^......2[.WG.W..+......E..r/V^".R...."..6..hht..f...........;E..Kx....)}Le.A.x.>..$/).._S.n.L......}..H^Sw...2. .v.io...../.........x.>..$/).._S.n.t^;O.....n...[.S...h.v.io...../....:/...[..7yK.c-

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002U.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.486838157878419
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:+sk4U/v9z7H1HtUEeIX+T9MhrNowrdQVru2YBX1mkA9g8gmlO1:+s+5HZWEXX+T90hRRQ5e0c
                                                                                                                                                                                    MD5:E6AE51940C034591570F3561D935AB00
                                                                                                                                                                                    SHA1:87FDFAAAFB6D1BEE19D0199CBABC54296A737C95
                                                                                                                                                                                    SHA-256:8F2420BC47B0F38DD45752605396E64422CD02A6B19ACF69AFBFBCA04E761BCC
                                                                                                                                                                                    SHA-512:CF086FED134F4BC6040289F65CE2557963AE2FF79BA1CA8A71B2BA8540734AB64727C0BD2A0DF9DE0EA4D66D55A307FC02FC0F1344A153E3DF339E2BBAE5AC9E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......n...v...b...................................................................................................................................2...>...J.......v................................I.......I.qk..B.....LZ...............2Q.E.X.e.......2Q.E.X.e.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............<r.g.....O...*f....N...^................>...o.N.....H..........Z........................................I.qk..B.....LZ............<r.g.....O...*f........<r.g.....O...*f........................................................................j.......T$c...............G.......H.......>............. .3...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002V.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 357x69, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):5465
                                                                                                                                                                                    Entropy (8bit):7.79401348966645
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:X0cZneDWlIKmXwxacOHHI6EhzNlSSDDgafbofgt7mGrw:XleDWlIJwQHihRdgu8imGk
                                                                                                                                                                                    MD5:8470F9A96B6C6CAD9EE60961E96D19B2
                                                                                                                                                                                    SHA1:AFE1F01FFA4E4CB06B1D770C9C59DA75B434D1AC
                                                                                                                                                                                    SHA-256:2DF453410796AEC7B9EFEC00059B6CE64BCF67313A95AE458BA600EA5DE14811
                                                                                                                                                                                    SHA-512:CAE5C2ED091BA49761F0348516D53491E578FB165F32F93AC7DAD927383E9A398B06229FAC6A8233777DF708E5001AE0037A1FA960293BDA49892C40B37F2240
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....C....................................................................C.......................................................................E.e.............................................8...............................!"1...2A#Qa.$34bBDSqt..........................................................?.....`0.....O...3Sd..@..5.0....Q.pw....;....!pN.DR....`0......N^...k.=.u.e.7{.b........?z....zV...M.....P:a.SPj.....WRK.=x.2.h..2..AS..s..A..|.Z/f$D.YX1pr......}G6._.~..)j...+.s.r".{..q..-.^@...#w|.H..*.K)....g...y..`0......2.w@.Ro.d....@...K....}...&... y..f.y.0.|DC..>p.[E.2......v..N.)Z..4.RF.D.8]..Z.|f/..+\ID.r/.o........0i..*.G.O..uj..RN. ....j...xnF...Q.Ls.U.c.D0m....z.k.P;f...b.=..L.hH.,./;.U..`sa.I...?*...I....M.0<.u....!..C..U.T.....s.Q......_..7K..*.....?....R\&=.<.u..oQ}WZ..Yu...{Fe3.h...@.s..mW.G..^....1.W.#[.q2.&u.c.G......`J./..X.C....M;.....3k$}.i.3...#/x.m.Oh.}FH]. ..5NNDIS.-.M~...6..w.d....P.;..k...........v*..T..L.P...s.!B.4..w

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000030.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 14x341, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3361
                                                                                                                                                                                    Entropy (8bit):7.619405839796034
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:zDqnxqMt6gGr/Nln5ANln5ANln5ANln5ANln5ANln5ANln5ANllHN6:CxqMQr/rn5Arn5Arn5Arn5Arn5Arn5AN
                                                                                                                                                                                    MD5:A994063FF2ABEB78917C5382B2F5FA8C
                                                                                                                                                                                    SHA1:BD5C4D816B04A2B6596DFE38DB01228F553FACCC
                                                                                                                                                                                    SHA-256:D72900E8DA72D1A7F3729971AA558E1E9B6E9CF9A0D51E83852E567256DBBFEF
                                                                                                                                                                                    SHA-512:CF2279033DD3EDFE6F6F9E5C517BEBD9A52863EEFD90F57F7A5AE0E0485E705254BE7ED6B50E6CA142669687727AE85E2E6035F69930B75F2E6D3EEFA961EF88
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....C....................................................................C.......................................................................U..........................................>...............................8H........59...$%&7F#'Ddf.....................................>.................................58EG........!#124$%&ACFbcde............?...n.p..v..a.~.._.>......#....8.....w.G...&.W...i...%6m..K;...4."...=..?.~......P..O...j.l..AW.jo..,..=d.h.ta..../.."...z|).J.......Ww._..<Wp.3+8...-5...G:..2.D..I>o..K.F;-.....#...`...6..T...M.....OOgV~..5...np...P..TYr...........b..{r.2.9..].DA.%C....=.v.z......CK."..R..l..y}.i..;.{....JzS.....~.?..Z....=c.h~*..p.@(@..G.....O.]...Hsd.xf".V]..S"..w...4e>....3*U.7..|M.x...|\......FD./.cIe.;.bId..+=...w.......[.k>....}.u...j.xZ.....Q4..+.....B....1O~\......I..h....LaXJ%&.w.<C...n/`.W..U.W.U.}~...}>..^.0.J.....@....LN.b.......5W...m].Eu...:....G..:4.=4ixx..@_0=.mab.T.U.....w..~.V.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000031.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.334568261888991
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:usz9G/Mm/EeXii9CW8RQyPQcB6yQfeBLgg:usz9GueX19CW8RJPQcB6yQfeB8g
                                                                                                                                                                                    MD5:8F99227D034F1DD8DB871CDCD899FD56
                                                                                                                                                                                    SHA1:2223AD1C68A4B60EE8320D0CC5191EF3594A1D40
                                                                                                                                                                                    SHA-256:C26CB578B353E2BABABF68EF53E7D506E1460D34BE9E582BB2F2F4741050A9EF
                                                                                                                                                                                    SHA-512:37F8110C0C185BA76A2ADE7BDE8140BED24B1D8AC969823D33D4F5B9A60425F81304B34E00CF517198559946AE19AF559775E94585A586BB41D87333CF3E4703
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZmX{.....mX{u#...1Zu..w..mX{u#...1Zu..w..mX{..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............H.Y...7G.A.<h.....N...^................/..].4H.UR6.kk.........f........................................I.qk..B.....LZ..............H.Y...7G.A.<h...........H.Y...7G.A.<h..........mX{.....mX{.....mX{.........................................mX{j....mX{T.]..mX{.....mX{..B..mX{H....mX{..B..mX{..>.)mX{..J...................;........4...4...4.."..............mX{.mX{.mX{..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........mX{.....mX{....#mX{............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000032.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:15:20], progressive, precision 8, 604x784, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):140755
                                                                                                                                                                                    Entropy (8bit):7.9013245181576695
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3072:i/aDiblRsFcOco8dofE5Zx1+NQI8Wh9aiOe5NTO:mnbM+TxaAi98W3aiOwTO
                                                                                                                                                                                    MD5:CC087700C07D674D69AFDFDA0FA9825C
                                                                                                                                                                                    SHA1:F11113DF69DACDB255C6CBCFB29C1D1CCE40B346
                                                                                                                                                                                    SHA-256:A7FA7F092EFF43030A56342C39A765F8D5CC48C7DB815DDFC8C1E5EC40117FAE
                                                                                                                                                                                    SHA-512:843202D975EFA91E73287052A893584B6E5AE601F91612B56539AA2F73D1AD3F997FCAD1E711E0F483A2E91D46D9643D0B026B43F4E94116A5D2FB6551536034
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:15:20.............................\.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................{.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.......J...\O.,......../$..........OE.m.o......T....Z..l.g.-....m.?...Y....3......"....].j.X.k.S.k.....4..R....{....?F.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000033.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.341165459307067
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:YRsM8ugcKukXEuVrXWf9Md4MRQyPFHzy4:KsNhcHhuVrX89q4MRJt
                                                                                                                                                                                    MD5:49E2105EEC3FF2F586AAD34750049D1A
                                                                                                                                                                                    SHA1:14A7D85A506C5930C4AFBB7F739C8FD0D13B93CE
                                                                                                                                                                                    SHA-256:97250E0A17DC65CD9EA2D583AEDF1605AF5394D6F1713A95B5A0146F3BF04766
                                                                                                                                                                                    SHA-512:EFDDA0F690F65520BDDDDBCB2A8D3F0F04964ABD336EF1F74083E4DB84FAEDA91B4DE2838691A44929F64EDEC9D2A5B981980BFAB27887F1D9C6ED5988A0DCCC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZN.l.....N.l.,...2Xt...s.N.l.,...2Xt...s.N.l..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............:.u."B.....`.@u!....N...^......................E.XQ.*..........f........................................I.qk..B.....LZ............:.u."B.....`.@u!........:.u."B.....`.@u!.........N.l.....N.l.....N.l.........................................N.lj....N.lT.]..N.l.....N.l..B..N.lH....N.l..B..N.l..>.)N.l..J...................;........4...4...4.."..............N.l.N.l.N.l..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........N.l.....N.l....#N.l............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000034.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:13:06], progressive, precision 8, 570x779, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):129887
                                                                                                                                                                                    Entropy (8bit):7.8877849553452695
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3072:QS1x1rXglsteJ79wHi4vNQR5yBlUdOSILe9hSj9jeWMPjdlOJ:vvglst1HiwWR5yBA2LeS9jd1
                                                                                                                                                                                    MD5:737E96E41D79D3BDACE7AB4F8CBF6274
                                                                                                                                                                                    SHA1:E6202A41A4F86B27D9EBCAEF7670B16C0ED67CF2
                                                                                                                                                                                    SHA-256:7966F3D8A2D61ECB49A35E163781858E052C0B122A18A1238AFE27B57E2850E8
                                                                                                                                                                                    SHA-512:D398C8521DB2FB3F8456FE792CF37472F3B851DD7298DB20E2DB79144F8E846D051878E77E5EF5D00E6840EDB90C6E2D97935BC1023A15FC45038CCE731E9895
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....iExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:13:06.............................:.......................................................&.(.................................3.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................u.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...W..I:..*....a....Aa ...w.T.M.v.........3x.......8Y....$.."-..m.I.0~sxB[@..=...:..\.Y?....@O.L;9i..U....?.5">+9.s\Z..vN

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000035.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.34687570437097
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:YJsXwPFuyRfEr7yXnM9ei8RQykXrViVmtV7VLViVR/VRV:KsXwNuTr7yXnM9ei8RJkXrViVmtV7VLA
                                                                                                                                                                                    MD5:63A73A063E13B981EB46A9AA9CD4CE98
                                                                                                                                                                                    SHA1:A389A344693AC90CDB8D3C5C2BA9D28D9186B014
                                                                                                                                                                                    SHA-256:231BFF170F5721828CB19931EA8AE97D420144B91A22ABF823C0C385455A3A4E
                                                                                                                                                                                    SHA-512:EC9807E914E8615755D14186762B14AF304F91DCD1916E079E12742C709EE041F80A65254549520DC36DAA1E56FB9F6C020B36AEC8F4826E6F78EC497253DBE0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ..q.......q......)..7.`..q......)..7.`..q..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............=......`..ut......N...^................W.-.ArA................f........................................I.qk..B.....LZ.............=......`..ut...........=......`..ut.............q.......q.......q...........................................qj......qT.]....q.......q..B....qH......q..B....q..>.)..q..J...................;........4...4...4.."................q...q...q..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4...........q.......q....#..q............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000036.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):84941
                                                                                                                                                                                    Entropy (8bit):7.966881945560921
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:X3sWfhTVd+xu6rA6SOONM0/YFXnviDwoPCaNSm+z/ze/fWNj7GfigeKyCGzw+QKW:nsOhdDJOwY1voPCaom+z/zeHAfGihCG8
                                                                                                                                                                                    MD5:CB84C108A76C2AFFCAC2551A3C1EAD56
                                                                                                                                                                                    SHA1:8BB7C2A12B056C1ED12EBBAE5BC9F60CCE880FFE
                                                                                                                                                                                    SHA-256:139BB0E79F89C3DDEF79B1716A5FBAB4C07DF5785FB3CDF6B4EEDDBF6C078452
                                                                                                                                                                                    SHA-512:6EF85144E9A7ACD0FF2E52A5FF42093153EFB69127B1C8549EEBC49B6CC196A46B65EE39A2CAD0206F6A41476D8B5B35D29EAC9942B8F84972B32E14CAFEED27
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d....................................................................................!.1A.Qa..q...........".2..BRbr#.T.3C....S$.cs.D..4%5......................!1A..Qaq."2..BR....3...b#.r.C4.............?.......m.q..'O.....r......_.1....8h....?.....O]~..k......GO...''._...!....o........''..g..H?k.......1...?.....z......>...+0..................GO...''._.........}.O.Z|.L?...........?.........[~t.......}......NO.....v.......J.......?..g..H?k......GO,m..r}o.z.....}......dC.9?..g..H_..........?.....O]~...m...C?.z..f....W.=u.B..m..C.-?.a.....3._.?.......o....np.M....g..H_............9?..g..H...../..kO...''._...!~...o.....0.M....g..H.........../......O]~.~...o.......7..+.... ..l?.}........&....3._./....?.........W.=u.C..m..C.+?..o.W.=u.A.^.O....:......_.........}..t

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000037.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.3407313392744715
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:YuusuouMoB/UdCxgtDh1jWVEe+h6XWLD9a1oTBrdQqrjxXTy8BXVdF9LA/qY2WCf:YhsD0xgJjOEP0XWLD9a12BRQyFjy8r
                                                                                                                                                                                    MD5:C71EFBB002170695297ACAA394F7612E
                                                                                                                                                                                    SHA1:EA641806026F2FF17040DF8EA59F03988351012D
                                                                                                                                                                                    SHA-256:1E8FA23127F32022C87DBF3CE7BCC58EEA9893E3BD45DD8B04227908BA86B174
                                                                                                                                                                                    SHA-512:D9081D880BF9B474C8A6435BFEF49555F92B6D711E0AAC70CD478141B4D5D8E4707E2E9047B4051DCCCF3618B2DAE62055850D38BE1BD193FA6650C9290244FF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZW&......W&...,t..+D....EW&...,t..+D....EW&...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................mJ.$....X%2....N...^...............1.[E..\@..B..,.........f........................................I.qk..B.....LZ................mJ.$....X%2............mJ.$....X%2.........W&......W&......W&..........................................W&.j....W&.T.]..W&......W&...B..W&.H....W&...B..W&...>.)W&...J...................;........4...4...4.."..............W&..W&..W&...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........W&......W&.....#W&.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000038.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 40 x 623, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1569
                                                                                                                                                                                    Entropy (8bit):7.583832946136897
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:KArPoy/sSfmBL0EGEsRgeTLLXFnViAAEslVorlP0i8OmO57EnGAkYelBKMN:9oQPTgeL5ViAe8rQs7HAkrlc+
                                                                                                                                                                                    MD5:07DB3F43DE7C1392C67802E74707DAA6
                                                                                                                                                                                    SHA1:C173ADB1999065C5E1E6DBEF934B4D4D7AF0CC23
                                                                                                                                                                                    SHA-256:51E05999A1C9F17DF28CB474E57DD8E64BDAB824874A532C20A23766A01F8967
                                                                                                                                                                                    SHA-512:E509255519D4E521E82332FF418DD5A6BBBC8476399A0D9C3D81542C1CABA535B2D79E5BC90F73F9EE8468643302137671934ABD600FC696F16161C91FEAC111
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...(...o.....>.c.....PLTE................................................................................................................................................................................................a.o.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.Y.. ..........}%.../].`<..y....V...m.....<....)..;Ki..'9...2.:.c...t..V..d.t;-y.Z.=K>B.."{Lj.~G..|..ENC.!Sw,....";.p..g....E.B..S.-...k..P."..E......l[./D.-.....Q+.G<>.+..b...#..y(...{a.M..J...<....v.W..F.qm.`.....(.mk.nX....l.Px8.0\Z....7G...$*.....&..Z.VJ.~......J.2|...2H..../...=.)q....ZT" .,%..h.p....Z$.!........r...Hh.f. ....P .d..1d....2.3h....;.A.... ....d..g4...A..^.....2.ew..."h...y/..j.h..B.......%.2.%..{r...+dG.=9h....P1...A...c...^h.]Q0.8x....q .!3....ZW"Z.!3...G.vC.GG..".&..X!3.|xB..V.P!.+zS..NX!3.....Nh.y(.Z.1.h..B...Z+....l8Xcu.B...K...@U..@Q...mB...x...&L C....mB.....@kC...Y.,.... ..e\F.B..........y..e\..:$(....Z.a...yn...f..z.~Q.{o...].ln.r....^.@.{..c.7..{...

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000039.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.330758611890806
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:aFsJ1PE7N5tONE+YlLAIX1mOI9GnloNrdQqrFheYBXlm429tqhF49lnT:aFscN5AEplkIX4OI9GnlsRQyFIY6
                                                                                                                                                                                    MD5:6CB9DEBB6B22F824C5BE3F40CFDFBBBA
                                                                                                                                                                                    SHA1:06DE15D28ABCB256711ED485096EC92B41FEFF67
                                                                                                                                                                                    SHA-256:B7B2EF4B2F78F9FAD43EC08233031AC0C836BD383CA3A7C99DD9D327F5B74DA6
                                                                                                                                                                                    SHA-512:88AB3E95A3AEAF1F4745A0BE8CB3E8B84EBFC6DB4D8D759CA242666BFE4894449CB79E8EAE9114544457928693FAB23589CBAFAF6F6AA3945EF83DFD93DEC4AE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.............8.......R.....8.......R.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............L.....-0...uW.....N...^...............u....{.L..N.............f........................................I.qk..B.....LZ.............L.....-0...uW..........L.....-0...uW.........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003A.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):40035
                                                                                                                                                                                    Entropy (8bit):7.360144465307449
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:MQhziQo1RKGlyyzYjlxuxwRUj/BN837xRmwH2uDTCn8qXFQziN:ThzrSzalg6O563l4uTC8q1Ig
                                                                                                                                                                                    MD5:B1DDD365D87605F96D72042CB56572F6
                                                                                                                                                                                    SHA1:ADF71DAD1A62B8A58A657C2EDBDD665A19EB846B
                                                                                                                                                                                    SHA-256:06E09DE80C3F32254DA4FE6B2CBAD7C05EF144DD54B8C65745E195BBF7317A2E
                                                                                                                                                                                    SHA-512:9C686092CC9524F34EA6CEC9AAE936A6225BCC54DE38DE1786EBA8F532959A80FF885E8664A09E4C318D7CA4B278E807D3D1F135BE55F30979B844FF5EC9699A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!1....AQ.aq.....".3.5...2B#s.$%..Rr.CS4&6...bE'7.c.DTtU...d.eu...VFfv.Gw.....Wg......................!...1AQaq........"2..4..Rbr#3$...B.s5Cc.S%.D............?..^.f....R*.N{.{f.....O.r.V.;U..~...U.(..>M._.yI.{8,..^.t...s`...j.O..U5t.&&..h.G.6Da.;.....J.......E..QD...C...}..N...tR.....~..].J:.V$.*.r......]...W......4.[.)6..Y_.....4...........m._'HR.a......]U=.....n...0.W..]..K..){.+...w...f...<|..1/.|.....b..-..y....]U#Ctn.7m.._.|..2I;|....tM....q.q.}.N)....'...9&...nR...R..}.........m._.LZ}u.../K....9.~..?.{....V.#..dx.Zk.:=..:.j].....E#....E~w%....J..[S..[......gr...vb.r]..<..ut..i...[P.w....:..Gkn>......#..m...9km`......t).up.....w....VOR.{&.nQI..}...wD.7Ey#n....MO.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003B.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.667550072578901
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:D79sdcV66MFt794E3/L7UXJ9K8otfrdQqrLVa6BXWwhJN:9sN6MFwE3/sXJ9K8QRQy46D
                                                                                                                                                                                    MD5:C31EF0F42585878BB3B340F3DB2767BE
                                                                                                                                                                                    SHA1:881F875701DA160481C5C7DF8F6E78A1060B172D
                                                                                                                                                                                    SHA-256:F997908D5D7A9B799D1741A67A6128859B035861AF864DA66AED3BED29997221
                                                                                                                                                                                    SHA-512:07A2F66BF995C12F3F478FCAADD60EF28E142E979CA8BA11D5AAC353275FF048639AD81A9434417CA5A554CBD0C0AC4603772B5A0BF6731C5A5AD6B756B86B0D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>...........v...~...................................................................................................................................2...>...f.......v................................I.......I.qk..B.....LZ..1.......1.X......:.....1.X......:.....1..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............J*......6C.!Z.S.....N...^...............C..G..pD..P_..........f...................................:....I.qk..B.....LZ............J*......6C.!Z.S.........J*......6C.!Z.S............1.......1.......1...........................................1j......1T.]....1.......1..B....1H......1..B....1..>.)..1..J...................;........4...4...4.."................1...1...1..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4...........1.......1....#..1............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003C.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:10:32], progressive, precision 8, 594x773, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):242903
                                                                                                                                                                                    Entropy (8bit):7.944495275553473
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6144:YVxOYlZX2kCWfYoFMXC/sBFC9r+4iEGM4rrcPoWmwkU6FJ:+OwZ2kbFMC/L99ifvokU6/
                                                                                                                                                                                    MD5:C594A4AA7234EF91E6C2714CFE1410F1
                                                                                                                                                                                    SHA1:C0F720D4CE3196852814D0B7347F0CAA0C6FD526
                                                                                                                                                                                    SHA-256:10C833E47BE1C8496F949A6B059C2D79212A4DD66BDE62116EA337FA4FE0B654
                                                                                                                                                                                    SHA-512:7313F6545A334F9E2DE5430B2DB5C419C4C8A40E075338DAFCD74970BCC6309786946E5DFB57531612BF4C6269495655706D920FD99922FDACFF9796710DA9C0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:10:32.............................R.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................{.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...v&.F;-v;}FH..Z...N..)Y.......h;C....G.0W..ww...MI..Z+..\.........c..4.1.~.Yo.Y6.&. q...............l.A#.~s?yYg..7ky...r

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003D.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.343714518251993
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:YvdsjZFtlJhYEXMRqXU4m9+G4wRQyiUSm:Ws3t3hFXMRqXU4m9+5wRJRS
                                                                                                                                                                                    MD5:8B1D73509BC70ED5B0DC273EC05504FD
                                                                                                                                                                                    SHA1:70A0487D38FB9D7818F375021C6DE3FB85BCC518
                                                                                                                                                                                    SHA-256:A15E14483330FC18337401C16010C996554154D0708179A2CF79639876D9B826
                                                                                                                                                                                    SHA-512:F735A63FD57B28DA804CF9C1905689EEEEE63B54CD07908654D9A1E77214E94081C47FB555B97F0327845BDD10052D005FFF1F67C45039C2F7BDC5C0668B540D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZnS0.....nS0......8jlW ..nS0......8jlW ..nS0..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................*\.h.6...c.w....N...^...............e..E..WA...?^..........f........................................I.qk..B.....LZ...............*\.h.6...c.w...........*\.h.6...c.w.........nS0.....nS0.....nS0.........................................nS0j....nS0T.]..nS0.....nS0..B..nS0H....nS0..B..nS0..>.)nS0..J...................;........4...4...4.."..............nS0.nS0.nS0..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........nS0.....nS0....#nS0............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003E.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:12:29], progressive, precision 8, 598x766, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):70028
                                                                                                                                                                                    Entropy (8bit):7.742089280742944
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:ub4bgbB7g9cKCmSzaNF0jAdAzQKTEFBQqUp/i0yG1pidLHTVX:ub4bIB7Qg2OjbzjgWp/i0yGCZx
                                                                                                                                                                                    MD5:EC7811912ACA47F6AEB912469761D70D
                                                                                                                                                                                    SHA1:C759BC2D908705D599B03BDB366C951B11F99A4E
                                                                                                                                                                                    SHA-256:FBB4573E3BEE1B337077691BEBAE15D6FAC52432405D31396D526D7694A8283D
                                                                                                                                                                                    SHA-512:881828150993A8C56E36CDA2051D89C1F6E0322643902C9506392C163E8734A2933A46486F40E5BC8C8D0164E180605E52620EF22FE14540AEA787A38B22E98E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....7Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:12:29.............................V.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................}.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....H.yM..? .Z.. .^.x..p.8.A...K.... .\{..)..y....t..=.^y)..v.@.W>. .h.. ..p.:.\)(.$....$.I).....!....E..Z.....&.5.).

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003F.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.348403142068751
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:esq0LEzljaE5VUXMI9WcMRQyLhpsZFUpqLu:esqcEzBXUXMI9WcMRJLhpsZFUpOu
                                                                                                                                                                                    MD5:ADAFFAD0C5A6BA80D9658CACB3BBE892
                                                                                                                                                                                    SHA1:1274C41B0EADBDA36828ABB111D5C0F51D6E187D
                                                                                                                                                                                    SHA-256:B7EB79982D35AE117D474273BF4C93B50857DE00E3BDA969DED778ACFDD71D85
                                                                                                                                                                                    SHA-512:91E63987A6FB8D76BE4955869EB34066F4C6FAF7ED26FBBF51A4B975B0B892F5852E60E9D5E36481384443B076CA86C1B5A204B8B732632FB35191398485E2AB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ;.#.....;.#.....3R.M.J.;.#.....3R.M.J.;.#..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............,.A...e...[.........N...^...................WUJ..=.............f........................................I.qk..B.....LZ............,.A...e...[.............,.A...e...[..............;.#.....;.#.....;.#.........................................;.#j....;.#T.]..;.#.....;.#..B..;.#H....;.#..B..;.#..>.);.#..J...................;........4...4...4.."..............;.#.;.#.;.#..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........;.#.....;.#....#;.#............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003G.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:19:29], progressive, precision 8, 221x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):24268
                                                                                                                                                                                    Entropy (8bit):6.946124661664625
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:d2wiieoHTRh5a1HAteZCWOZIM+L7WhNjYn:8wHFHJ+/OZIKhNO
                                                                                                                                                                                    MD5:3CD906D179F59DDFA112510C7E996351
                                                                                                                                                                                    SHA1:48CDB3685606EDD79D5BCDF0D7267B8B1CCBD5A8
                                                                                                                                                                                    SHA-256:1591FD26E7FFF5BE97431D0ED3D0ADE5CFC5FA74E3D7EC282FD242160CE68C1F
                                                                                                                                                                                    SHA-512:2048CBA13AF532FF2BCC7B8B40541993234BD1A8AB6DE47B889AF3F3E4571F9C5A22996D0B1C16DD6603233F6066A1A2A97C16A6020BEDD0826B83BAD0075512
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:19:29.....................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................$.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....)......[]t.\Z..g......A....&D.$LH._..X..Xl...`....cZ.X.........>......f.Z.X...]..~L.S..@..I$..I.IO.....x...s.g.[f.h{9..

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003H.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.324690894028583
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:qsRRwMswXKE4XSI9uBgRQypQES6yX1Ebvf:qs/wM14Xb9uBgRJpp2
                                                                                                                                                                                    MD5:D1B92896717A1B0E505B430997637CBD
                                                                                                                                                                                    SHA1:B7D67627D7F1090FEEA93B17EFE2A2E91A2F05B8
                                                                                                                                                                                    SHA-256:12464C4AE6968CB3C74738247963AB9F7802FA8B509C50A9A64BD345E050372B
                                                                                                                                                                                    SHA-512:CB40E5F1E37E57F51C08743CB74019D7D4FDC9E3F90EF85FEF2A75BA1E60244627AF966870F1DD8FE725D158ED0D77FCC0B2CA856BAA7552B5467AF6350961DC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ _...... _.......d.v.. _.......d.v.. _...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............."y{...?|...x......N...^...............5...;2.E..k..M@.........f........................................I.qk..B.....LZ.............."y{...?|...x............"y{...?|...x........... _...... _...... _.......................................... _.j.... _.T.].. _...... _...B.. _.H.... _...B.. _...>.) _...J...................;........4...4...4..".............. _.. _.. _...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4......... _...... _.....# _.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003I.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):47294
                                                                                                                                                                                    Entropy (8bit):7.497888607667405
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:aQ10VrIBdBvDpQrQ7P9/FUOLG2vTSeG9lkCsMKzXeMBk3CBp:aC0JIBL+QsOLG2+ZAC1KqM2I
                                                                                                                                                                                    MD5:7A450E086AD14BA7D89BA5DB3D3AE6C7
                                                                                                                                                                                    SHA1:E7AEAFCFCE476390E18C19456BDF6529D863D518
                                                                                                                                                                                    SHA-256:BDD997068701ED3A00A224EB694B003C01AC69B857FE7B4147D6C34875B1632B
                                                                                                                                                                                    SHA-512:9B6D50A6CDB6081DA107A2CDDB1BD2811A5764994C8E3F67D56CA81084BE0D068C27435154E867199F38688EA65E8DE02A56DCAC47D0F5E55F0FBB6598814938
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..A..Qa"..q..2.......B#...R%.r...$&b...3Ss.4dU6F.cE..'GC..t..5eufW......................!.1..AQ.aq..".....2BR......r.#3.d...b..Ccs.t......$4T...SD%5Ue&Vf............?..M.7(..).:.a.q.......>..[:O...afQ.uCO..U.....go.l..p..YqVklQ.{i.w&.]Z.\+JQw._.n.'.h..,.bj..X.].k&.Q.>gU..f...1|....[...jQ.%Zb.......t..........*..V..j.6....Vj..i.....?...IY.P.....$.j........[l.....S.4.J9.U\.......7I..[..=*N5....xW..../...=?n....uG.D..S.>...8..3........n.S....]k.*...4.>.R.o..{..l.H.#.^....<amG.m&.......,....wDY.W.m.X....We.IR.Nu...y..Z.l.._S.mr.m...y.]m.R.MT...6.5.5}.K..#%..k].7.Y.q]...%.r.7.R^jR..z.K.T[t.a..d.)glW.r.v,.`....O..^..o:.Uc.\..D....f..D......yt.Q...Y.....

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003J.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.500763140704855
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:YsO7XdTEwBXC9gA8DERQyp7iqWClie8r:YsO7XCwBXC9WDERJp7iqWCliDr
                                                                                                                                                                                    MD5:0B1E7A62FC387D49F39EA3222EF48FA6
                                                                                                                                                                                    SHA1:76E1D501BC56F845542422BF96ED2907C4FC84F2
                                                                                                                                                                                    SHA-256:A3A1DB976875EB06A6CF7F32288C98575357AA5A682E6BED04E5F7CCCF42D450
                                                                                                                                                                                    SHA-512:1AAA685AFAEB900CEAAD81A5C75412AA30027E09D90C5A2DDA6D2E675A781BC8424EEA08730253F5424D09D72AA3303D526B9FC4F10CAFB99AF1043FABBA18EB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......n...v...b...................................................................................................................................2...>...J.......v................................I.......I.qk..B.....LZ.[.......[..'7w.<.HDc.Ga.[..'7w.<.HDc.Ga.[...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................vW...>Cr.........N...^..................-.a.O.."...........f........................................I.qk..B.....LZ...............vW...>Cr................vW...>Cr...............[.......[.......[...........................................[.j.....[.T.]...[.......[..B...[.H.....[...B...[...>.).[...J...................;........4...4...4.."...............[...[...[...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........[.......[.....#.[.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003K.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 60 x 336, 4-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):347
                                                                                                                                                                                    Entropy (8bit):6.85024426015615
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:6v/lhPtnlx/QulkWNY2V18A6Akp7eee1VDjMHCyLezyKUX5Gp:6v/7RrIubiA6AkpNhiyKe+
                                                                                                                                                                                    MD5:78762C169F8B104CB57DFF5A1669D2DF
                                                                                                                                                                                    SHA1:9638B71B584CD636834016A635ABF8D9C0887711
                                                                                                                                                                                    SHA-256:E64FDCD0B108737D8B8F7B677029F924031D6BBAA50585D9C3DEF7C7E92ECAF2
                                                                                                                                                                                    SHA-512:5ED899AAF73B72DEC32E171FFA112382667D5BF3FBA98C92E313E66C0A6975EA97068F4CD32B62283F18DBD5345C11E3610F7EEAC2F2DE71FC44593180B9CEAC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...<...P.............PLTE......................=l......bKGD....H....cmPPJCmp0712....Om......IDATh......@..aI...B..C..l...^.%.`....>.]..|0.....a...hb...0......q.......p"....;...K..x=...p...y.yy~J....|...\.......y..X.......'...>1...Ky..f....&........N`..f0..b...3.......`Z.3..3.....o.......4.&........SV...4.....IEND.B`.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003L.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.3553680121126614
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:AsOk6A9V2nat0wkjE6LXA2w99+RxoqKrdQqr8Wu0s2BXjz49nZyCbTR:AsCS2naPKEcXs99+XARQy870s2UzH
                                                                                                                                                                                    MD5:6CE0A7A63B185015C22DD52B2AD20699
                                                                                                                                                                                    SHA1:581304B676963586A0B0931275AB07C42A0C24BB
                                                                                                                                                                                    SHA-256:416B96F61EB231A67E3EB623DFFE50041CB1B41AD2DB81542070595B0A27919E
                                                                                                                                                                                    SHA-512:73807D36CF08FE7EE00A36D1E4C03E9E72128E3AC3AFBABDF201D085D2498AE36879764267E219AF6607F58620AD039A2B5001C551C1DF30DC1B8140FB2E39AE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.........EU.g.=..d...j..EU.g.=..d...j....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................\...*....o~....N...^.................h.7..N.....}..........f........................................I.qk..B.....LZ................\...*....o~............\...*....o~....................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4......................#..............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003M.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 40 x 617, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):827
                                                                                                                                                                                    Entropy (8bit):7.23139555596658
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:6v/7Hs2NwBW1mtjeSfaTHHy05riYUtr8y8PQvPYzzg979Reip0QPqc:oOsotazy4rStr8y8PQIzWea0Qv
                                                                                                                                                                                    MD5:3E675D61F588462FB452342B14BCF9C0
                                                                                                                                                                                    SHA1:86B62019BC3C5BE48B654256B5D10293FC8C842A
                                                                                                                                                                                    SHA-256:639EADAD468B6B32B9124B1F4395A8DA3027FF7258D102173BA070AE2ED541AE
                                                                                                                                                                                    SHA-512:E6EA855B642ED36FA82F8E469A826DC57EB0C36E307045FF8D166F67AF9242C87840833BE31FBE4706DC54100E999D6A3D3A78D0633A3114735818874AD34758
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...(...i..........`PLTE...................................................................................................bKGD....H....cmPPJCmp0712....H.s....qIDATx^...0.Cg.;......@j..2c.=~KP.[H~..@..8...?U.g.n.a=.=.).....3..u^(.....L....5..........8.}..T.f.n.a=.=.).....3..u^(.....L..r....s..8.....W]....,..9..G?.a..`c.z...E.p...)Y.P.....#....@9.7].....,..9..G?.a..`c.z...E.p...)Y.P...`b....0.b.+~{.Pu...1..<..0._.l.@O.y.(...V3%..J....s... .(g.+.qyWu...1..<..0._.l.@O.y.(...V3%...%R.L.Q..x..R.<t.o......7.............:/.E..j.da@i..`b..Z......u.>.?...7.............:/.E..j.da@.Dj..9.W....s. .....:.......L...">w..7... .....:..."...L..."..a....D..Ya.l....E.{.@&.|.._...7..D..Ya.l.....{.@&.|....0.J.."z.0s..s....=g ..>........"z.0s..s....=g ..>..l..1...y..g......IEND.B`.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003N.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.322416554578252
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:OsLXk1SKsEXndwXX6Hw92Bq7RQys96pVFa6pO3M:OsTk1xJXnCXX6Q92BARJyE
                                                                                                                                                                                    MD5:57406FB7145D00941D921179DF31D2EE
                                                                                                                                                                                    SHA1:61A0643FCE9EF1A41B8C9E3A53ECA3D58BCBABD0
                                                                                                                                                                                    SHA-256:DCAE8831EB0F1453B79FAD54CB4C274C0470A79B68B5A6054593871534F6FE3F
                                                                                                                                                                                    SHA-512:1B2CDEF2215748456C39115044072EC00868BE41CD74BDC577A009331BFC44A280E0F557D437050C17341D4F9FB2AF8BDE6D4C433D2D5BBA9BA591D200750FB3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.C*......C*].E...jU.dT...C*].E...jU.dT...C*..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............A.Z..c.."".,?.il....N...^...............&)J..9.B...t@...........f........................................I.qk..B.....LZ............A.Z..c.."".,?.il........A.Z..c.."".,?.il..........C*......C*......C*..........................................C*j.....C*T.]...C*......C*..B...C*H.....C*..B...C*..>.).C*..J...................;........4...4...4.."...............C*..C*..C*..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........C*......C*....#.C*............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003O.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 50 x 600, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4410
                                                                                                                                                                                    Entropy (8bit):7.857636973514526
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:E/pQuIhKZ7u06dICH3AroiTe8DGTl55poBUmLNjpH7MvDHjfm:MpdZtPbknnRPpkLNVMvu
                                                                                                                                                                                    MD5:2494381A1ACDC83843B912CFCDE5643B
                                                                                                                                                                                    SHA1:98F9D1CC140076D1AE5A9EA19F47658FD5DF0D66
                                                                                                                                                                                    SHA-256:5EEBE803E434A845D19BC600DF3C75E98BB69BD0DE473CEEC410D1B3A9154E28
                                                                                                                                                                                    SHA-512:0E64CC3723DC41D94910F7ADFB6A0DFB5049350FD15A873695614E4A89ABD78B166BA4E9C8CB95E275FB56981539DECD2A7F28FBC25E80DD5E2DEA8077CC9489
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...2...X.......E.....PLTE...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................B..(....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.].\TU.?3"...(..L........q.Q...H.*j......W..Xd.ie.f..%.XT...em..m.m.vkik...>.}..}|..{'.U..~......}....s.............,CVu.x.:C..5...;.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003P.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.358397868806064
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:Yu6s4RDVTkttMjPEZUncf0LHX5f9QzPoFrdQqrBwZaBXZ5Ffx5:YNswVTkKPEZnf0LXJ9eP8RQyhnZ
                                                                                                                                                                                    MD5:7CA92AF3D20A9ACDB07732294F61282D
                                                                                                                                                                                    SHA1:CBC3C332C7BB634E0D9D306CD322CB6013C620EB
                                                                                                                                                                                    SHA-256:95DE7A7610EDBF2E04FB85CA96FB267C218C9F26BA76A27B6A4068ACBF277395
                                                                                                                                                                                    SHA-512:94634955228EFA63F86B21CE3BDE469D143793F2BC90E03516A08A89526ADAE5BFDD79EBBFAF89AACB3E860D4408D4A18A571EEB4F61A1F39F5A14BB11A6619E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ.............>..(B..O.hS.....>..(B..O.hS.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............N..L<..yW.7(......N...^................g...KD..Q.M..8........f........................................I.qk..B.....LZ..............N..L<..yW.7(............N..L<..yW.7(..........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003Q.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):136726
                                                                                                                                                                                    Entropy (8bit):7.973487854173386
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3072:SIXmy5Tl704vW2ZKkvV8UU0ZWUF0BJwySIdgz816YzDc1+opecYPn:Sny5Tl704fZFV8UU6LGXwyS4xohpQPn
                                                                                                                                                                                    MD5:4A2472AC2A9434E35701362D1C56EDDF
                                                                                                                                                                                    SHA1:16FA2EA2D2808D75445896E03B67A93000EEDDD8
                                                                                                                                                                                    SHA-256:505F731CB7707EFAB2EB06685B392DC7E59265A40B55AAE43E5DC15C0A86CBA4
                                                                                                                                                                                    SHA-512:5E28D8FB2AC62ED270968072A30013334461F7CAE96058AF9EAA6E10912989DC47112D2133892BF61F7A516B77C6FF71BA2A000B750A9F95C787E538B09595C2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQaq".....2B....R#..b3...r...C$...X.....Sc...9.%'.(Hs4Dgw..T..5GW.x.)......................!.1..AQa"2.q.......B..#c........b6.Rr.3s$.&..S...C4.%5............?.........(......(......(......(......(......(......(......(.G/.GE&...)..P.x..B.({i2Y;.z?G...Yfc.)H..^....#.....}3..Sc^.H..+...M.a.P.....GS.....H_.3..<....1f........1.<.\..nn-..s.s.\9Y....=.......S.0.......N..cA..Io..r.3..........ay.....K.....,.;9..Q......xO.Fa.2..>........{4k.....|....?U....3.8..._/3....#.. t.y......yY.......e.<........#.....B.....Z.%.Y..S.ye.W4...l.......X...%.@y}>....l.yi..D..W......L..._D.Q....)...E....n.%...*..K.4#.8`..I....h..h.o..I......-...hB...3..u.(5..........n...,.@....a.t.9.....@.s.>.&...@

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003R.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.347053447784285
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:5g3Bsoxinvp/EKHYXX9qVrn8RQyoxeSqON5FqO4Uy:5gRsoAvOAYXX9qVrn8RJGeSqON5FqHUy
                                                                                                                                                                                    MD5:4E91FC2C47C3EA5495A7D46E30852B6C
                                                                                                                                                                                    SHA1:676724436A7007269EC87500FBA76068DF689D52
                                                                                                                                                                                    SHA-256:74A23C613D7A30A51C3E107F6304ED069B4EA02E9174FDA2100E83EB28C32DAC
                                                                                                                                                                                    SHA-512:2A0C95CA81915784F1056306B86CED0DCE15BF54992530FCC637C7B45CBBE8571249D0D0FC7CF3394F10229F1D88B78FAED6A2E8F7E20C826F1859731EA41A1B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.jk......jk.c.7...,..qI+.jk.c.7...,..qI+.jk..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............C>>b1..("..Gy......N...^...............qW...x.L.3....Q!........f........................................I.qk..B.....LZ.............C>>b1..("..Gy...........C>>b1..("..Gy............jk......jk......jk..........................................jkj.....jkT.]...jk......jk..B...jkH.....jk..B...jk..>.).jk..J...................;........4...4...4.."...............jk..jk..jk..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........jk......jk....#.jk............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003S.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 77 x 627, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):5136
                                                                                                                                                                                    Entropy (8bit):7.622045262603241
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:djzuNKb3XHco17p2wolIxIx7lpskdsC/ddWNKeabJbMojpxLDTu1:VzuNKb397pwlIxKp7qs3bJb5FBTw
                                                                                                                                                                                    MD5:FA38AFA965141EA3F17863EE8DCCDE61
                                                                                                                                                                                    SHA1:2B4611E651AF7549C1AA73932B1136B561A7602F
                                                                                                                                                                                    SHA-256:E1CB1A0EC9BE62D5445C73AA84DF38234002A7E164EE830C9DF24997802CB5D2
                                                                                                                                                                                    SHA-512:A372674F5CA343321BA9C413D346070709F7685706C9C6C3DC7F61846B59253A5E6FE800DBA10AE870FD3887439B2AA106FBBB51751E92A163938A4393C43E28
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...M...s.....}8nv....PLTE.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................z`.....tRNS...................................................................................................................................................................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003T.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.448589456328403
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:psVrqFDV2VW6HaGESXkn9e/YRQy/2lEcqJ+RzTJ:ps9I6HCSXkn9e/YRJOqO
                                                                                                                                                                                    MD5:28CF2BF53FF8FA4AB19B1BD42AF94CDE
                                                                                                                                                                                    SHA1:4A0F575E16CEB91F5EB6B12A76E10CB857A0B8F9
                                                                                                                                                                                    SHA-256:7162DC48C7679628B51A0C7A50B28E62321A985BC034BF4CFB0E746350F49C9F
                                                                                                                                                                                    SHA-512:04E06A6D66E1C0F67B37DB5849CFB20CBACBF11926DD7509C53C2D323A077B9C8A4548AFEF232A9353DDA4153981B6DE9809B8F64FA7BDAAE92F3981ED98F332
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......h...v...\...................................................................................................................................2...>...D.......v................................I.......I.qk..B.....LZ.............J........S.....J........S.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............5..?..0.*..L.....N...^...............$....d.H..=..}..........f........................................I.qk..B.....LZ..............5..?..0.*..L...........5..?..0.*..L.........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003U.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):52945
                                                                                                                                                                                    Entropy (8bit):7.6490972666456765
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:cjvqR0XvFaGCTJffi0tgybmWDoTw71kHUAnjvawrlp2+NUO8dWSNl3PF2PjK/q09:cyRffflgybmWoTw1UUADHUbU21MjpAD
                                                                                                                                                                                    MD5:AD003F032F32FAC4672D4CE237FA5C5B
                                                                                                                                                                                    SHA1:AE234931B452F0D649D91291763B919CF350EA49
                                                                                                                                                                                    SHA-256:ADB1EBBE18D6CD8FF08AA9BF5C83CDB83BF9AA179698E34E93DBCDDE12F04D32
                                                                                                                                                                                    SHA-512:ECA25FA657ECE3A66D3E650628E0F65D3BADD38864C028AB6553950A1A66D7D55482C85E9E565573E9E5AAFA91C2D53235971C644A266D41EB69F8E72E3A843B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQ..aq....".....2....BR#r.b3$...C.Sc%...s5E......................!1.A..Q.aq"...2...#...B...Rb3..$..CSr...6............?......y_N.e.H7?........W..w....k|...S..d.4.>.RW5z.$.i.)V.O....>o...c..*&1.D..O..".ufbb..1...t..u=..K...m...~.....F..-.fb:i..=f..C.w.[{..~.7k....;..:..3....4.....$..m]...}....~q...9T.#..7.~..8...q.N;c..ffo.w...W..d........../t_........lWJE..).>..v;:=....Rrw#.m.n.n...E...vm.J}2N*..|.4...80.#..e....t.J..ZQ.x|g/....F..e....k+vK...M..W.X.e.L..~...j.....kz....=...n:O.:..[.L,.+R...Y..zKNI....,..{e..U.'...}.......|..t.]...~...b4......_.i..../.......m...a..n...v.j.?..Rc.$G|.31..#..$?.........h.w....-... .a.%z..u......u.A....Fm..J.......G..[...w.....:....w/.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003V.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.416733092084718
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:zWBSls8q92lNtWlEbLjXXAXgu9+G3drdqrbmBiBX9Q2m/DAd:BsJ2lNUEbYXP9+GNRy7k5/M
                                                                                                                                                                                    MD5:DC6DC39E1338019965A6486CAAD383F5
                                                                                                                                                                                    SHA1:4284CED3053AECD8C319BADEF876D8425DAC503B
                                                                                                                                                                                    SHA-256:4E9A8D886374ECD360F44FEAA7EC315A97EDF65CE03C80EAF20E181B8B13401A
                                                                                                                                                                                    SHA-512:0BAD41DF532606F50DE5E8C5ADF454D33AFD04679F5346861EE9FF19D00F3F1F4E70CDB70519DD087BDC6EBB5A698A48A83EB157847DFDC0A8726AEC69085BEA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......h...v...\...................................................................................................................................2...>...D.......v................................I.......I.qk..B.....LZ.........e..s.!.7.q.....e..s.!.7.q.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................r41......A......N...^...............-....|9G.iA...P........f........................................I.qk..B.....LZ...............r41......A.............r41......A......................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4......................#..............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000040.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):79656
                                                                                                                                                                                    Entropy (8bit):7.966459570826366
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:2kuUliOeU4os8ii3nF3Hxro/qxXD9u/kjYgMZqoEs6ZUldm:3uUsOXYIAixR2k7WAZV
                                                                                                                                                                                    MD5:39FF3ACAE544EAC172B1269F825B9E9F
                                                                                                                                                                                    SHA1:2D40DE8D90BD21D56314D3F99CEF4FBAE3712C0F
                                                                                                                                                                                    SHA-256:70475431CCA3C91A4EFA3B8F04864371D2D3A45696674A1A0562FE9CD8DB287C
                                                                                                                                                                                    SHA-512:3B9F3B32696AB7779864E83DC0C45960114A130BEE0CF4D0643DE57FF952171E5D775AA49141EE31A28A9B5D052B26EB421F26EA736D7EF4B3A7EC812CA411CB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!.1A.Qa"..q.....2#..BRb..r3$.Cc..Ss.4...D%5&..T...'7....................!1.A..Q.aq..."2.....B3.r.#..R...bc$4..D.s%............?..Y..T.o.\......=.a..j..'^..s..[../........Y.......<...(..4.....7y..Ln.[9.cK.ilN...u@$.V.9.V?3..s.KL.z..w.jW.C.............@.~+.o?o8...k....,.m..9.".....q.....d....z.W...q...~...'..e..>..f#...S.....F....pU.......7..N.vfK......S..G.#.....}.c.........RXt.bq1.`.....[+8\.*.N..:......}.....r..........')......Na...&...m......c...a4_%d.............co..0.n.L.Q..E.Lt..y.|..F..4.i(>.._..\.eNL8..?z9I:hLgC.@.p....g.t......'.I!d..?1f..R..........|..4.wJ*..%g..~0bt.....*...v.......O...:.~.>~..o.x...9.@>...s.&.E.0/G.c..t.<..F.t.A.z. ......;.........Gp.P

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000041.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.468149180538293
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:EPssc1icL8bwDs3y+t5EfEWn0qlBXsp9zoo9rdqr25aiYRXz2W49WDxWc3ukW9WD:EPsFL8bwQ3y+72ESXQ9zosRy28iY7P
                                                                                                                                                                                    MD5:29EE043A320CAB2A63299A11F700A95A
                                                                                                                                                                                    SHA1:F8FDAF2DB178FBDCB76D49D36DE6D85E56D05A10
                                                                                                                                                                                    SHA-256:ED4C4B585E93F26351A986142EB3D3A26AB418D02D032E29722AA0202FCF38E5
                                                                                                                                                                                    SHA-512:34E19220F031A311D45C4516810E74A31690391462C20F1B7CF142C9ED7E98ADA17B7B6D7F7AB5DA9636DCDB70054F3B67496613B6B31E90825170592A850D30
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......p...v...d.....................................................?....?........................................................................2...>...L.......v...............................................'..?...D.I.......I.qk..B.....LZ........'..?...D.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............e.+...".ns;=......N...^...............s.U..@.M..8.nAfH........f................................... ....I.qk..B.....LZ..............e.+...".ns;=............e.+...".ns;=..........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4........................#...............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000042.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):40884
                                                                                                                                                                                    Entropy (8bit):7.545929039957292
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:MCBOA4d+ElOXJ/3pI7cRBiL7L6qERqGz65WXzZqJsKQSbIsTT6XB:hIAU+2cGdLX6qBG4WDZl4Ihx
                                                                                                                                                                                    MD5:7379775A1E2AB7FAB95CFFCE01AE05F3
                                                                                                                                                                                    SHA1:3D3DDFD8AC7E07203561BAE423D66F0806833AB3
                                                                                                                                                                                    SHA-256:9301DB6D2D87282FCEE450189AEACE16D85F64273BF62713A3044992B6B7A9E9
                                                                                                                                                                                    SHA-512:4B5006E620E80D3A146944649CF4CA619782CAD7E8C4CD0D1DE0EBCA0FA05EACB7378DAFCEED3E26F5698B07F19604614D906C8F51F898660E2F129D8DEC6F62
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1A.....Qaq....".....2....BR#S..br...3T...C$.7(Hx....4D.G..Xh.cs..'..t...%...8.....................1...!AQ..a...q"2.4Tt.......R3S....Br...#s...Uu.bc.de..$D..6..C%E..............?...z...;sB.yv...........]t.\...n...../....m....M.=.3G+..x+.....S).*&.J../..8..O/+..sG...p...<!....~.c..C.w..,[oHom.wc-.J.~.......L[..6...'..i_..S;...!Y.z.q].EK..M.x...i.x.+.;.+...}....#......f.)........e6V..p.;........s.)..Ml.J......IU.6...<9+9.^..l..Y...[._...2..^..j.ia...._..3.;...~..<3...;......z.^.......]..Qk.,...Yk...3.3Jy^p.}....q...I...&..t.......;..9.g.GH;..'...%...)..[..y..../...zCn..>...'...1e.Y..;....]..7...N>t..m-.j.............H^..T\.q.ru...}...eTn]I'r.^].#..wOY....v

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000043.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.328351458280037
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:Ylu8snjHNW2uqcmEa+DXHw9bJfERyr4IU:WsjHNW2ubDfDXHw9b1ERyMI
                                                                                                                                                                                    MD5:1824458046A999E4C017DC794D9BC321
                                                                                                                                                                                    SHA1:460A1AE1DF1113740594B240D0D45105BA763A54
                                                                                                                                                                                    SHA-256:CD588DAC6B0E3A1D1544F41A2ED7BF786ACF8A0C453D8E022D3D15368F197832
                                                                                                                                                                                    SHA-512:581A9D56FDBB0A202FD0585933EF433796213579419FA317A81AA03DF20DC50CFC9D031E10E2174AA82B9B17156FAE1CC41CC1A35ADD8C81830B85071A9486F2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ.d......d..[..3...V....d..[..3...V....d..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............bie......$r.eV.4....N...^.................p...!J...S.q..........f........................................I.qk..B.....LZ............bie......$r.eV.4........bie......$r.eV.4..........d......d......d..........................................dj.....dT.]...d......d..B...dH.....d..B...d..>.).d..J...................;........4...4...4.."...............d..d..d..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4..........d......d....#.d............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000044.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:05:55], progressive, precision 8, 612x618, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):68633
                                                                                                                                                                                    Entropy (8bit):7.709776384921022
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:tapXpSTJDOkFGdJdBk/slsbfsw1imaapnbvD8:U2OjJr6b07m1bvD8
                                                                                                                                                                                    MD5:41241EE59AB7BC9EB34784E3BCE31CB4
                                                                                                                                                                                    SHA1:98680761A51E9199CF3C89F68B5309FBEC7EE3CB
                                                                                                                                                                                    SHA-256:035B26DF61855A3F36DBD30FDAB0C157C04C9E8AE2197EA4D4AEB3E82E6A4C2B
                                                                                                                                                                                    SHA-512:3EE331D5BCEE4AD5D3FC9661D4AB4053F7D351591A094334F963C33C9D0E32CCCABE9334AD7C308108CE99617E064FE848DCD469ACD8D83FBE5C4452DE523D8F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:05:55.............................d...........j...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?../$.W:SZ./...9.....-...u......r.....].c...@W_.7...+......v.+PD.I..-<1.pDn-\.....p.$....0.}V....\..>.~..XN.o..l(E....ik..o.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000045.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.427279459888687
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:56BsVc/8/yy0QtEwCyPEg3LaCJvevf1XrY9/DoZrdqr2NmRXI55sY8taoFp:56sv0QHEg3lmX1Xc9/DYRy3y8I0
                                                                                                                                                                                    MD5:8B5C3365A0187F8ECF010D2B0756B81A
                                                                                                                                                                                    SHA1:932E3D04B6DBA3B7D2AE4FEA2F4517BAFADDB683
                                                                                                                                                                                    SHA-256:24EA6F49A717F91DC73D99CC19DD9B4243839C90493C3610FFB1A30642FE7F7A
                                                                                                                                                                                    SHA-512:E477DA27731478ABD4393A122999111A89C398EB5414DE018CEC2A8C1F3452B73A0D3C92CAEBD857303961E1E04A4C4BFAB92E8D755BC0F98E4C76C4E809719E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......t...v...h...................................................................................................................................2...>...P.......v................................I.......I.qk..B.....LZdIS.....dIS..dO..L....dIS..dO..L....dIS..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............i!$....-F0+.:;.....N...^..................;..dD..._S.e.........f...................................$....I.qk..B.....LZ............i!$....-F0+.:;.........i!$....-F0+.:;..........dIS.....dIS.....dIS.........................................dISj....dIST.]..dIS.....dIS..B..dISH....dIS..B..dIS..>.)dIS..J...................;........4...4...4.."..............dIS.dIS.dIS..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........dIS.....dIS....#dIS............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000046.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 176 x 513, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):11043
                                                                                                                                                                                    Entropy (8bit):7.96811228801767
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:YyroOCsBI9pkCFsHHX2RE6VOlPuIqmBtJNBfAr+ADP1IATaNeTyZ4GF+WQQ6Qwq2:BUOCsB2kCGH32RiPDtDBfArPDP1I/eyM
                                                                                                                                                                                    MD5:8E9AB9C28B155A66BC5C0DA5E2A4EFB5
                                                                                                                                                                                    SHA1:972E61F162D48F1CEE21963ECBB2FE439105DB55
                                                                                                                                                                                    SHA-256:B243A24FA13BC8523450E22F408F9EFF15301C938F8CA52A57018B58CE6785DE
                                                                                                                                                                                    SHA-512:12062D69E676B3B34AFCEF25AC17B40294282D5BAB6C0110680293D7CC96EC17EBCFE104C284E64A30EE3C483E319E9C37C03F6EE82C79632180E45C7A684E8C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR..............`....`PLTE............................................................................................... .......bKGD....H....cmPPJCmp0712....H.s...*YIDATx^.]...,.N.8.i......0..e..y.......8.6....Fo.........=...F..._..........O..{..............3.|.L.|.............>.....v..n.1J...k...."....7........J._.5LQ`..k...._Z.W.x:..k...g..._.....u<.Q{...1...q6.cs...l............30.g...< W...a.5..>O....9}..c..........s|I.).>.fo4.<q......>...c.:.u..co.#.7,.O..G./.K.|..q.p...(.(....iH.......m..+.7...../..{W.l....b....?.`^.q.9L&.>.hN2`1..m...]$.0J....rBy......{.._...G....;.r.Q..;..,...9..F...t;.+..2.Ub......V...8.k..5.........'[..s.H..).......%j._.&.....BN..V..q...T...#..........0.E&.o7....$..m..8g.f._$..k.8...5......HgQ...L..\.........)B.I.r.(..8.a..$N.9.=..o..Q..(.e.a..O.....c.= .......$0..X.S,..(p......$..l.c.I...=."......g....^..#~,&.a9iK..ZNE`...pFJ.@Wd?.<..Bt.E.......e...i.%d...}.!..B......9.........B}.....5...;..hL.D.....4z.....|.)

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000047.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.354245514473734
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:3bssw33qEiNqTt4v/wEQL4MXTM9iqjxoFrdqrG+KBbUhRXoE9Btx:os4viNqT2nwEQcMXTM9iqlkRywCh
                                                                                                                                                                                    MD5:5B5CCA57A8D1F97AAC11824C0D8E361A
                                                                                                                                                                                    SHA1:76D0E84173CB6BF984263C2FDB4BBDEE030FC1ED
                                                                                                                                                                                    SHA-256:A75FF6F922280F5B6C415E588C8016A59B7F1ECA086A2FE7E98C5F8CC926ACA7
                                                                                                                                                                                    SHA-512:D6F167B20CB2FD6146CAA576DB17FC9257F248DCF2614BA783069581CF7F4CE1E43ED6AF1C64923F7BF0B8AFDAFE14E9758D5D721F2B1A30D6876B6400A917E6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ../......./...]...2.^.Y.../...]...2.^.Y.../..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............h.E+.".....>.S1^....N...^.................u|[D.O.......T........f........................................I.qk..B.....LZ............h.E+.".....>.S1^........h.E+.".....>.S1^.........../......./......./.........................................../j....../T.]..../......./..B..../H....../..B..../..>.)../..J...................;........4...4...4.."................/.../.../..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........../......./....#../............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000048.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 40 x 650, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):647
                                                                                                                                                                                    Entropy (8bit):6.854433034679255
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:6v/71rwqZMXVs99W1YvpLp/Fvl+f43ocLtuplb+CrGotLRd:+wqWXVs99rpLpNvr3pIx3b
                                                                                                                                                                                    MD5:DD876AA103BEC3AC83C769D768AD39FB
                                                                                                                                                                                    SHA1:1833603AA9B6A7E53F9AD8A336F96CCE33088234
                                                                                                                                                                                    SHA-256:1262DD23AD54E935CFA10FEB1BE56648E43BEF1116696CA71D87E6E033B1CA7D
                                                                                                                                                                                    SHA-512:946DB2277213104A3B29EC4388578B05027B974A3093B4CCAD8847397AA51AE308BC6A199E5705E1F901D6E4B1BA34D8DECFD6E5B6685184A307D749D7CFAEDD
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...(.........xk....`PLTE.........................................................................................>.S.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.)..1..7w....6.*.H`T6.ha.k.............b!....Ba..C..P.4K..@.....h.E..X....PX+.P.-.....@@"...o.O4....xZ<...B...B..,A..y.s<......b!....Ba..C..0_p. .......=..,...i. ...=.j..N...........{4+...xZ<...B....|.....$.K<.vyE..X....PX+.P.-.:... .'p......\,...i. ...=.j........K.....%J..S+.....q..k.H.@DD.s...:..J.K.DDL.\.@`,.DD.:.(]..N....KD....A M.....F..S+.....1.sq........\.t..;..../...~k...4.DD.:..]..N....KD........@DD.s...:..J.K..[...Q....V......IEND.B`.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000049.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.367157037777987
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:asoQ/JH50O2+CtMpLMMEjFLOXsLw9D5oVrdqrKUQBCug2RXEE2HkutysytAg:asf05+CyREjF6X2w9D5kRyKsuHrA
                                                                                                                                                                                    MD5:35EF6E3C5D4CF257A59188B6620DF609
                                                                                                                                                                                    SHA1:4441013203283EF51908FBB45FE75D92B473CE52
                                                                                                                                                                                    SHA-256:9C4920B5993CFD48F272A5B71C103F89BAABF95FE1A7B687009453E0663A87E4
                                                                                                                                                                                    SHA-512:8D56880865EEAEA323633C080E3F968BDBC39878CA18E411A9BDE819C4E267ED020533B4DF09D0D97523F35FBEC6800F802381E78B5D9BA3158E54E597A1F746
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ..8.......8..'. ..~.....8..'. ..~.....8..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............uB.,.?.]\......N...^................NZ.[.OC..V...7G........f........................................I.qk..B.....LZ..............uB.,.?.]\............uB.,.?.]\.............8.......8.......8...........................................8j......8T.]....8.......8..B....8H......8..B....8..>.)..8..J...................;........4...4...4.."................8...8...8..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4...........8.......8....#..8............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004A.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:27:10], progressive, precision 8, 102x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):52912
                                                                                                                                                                                    Entropy (8bit):7.679147474806877
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:DB/nIviNJD9C8kfJj6TkVr4q24FsUpjPc021si:DdnIvi3D9C8Cl6Dq24ayPCz
                                                                                                                                                                                    MD5:1122BF4C2A42B4FA7F29D3C94954A7C9
                                                                                                                                                                                    SHA1:3750077A830FE21735A43ABD35C63BA9A4D4B0DE
                                                                                                                                                                                    SHA-256:423B0DD1A93B391D15B1DC8D8757C3BF5725FF2E7A59E6E3140033E2876B67F6
                                                                                                                                                                                    SHA-512:4626EFE2EDED2361D6296B57F994DC434CC9D02357A8A6A67D84A544FB8A1CFE0005EA98F846AB963BED7F2B6CE96BC9181182C9459843A52A98D3A731A4FE73
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:27:10............................f.........................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....]+\.9.9.P.d..Z.?~>.-...]6=....*.......S.9G...b<$..Z..........>.v.o:.o%.e...z.F`...[.wo..z.....k..E...5....G..7.......c2..

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004B.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.336696124902262
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:isHa/aAavGGc/EkgKXCAkK9bJ0RyLr70vaAacPahazjaO:isH+N0GTskgKXfkK9bJ0RyLr4vNhkOj
                                                                                                                                                                                    MD5:48046444EA87660CD4382EB9B392925F
                                                                                                                                                                                    SHA1:587F99E671DBBD844C6FBD871089C9AD2B9E2B2E
                                                                                                                                                                                    SHA-256:313388591133F63F13E641E1831FDB0C356888523304BDFCFCC7F910F35F674F
                                                                                                                                                                                    SHA-512:1EBE5D1F8ADE6893C2E39175FDFE0FDA181B50FF101EDA1226732C48BAA03606265F05E1DE1D10204B7C576FCAAAB9269DC20F71188A181550A7BBD00A6D0917
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.*.......*..Rc....6.QH%.*..Rc....6.QH%.*...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................G..D...7.%.8^....N...^..................CtNI.zc.+-!.........f........................................I.qk..B.....LZ...............G..D...7.%.8^...........G..D...7.%.8^..........*.......*.......*...........................................*.j.....*.T.]...*.......*...B...*.H.....*...B...*...>.).*...J...................;........4...4...4.."...............*...*...*...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4..........*.......*.....#.*.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004C.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:18:09], progressive, precision 8, 164x641, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):27862
                                                                                                                                                                                    Entropy (8bit):7.238903610770013
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:LTawAZvhbrXzDc6LERLQ/b5vXOl6pXQ/wD5OUMrdRUUhCplQg0ESSz:6wm/vT/b4wxoqbdUhWnSs
                                                                                                                                                                                    MD5:E62F2908FA5F7189ED8EEBD413928DEE
                                                                                                                                                                                    SHA1:CA249B4A70924B73BDA52972E9C735AEC35A0C5D
                                                                                                                                                                                    SHA-256:20ABE389C885E42B6EBE9E902976229BB6FD63C8C34CB61AA70B8B746209F90A
                                                                                                                                                                                    SHA-512:EE8D1821A918BE8714F431895E7223D08036E88A4FDB9A5485EFF246640EE969A69A8AA4E2E9DDC35BA75FB6D4E95092A286E90B477BD6998C313639C2C31F25
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:18:09......................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................!.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..P.v..+..n(a..Q..S\6....Y....D......} w#.b..]l.5.RU..k...... ]$.$.........f........?.z@2uU...7....?..|.Q..I.&.. ......"T4)wdH.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004D.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.488970049303086
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:usDkqh0E3sTuLMjMtRqE5zQWXr9Jw8/oVrdqruGG7RXmTLWNf3vn5:usBaoMIWE5cWXr9H/MRyAWcn
                                                                                                                                                                                    MD5:62E97E0FA2D18E4945E6B997DA9FAB12
                                                                                                                                                                                    SHA1:ADD39E107D6097F4804555496CB3CAF5066D4DC6
                                                                                                                                                                                    SHA-256:61FC753D6CD80102977D9488FE4E315E755B76D41A9893050C5C15C65DD3006C
                                                                                                                                                                                    SHA-512:013FFBE9F89965CD3A65E1863BD32DE7BF07CA9A85D13D258BDCC2A49C0FF501AD7C12F32AAF469E61D34B0A3B8949351C648A567AC2B96DB2EBCF2B3137AA6B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......r...v...f...................................................................................................................................2...>...N.......v................................I.......I.qk..B.....LZ."L......"L..K.."g3.. .G."L..K.."g3.. .G."L..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............~...{.....G).i....N...^...............w^!.$.rJ...$C%........f..................................."....I.qk..B.....LZ.............~...{.....G).i.........~...{.....G).i.........."L......"L......"L.........................................."Lj....."LT.]..."L......"L..B..."LH....."L..B..."L..>.)."L..J...................;........4...4...4.."..............."L.."L.."L..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........."L......"L....#."L............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004E.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 50 x 556, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):977
                                                                                                                                                                                    Entropy (8bit):7.231269197132181
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:6v/7QiFJaY/z+obuqFA4fypjQSbtBK+lcqNGSbb7XTJArRRzN5DjNRkPmu5cCbR2:x0QY7xbjy9pY0JPXLTWroeuCCbX0
                                                                                                                                                                                    MD5:B7F74C18002A81A578A4EE60C407A8D3
                                                                                                                                                                                    SHA1:70A7D4BB1B3ADF4397D168AD0D81B286F88EBDE0
                                                                                                                                                                                    SHA-256:95F59A0433050180D4C0E8858B83363D51BEA6752A8B7CA516A8677854D8F5B6
                                                                                                                                                                                    SHA-512:13186A7CDCE80BCA9D2238666D6D7A989FA1887EABFA5D8A9A63EEC304DFD4BE8EFF652205FA56E1D1CEE7D3680AF8C70A952AF73AB3C246400E8D4EBECBDBA9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...2...,........A....PLTE...................................................................................................................................................................................$.y.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^...0.D_.......cck.....%a...X.a0Y...-..!.G...[....(.r.H.$...1 .zq.4V.e|a.6.X..4..kl.%....=w....6..TN.....{.4..T/.z...../.....3..!~..t.#b..^.....E!.SFb ...-.....^...,..C.!.b...i._c...s.X.w.. lsQH..H.gKc@@...i. ....m...;Ci....@G.; V{..lO..\.R9e$..{.....P...E.+.2.0D.B,..P...56.?......K.6..TN....^z.4..T/.z...../.....3..!~..t.]b........E!.SFb ...-.....^...,..C.!.b...i._c..Y.O...?.9k2.M.?5 .n.P...,...d._..%M?....6....,.1..R.4.a.R.+..U.Q..P...vd..T........j .]@....."..lJ../.90.4...Y. ...9.%...{......Hc%.....i..%M?aG..H....o.q.......4.......X.d9.r..CI.O.5.Ri0?.s\b....w...>/k..4V.)Y....P...vd..T........j .]@....."..lJ../.90..2..MP..l..?....K.X.....IEND.B`.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004F.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.3160422056811765
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:ws1BWFvUfWE3TBXI9z8sRyMILCqt6DCA2V:ws1evEjBXI9z8sRyMILC26DCRV
                                                                                                                                                                                    MD5:83847C399D93BB2F9384E4339D319EF2
                                                                                                                                                                                    SHA1:7648D742F2AD72DB290BFB1E145031F6B70D3BB5
                                                                                                                                                                                    SHA-256:A8E803CE092466352F05D31CC9FEA695AFC40F28FC6A97FB241D16453B9282B4
                                                                                                                                                                                    SHA-512:6D95DCCFCD6D8CEEDDE7D5F624A6BEF1A9570035F49C5315F39A45EA9145C6046B6FD94ABD3DCF5D48F7FF43E65A2C24A840F8B985247472C42F2EFC8249F699
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z.........................../6....../6..Z.F..........I.......I.qk..B.....LZ/6..Z.F........./6...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................-n..&:.".......N...^...............r....jzB..#.`RI.........f........................................I.qk..B.....LZ.................-n..&:."................-n..&:."............/6....../6....../6........................................../6.j..../6.T.]../6....../6...B../6.H..../6...B../6...>.)/6...J...................;........4...4...4.."............../6../6../6...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4........./6....../6.....#/6.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004G.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):34299
                                                                                                                                                                                    Entropy (8bit):7.247541176493898
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:BrSX4V3P8AIc4KLkHeXRUer0zrhOmXfvG0yH82I:tSXuIc4K2eBtswKsHg
                                                                                                                                                                                    MD5:E9C52A7381075E4EBC59296F96C79399
                                                                                                                                                                                    SHA1:BE295AD24D46E2420D7163642B658BF3234A27EA
                                                                                                                                                                                    SHA-256:D56CEFE9EE2FAE72E31BDBA7DD2AA4426EA22E3CEB22EF68C8F63F9F24D5A8BC
                                                                                                                                                                                    SHA-512:95CC96DD4459EBAE623176033BA204CCDC50681A768F8CBAE94C16927D140224E49D5197CAE669C83C77010C5C04C1346CF126BEF49DB686F636C5480342A77F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.......................................................................................!.1..A..Qaq......".#4.2r3.$.%...B.5U&6....Rb.Cs.7..cDTEFVf'...S..dtevw.u.........Gg.....................!1..AQ.aq.2....."#3.4....r..BRb$CS.D............?..5..............#....v.q.m.}\..{....;...r....h.....J..q|..'.;\..6..v......e...../.k..|.8..i..|..]..3e.m....n..Z.GS..n".y..w.-...[a...7A.....i.4.)9\..~C...=.........s..\V]c.D1<./.g.l.&v..~.h..]....zb>G..y:vNS.\......LU....t.{*..Z#.?..v-...wn.rR...P.....y\=.v....../..9_...m4...V.|.+.o.#.......xj....}..>.s.>C...m.[;.>.p...=^.i.X.(..1...{.F#N.W...xi.z...4..u[{...yO.....8..}\..2...KlX.nbya...2.&.F...R.b.k.7.GV.x.h.y\.Q..O<\>......-...=...r......\......Z.Z...Jf.'....z..Y.q>.p....o..K....h..R..c.lg?......A.Z...Y.q3.L|.'5...

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004H.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.345866528987482
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:+sVWc4EvthJhEZEHSFLjXpaJi973o7BrdqrnyEJQRXGzuWd8tPO9:+s54Ev76EyFPXgQ973uBRyzyL2uPO
                                                                                                                                                                                    MD5:01D643A818204117C747E799801A183C
                                                                                                                                                                                    SHA1:74EAC5D4A281EA784C21559F4D2AD6EAB7C2DCC4
                                                                                                                                                                                    SHA-256:9856D41F661699EC9F96244724814DCD560B8B6A4C47BC22D23FABD23078A023
                                                                                                                                                                                    SHA-512:DCDCE8F70E3FCB1989FA9258EF2DC18ED5FB2DFEDF50814A415D78256BE57C30E855F5225A4291D9BF675FE53C8B33815FF20C7D04B6B43BC1B1ECF5CE429255
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ...........3>...-(.O......3>...-(.O........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............57m...%Wl........N...^................e...M...J............f........................................I.qk..B.....LZ..............57m...%Wl..............57m...%Wl............................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4........................#...............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004I.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 171 x 552, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):10056
                                                                                                                                                                                    Entropy (8bit):7.956064700093514
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:edmu1fpj5DVHuooK4EpGLbAdT+dBXYBR8D1V2p6KwoPR6KUX9ojwRpgA:2Pp/B4LbAF+dBo/1E3S6JScpgA
                                                                                                                                                                                    MD5:E1B57A8851177DD25DC05B50B904656A
                                                                                                                                                                                    SHA1:96D2E31A325322F2720722973814D2CAED23D546
                                                                                                                                                                                    SHA-256:2035407A0540E1C4F7934DB08BA4ADD750FCB9A62863DDD9553E7871C81A99E3
                                                                                                                                                                                    SHA-512:BC7DC1201884E6DAFDC1F9D8E32656BFAEE0BB4905835E09B65299FE2D7C064B27EAA10B531F9BECF970C986E89A5FD8A0B83F508BBA34EB4E38B3F7F5FC623A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR.......(.....!..t....PLTE.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................4.....bKGD....H....cmPPJCmp0712....H.s...#.IDATx^.w`......$..B....... ....fz5..6`l\.8...Nsz{.//y./....{.7}g.....e.....~.......s...f.....%c...6....O.PJ...Y.oi...9..'j.2..6.-

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004J.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.283041707467262
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:ilbsY9O21NLz2EtJTEXh2aLnXzj9zsoprdqrQpBPuRXrILWwj7xkwLOlGi:ilbsOz2EXEfrXX9zsQRyQpB2g6
                                                                                                                                                                                    MD5:AA3F57502746DEEC56AFE942517A0E39
                                                                                                                                                                                    SHA1:DA8F5261238C95439FA94EF55C6B8F7281D86A50
                                                                                                                                                                                    SHA-256:F5834C6494AD50633D41096825CB835355A723310D069100BFE8E06F698D1521
                                                                                                                                                                                    SHA-512:1ACD2F4FB32399F951BBC041B842ED2661115D565A6D1878D5921C0387F77940A6E81183769CFB592D6C64F5F198BA2F8CEA6B9F065E7E22632BA2AF3B296FEF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.UR......UR.....;ef....;.UR.....;ef....;.UR..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............'_V.p...:.J.........N...^...............ng..BP\@..qq.A..........f........................................I.qk..B.....LZ............'_V.p...:.J.............'_V.p...:.J...............UR......UR......UR..........................................URj.....URT.]...UR......UR..B...URH.....UR..B...UR..>.).UR..J...................;........4...4...4.."...............UR..UR..UR..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4..........UR......UR....#.UR............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004K.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:11:38], progressive, precision 8, 577x757, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):84097
                                                                                                                                                                                    Entropy (8bit):7.78862495530604
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:cgHTEuD99rHwA5MSadIV2MApVmfJkAKOQ/Z1I7ngpDDyHfKFVITrU:HHjXidIhApV88/jIEmrU
                                                                                                                                                                                    MD5:37EED97290E8ECB46A576C84F0810568
                                                                                                                                                                                    SHA1:18D9FACB4CFA3CBF63B882CABCF30B203EDF4126
                                                                                                                                                                                    SHA-256:140DD943D0F0CFE6AAA98470B7D1A7CB62CA02CB1D8F522DD2AC77433232EF41
                                                                                                                                                                                    SHA-512:E0F57314C136211B8253EB2AC0093DED82198E7170D4F97C40D82FD4EC4123D2AAFE3EB4EBC3E7523C4DF4D77619408773871BDE15B6DC6C4049C71D5B9D4222
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....hExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:11:38.............................A.......................................................&.(.................................2.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................z.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....b.xH......T..I...S.q.~..../s.R.x.....8.a..vE.5...-.G.A.4...._......$K..d.@NC.q....J.....>e".I.%...I0).R.I$........M3.F .

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004L.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.327288474398738
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:BBDnsOo3xjEOyvwtgStKI5EMxLXim9LooVrdqrdGWSRXzv8RDHlv:BBDnsrxjEbvw2I5EEXv9LoERyom
                                                                                                                                                                                    MD5:F79473BD2523BC20490CC52B7BFCE947
                                                                                                                                                                                    SHA1:40916C2C3410EEC67479E9B67A1142D023E83247
                                                                                                                                                                                    SHA-256:8E262AF29F9CE9F4447E7CFF6C3EA75FDBEEE21555D299969BF1C772B82ACA7C
                                                                                                                                                                                    SHA-512:B1CE8021196B98AA8CD1A104DA7E0C15FD11D28BE3CF03ABC14324A8DEBDCB6875144E99F14BA3BC07155687C339DE0CFFA9D56CAE398B62C695C8497C734BC4
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......L...v...@...................................................................................................................................2...>...(.......v...t............................I.......I.qk..B.....LZ.v.......v.U"t........D.v.U"t........D.v...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............9b.Uk&.....e.].....N...^...............4.r...B..\...........f........................................I.qk..B.....LZ............9b.Uk&.....e.].........9b.Uk&.....e.]...........v.......v.......v...........................................v.j.....v.T.]...v.......v...B...v.H.....v...B...v...>.).v...J...................;........4...4...4.."...............v...v...v...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4..........v.......v.....#.v.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004M.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:26:15], progressive, precision 8, 216x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):64118
                                                                                                                                                                                    Entropy (8bit):7.742974333356952
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:ORG4azGOKXzkEmR4bdRSbxONOoz0khbSb4J/5GZK5SWUlRwUYdv1M:ZXzGXzJdhRmgHfIb4J/5GZK5SWUldYdq
                                                                                                                                                                                    MD5:864EEA0336F8628AE4A1ED46D4406807
                                                                                                                                                                                    SHA1:CFCD7A751DFDBE52A20C03EE0C60FDFFA7A45B93
                                                                                                                                                                                    SHA-256:7CE10D1EA660D2F9CF8B704F3FAB2966A4CE2627D9858D32C75D857095012098
                                                                                                                                                                                    SHA-512:0CAA0C54C14571C279A75F0D5922F78A17803CF6EE1724D66819F7F5944C0F5B25CB586BB686A52808CDF2F8FEB3E4864052A914884054EF7DE44124A8CA951E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:26:15.....................................................................................(.....................&...........s.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................#.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....NC+n....<.=.7..&.8A56..@^.Q..\\...E.>..".&G.......J .'....$.I)........0.../..mv...D....<v0=..ugc+..l.o...=.c.......x.&D..{`8...v

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004N.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.344334150083745
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:GsTyI7q2dkNllEXX+alh9b54wRyvyR2dIfC3dHf:GsTyI7q2dylyXXLlh9b54wRyKR2dIfC9
                                                                                                                                                                                    MD5:14DDACF6EE473B9AD3292A9824E63331
                                                                                                                                                                                    SHA1:4C26284A29A1766FBF68CE9AB3D01DF377F396F2
                                                                                                                                                                                    SHA-256:616C3D434C252FA0E8CD6BF2BD2DF1369CAAC30A3FEB144B8CF12313CFEE3E0E
                                                                                                                                                                                    SHA-512:3262DEEDD18DE51C82163B04C1A8492A49224FB7951044940672A4A30F188BBFDE3CF8AE79767B1AB8CA535940C6E7FF732259E8C9E0BC3CA5073E014C78AB98
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZns......ns..Gr...a:.k...ns..Gr...a:.k...ns...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............5.iR....(.....yt....N...^................f....=I..>g!W..........f........................................I.qk..B.....LZ............5.iR....(.....yt........5.iR....(.....yt.........ns......ns......ns..........................................ns.j....ns.T.]..ns......ns...B..ns.H....ns...B..ns...>.)ns...J...................;........4...4...4.."..............ns..ns..ns...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........ns......ns.....#ns.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004O.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:09:29], progressive, precision 8, 609x675, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):65998
                                                                                                                                                                                    Entropy (8bit):7.671031449942883
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:klZtmExaFrtWgpc+Sg+DKeplHClpHfRtPMbe:VEWWl+SNDKqlH8p/vse
                                                                                                                                                                                    MD5:B4F0A040890EE6F61EF8D9E094893C9C
                                                                                                                                                                                    SHA1:303BCBA1D777B03BFD99CC01A48E0BB493C93E04
                                                                                                                                                                                    SHA-256:1F81DDE3B42F23F0666D92EBF14D62893B31B39D72C07AEE070EAE28C2E6980E
                                                                                                                                                                                    SHA-512:8F07E4D519F2FD001006BB34F7F8274B9AF9EC55367B88D41D24E5824FCE4354FD1290CE4735E43930829702ED53F41DF02C673904A7091E9354C28E029AD4EF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:09:29.............................a.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..-O..s(...gO..@...[..+....+...H.'m........L.......@.......[k...S..O..p.'{X..3......]W..w.+.V....[.-.....2..i..i$.p.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004P.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8192
                                                                                                                                                                                    Entropy (8bit):3.2505395761033795
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:uBsJ1Q0lCeJ+WEcwqPXjmS97zqaQR07bqOxuS0dEnu4lyB:+sE0lnIc1XjmS971QR07piS
                                                                                                                                                                                    MD5:2A6C7EC5DBADB390A3D62796E226632A
                                                                                                                                                                                    SHA1:77E3407FD837BF6EE7493DEB52E932CD8EC9AD9D
                                                                                                                                                                                    SHA-256:81F13B77CFEB9A02A3ABDEA07FF08832597DD469FD16DB23DD0FAF7FF2198C95
                                                                                                                                                                                    SHA-512:0A0C1EE61B0F677541955AFDDC37BA31E3D406E12A0D2A1D86BAB72C856D4E6B416F5017C073E8E35FE74DB2FC224924EC2486866D65334411F7EDA9A8EED43E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>...........v.......................................................................................................................................2...>...j.......v...............................9.......9...m...c......I.......I.qk..B.....LZ9...m...c.....9....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............d..................N...^..................e...N....U..........&...................................>....I.qk..B.....LZ.............d.......................d.......................9.......9.......9...........................................9..j....9..T.a..9.......9....D..9..H....9....N..9....?.#9....9...................;........4...4...4.."..............9...9...9....z...y.. x.. ...........$........4...*..7*..7...........Op.b..F.$..i.................;........4...4...4.........9.......9......#9..............................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004Q.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):32656
                                                                                                                                                                                    Entropy (8bit):3.9517299510231485
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                                                                                                                                                                                    MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                                                                                                                                                                                    SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                                                                                                                                                                                    SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                                                                                                                                                                                    SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004R.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12824
                                                                                                                                                                                    Entropy (8bit):7.974776104184905
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                                                                                                                                                                                    MD5:2628353534C5AD86CBFE57B6616D46DD
                                                                                                                                                                                    SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                                                                                                                                                                                    SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                                                                                                                                                                                    SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004S.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):32656
                                                                                                                                                                                    Entropy (8bit):3.9517299510231485
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                                                                                                                                                                                    MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                                                                                                                                                                                    SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                                                                                                                                                                                    SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                                                                                                                                                                                    SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004T.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12824
                                                                                                                                                                                    Entropy (8bit):7.974776104184905
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                                                                                                                                                                                    MD5:2628353534C5AD86CBFE57B6616D46DD
                                                                                                                                                                                    SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                                                                                                                                                                                    SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                                                                                                                                                                                    SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004U.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):32656
                                                                                                                                                                                    Entropy (8bit):3.9517299510231485
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                                                                                                                                                                                    MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                                                                                                                                                                                    SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                                                                                                                                                                                    SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                                                                                                                                                                                    SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004V.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12824
                                                                                                                                                                                    Entropy (8bit):7.974776104184905
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                                                                                                                                                                                    MD5:2628353534C5AD86CBFE57B6616D46DD
                                                                                                                                                                                    SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                                                                                                                                                                                    SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                                                                                                                                                                                    SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000050.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.355522107182247
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:Yu6sbg+Mi6Uwtg+8mEya7SXx9zmjd5rd3rtxPFWRXWTBDBpPJt:YNst6UwKWEya+Xx9zmbRbNWMLJ
                                                                                                                                                                                    MD5:FDC0296D2718DCE2596CAEE140701694
                                                                                                                                                                                    SHA1:6450ECCAA114EBE44809D70567F0A64D931C6FCE
                                                                                                                                                                                    SHA-256:0C63C08C2EF14573A10568F30550FFC4D4E9179749E4A58704215211F7B0239B
                                                                                                                                                                                    SHA-512:4820287AB3F5C9030EA8C133B2A480DC903547AAA105252E1031C21D281606A3CD74BEB4779F374CD0C9D1DFFF9BFC9DD238015119386F4522714B6130B8ED5C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ..9.......9K]oy......~s..9K]oy......~s..9..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...................K..O.....D....N...^.................c...{N._..'.A.........f........................................I.qk..B.....LZ..................K..O.....D..............K..O.....D...........9.......9.......9...........................................9j......9T.]....9.......9..B....9H......9..B....9..>.)..9..J...................;........4...4...4.."................9...9...9..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4...........9.......9....#..9............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000051.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):39010
                                                                                                                                                                                    Entropy (8bit):7.362726513389497
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:6tCjwO+E+KW0ZtOgepcoWW4pAWQ6/KWcR474HOAZaDfK:68j+E+KW0HOgep/72/NKWcRNefK
                                                                                                                                                                                    MD5:9700DE02720CDB5A45EDE51F1A4647EC
                                                                                                                                                                                    SHA1:CF72A73E1181719B1CC45C2FE0A6B619081E115E
                                                                                                                                                                                    SHA-256:7E6A7714A69688D9FFDF16AA942B66064A0C77FCD9B3E469F89730B4B9290C3E
                                                                                                                                                                                    SHA-512:5438921467D62376472007B9EBF3C35C9D9FE3EDE04D99A990129332D53EBC8EE2555C0319A4F7C0DF63516F29CEDF2171D8B6DC34C9FCD075C2CA41EB728660
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!1..A...Qaq..".......2BR#...b%&6..'w.r.3f7W8.s5EUeF.g....CS$4.Vv..Tdt..G..(c..u.Hhx.......................!1.AQa..2.q....".s...3.4BRr.#......b.$c............?........uf.....t...;..[...W.h.....-.k.f..i.u..KQ..b.F...rM%/.8n.S..=9.....G$O;.f.}L..N..U._i.[.X...3.~....S.~..+t$...c.5......{..X/..#.G...}s....6......^....o~.$.\WA?...^*w[O.~..6..~....a....~..:..0.......{O...|.s.u._w.........i...........{K...._.?.../{.....A..8....<g.iu..<..................X......|]v....D..9.k.w.|-IF.Tv.-.&.........."'.4.b....z.._.Z.....G...u.xyt./_.q..m>..S.V.Xdc.bw.T.W......g..........}s.._..?....U]_.......`......>.|'.~xH....,...?........?.q....o../..R..;...Y.G....A"?......?.<..1...w..o.M.........tco.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000052.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.417187092538865
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:xsds812bvLqxoEN1XN4r9kk+jsRb/36iA81B1pHi:xsdsCqvLKV3XNG9kk+ARb/36iACB1pH
                                                                                                                                                                                    MD5:6C52B8C46DA975D0CF8B4202F233EC4D
                                                                                                                                                                                    SHA1:CB7AAE5BF416383415CFBC4AD66921119663F91B
                                                                                                                                                                                    SHA-256:D4D6CF859AA173B81549B438993BB28F705B44D2B846720BF91093389BBE65AD
                                                                                                                                                                                    SHA-512:B71BE7B4514B75989383A75DABEFB5424F6C33ED99851C69B2DA53883BBC98C025EAC8D1173A78A37849BEE1F39EB2EE7E984DF91BE4CE0B39CF148AC9DD50D6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......h...v...\...................................................................................................................................2...>...D.......v................................I.......I.qk..B.....LZV[......V[.(\X..h...E.`V[.(\X..h...E.`V[...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............SK....9..}.x.....N...^...............J]..I..E....V'VJ........f........................................I.qk..B.....LZ.............SK....9..}.x..........SK....9..}.x..........V[......V[......V[..........................................V[.j....V[.T.]..V[......V[..B..V[.H....V[...B..V[...>.)V[...J...................;........4...4...4.."..............V[..V[..V[...z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4.........V[......V[.....#V[.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000053.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):25622
                                                                                                                                                                                    Entropy (8bit):7.058784902089801
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:EhK81gTCyJ/Gf9Aw3t8w8EtdPeGDh6bEi1Ie1u4ZbvgwTwrSRh7ZKNpIGY:IjcRXwdJvtdGsUbEi1IeY8vgwTyC1+Y
                                                                                                                                                                                    MD5:F8CCFC24DEB1D991EBE085E1B2D7D9BF
                                                                                                                                                                                    SHA1:AF76C22A765434AEDA134924C517C84107F4FED5
                                                                                                                                                                                    SHA-256:7354001527AB554C44E7D6981B86DD933B7DC2E0D3DC8512AD3EECD843245C52
                                                                                                                                                                                    SHA-512:818BC3690B01B30BC571E4CF45EC8D1AFCAECBAB003532644381F1CF730A5B3486862D08F7579B2D3D89167AD7DF35028881245C9550B0DA23D1F81A720A9704
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!...1A.Qaq.........."2Rr.#.t6..B..3S$4..v.b..Cs.%5..8..cUV.(.DEe.&Ff...T.d.......................!.1A..Qaq...s4....2r..S"BR.3....b#C$.....c............?..D.."}:......&&...?3..W.q*.......]...m.Y.k1......K).J...uV.b.../.0.E.H..4..W_T.[t.V.w.9.x.qe.L..o.oL.....d.\.....6.|.o...}..H{Yn..E...6Y3.l.e..D.:,.n.%...t...m.........,+,..|..n.....6.*...f........6.../$../Vi..H...e.f.F.zn.).n.E..2sTn.i...Yb?6+H&...Bf..*....z.o.^7[..u.:o....t.s=.....(.s.....f.g....q9o.u1L.N...smzE..[>...+\O....j.<....j.c.W.............U..+.F/.'..W...T./W...>i01./....j.s."..Q...{...a._~OW...Rp.)*.e..W..Q4)<..'..W...q...'..U..z..g......U}...O....w....0F:.N..V.3W.|..'z0.]...j..U[v..g$D.Lc[.e...UW.m0+

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000054.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.329553671676991
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:YualXsP8CTLskftVke5EHGKVXkWcx9A+j49rd3rUMx6ndXCVlZ7pN:YJsHXskf15EmCXfo9A+YRbMY3
                                                                                                                                                                                    MD5:0EA3C0D6E1A506C42FF4CC95594D3371
                                                                                                                                                                                    SHA1:E0DAEF8BC2D7668CE851B138C40E6A0A4184A803
                                                                                                                                                                                    SHA-256:2304698C78D2515C4976BA219F7B3349552CD9AD032672623C3C56BDB049807B
                                                                                                                                                                                    SHA-512:2B07708AD4374A4A224FEB1B3135437B6B58ED401983BDDCD7EBEDBE9F78FBF3352237B13465099781D42DF85039037DC37AABDA0DCEDCC3651F924A8862B0AF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZs.......s...,y&..W.|..s...,y&..W.|..s....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'............._\.......}..H.......N...^................l;..B..".p.C.........f........................................I.qk..B.....LZ............_\.......}..H..........._\.......}..H............s.......s.......s...........................................s..j....s..T.]..s.......s....B..s..H....s....B..s....>.)s....J...................;........4...4...4.."..............s...s...s....z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4.........s.......s......#s..............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000055.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 50 x 500, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2033
                                                                                                                                                                                    Entropy (8bit):6.8741208714657
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:P37XYSDTz+UUl7DHt7Ah8l1+4ZfFclFUXwobKXlZr:v7j3z+UoDN0h8ugf2AwobMN
                                                                                                                                                                                    MD5:CA7D2BECCBC3741D73453DCF21D846E0
                                                                                                                                                                                    SHA1:E34B7788498E33FFF0CFB00125E6BA9E090F6CED
                                                                                                                                                                                    SHA-256:E9EAD0BFC09D32CB366010CDFEDE1C432A2D1D550CB7332BADAC1BEE9482BC86
                                                                                                                                                                                    SHA-512:7FE2C3654262B1EEBED4F6D83DA7D3450E1BE52500A3964185FC0092041506A237A2728E5D7EEA0A3814E413E822B803B789C49CF744D51816A2E4EDE5B4247B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...2.........H'......PLTE........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................[....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.\.W.G...=a.ewA..a.!r( ...%Dc..x.x....N.OO...3=...S...........~.z.D.0...g.2P.7.*M.#'....z.......3TPj.Z.[5....V..z'L3...a.j9..C>..9.z

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000056.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.331472004340808
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:zYTNsl/2LyKUxCtQExEkJLQXH94fj41rd3rgx7dX59Tfp7hh:Gs+yKUxCicE8MXH94foRb8T7h
                                                                                                                                                                                    MD5:BD7405FB3DDEC6D07FD0CBFE8E904AFE
                                                                                                                                                                                    SHA1:5B304E783C3EE7B0084B1C2728403C2E2F7695FB
                                                                                                                                                                                    SHA-256:8FF0BBE29B59C451FE0812703E1A5E68D5CD2EDA656578F90F6E110A68732DA0
                                                                                                                                                                                    SHA-512:ADD96D9002EE94F0E67DB20E60BB8E7CD3265B10E2FCB025FC7FB8158219C6A2EFFDE7504E31443B2FB8FA51FDAB4CFCABD3697F9DB338DB75CB0EC59789D6C9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.J.......J.......5vUQ....J.......5vUQ....J...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............x.j.=.m..Z:.i.w.....N...^...............@......B.w.>*5..........f........................................I.qk..B.....LZ............x.j.=.m..Z:.i.w.........x.j.=.m..Z:.i.w...........J.......J.......J...........................................J.j.....J.T.]...J.......J...B...J.H.....J...B...J...>.).J...J...................;........4...4...4.."...............J...J...J...z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4..........J.......J.....#.J.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000057.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):55804
                                                                                                                                                                                    Entropy (8bit):7.433623355028275
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:gVvci05lhVbfBcWvBLeynluexaWqzww/u5:gVUZhHDljaHww/u5
                                                                                                                                                                                    MD5:4126992F65FE53D3E3E78F6B27FD49DC
                                                                                                                                                                                    SHA1:BC0D76B69310DA9B909D3EE4CECBFE5F386BFB45
                                                                                                                                                                                    SHA-256:3FBE3C1C238BD7DBC67F8CFF5F3BDDFD513C96A9851B9616477947D21DFF4B2E
                                                                                                                                                                                    SHA-512:624853F5E56D224C8188F122B2C4724F867D4099E7FAAFB9C945BE7E2907900ADCF4AE97AB08909CF94E96FB6F381E3B6396D560D93EB2731E4E69CBFE628F10
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d..............................................................................................!1...AQ.aq"2.....BR..8x..r#..9b....3....CS$.'.cs.......7Gw.(.4%5&..Wg.h......tEVfv..H..........................!1A..Qa.q...."2..u6....BRr.#...b..3s..d...7.Cc.$Tt..S4.5Ue..&..%.................?...,...8..{..S.y.N....%..q.8..H[5....o..xg........)c(.eO.YO..._D..x.U.....%.S.r.r._.^..Su.h.Q.t.:.#?....x..B.S...Q.....oqF..%..8'.qx....%.2JKjF..{y.w0.*a.RMb.c.Q{%....eW'..[IV..'ZW3...[...MN.....rO.:....$.i..7....Vrrr...I.r..M..Qo..j....q.^...N...J......%.J..)F...>$.....u........o...+......[...*..t....R}.I..R..S..GB..:......).6_[^Xft...F.1.....zP....,.#....MG.T..Q.F.....)Fi../.I...,%.voEb.b.Z..V3..FT.}..[Z{....wd.z.e.....QwW(.).t..\..'....:)<W.<..&k...caRT.X(..K.....:f...]...q..

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000058.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.454229981226856
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:Z25sU68nrC0BdEzXrf9slsRMz+8W8p/r:ks0r/6zXrf9slsRMz
                                                                                                                                                                                    MD5:2B7180C086EF989F468EAADB856D4104
                                                                                                                                                                                    SHA1:2CE7026BCEEFFB5C960FAFC33446772ED08C15DD
                                                                                                                                                                                    SHA-256:9432CE78BA3DFC778E890FD32B49BFC5A09A87AB51BD34D58CC7BDB2A904F9B5
                                                                                                                                                                                    SHA-512:1277170CF54010165E649F3B956BA85C1861ADDB757D7DA958CBE16C4B73795C25194E9E3EBB067161BBDA25B39EEBDE7BF9ABE412FCA13CCDE90983DF0BF76B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......n...v...b...................................................................................................................................2...>...J.......v................................I.......I.qk..B.....LZ.).......).L.._...9+.Q/..).L.._...9+.Q/..)...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'............. ...I...?...u1;....N...^.....................]G...(............f........................................I.qk..B.....LZ............ ...I...?...u1;........ ...I...?...u1;..........).......).......)...........................................).j.....).T.]...).......)...B...).H.....)...B...)...>.).)...J...................;........4...4...4.."...............)...)...)...z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4..........).......).....#.).............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000059.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:08:07], baseline, precision 8, 595x450, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):59832
                                                                                                                                                                                    Entropy (8bit):7.308211468398169
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:HS9SYFtN0+CRa9mfJy4zBAiIJhzrkHDV2hJK:yAmta+Tyy4zBIJW5WK
                                                                                                                                                                                    MD5:DCDD543A4E0BA2C1909BA095D46FFBCB
                                                                                                                                                                                    SHA1:B86C89537138FE07255354202D3EAD0B53B3C54D
                                                                                                                                                                                    SHA-256:28F334B77068F71F5F92A95695433B950610204A0E5580CE567DB8FAD4993ECB
                                                                                                                                                                                    SHA-512:5408C3259B7F3288A4BEB04342799AD5FE3A6F0EC7E92353B29B7E7E538DFA9903B39637226919E0421BC422635D25F5F8069DC7441864DC03E1B909BF5C2C84
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....fExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:08:07.............................S.......................................................&.(.................................0.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................y...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?......;R~+'....xh..~.n-}.......Te................^B..IU_....._...S......h.......!....9...A}6V=J......C..c.....Ug.Wh......

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005A.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.31006546384068
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:htsNAfzybCb0SWE2X0o93S0RMdG4fip20Kk:Tsm+I0S2Xh93S0RMc
                                                                                                                                                                                    MD5:8659A4F8ABE1EBB808BA1DC06FE9A4D5
                                                                                                                                                                                    SHA1:08898489841B78DAACD20E71D521988B0D95FDFD
                                                                                                                                                                                    SHA-256:EC157C2232430D98D43E12A958665ADF65E0C6370B121809EAE98BF377336B66
                                                                                                                                                                                    SHA-512:545F1A358EAFD5A133B8C361334611E27E049EA2688A3E0EC4E2EA1A508ACED3FCB38FCB3F7788562EDAF615AD0BC8008A125DFE1415F92D9DD8371F8429E090
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................E.......E.B..y...P...I.......I.qk..B.....LZ.E.B..y...P...E...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............uL.....70._.......N...^..................y..A.;....\.........H........................................I.qk..B.....LZ............uL.....70._...........uL.....70._.............E.......E.......E...........................................E.j.....E.T.^...E.......E...B...E...C...E...>...E...|...E. .3...................;........4...4...4.."...............E...E...E...z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4..........E.......E.....#.E.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005B.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):33032
                                                                                                                                                                                    Entropy (8bit):2.941351060644542
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:ofmqvnCfmqsp1Ue5xzMq+Qh0dffUmS0w5xzMq+Qh0di:AGAp1rmSl
                                                                                                                                                                                    MD5:ACF4A9F470281F475EA45E113E9FB009
                                                                                                                                                                                    SHA1:B20698DDA5E5AFDD86BB359A6578C9860D5DF71F
                                                                                                                                                                                    SHA-256:5DC2367A80588A7518DB5014122510BF0FD784711015EF83A8718336584F82D0
                                                                                                                                                                                    SHA-512:998B7DB9DB08FD15A293267E2371052E436E024AF8D34F96D3C8FF04B1316678DFC1674C921CB404121FF381A4FC39DC759E6698F19D42A6261CBD39469B0A08
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:....l...........................Ac...... EMF........$...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC........................F...(.......GDIC............^...........F...........EMF+*@..$..........?...........?.........@..X...L........................."B...B...B...................?...........??.....n............;...<..@<...<...<...<...<...=...=.. =..0=..@=..P=..`=..p=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...>...>...>...>...>...>...>...>.. >..$>..(>..,>..0>..4>..8>..<>..@>..D>..H>..L>..P>..T>..X>..\>..`>..d>..h>..l>..p>..t>..x>..|>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...?...?...?...?...?...?

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005C.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 3005 x 184, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12180
                                                                                                                                                                                    Entropy (8bit):5.318266117301791
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:k1bHyG/fKOOOOQJUg+g2S+kEm6alfsfsfn32:+bSG/yOOOOQ+g+gOab32
                                                                                                                                                                                    MD5:5C859FF69B3A271A9AAB08DFA21E8894
                                                                                                                                                                                    SHA1:3156302A7450ADFF4D1B6EC893E955D3764D4DD4
                                                                                                                                                                                    SHA-256:B4A8E9A67EE0B897615AC4CCE388FFC175AB92D9E192E6875C79A4E7C1B5BB6E
                                                                                                                                                                                    SHA-512:4CF518136EEBCA4F400A115D9B7BB0CAC9FA650BF910B99E15F04A259B7D3EFCFFD6796886FE09DB08C37C332B14BC8500845C09C8EAE1F2306F90E98D3C99E0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR..............;j.....sRGB.........pHYs..........+..../9IDATx^...dW...S=.dL$.............-.`...'...x.7.D...(...$.?cO....9S]=.v...Z.......{..wNuf.&.....a.k5~...._..\.yk..v.....}{._.Q...5...._9o.n.....}7.].1v..t......q....3.<..0<.p.......0....s...... @....... @....... @....... @....... @...X.'..U-..... @....... @....... @....... @....... @......,I......+..... @....... @....... @....... @....... @........z...r.. @....... @....... @....... @....... @....... .$.C.KJ[.... @....... @....... @....... @....... @........&`.=X`.%@....... @....... @....... @....... @....... @....../)m.. @....... @....... @....... @....... @....... @ ....`.)....... @....... @....... @....... @....... @....K.0.....J....... @....... @....... @....... @....... @...`.....\.... @....... @....... @....... @....... @......,I......+..... @....... @....... @....... @....... @........z...r.. @....... @....... @....... @....... @....... .$.C.KJ[.... @....... @....... @....... @....... @........&`.=X`.%

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005D.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.359078600272797
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:AsYuYDzE6t6s0qEPEczowLMRBXrg6SB9Ys4p5vZrdMrwhcPgQXi49oah:AsAfE6EsnEsAowuBXpSB9YdhRMwggY
                                                                                                                                                                                    MD5:B9D2A99C226913D8049CC0AB53A38F10
                                                                                                                                                                                    SHA1:EA5AD36AB080BA12AB1178FFFD305C4240AC1C4E
                                                                                                                                                                                    SHA-256:0E51BA0E875D80E932BD11346AC21BC550E0B8578F214DC42FCB81FCDA16ACE5
                                                                                                                                                                                    SHA-512:D5ABE7DE6B176BFBF261C03BB50898A67F43286ED2E793A3321D7208E9825C962835E1626882B0584D0F0B9C08542B2B674886AF2316ECC2E76CA75152E23B4A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.-.......-.5O;....[[q.*..-.5O;....[[q.*..-...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................Q.14.........N...^...............d.g3...C..}no...........f........................................I.qk..B.....LZ................Q.14.................Q.14...............-.......-.......-...........................................-.j.....-.T.]...-.......-...B...-.H.....-...B...-...>.).-...J...................;........4...4...4.."...............-...-...-...z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4..........-.......-.....#.-.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005E.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 39 x 600, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2104
                                                                                                                                                                                    Entropy (8bit):7.252780160030615
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:2PPEOtz2P/LJtVRaqBG8qFOPvHlcEXgkuwf+j:2PZFSjJDjqFOPPlXgG+j
                                                                                                                                                                                    MD5:F6C596F505504044DF1E36BA5DA3F09B
                                                                                                                                                                                    SHA1:BCF17EC408899B822492B47E307DE638CC792447
                                                                                                                                                                                    SHA-256:EDBB86F160050FBF1F9860276802BAE292DBFD0BC98E3EA90D43D981E9F0C54A
                                                                                                                                                                                    SHA-512:E8D067A1932CED8746FE7D665EEC34EA92A98AFF3DF26FFA9DD02742DDEA3C5654124A88A649FA33DB596F96A5FC9CB2C693D03132F1C8B254ACB56DB4763BD8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...'...X.......:....PLTE.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................{.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^..c.%i.F...m.m.f.m.m.m{&....X...9.....M.WUW.d.N.O...E$...$...)H....n....N.k..v.....v1L[w)w.}..!...Y.X.V.D.......[....;..[..;....

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005F.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.348656919121389
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:VMs2svCWDUXTE2zXklW9Nv4RMt4QvCCw:VMsxvCWSAOXuW9Nv4RMt4Qv
                                                                                                                                                                                    MD5:43214806250CEC8AD074B5C0B695B8CB
                                                                                                                                                                                    SHA1:C1F859DE8C96357EC4E6DCA19D61CF4A0B1D6AE9
                                                                                                                                                                                    SHA-256:43DF2AAB8F74B769326EF571813C56DBCC055B2DF6B0D2F9F1390B9C0E554638
                                                                                                                                                                                    SHA-512:91B64EC50CD5046B34121B3CFEE1C31F910AE3AC2EEFEA0259B16D4046752EC4798A3E8C67A265DC7E1481B871E09EF2C19A739C01216116FE7B26ABC6402308
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ<......<.........1j.<.........1j.<...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............#lm.L....?FD8/.6....N...^.................$!.JND.O..%*&.........f........................................I.qk..B.....LZ............#lm.L....?FD8/.6........#lm.L....?FD8/.6.........<......<......<..........................................<.j....<.T.]..<......<..B..<.H....<...B..<...>.)<...J...................;........4...4...4.."..............<..<..<...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........<......<.....#<.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005G.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):14177
                                                                                                                                                                                    Entropy (8bit):5.705782002886174
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:EbgGcV/hlvpfal7rgYa8S7auAxwfuSTmCSNoFQ6NO7L:EbgGcVnpwimnd38FdQL
                                                                                                                                                                                    MD5:7CDCE7EEBF795998DA6CAC11D363291C
                                                                                                                                                                                    SHA1:183B4CC25B50A80D3EC7CCE4BF445BCFBAA6F224
                                                                                                                                                                                    SHA-256:DE35AF949D4F83E97EE22F817AFE2531CC4B59FF9EE6026DCA7ECEBC5CF2737F
                                                                                                                                                                                    SHA-512:560FB15A9C12758D11BB40B742A6EAD755F15AD10D6C5DEBA67F7BC8A2AE67C860831914CBCBCDED9E6B2D1D5F26A636B9BCEF178151F70B4D027316F94F27E1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!.1..A....Qa".q..2.....&...B%6.'..R#3.$E.r457bS.DUFV.Wg(.......................1...3.Q..2Rr....s.4.!Aq.S.aC5B$%............?...n.Liq.}.{#....3/gg.1.M +..~3...q..+=..:.g.i1;P)7.....q..n.s"p...wx........v.t.f;..L/..~....y.r[.r.....n.n3..6i..g..}../........3..x.L.i?We..l.......~..<.;..6..o.....N.t.o6.l..~.......<...m.V...Q.7k.u./wq.t..;.I...}..{...>.L..3m..a....yd......6~.f..~Y..}+..<.[w..'-..?.v.7...v.u..4.......1];..u.MO.......s..p..ms.'.O-o...O......m.k.e....)t....i>..E|....,iOyD|.{......g.n...cu....=..........h.\.Q:?g/?.I.3._...t...d.n.0.%y....S.Q....S.&K.w..&wY<....%.g.v.....$y..#,i;.=...t...I6..yO..o.d..w\k...~......)..rK.......].u....N....e.s..kU.u..'}

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005H.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.340523492187993
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:e1sXf+HkefKstmcEYXL7oRcX1Vc9sqsapy9rdMrpIjCFX049v0p9qx:gsGHkefKs5EQWcX1Vc9sqHgRMeCx29q
                                                                                                                                                                                    MD5:75E5EA25B98CDBF2944173FDCDA52E4C
                                                                                                                                                                                    SHA1:68E87E4587F82A61A2EB845D923AA7024EA480CF
                                                                                                                                                                                    SHA-256:883C1B25D87BE2C926329F96733AB25838DB1F793DBB63C59D5C2AD4B070B9B0
                                                                                                                                                                                    SHA-512:35368376474D2ECDED3C5732AAEFAB65046F132D72D3047F5960E79BB99C874191CE393240C8E4E6AE72076EA9F0992FC3FB835375881BB3D6EEF1F45D4FED44
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ..m.......m|M}..'.#.|..{..m|M}..'.#.|..{..m..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............`..8.\a.....M......N...^...............y..[..fH.%....r........f........................................I.qk..B.....LZ............`..8.\a.....M..........`..8.\a.....M.............m.......m.......m...........................................mj......mT.]....m.......m..B....mH......m..B....m..>.)..m..J...................;........4...4...4.."................m...m...m..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4...........m.......m....#..m............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005I.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:44:07], progressive, precision 8, 611x163, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):36740
                                                                                                                                                                                    Entropy (8bit):7.48266872907324
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:3nwDxjTvoE0Rjwit4rjucDILWg7/Da0JgGQ8e1S8SA/Khos0:SxjTmZw7nucDILj77a0JgGQvScb
                                                                                                                                                                                    MD5:9C205C8D770516C5AA70D31B2CA00AF3
                                                                                                                                                                                    SHA1:9A1002F0CF7F92F1BE2BB25BAD61CEBFAC282482
                                                                                                                                                                                    SHA-256:E111F96490755C7D71E87C88ACAEA38AFE55BB865B1A14A83C5BD239648D5E2C
                                                                                                                                                                                    SHA-512:A3E105208B32831265428572B0937DD3C17B793D8611B2DA8D4939F1BEC6050999D375E3F6B87D53AD49DFA0EAE737B0141D37597AA42116C310761973D4A134
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:44:07............................c.........................................................(.....................&...........n.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d................................................................................................................................................."...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..o...4.gP.~.c...K{...V.=...].<.........vS.........s....(.t......X......kk7....~-...yF}^c.Z.\.G./.?t...>....:.>......./.ib..).

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005J.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.434639305748568
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:LRsv18Ce0umgqMtmoypxELLC5XlN9NsapylrdMrreExFXUcskPOBHU0g:LRs7u3vUxpxELaXf9NTIRMrVU00
                                                                                                                                                                                    MD5:B1B14E5069822B419E69C94B33D6FA42
                                                                                                                                                                                    SHA1:CCE60887D412DD944B18998F4343A98431EEE11F
                                                                                                                                                                                    SHA-256:99D0166CBE73DB2B03C10D60B47B478EC3A0FBE5755F62A46EBB52BAAA55793D
                                                                                                                                                                                    SHA-512:4A8C6F30664D3F9E206E75AB370D604A4EA832301E4BF8B968E11F2FE66A9A3A30400016F2BFC152CDFEF5EAADB5B31F69220CED5046F0F4A2D7338D22E97A68
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......l...v...`...................................................................................................................................2...>...H.......v................................I.......I.qk..B.....LZ6.7.....6.7...6."u!}j.\t6.7...6."u!}j.\t6.7..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............t=.f........s/J....N...^................l.#.w;G.....i.........f........................................I.qk..B.....LZ............t=.f........s/J........t=.f........s/J.........6.7.....6.7.....6.7.........................................6.7j....6.7T.]..6.7.....6.7..B..6.7H....6.7..B..6.7..>.)6.7..J...................;........4...4...4.."..............6.7.6.7.6.7..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........6.7.....6.7....#6.7............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005K.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):53259
                                                                                                                                                                                    Entropy (8bit):7.651662052139301
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:dCiCBBenRYWDBCipMYGTbYGLHbXxoP/qEF+MU50qyJ30h2W474S/Aq/xc4674bi5:dCiIQXBCiwbDLHD0/sFyVel4Pi4UgE
                                                                                                                                                                                    MD5:2EE369ABB7936F8C28FF0ABDD224EA05
                                                                                                                                                                                    SHA1:FE9D304A7B49E31EAE439369ABC548E265149636
                                                                                                                                                                                    SHA-256:FB12D59B8BE911247BBAFDD416852E8B74B028005A141CB4DBBBA109B4B6ED2C
                                                                                                                                                                                    SHA-512:5CF396CA472C32AE988600176114106CB1619404DD899A3867A5AB43DC90583B771EF69B14EF50E56A21F038BF51D8463C6ADD2DE9D4CB523F6290E24A4DECB3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..AQa....q........"2..R..Bbr..#S....3$.....C.4v..(X.DtEUV.....cs..Td.5uf'Wgw8Hh........................!1Q.Aa....q.2...."R...r..3.t..U...B#S.4ub..C$d.5Ee&'7c.D%sT..............?.....?...k,lk^...M".Yo5.Qp.&s}b.m.:...W.x}.*.a......N1..d-n.-..^..b..TZ.W..."....F....^......ve5...^...2.:i...........~u2pK.z./&..u..L[I....Y....@y{|>..MN=:....Q[..H....a........|%..4fV....).....^.9b.f...F...p.=.W...aZ.........Z.t.n.....z3..[..lVh..\.N-.._.sK.y.._e.G.jig.a.7^....u...*.p.5.a.].........u/u..D.yl.XA..f.z..~.x.....N.....b=.uv.2.t.'.N.-.H..n.v.a.A[.Z.....T2...._...:....h..l.E..sm..a.3I...RE...fWb.Ek.0.#.)..Y#T...........u{....U....s.].7_H.2.`O6...P......}..4LR....]4.mid...

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005L.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.319524164022326
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:Wsq4Z1/it5r/nTEXDJxGXxPD9COswQxpy5rdMrZH0FXbD9KoldAMF:Ws91/iT/TEXqXVD9COTQx0RMR099j7
                                                                                                                                                                                    MD5:7E6271284FA188A2AE31D0D80AE91F50
                                                                                                                                                                                    SHA1:11E2271458159B38FDE2464B2487038B54896A96
                                                                                                                                                                                    SHA-256:B165CF780506BC4986ABB172E7CCDC8083F27564D54A39D240E1A6B85F30B043
                                                                                                                                                                                    SHA-512:25EF6DC40762DBF70D670D0DBF99FA39FC4D996E2E6B9A4CE43CDCAC2B1F88EE3E9F11DD255C4B1A07B430793080783F1DDBC35866D1FA22479D85F311675D8E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ..q.......q.....=A..&a@S..q.....=A..&a@S..q..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............uJ@..'..0A/H.....N...^...............g..C...H.Q..8..)........f........................................I.qk..B.....LZ.............uJ@..'..0A/H..........uJ@..'..0A/H............q.......q.......q...........................................qj......qT.]....q.......q..B....qH......q..B....q..>.)..q..J...................;........4...4...4.."................q...q...q..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4...........q.......q....#..q............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005M.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):60924
                                                                                                                                                                                    Entropy (8bit):7.758472758205366
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:kU7O7+CFqO6DkxTgPzo2wqggrrX8QvN1I/ZLBttB9+dPFXbc:hVuqJDaTqo2wq1L84N1I/Z1tT9X
                                                                                                                                                                                    MD5:D58C51D2CF586A5E14A9EC8529C3B0A8
                                                                                                                                                                                    SHA1:F4811A353797C29B1E3F5A61B125C46E1534D587
                                                                                                                                                                                    SHA-256:F927C7825851974A2149868146970706523A49165133CEE6027A43E8C9ABDF27
                                                                                                                                                                                    SHA-512:34B963173AFBDF07432F4B983D29F10376E4771FE666E9D50B1A81DA0B9F6001FD86B4A08B9711386DE153BF6E03C8E932E2D181C8EAF94EFF34D20FCA7570E0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d................................................................................................!1AQ.aq....".....2B...Rbr#.s.4...3$.5u.6v..CSc...DT..f..t..&F........................!1..A.Qaq....."2....B.s....Rbr..#4...35...CSc.$...DTdt..%..............?....O<......X.O.Fg..{.W&u.u.T~.|r;g!.._X..N.p.4.........................................................yK..xd...6..|%....\j..e.=...Y..f..I.|-....e...$R.j.......~.W#....{.....V.k.|F..z^..:.~..f......"x.....L..K..r../.;..[..l...;.U...W...X.........8.....y?..B...m.......j..Q.g3..G.K....GL.o..n7a..Y..[.'.........x........\......~...f...0\Wc.n?k.|.....1.ww;..2..?...r4uF.MXdB6..W..mG2NJ.E........u...2.q...Z..=(l)jU.X...U.\X.......O<......X.O.Fg..{.W&u.u.T~.|r;g!.._X..N.p.4.......................................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005N.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.32828272512874
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:wsBDmD8kE7MtaHEJtAcXG99psPpy5rdMr9dRUFXxxM9xk3WpzFPl66:wsn7MmEBXc9p+MRMyz8l6
                                                                                                                                                                                    MD5:D2A03C7213BE08C59F4A7E6DAEA5A66D
                                                                                                                                                                                    SHA1:2057F62BBDE0E474E6717E721C8274C19BDEECA6
                                                                                                                                                                                    SHA-256:92F0049A7233B4E0BF60C88013FE3CD9410211D2BC4202109815EC7CADC81153
                                                                                                                                                                                    SHA-512:DEE888129694623CB8DFA0F6547815D59605DE02687F039F2ECC8CA98F0BADBD9C0B0275363DC4CFBF02B46BFD51EA5ACFE2925028EEE6F64607C0C7EDBC5FC6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZm)......m)...0.(,...1.zm)...0.(,...1.zm)...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............0'...iB.?.'.#u.7....N...^...............f6sL.1.O................f........................................I.qk..B.....LZ............0'...iB.?.'.#u.7........0'...iB.?.'.#u.7.........m)......m)......m)..........................................m).j....m).T.]..m)......m)...B..m).H....m)...B..m)...>.)m)...J...................;........4...4...4.."..............m)..m)..m)...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........m)......m).....#m).............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005O.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 39 x 579, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):515
                                                                                                                                                                                    Entropy (8bit):6.740133870626016
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:6v/7su2/c30mqkg9VgFHe7Ll8UmJX/N+1Zmkk8f3lbtI4:4mc38gFHe18lkk8f3lbth
                                                                                                                                                                                    MD5:E96BE30D892A5412CF262FEE652921CA
                                                                                                                                                                                    SHA1:8190A0BFE21D04BC6F3A406E91B87CA69C03A2DE
                                                                                                                                                                                    SHA-256:0E31DA4DFCFF4A36C64C1CE940362D2309769F36369E4C43C317D5F2FA15658E
                                                                                                                                                                                    SHA-512:D647F51ABBD013226A6ADD0D551D058C633F867F9AF5A9E099B85D6E291D220F7B85958B07381CD4C7C4F72356DBAFE2A86932AE398E28C56CDDF0744E92EE24
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...'...C........b...`PLTE..................................................................................................bKGD....H....cmPPJCmp0712....H.s....9IDATx^..I..@.C..<..?mo.#C((.J}...~..B...b.I.i.\<.e.....(p.I.EO...q.x.......dRz....K..b0.:.<c.o..0.x\:...F....I&..ap....."P@....DO...q)p*..@Y.CL2)=......1.........4....._.G..^`..lDO...q...X....SL..z....K..#.L#..I6..ap.Ls.,....7&..ap.p..lI...,GO...q.....k.n1..4......3=.f.x.$..4.....o....x.$+..0.x\.,&6...............IEND.B`.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005P.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.366459686374186
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:isr0mFjmn/iRS7tca3EPA8HnBXLHB9+6sZxpyxrdMrRp/2FXvAEs6+kYSBErzTIg:isBjI/iRS79EPFXLh9Jwx0RMD/2NILA
                                                                                                                                                                                    MD5:80608DDAF7352189928EA9641A515B65
                                                                                                                                                                                    SHA1:866E7F78EC4EE08D59378A11AF57E34CFAB10E54
                                                                                                                                                                                    SHA-256:F7A392C5C574F2BBB2FE8BE8E25E61AEBA12B704CFEBE31368E6FDAAAB92884E
                                                                                                                                                                                    SHA-512:CE05487FDABAA45297B234D0DF100B1F47B9AC6F639A4E451BB89229487D08A7C6116BFA257B3190397B7B2914F93AE89B70F5A1823B0FF2B852137E437B020D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ.q.......q....7.B.w.-.q....7.B.w.-.q...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............B.3sd. D...`.}....N...^...............#JB%.eRO...W...\........f........................................I.qk..B.....LZ..............B.3sd. D...`.}..........B.3sd. D...`.}..........q.......q.......q...........................................q.j.....q.T.]...q.......q..B...q.H.....q...B...q...>.).q...J...................;........4...4...4.."...............q...q...q...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4..........q.......q.....#.q.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005Q.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 30 x 700, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1547
                                                                                                                                                                                    Entropy (8bit):6.4194805172468286
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:dZeDNYbS+238CTUFPA6SXG5qSacX9q73eXu0vC3dU+OB2gbwHRuZ:dykp9FzBBacXQ3uNC3n7xuZ
                                                                                                                                                                                    MD5:0BA36A74DFBF411FAB348404CCEC3348
                                                                                                                                                                                    SHA1:4C619790E517416E178161028987DF1CD3B871CC
                                                                                                                                                                                    SHA-256:2E7AAF26BEC32148B96442E8FFF1BD2CEF2D72630969F23B9A2ABEDB6CFEC93B
                                                                                                                                                                                    SHA-512:90AF53DB7C413E2ADB970AC345F73E4ED8AF626E179C929E6560118F7A9E98DC7C5FF02B2B3F6C98D397E0FE2D85F3427C6928C328872149E176FA8A99E91F54
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...............\....PLTE.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................D......bKGD....H....cmPPJCmp0712....H.s.....IDATx^.WSTA........b.0gPPP0..E.9b@L(.c.N.U>..@......;...}..B.(....$......5..XS...I....).!....D^.uE...\..5........F."o..-...m.n. .^.....q= .

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005R.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.31111723782572
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:IvsPpggw2gCJnEDXv9WkYRMuWEZgtwMx3Lw7:CsPpgP2jJEDXv9nYRMZMgthx3L
                                                                                                                                                                                    MD5:401C9F9B49C457A47795E5850747E0BD
                                                                                                                                                                                    SHA1:1292E734720DBB6C2B11E43E308999C504E6B34D
                                                                                                                                                                                    SHA-256:70C7A700418550BD16E544B6031B0BA4BF7F93BA29AE933EE38A1549687C9101
                                                                                                                                                                                    SHA-512:F8C6C159833763C24FBA7688DB629ECB85A089521B107FF5F16715FF90EAA91A66A5B4B58DE2CFF31CB21E2EC4707B2AA25F1115E571B176B998DB5A1FE81299
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ..X.......X..{........F...X..{........F...X..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............i...rK.....w.......N...^...............0.4..LG.V..Z...........f........................................I.qk..B.....LZ............i...rK.....w...........i...rK.....w..............X.......X.......X...........................................Xj......XT.]....X.......X..B....XH......X..B....X..>.)..X..J...................;........4...4...4.."................X...X...X..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4...........X.......X....#..X............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005S.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):95763
                                                                                                                                                                                    Entropy (8bit):7.931689087616878
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:EoES7mhTyzabUaE77xAOmq0zVruQlttNxlipxVWssMU2YhRy2v6pKKYhQzwMc2:zz7mhTyzabUa4b4xuQlttnlGx8x9h02M
                                                                                                                                                                                    MD5:177DD42CA99CAA2CCBF2974221680334
                                                                                                                                                                                    SHA1:35FD86B3DD082A6D4930C67BC0E05D3B5817465A
                                                                                                                                                                                    SHA-256:525A857D0EDA855A64D3619DF58B1C2D013A73E60FA0D49B155ECFCB2C134C7C
                                                                                                                                                                                    SHA-512:6FB6D9A6C97B1115C3246690A2F339CD612899AC25ACBA00296EAEAA0A1D094E7339D670969764FE23EB7C08FCDD01C6F78FBC0735D504D5E02AD342901719B3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!..1AQa...q......."...2..B#Rb3..r$...6..C4....Ss%5...tu.c..Dd.EU7....................!.1.AQ..aq......"r..2...4Rb#3$B.Ss............?..H..dV....U..-..0]Cp.%O.Z.Y.e.=/.q.....j76.w@s...5.&&&5...n..w..>.1....;.vR..[.......=.......KtY]u3.g18...).r....&.IZ'.....g..4kY..X..b.......y<...r1........e.._...X...w....op.m%Jr31...S.Vo.._....OI\]....F..V-....\...2j..X.....y.p.$4.....&#..]..n.V..x..P...F..C.f....])..~..Z\.....,..#..v..v...2V.k.SuaydO../[.*c._..oTV<Z.s.[...o.x..>....-....v...#....-.X..L.Z./#.XG.-.0......%w..H.@aZ....C.}...N~.;..R......5.D......I.... .R........s.>..ks....(...S...9....2=. :^.. p.+?(....$..Q..I.........=|..`2. v..t......U*.8.u.. ...'...*...2;u....& 3..$.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005T.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.330392645049963
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:+sW7RFCUetWPap9XEyLgmvXuHEb9FU7pytrdMrOzVQFXhBeNIFJ:+sGFCUeKa/Ey00XuHEb9W7gRM+VQme
                                                                                                                                                                                    MD5:57E60278AEF81E82039A0F65E4D94EAE
                                                                                                                                                                                    SHA1:9E2D97B32F9B30AC7CD128EEDBF854180294B8D5
                                                                                                                                                                                    SHA-256:E0CF18553581AC7B2BCCF2E4B75DA68418A3BD04F3A5B6CA7B908E9E4845F638
                                                                                                                                                                                    SHA-512:D50758343C16473FA729ED954E15004544FD768D89F377AF59B23714BE61F4A9EC5A5AC48036F9608E4F7D3BB41CCD1123FEF3F387CB4FAC2F0CFB4F0B606014
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.Z......Z......0frm..3.Z......0frm..3.Z..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............c......'.n...^....N...^................&.J5#.O..a.............f........................................I.qk..B.....LZ............c......'.n...^........c......'.n...^..........Z......Z......Z..........................................Zj.....ZT.]...Z......Z..B...ZH.....Z..B...Z..>.).Z..J...................;........4...4...4.."...............Z..Z..Z..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4..........Z......Z....#.Z............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005U.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):67991
                                                                                                                                                                                    Entropy (8bit):7.870481231782746
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:3PC0XJjsmsKuZRG1pXuZ6z3wARnV9AEnieCc7cllJcHJ:qyMBzkUZ0gq25c7Z
                                                                                                                                                                                    MD5:1271B1905D18A40D79A5B9DB27EE97EA
                                                                                                                                                                                    SHA1:9618608FBD7342DE6C71220A36C3F4995BA9C13E
                                                                                                                                                                                    SHA-256:5B321A4D81BD499B289B1755F6450A42047C494DFBC112DBD56DA4CED2C15C1A
                                                                                                                                                                                    SHA-512:C32DD26047F6B8AA061085B38AC2B8335868E1BFD8731DB65544309223A955FA4BF45B06AC8D244408658F51A1775B6F19FF0FFC804989DE706DE8EB36F1436F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1..AQa..q..".........2...BR#b.r.3...$.'...)..C%7gw..(.S.W89.......................!1.A.Qa.q".....2...#....B.t......rc.$%67Rb3s&'CUu.v....S.d5.V4T.e.............?...?..Wj.e.e.......w/..E..eOw_.....6......u..C6h.,..;.g.D8Z..-)O..jy..e;.u.g..w..[.L""k'w.......'1'.[......=..P...S.9a.V./O....q=8xk]...........9......F...e9'....9.O.... .&.....p......c.4...mr...?.......L..'.....0....+..|_...POM=7.?.2.a....};.Z..y./....>./.C.<...;.....|.1>...........S.8.o.O...+..n2...k../.X..9...Y...:.....\...Dk......q.K..\.Wuh.!Z?.mu...R.5.A.S.h.0..[..v..+M.....aUi*.k..?#..._...X..R.&]..[..;../]L..f..V......*.e...ut&.#.J.5....c%..o.$..v.<K.6..T.IP.....6X.*.uf..t0^..-.)m$.!.q(.j.f;..WB6.b.B..R.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005V.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.341491427501756
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:YsdLYIgXl02+ztMNEEvlLo/XDc9RUG7pylrdMr7k/PdvFX08og9NXlqekViwlLo9:Ysuv+zxEd6X49SG7IRM7EPVHp
                                                                                                                                                                                    MD5:47FD11EBF524416469F1C13886A8EAFF
                                                                                                                                                                                    SHA1:B83AD9EE1EEADF1650B8E365A10C78D97F5BF700
                                                                                                                                                                                    SHA-256:9620761674AC6B955D863BE06B84931600523C6C6298E298030377F9027F8D26
                                                                                                                                                                                    SHA-512:0B11D56D6EDDCA543060AD24FEEF568046F9E4E6C0009354973839D4F1D57DCBE5E5A24E3697DFDA9E76482D7F7FB315B481393376181BD7B1247464F01D024F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.........................................I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................g.z...U..._....N...^................J.gT8{M....>..........f........................................I.qk..B.....LZ...............g.z...U..._...........g.z...U..._....................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4......................#..............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000060.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:06:24], progressive, precision 8, 38x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):22203
                                                                                                                                                                                    Entropy (8bit):6.977175130747846
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:5q3R1VBvq3R1Flrk6Q0QPJJrR39joOVMJ25d1NkMhIwobbtAAAqYnLJZMJYZ2AC:xw6Q0WJR3FoOVMJIIlAAAqYnMJdD
                                                                                                                                                                                    MD5:2D3128554F6286809B2C8E99DE5FD3F6
                                                                                                                                                                                    SHA1:FC42CB04151D36F448093BDEFE33031A9B8D797D
                                                                                                                                                                                    SHA-256:14FA2D16310485AA1CE41F6D774A3D637E8CF8B03C4F72990155DF274FDB6BD9
                                                                                                                                                                                    SHA-512:D8531247A6E89ECABEA9C4A78F596CCE3493334EDF71AE4F7998FDDD0F80705948609C89756AB56FDFAB6D04DEC5F699A693801A772CA2EE2465BDD2CE5D2D5A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....XExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:06:24............................&.........................................................(.....................&...........*.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...H.....Go.Kxn.b..g...........%?_....O......q......7G......%%.V..8zm.].v?...jJ~._..>.......O;........o..rI.A.....n.a.........

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000061.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.422696057964803
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:eAsAxunucRMh8EDuX/9Se4RM8viP8rfz8m+ZZ:eAsmcucWDuX/994RM8o
                                                                                                                                                                                    MD5:01F135C6450399A98BC2228697FECC1F
                                                                                                                                                                                    SHA1:54A548E65C4E1956E6D632DF3300CDDEACF546B6
                                                                                                                                                                                    SHA-256:42612214CC6BCF038DBA49FA379C0B784FCD197C9F6DE208BD242B99687625C8
                                                                                                                                                                                    SHA-512:0EB4600BAFD386A58959EC1AD8CB9CF06241984ED9057C558FE585EA2DBC50317078BF4902922406B045810104B828ACD34E25E6929D62AAAB46C60014E88494
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......l...v...`...................................................................................................................................2...>...H.......v................................I.......I.qk..B.....LZ..".......".f.....N.A.>...".f.....N.A.>..."..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............#...9.....k<kc....N...^.................L..xBJ.....E.........f........................................I.qk..B.....LZ..............#...9.....k<kc..........#...9.....k<kc..........."......."......."..........................................."j......"T.]...."......."..B...."H......"..B...."..>.).."..J...................;........4...4...4.."................"..."..."..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4..........."......."....#.."............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000062.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):15740
                                                                                                                                                                                    Entropy (8bit):6.0674556182683945
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:Elv3GG8/OOs+GouFdxMlxjoPyerzkpuOo2vPMc62PaJseZC+BJoS/:EtNiwdxMlZoPhzkpuOo2PMc6rX8+B6+
                                                                                                                                                                                    MD5:FFA5EC40DC9A0FD10EB9E6355142D6A6
                                                                                                                                                                                    SHA1:3D3D6A7E086B3C610C08F1F3E3F883604F06F2A4
                                                                                                                                                                                    SHA-256:D74C3973C8D1F7C77274691AFB1AA934940674341D7EEE563BE75E563281BDFD
                                                                                                                                                                                    SHA-512:6FAF2A24D06E6008F3579C7CEC90C2887462BDF83FAD7372FBB74B8DE90340B580E9836F309B68A9794597A598F7DCDA661C9A58DA6D8187C69083B7A17C9CD9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!.1.....AQ..aq.g..8...."r....2.FG..#.E..7.Rb..Cc..D.v.B..3s..$d.%5Uu..&6fW'w........................!....1Aa...d..5e.6.q...Q..."2b.c..r3DE..BRs4U.#C.S.T............?...u.&0...cV.T.I...1..=4....Ce_.g.q.=F.M:>)...k..pm..h..=........S....)Ja8x...b.).=5.q..0......k.M.....1?-.G.b&.5..Ep.8t...'...R)..ta.F$bXO]tW.b.6#.t.XWN..ZW......].....G....x&&f..'L.....7...\...'.8...~`.sa...............................................X........qo...SMk...'.V...i..hb.}&?/.k.:>l.^....>Y...<}...&.jY.Gn.MKejyV......D......gf.0....t.nw..XQ...H.B.....=8.UkR.....Hm..w..]...k...#Z...F../.gjWvf.....w.aZ].2..5..^...VZv..._.7..a.|...:.B...,f...............~....m.;_.....-.e.y.w.[m.].bu.b.f+.E++\.....Y..7

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000063.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.309203156720785
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:qsEUXJ9qBEjA3X4W9K3ARMEk+sWXQsIFwi:qsEUXJ9LjA3X4W9kARM0sWXQsIFw
                                                                                                                                                                                    MD5:CD83BBDF1BD369D854BB19B603C9DE96
                                                                                                                                                                                    SHA1:6E46606215E69D6FD1CE537BFAA0BECD12A1319C
                                                                                                                                                                                    SHA-256:D73879F65B2F4A3B87F0DBC3E5D8A8618A5A268BD2B03AB95416BAF7B03862D9
                                                                                                                                                                                    SHA-512:E89E0B71C6211436D82D7EAEFC42395F5830EE9CE082C74DB1FFCA654A3A886C8D462C37090E27602C7B82F90CF5195F65DE2E36CDA03FB1795552040F95BF85
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZAIe.....AIe.Q...7.4.J..^AIe.Q...7.4.J..^AIe..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............Dy.\Q.B..b....6....N...^...............a.2G..[E......3.........f........................................I.qk..B.....LZ............Dy.\Q.B..b....6........Dy.\Q.B..b....6.........AIe.....AIe.....AIe.........................................AIej....AIeT.]..AIe.....AIe..B..AIeH....AIe..B..AIe..>.)AIe..J...................;........4...4...4.."..............AIe.AIe.AIe..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........AIe.....AIe....#AIe............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000064.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):86187
                                                                                                                                                                                    Entropy (8bit):7.951356272886186
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:AbmHwD7za0syWMetp3TdPFzoJamVdAQZCiUit9qbYN6LerhWMzIWgN1EeaYhJM:1QnzsyTeP3TPAdAQZCi5qbYEKrhWWMNO
                                                                                                                                                                                    MD5:FEE4785DF76E93A9DC2F4501CBAEAE12
                                                                                                                                                                                    SHA1:8FB4527BDE05EF208FCDB168098A07707C27501F
                                                                                                                                                                                    SHA-256:F091DED5E283AF6848670A3172E7C43C6099875D39B3FC69C2BDBA914F609602
                                                                                                                                                                                    SHA-512:7E99D33151A0D3873D6A819C98EA8E62D928C087B7BA2080F11C7BCF746AD60A44D4FF6EE3D2D2E8DFA4BF1FC6285ED56BB83F91C2FC6FC4FDFF2000105F10B1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................1.!Aq...Qa."...2..BR#...br......6v.7..3.CSc...$4.s..&dt%u.f.......................!1.AQ..aq........"2.B#....Rb3..t.5u.67.8.r..$....C4.cs.Sd%.DEUe&.............?............w.....c.....i.A.....3...7.......7..P......%.........?Th..l./?.;.....$}..=5Oa...F.c.A/...D.D..]..y..3e.5\%.fo2.X.*]q.5Ee.}..i..md.T....#...-...Mu...9...-+..~w5O.);..G..'.;..).....A_...M.vV..y.q......,<.3.(...._K:..XM.......w.......9..T.......?b..a-%.c;.}..>....|.,lZKCEB.t...fw|.Sw^..Y..:.J.................t._P..v..j.1.R8.R....G..W*H<(Xi........i..xcu...WM.dqM>'W..g....M.q.....+.....b'..~....>..T.~Jc....fj.X.x..9...N.w.6:..>.......&.(h..u...t._...)_k#7Za...cZ....P...Y..;.V.,..xo.....f........Y...\6...M'L._

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000065.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.68130634150897
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:8sKNwwgxc6xEtUFJVXs92HIRMZnwuQBBwo4NLE:8sKNwwgq6OKDVXs9AIRMZnwuQBBwPLE
                                                                                                                                                                                    MD5:4D0935B3F5238C4D067F324EF6F56F7D
                                                                                                                                                                                    SHA1:0A9526ED7D2A0F611283561A192A1B51249E0D4A
                                                                                                                                                                                    SHA-256:B271C9D08327C2B0EBF6E36A46CB914E15CD996AB17E9A8032F7A8FAED80681E
                                                                                                                                                                                    SHA-512:FFFB370FA5B9758D4BDEC9BEB294C24971FA113571A3466DDD68D3C72A35E38CF52E5110632FDC713800172996FB26B7B5DE8C903415AAE50F41ADA4B8C5F722
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>...........v.......................................................................................................................................2...>...t.......v................................I.......I.qk..B.....LZ.V.......V..`k..$.3..K.V..`k..$.3..K.V...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............^.t].U.)y...g7.....N...^...............?x..3.O..,..*.........f...................................H....I.qk..B.....LZ.............^.t].U.)y...g7..........^.t].U.)y...g7...........V.......V.......V...........................................V.j.....V.T.]...V.......V...B...V.H.....V...B...V...>.).V...J...................;........4...4...4.."...............V...V...V...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4..........V.......V.....#.V.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000066.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 85 x 470, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):11197
                                                                                                                                                                                    Entropy (8bit):7.975073010774664
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:p9wNdtRKcVHso6zsqm06xaqZdingVzLZ7/PGSIz/yycRTbChh/JzhbEx15RGb:mdtMcVHqgAqTinMzLZ7/uSIz/yTR/mhF
                                                                                                                                                                                    MD5:DDC3CC30794277500EFE4BC6667EC123
                                                                                                                                                                                    SHA1:EFC9642C1F95B5FC38764476AE481649C016FA0C
                                                                                                                                                                                    SHA-256:7F5B660A1A0BF46C75AAF19B4F77A0E086DE003EC03AFC1F58D871D55AA5BA9E
                                                                                                                                                                                    SHA-512:25232A84604C3959634D33090238FEC8D51E40AD84EB3A08BB8522A81BE1E83378649C014E98E1DFCDF46B7BFAC92D8D2429211CD11D7EE0334C9C3DF7C1B6A6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...U.........1x5.....PLTE....................................e........................................................s...............x..........................o..............................................................................................................................................................~.............................m...............................................j...............................................p.......z......................................................x..............|........................................v.......................y..........................................................h...........................................................................P..{....bKGD....H....cmPPJCmp0712....H.s...(SIDATx^.}i@S..N....h...!..)....AI%..p.L."a..)..`U..,h..:O.b.:.j+.Z).b..zN.s..{O...&|..N}...${....~.....k}.[k}{.o^.D_..W:35ly..7rL....6n0.A...b

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000067.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.329988257088939
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:aszoj487p2tqYnVElLJMXSYp9xU3c0pyprdMr1EyPFX82JCh6lF:ass7p2gIElOXSO9yXERM9izO
                                                                                                                                                                                    MD5:3DA66D7B3EB549FFBD52114FDF5DB773
                                                                                                                                                                                    SHA1:8430534547DD9A11C4D6707DF1BB2963B9B7B88D
                                                                                                                                                                                    SHA-256:6A030C8203FBB471439E6A7A3C4BCB2D84A70067CD04E6A235C23BFEF477B1EA
                                                                                                                                                                                    SHA-512:76439446C5E7859EC74E3F9BF720430F0A662EC7244C591A5B65CD4BCE1D5D12F02CC3EE01975B9EE207B327451D11E354839F66472298C02BC09E25CA949971
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.o.......o..f5..%,..d,g..o..f5..%,..d,g..o...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............R.v....%.2R..MQ....N...^................,u....C...jl..5........f........................................I.qk..B.....LZ............R.v....%.2R..MQ........R.v....%.2R..MQ..........o.......o.......o...........................................o.j.....o.T.]...o.......o...B...o.H.....o...B...o...>.).o...J...................;........4...4...4.."...............o...o...o...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4..........o.......o.....#.o.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000068.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 88 x 574, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):19920
                                                                                                                                                                                    Entropy (8bit):7.987696084459766
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:DRSgtAxJx7bzvAsVSqQElOT4uHmpmvNYT9aPU+QtsC2LgfIqJZnbeyRB:DsgaN7bzvAsVdK4uGQFUZ6bU/p3
                                                                                                                                                                                    MD5:1BDAD9B3B6DE549162F9567697389E1C
                                                                                                                                                                                    SHA1:5D9C09159F07A3A9BDCC6C4B9BD9CB72D0184E6F
                                                                                                                                                                                    SHA-256:0908A4CFA23F93011176D47F45843E9CA2973030421996E8E27484781F54B0EC
                                                                                                                                                                                    SHA-512:475040779AC247BB5C3E11862FB55FBDDFA12D759EE86A33E11BC1F3B656D6CD0F9B25146C0113E43E1D8001D8867D3BC3BF7E6FE21F3A0016CB1F8B70B7A15A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...X...>......y=h....PLTE..................................t........iw..............................................._n|...Tds...ky......................................................p~.....................................................dr.................v.............................................n{.......ap}..........x.....z...................u......................|..Vfu............r.....w........................................~...................Zjx...................................Yiw............w..|....................Xgv{.....y...........................jx..............\lz.........}..z.....t..[ky........u..y.....gu................................{..........}.....u....................~...........y....r.....bKGD....H....cmPPJCmp0712....H.s...JfIDATx^...\.W./.}....Sy...(..4....D.-.....H...% .$"D.Qr.......`..;...6...N......s...^...L.....Y{.GQU`..~...j....{...-Ax.K..&.....F..I\i..

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000069.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8192
                                                                                                                                                                                    Entropy (8bit):2.9115189068321428
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:agsyrX0RtiNpE1Le9NVSL6MhwnXeT9RCqs4pyFrdMrHf0/FXK9zcejYp:agsG0RApE1MN0fcX49kqdYRMHIw0
                                                                                                                                                                                    MD5:1EB272EB93B2DD8224D141933EC2B3EA
                                                                                                                                                                                    SHA1:39EA327442192111122A915CE3C31EC9FD23CED6
                                                                                                                                                                                    SHA-256:C3FB2EE3E4EE8ECD61B7279702FC155C3F63CA1FDA976F714E90859C48E82F81
                                                                                                                                                                                    SHA-512:230C54D41FD5106610EE0BE865CCEEB82AF7D863CC72DBA2E48E518ED5D517AB315CB7F780C6C5FF4599E1669126C24F5F182F31985CCB05B11FC6281917DE6D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>...........v.......................................................................................................................................2...>.......H...v................................I.......I.qk..B.....LZz`b.....z`b...w. m.!.#dz`b...w. m.!.#dz`b..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............+..^07...(..W.J....N...^...............EZ..Z..J.<.Wz96.........f........................................I.qk..B.....LZ............+..^07...(..W.J........+..^07...(..W.J.........z`b.....z`b.....z`b.........................................z`bj....z`bT.]..z`b.....z`b..B..z`bH....z`b..B..z`b..>.)z`b..J...................;........4...4...4.."..............z`b.z`b.z`b..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........z`b.....z`b....#z`b............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006A.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):179460
                                                                                                                                                                                    Entropy (8bit):7.979020171518325
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3072:oiKXvL7lv0am/R1vrdH+9dK6zPQ6bbnGDpcGGDNMIOIMAT8q9Vc02Q57S4A+vMFz:+vlvC/HvgA6fGqGGJlO1qZ71W6CzDn
                                                                                                                                                                                    MD5:4E131DBFEC5C2462273CA7B35675B9D9
                                                                                                                                                                                    SHA1:CA037F444D819A118AC37D7AA3782B9BF94C1616
                                                                                                                                                                                    SHA-256:2A4A3530D652E227DDD5ADC096A95F6034718F7C380B07DB622022D768815059
                                                                                                                                                                                    SHA-512:C333ECEB1439D0238BF44FB7896E62DBA4C645B70413AA0F99C1F10E8DCD20C2EEE5C83F2E9DDE9A2494C85A6D8D13CFFFC4160E2F598E17867015F5244D656A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!.1AQ.aq...".....2Rr..Bb..#34.....CSs.$5c.t....%.Dd.6.T..u.U....E.7w........................!.1A.Qaq......2."r.3....BRb.#4......CsSc...$.5..%.DT.t67d..Uu...'............?..c.......p..z..i.....z......kj........F>f......3N...M....RM.&..-.~.Q..'.....q.a..w...-~......g.{..&.......V.n.D....>FS!n.....@..)...W..q..Wr{..J.gf.{.M$.P@m.,..9..&m.D...w.._...-.O........s.....h.k~......(.K...V..l.-...+.9.k......*......#.p#.O..9M..mF...C.......7+.AI....4vw.;..H......e..Q.u[.eUK.....z.....[.Kt...s..Lf.4..l{.....sh.............=..;..iqkj.m.a...NH......v..H..$..q.y......c...U[Mcf.......+...S-...^....4..T..YtL.x.v.;.....<...Ik|B.$.s8......3.+.8.l.. h.:....%B..W..I.QRS..,*x.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006B.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.352329065183147
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:c1012s6sQlF7RpPEdXt9Z+cRM1GbuRBo:EM2s6sQ37P8dXt9Z+cRM1GbuR
                                                                                                                                                                                    MD5:3AB54C4ED3E370DC61F70D8D3ABCB81E
                                                                                                                                                                                    SHA1:E1B1E547FD13C1A4131FE7F9F8E7F86389819DAB
                                                                                                                                                                                    SHA-256:B3B68731CB8EB097D3FDFE74344550AEEE8F648810EDFA56386DFC021278FC53
                                                                                                                                                                                    SHA-512:C3532F8CCEB0FE30DCE59D0ED32A3EF7E3098BBFDBF3C8E2C98A8E28315308B581C926930C5FEBDE563822AD56365E79A4058F1699CDC8E7C9E82DE7CC3145A9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZJ.......J..C7....H.ePyJ..C7....H.ePyJ....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............FeG.>..@.bN.I.....N...^...............#......D....`...........f........................................I.qk..B.....LZ..............FeG.>..@.bN.I...........FeG.>..@.bN.I..........J.......J.......J...........................................J..j....J..T.]..J.......J...B..J..H....J....B..J....>.)J....J...................;........4...4...4.."..............J...J...J....z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........J.......J......#J..............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006C.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):109698
                                                                                                                                                                                    Entropy (8bit):7.954100577911302
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3072:rDlmvIWr0aRtNCfShCWBxyCHMlcVG0Ezy4FR:rDliIfot8ahCWBcCHDVwR
                                                                                                                                                                                    MD5:8D804A60E86627383BED6280ED62F1CF
                                                                                                                                                                                    SHA1:E23FF14B10AD0762DD67FBA3CD6EFC85647C0384
                                                                                                                                                                                    SHA-256:494547E566FB7A63DD429EB0699FE41AA8998F8EA2F758D813FE3D56C3075719
                                                                                                                                                                                    SHA-512:0FB19F3D00159F2748C3A54E952E551B9FEA6910D67A54DECA8D099992E50383EADB92768FF1F75CFFAE82A7A157B1E0F77A2F0BE7EC64FD2324304FDCA46577
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...............................................................................................!"#.123..AQB$..aq.RCS...b..c4%..rs..D&....5E6'..TdUte...u.....FV...7.......................!"..1A2B..QaqR.#.br3.........C%...$5.....c4U..Eeu&SsD.6T..................?.....O.C.....^..R<A.g...[....3.....r.0.....nX.S....}...[.?Z.....A.?..~~I..rY|N.o...9......!...o7r../-.y...'5.3.U.s".-.0.1......SS...&.Q.j.*.$m.e..:x....`}...EP.?.7..~G(so.......O.....z.N..<....~^a.e...........p9.?<._..|......~.<@.D.9..G..?.?z.y?z.C.U.w..[.,..A.+........s......g...G.^....pz.xY.....d8.y.X...P..O(A.O..~:._.......<...o..4s..^.^b..x......_a.....|{c...:..X.....}.._...[?..NK.c...}.<......H.G....+x.Z..|....n...o....`.nk.#.%x......-|...|7......N!=././..w.8x.".8....'x........w...,>....j[w8a..}..lS..?.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006D.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.34699938466665
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:+BsRCyIrD3tp/E3y2XQIXHiI9JsPpy5rdMrlOzFXPRCd6ll:OsV4D3DEfRXHr9JO0RMQzkO
                                                                                                                                                                                    MD5:B1336DDA0C398B11E7BA475A6117A162
                                                                                                                                                                                    SHA1:CF10050EE74AF9694E57698B0F65C46E5C828FBA
                                                                                                                                                                                    SHA-256:8DB9EF970D1D83F81CD4D42E1DDD365428FD65FC5178C18D67406C1EF06F990B
                                                                                                                                                                                    SHA-512:A83FEF10D04DF74BF23179163D31962222C3C4DFD442EBC6FAE9A044BAE3A86343683C470E0B7FE56AE27FA5ABCE280CA6067C78A332084CE8546A993D54801F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ5.......5...7.....+.%+.5...7.....+.%+.5....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............`...u....O....J....N...^....................-vN.T..............f........................................I.qk..B.....LZ.............`...u....O....J.........`...u....O....J.........5.......5.......5...........................................5..j....5..T.]..5.......5....B..5..H....5....B..5....>.)5....J...................;........4...4...4.."..............5...5...5....z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........5.......5......#5..............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006E.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):41893
                                                                                                                                                                                    Entropy (8bit):7.52654558351485
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:pZvVQkUbOHxx3pvVmO5rsP5gUdXwFMuv53knzyncaXgRDqPU:pZkijV5wScXwFMYknzucaXgRyU
                                                                                                                                                                                    MD5:F25427EFECFEE786D5A9F630726DD140
                                                                                                                                                                                    SHA1:BC612A86FF985AB569ED1A1EA5FFC4FDB18FC605
                                                                                                                                                                                    SHA-256:5A36960DF32817E8426BD40A88F88B04FB55B84BAEF60F1E71E0872217FDB134
                                                                                                                                                                                    SHA-512:B102F34385196D630F198667E874F25ADBC737426FDAE0747EC799B33632E5DC92999C7C715DC84D904342738930267AB1709870BDAA842243E4C283FE5E1554
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................!.1AQ....aq......"......2...Xx..9BRr#.b3$..&..g.8....%F'G.(H.Ss..D5E..v..W..Cc.deu..7w.h.).....................!.1....A..Qaq...Ttu.6..."R..5...2B..S....bcs.Dd%&r3C...#$...Ue.............?..R...%.R...t.MQ*.l...v...V]..n...Zw....M....4..F.&&bb0.:]l......ay.r<..3.l.Q^.........I54.N2.8..2s...w..r6.......[1Zh....O...9..>...B......x]...r.\.\..v..~....y.QT.3.......=....r..}.l.....o;....M..C1....w)...+o1f.]...MoA.E..s5..i.\....miGsy..m\.Zj....I'YU.\tU6La5v.>.K..m.]1.......k..0....</5v.V7lY.e.vV.+./[....f..u{....s.}.Rb.Z.....Y.6]..m....V.\...Mr.=r...K...l..%..m^.......X.(..fG..[F*ly.jL.a4..vs..o.e..q.9km..w1.yg.....r_.*h.n..5i.-.{Y.l...<...'Or.s..Z....../JP.....\FV.S..............m

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006F.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):2.6072368476613397
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5CE/ddCSlEARoDlPV9bUA1slYoHPjOlmjlq+:MEyARgnZ1ZMPX
                                                                                                                                                                                    MD5:6C0BF22356ED1043D34E94B75984B289
                                                                                                                                                                                    SHA1:D5A77910102FFE2C944E6EF547B1FAD10EAECA40
                                                                                                                                                                                    SHA-256:C788876B2DF49EA888C09451D51A4E36F3C36D0B191951062C74C29CCB29C55C
                                                                                                                                                                                    SHA-512:8107376279B449DB4F86DD4F3E32C4E6CBB1065B34FA06E9255E90957D6FBD68C8397600E68D47DA47D8E2E719A2B34E82997A032D53ABA785CECDBED2CFA6A3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:...........................................?..?......................................................................................................................................................................g.....xK-:............aT..K........:"&.....6...x.H:"&..J5.@....=?.....J5......g.....xK-:..........................................................................A.{..8..A.{..T..A.{..]..A.{..d..A.{..r.......n.....`......................4..~...1...(...(.......C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.\.r.o.o.t.\.T.e.m.p.l.a.t.e.s.\.1.0.3.3.\.O.N.E.N.O.T.E.\.1.6.\.S.t.a.t.i.o.n.e.r.y.......S.t.a.t.i.o.n.e.r.y.........1.......S.t.a.t.i.o.n.e.r.y............A.{..1... ..$....S.t.a.t.i.o.n.e.r.y.......:"&.....:"&.....6...x.H.J5......J5.@....=?....2...........0...`....................J5.A.{.O7................................c..,............................c..,0...........W...7$.N.i^u.K:B...............A.{.A.{..1... ..$....S.t.a.t.i.o.n.e.r.y...

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006G.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):3.409452104940445
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:YTr7tkfosmaR10GsL+0KtrZCrBJmQEtaDsNF/hZVbsPJmQEtaDssDEZxlYJmQEt2:ImfHmK0l+08jJJDbPUErl7p/SKQj
                                                                                                                                                                                    MD5:DAE5FE09741088BAACC9F6C79420FD15
                                                                                                                                                                                    SHA1:12F5FF3B7D97CA42F4F9C95F040C9A5393152D7D
                                                                                                                                                                                    SHA-256:33E026086BBEAFB86E7FAA4AA9C21AB8118C84EBDB2DA4735F5D591E30C4FF18
                                                                                                                                                                                    SHA-512:56214A65D1FEBE4AEC9E3412EECFF640473653F8D25F1C86DC5F848DAD5B446A76E2475F169C6344AC30C804B688B33676459282B042B9BACFB8AD91D4547BFF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........0.......................................................?...............................................................................................h.........................................'.......'i....>.;...Mm.X7......X7....3i...D.l...S......q1gn3.......'i....>.;...Mm..'..X7....3i...D.l.X7...........X7......X7..................................................X7..w...X7X.....X7..4...X7......X7..$..b.`T.9....eT(P...J.T&d................4..(.....x.(.....b.`.....b.`.pn.I...Q./..S]......S].pX{...b.....2...v.......4....................X7.b.`...e..J.......................b.`.....S]...c..,0...e...B4.$........[.-...I.......9........................e.......eq...A....J.zS]......S].pX{...b.......eq...A....J.z..e..J.K...E...)#.x..J..b.`.pn.I...Q./..b.`.....>.................'i....>.;...Mm.X7....3i...D.l......................J........'..c..,0...e...B4.$..............E........................................0...........e....4..................T.o. .D.o. .L.i.s.t........s.)..O@

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006H.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12288
                                                                                                                                                                                    Entropy (8bit):3.9112658940238667
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:RsRzu6/MRDVwFtWXMgTCP3L+Rz+9v6p4FWKMJn6e5DjV9aVtydpRz3:msH15RzWWkW
                                                                                                                                                                                    MD5:3294B081C8CF9FD199CE11EE1F77CF52
                                                                                                                                                                                    SHA1:C8FC282B6FD3EBC52DC9953739360E8B46EBC50D
                                                                                                                                                                                    SHA-256:3C83B2E563AADD74F8D6A5394EB13B504E796FBCBBCC13F9B0F8EA117EFEB5E8
                                                                                                                                                                                    SHA-512:0013E77FC71F65C8EC16AFAFF9FB49397D575B8E244FA32D7260DDB9FC3E7BD0E5D31CEA2DA5F3D4F8D537D75B6C890589ED1A5F38822050FC926C9956FD896B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>...........v.......X .. "..2...>...d...<...v.......@....!...........................................................................................................................................I.......I.qk..B.....LZ....;........."...t........."...t........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............m......2....7#.....N...^.................38tI..h.Wro.........h...L...............................D....I.qk..B.....LZ............m......2....7#.................................................................................................j.......T&n....................H.........K.............$...........-...J.....z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.5............(...#...8.....z...,4. .......$>........4...4.@..7.....................D..n4..o4..p4...4. .F

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006I.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:05:55], progressive, precision 8, 612x618, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):68633
                                                                                                                                                                                    Entropy (8bit):7.709776384921022
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:tapXpSTJDOkFGdJdBk/slsbfsw1imaapnbvD8:U2OjJr6b07m1bvD8
                                                                                                                                                                                    MD5:41241EE59AB7BC9EB34784E3BCE31CB4
                                                                                                                                                                                    SHA1:98680761A51E9199CF3C89F68B5309FBEC7EE3CB
                                                                                                                                                                                    SHA-256:035B26DF61855A3F36DBD30FDAB0C157C04C9E8AE2197EA4D4AEB3E82E6A4C2B
                                                                                                                                                                                    SHA-512:3EE331D5BCEE4AD5D3FC9661D4AB4053F7D351591A094334F963C33C9D0E32CCCABE9334AD7C308108CE99617E064FE848DCD469ACD8D83FBE5C4452DE523D8F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:05:55.............................d...........j...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?../$.W:SZ./...9.....-...u......r.....].c...@W_.7...+......v.+PD.I..-<1.pDn-\.....p.$....0.}V....\..>.~..XN.o..l(E....ik..o.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006J.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):20480
                                                                                                                                                                                    Entropy (8bit):4.084379266366291
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:lrRbV5MCQjvzRruadSEwLrFw/gEod2G6vEmXODTnE7jaXawPWU6nRJvZwAx01+30:xRb3w/962o3E7Q0RJi4rMRf
                                                                                                                                                                                    MD5:64ACE86BE299BE85057EFB314B6D16A1
                                                                                                                                                                                    SHA1:15E4674C521210587222FA3C1696B8B11C8249D7
                                                                                                                                                                                    SHA-256:05F5F7EAD64E1F506FE8CAC235F94A004E858C8622B3AB769016B276053EDD8D
                                                                                                                                                                                    SHA-512:B1E2D0DAC2EEF2CA396423A23D2CB760E4BF8C17BC07F21FB1FDF0641C60F92DE261FA1984BB01A1645F990187F8C6C1F07A3168451ED366B9C57B2CD0441EBF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:^...>.......L...d... .... ...9..^...>...........d...h...@...@;...........................................................................................................................................I.......I.qk..B.....LZpd..1...pd..T..8.Y..t[..0.q..#..lk....0.pd..T..8.Y..t[.pd...I.qk..B.....LZ.I...........pd......pd......pd...........................................0$.....0 .....0$.....0..)...0 ....pd. .N.&pd.....'pd...@.....'pd.2pd...z...,4. ...."......$>........4..`..7......L.o.w. .P.r.i.o.r.i.t.y......................pd.:pd..pd...z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.2.3............0..z... ..$........................................2..7.........1.h...?.......?...?....rA\.-?>...o.u.t.l.i.n.e.L.o.c.I.D...o.u.t.l.i.n.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.4........?ff.A......'pd.%pd..pd...z...,4. .......$>........4.@.4..`..7.....................D..n4..o4..p4...4. ..1.......pd.*....pd.....%pd.#...'pd.&...9pd.....

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006K.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:08:07], baseline, precision 8, 595x450, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):59832
                                                                                                                                                                                    Entropy (8bit):7.308211468398169
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:HS9SYFtN0+CRa9mfJy4zBAiIJhzrkHDV2hJK:yAmta+Tyy4zBIJW5WK
                                                                                                                                                                                    MD5:DCDD543A4E0BA2C1909BA095D46FFBCB
                                                                                                                                                                                    SHA1:B86C89537138FE07255354202D3EAD0B53B3C54D
                                                                                                                                                                                    SHA-256:28F334B77068F71F5F92A95695433B950610204A0E5580CE567DB8FAD4993ECB
                                                                                                                                                                                    SHA-512:5408C3259B7F3288A4BEB04342799AD5FE3A6F0EC7E92353B29B7E7E538DFA9903B39637226919E0421BC422635D25F5F8069DC7441864DC03E1B909BF5C2C84
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....fExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:08:07.............................S.......................................................&.(.................................0.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................y...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?......;R~+'....xh..~.n-}.......Te................^B..IU_....._...S......h.......!....9...A}6V=J......C..c.....Ug.Wh......

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006L.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):20480
                                                                                                                                                                                    Entropy (8bit):3.250693438832101
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:DCHXTBeDMPNQPHwNSg6VkgnRJ6RNuhbwqf:DCHXTBeDMVQPHwNSLFnRMRNuhbwq
                                                                                                                                                                                    MD5:8ED002F83D5D4BD56BC43B9AF10DB9EC
                                                                                                                                                                                    SHA1:7559094FE97AEDA56DB925E4FC2106BCF96EC876
                                                                                                                                                                                    SHA-256:3C0CA3E4E0BC165FD2683E674ED783AB7B1B6F564B9E860869B5CBB03164E6E0
                                                                                                                                                                                    SHA-512:425DF66A80D787935F682EDB1BDA3D750F89B92F6E2ABE9885D4B9BA408E416D02C52C9606B26D6A6EDABE9B2B1EE8B9CF27D32046108A50838528BD46EB191B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>...........v........ ...-..2...>...B.......v.......@....,...........................................................................................................................................I.......I.qk..B.....LZ....P.......8n......D.....8n......D......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............\To<...1..2........N...^..................=.W.J.._.js7................................=.W.J.._.js7............=.W.J.._.js7..........\To<...1..2....................................................................................................j.^.....T'........................-..................... .L.........3...I.....z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.6................3...9.....z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006M.bin (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):53259
                                                                                                                                                                                    Entropy (8bit):7.651662052139301
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:dCiCBBenRYWDBCipMYGTbYGLHbXxoP/qEF+MU50qyJ30h2W474S/Aq/xc4674bi5:dCiIQXBCiwbDLHD0/sFyVel4Pi4UgE
                                                                                                                                                                                    MD5:2EE369ABB7936F8C28FF0ABDD224EA05
                                                                                                                                                                                    SHA1:FE9D304A7B49E31EAE439369ABC548E265149636
                                                                                                                                                                                    SHA-256:FB12D59B8BE911247BBAFDD416852E8B74B028005A141CB4DBBBA109B4B6ED2C
                                                                                                                                                                                    SHA-512:5CF396CA472C32AE988600176114106CB1619404DD899A3867A5AB43DC90583B771EF69B14EF50E56A21F038BF51D8463C6ADD2DE9D4CB523F6290E24A4DECB3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..AQa....q........"2..R..Bbr..#S....3$.....C.4v..(X.DtEUV.....cs..Td.5uf'Wgw8Hh........................!1Q.Aa....q.2...."R...r..3.t..U...B#S.4ub..C$d.5Ee&'7c.D%sT..............?.....?...k,lk^...M".Yo5.Qp.&s}b.m.:...W.x}.*.a......N1..d-n.-..^..b..TZ.W..."....F....^......ve5...^...2.:i...........~u2pK.z./&..u..L[I....Y....@y{|>..MN=:....Q[..H....a........|%..4fV....).....^.9b.f...F...p.=.W...aZ.........Z.t.n.....z3..[..lVh..\.N-.._.sK.y.._e.G.jig.a.7^....u...*.p.5.a.].........u/u..D.yl.XA..f.z..~.x.....N.....b=.uv.2.t.'.N.-.H..n.v.a.A[.Z.....T2...._...:....h..l.E..sm..a.3I...RE...fWb.Ek.0.#.)..Y#T...........u{....U....s.].7_H.2.`O6...P......}..4LR....]4.mid...

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000001.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):0.04401584019170665
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:RRk//:Lk
                                                                                                                                                                                    MD5:CD74ABACE8A00B17BD8107BC5982C21E
                                                                                                                                                                                    SHA1:D53193CF8A43D766FBFA52976192F44D6B0F79B2
                                                                                                                                                                                    SHA-256:B670BC07C9CB554511180DCF3F6A2C7818E8CE6E67B84784F0EA4D35EC61D516
                                                                                                                                                                                    SHA-512:1B48A37FCF0F9FB9ED9B31A8F3E36596689BF1EEC6F41F5EFA3C728121944919CE7A81F0379A108D80AA051CFEF07DC296F9C0691FC8855983B2F29EC15C7FEF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000002.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):0.4971149941647013
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:vldawlAuil8xt/l2l32k/qz/NGrGulHVjHNGrGNl/OkdIMl2hliJw5Y9r7jxzElB:NTcLzRaYl5GwJ/fj9w1EV7e
                                                                                                                                                                                    MD5:A32C1D9A9DE87230F2D28E8BB5431F01
                                                                                                                                                                                    SHA1:CF147650C5781E6696D14D65869D3764E78E7BF5
                                                                                                                                                                                    SHA-256:41237956811B4251FDD7CCB56A4215B62DD5641A942806B9829AD2314B90BB80
                                                                                                                                                                                    SHA-512:6BBA21C6221F53ACAE1EEEBFE77B573B6A3C61AC58637848C7B33BB0020DC568FCB95366E1445059FEAB1C390129B7ACB84829CFAB8A1DE84D1B20CCCA1222E4
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>...........~.....................................................................................................................................................................................................B..0w..................................B..0w........................................................................................................................P..............................................................................5........m;.H....7.5N..........Fq/U.........9.]@{FE..K....A....N...^............................................................................................................9.]@{FE..K....A............................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000003.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.5321830350265895
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:/0N5LYr3+xz3LRhxyw0L1/4NtBlkw0La/SCLBwEwLq096B6ggPxXb:/u5LYr3+xj1hxyL94NtgLu/SCWEwu1
                                                                                                                                                                                    MD5:B783C213FD7FBBA8C9C010C5AEA86603
                                                                                                                                                                                    SHA1:124BCEE86AC2776D87BD830FB32420DD977150FC
                                                                                                                                                                                    SHA-256:A6314C848EEE13CC99B48C50455DE1F5B0CD74BFADB3DD8332CDB0B71AFBAA3D
                                                                                                                                                                                    SHA-512:880FBBFB06F00E3DFA8F104B9AF65EEF99F8FC115794257C67DBEB21BF8EA5580400AE79F39E4E6C6F27B2F38CE91928B98388CAD5F38DE087A3AA48EC339A8A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:j......@0.......................................................................?.......................................................................j......@h..................................................`-"S.2XS..tJ..TE......TE...I.8.Oz...t.V....&....o..t..(...T.;.8..,_.{.(......`-"S.2XS..tJ.........................................................................(.......(...T.;.8..,_.{..TE......TE...I.8.Oz..2...^............... ...:...........(....TE..t..N...........................X.........5..............."...J.T$......T%q.....T.Q.......TE.....8....c..,0...e...B4.$..........C@RQ.H..B......Y.....................Rs......Rs...H..!..B...t.......t.V....&....o......D.5D.........J.2T..F......N).J.....t...F....e.ZK........>..................`-"S.2XS..tJ.8..:.Y.=,....W...t...F....e.ZKN.......N..X...J..0.2=............t...F....e.Z...............t...c..,0...e...B4.$...........I...M.....0...............................0...........e....4..................T.i.t.l.e.......|{

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000004.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8192
                                                                                                                                                                                    Entropy (8bit):4.716064569068485
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:DsLar9soNGNNPLX2UsRiwcWLPyjgLha9gPww4OR:4kkNNPjXsRiGa0higPL4o
                                                                                                                                                                                    MD5:B9BE20B82BF19DD14C66013CC15CA2C1
                                                                                                                                                                                    SHA1:0A9972865DA395596FDD34C15D6462F00F76EAF8
                                                                                                                                                                                    SHA-256:7D44DECCB3E714DDFA34E0C418DD54392F2AEFFC2E29E09908711A2816F74498
                                                                                                                                                                                    SHA-512:768DB30EAAE3C9BFB28DEC74784C406AAAA127ECF8EF1A85AFBAF339DDD18AE3B109BB033CAF09533E0ED6EFC782A850271BF8C338023626000FE046AA59239D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......t...v...h...................................................................................................................................2...>...P.......v................................I.......I.qk..B.....LZ....4......~..N...j*[i>....~..N...j*[i>......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............5.U..5V.8..w..r.....N...^...................O`.K....C@.............>...............................$....I.qk..B.....LZ............5.U..5V.8..w..r.........5.U..5V.8..w..r.........................................................................j.......T%;...............W.....H.........+.......S...............Z4...........................................4../4......p...............C.a.l.i.b.r.i.....................:...k.....z...y.. x.. ...........$...........7...7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.3

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000005.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):40884
                                                                                                                                                                                    Entropy (8bit):7.545929039957292
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:MCBOA4d+ElOXJ/3pI7cRBiL7L6qERqGz65WXzZqJsKQSbIsTT6XB:hIAU+2cGdLX6qBG4WDZl4Ihx
                                                                                                                                                                                    MD5:7379775A1E2AB7FAB95CFFCE01AE05F3
                                                                                                                                                                                    SHA1:3D3DDFD8AC7E07203561BAE423D66F0806833AB3
                                                                                                                                                                                    SHA-256:9301DB6D2D87282FCEE450189AEACE16D85F64273BF62713A3044992B6B7A9E9
                                                                                                                                                                                    SHA-512:4B5006E620E80D3A146944649CF4CA619782CAD7E8C4CD0D1DE0EBCA0FA05EACB7378DAFCEED3E26F5698B07F19604614D906C8F51F898660E2F129D8DEC6F62
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1A.....Qaq....".....2....BR#S..br...3T...C$.7(Hx....4D.G..Xh.cs..'..t...%...8.....................1...!AQ..a...q"2.4Tt.......R3S....Br...#s...Uu.bc.de..$D..6..C%E..............?...z...;sB.yv...........]t.\...n...../....m....M.=.3G+..x+.....S).*&.J../..8..O/+..sG...p...<!....~.c..C.w..,[oHom.wc-.J.~.......L[..6...'..i_..S;...!Y.z.q].EK..M.x...i.x.+.;.+...}....#......f.)........e6V..p.;........s.)..Ml.J......IU.6...<9+9.^..l..Y...[._...2..^..j.ia...._..3.;...~..<3...;......z.^.......]..Qk.,...Yk...3.3Jy^p.}....q...I...&..t.......;..9.g.GH;..'...%...)..[..y..../...zCn..>...'...1e.Y..;....]..7...N>t..m-.j.............H^..T\.q.ru...}...eTn]I'r.^].#..wOY....v

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000006.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12288
                                                                                                                                                                                    Entropy (8bit):4.440739445740616
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:Lsq41qBGLkh2gUMUA8Le0egr8oDdTgbRiu38AOwXivRkLRDCe0RNmGL9fQfRB:wFsalgt4e0B3DdcJn9ivRkLoe0R75e
                                                                                                                                                                                    MD5:70F889BF5A9B2631D97F9183939E5C6A
                                                                                                                                                                                    SHA1:5887C99AB23F07DB275F6070A01EAB1744195360
                                                                                                                                                                                    SHA-256:30BE8DE7FC8BC71BF6C6CB1ED060336E6047756AA7A870C0BA48CA5B5735C960
                                                                                                                                                                                    SHA-512:3F1CE48CFB3AE113915E280D8155D1764E85BDFCB848362228F305465359CCE4DD30FEB2EE28615A04935AFCB3E8C19841565C67C2ADAC9993DE220138DE9E99
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>...........v........ ...)..2...>...B.......v.......@....(...........................................................................................................................................I.......I.qk..B.....LZ...H.....7.`&.&..-.l,...7.`&.&..-.l,.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............}%"..w.1Pw...9m....N...^...................*.E..TF|X.B............................................"....I.qk..B.....LZ.............}%"..w.1Pw...9m............................................................................................j."....T...............T........... .A........... ..........3..:..8....z...y.. x.. ........ ..$...$........D..........7...7.........*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.1.5........................Z4...........................................4../4......p.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000007.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:19:29], progressive, precision 8, 221x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):24268
                                                                                                                                                                                    Entropy (8bit):6.946124661664625
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:d2wiieoHTRh5a1HAteZCWOZIM+L7WhNjYn:8wHFHJ+/OZIKhNO
                                                                                                                                                                                    MD5:3CD906D179F59DDFA112510C7E996351
                                                                                                                                                                                    SHA1:48CDB3685606EDD79D5BCDF0D7267B8B1CCBD5A8
                                                                                                                                                                                    SHA-256:1591FD26E7FFF5BE97431D0ED3D0ADE5CFC5FA74E3D7EC282FD242160CE68C1F
                                                                                                                                                                                    SHA-512:2048CBA13AF532FF2BCC7B8B40541993234BD1A8AB6DE47B889AF3F3E4571F9C5A22996D0B1C16DD6603233F6066A1A2A97C16A6020BEDD0826B83BAD0075512
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:19:29.....................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................$.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....)......[]t.\Z..g......A....&D.$LH._..X..Xl...`....cZ.X.........>......f.Z.X...]..~L.S..@..I$..I.IO.....x...s.g.[f.h{9..

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000008.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12288
                                                                                                                                                                                    Entropy (8bit):4.643813499819591
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:PsiiQIbCO1uxqoqNhjjCg2Ss/nO7+b9GXRfTRptIkv5Nq72wB9dMZMw:EiHKCO9X3jGgQ/n/xYRfTRpxNQ2wrda
                                                                                                                                                                                    MD5:4F28F119A9646001202CAC029D795317
                                                                                                                                                                                    SHA1:1E8B3A5A26B28CC77FC35AFEDDB6F7FDC881FD93
                                                                                                                                                                                    SHA-256:7110978FB28B6CAF683085A6DD43EAF6D37D52694A76A5367CC8D87BFAC1B293
                                                                                                                                                                                    SHA-512:E7DFBBD44690AD91562700CD7EEC2930F3D7EA02F2CEEAA5E22988DF89B64140C719BDC96046EE26CAEC9348B889BA6750E152C028C8ACDFC1C6C061E893AA58
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>...6...z...v...N.... ..X,..2...>...........v.......@...H+...........................................................................................................................................I.......I.qk..B.....LZ1.5.N...1.5.a.6.8....I..1.5.a.6.8....I..1.5..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............<e.......(+V......N...^...............c..He.>I.B.H.S{5............P....................................I.qk..B.....LZ..............<e.......(+V...................................1.5.....1.5.....1.5.........................................1.5j.9..1.5T....1.5.....1.5..s..1.5H....1.5..0..1.5..`.&1.5.........1.531.5:1.5A1.581.5..z...y.. x.. ........ ..$...$...............7...7.........*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.1.1................Z4...........................................4../4......p.........

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000009.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):39010
                                                                                                                                                                                    Entropy (8bit):7.362726513389497
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:6tCjwO+E+KW0ZtOgepcoWW4pAWQ6/KWcR474HOAZaDfK:68j+E+KW0HOgep/72/NKWcRNefK
                                                                                                                                                                                    MD5:9700DE02720CDB5A45EDE51F1A4647EC
                                                                                                                                                                                    SHA1:CF72A73E1181719B1CC45C2FE0A6B619081E115E
                                                                                                                                                                                    SHA-256:7E6A7714A69688D9FFDF16AA942B66064A0C77FCD9B3E469F89730B4B9290C3E
                                                                                                                                                                                    SHA-512:5438921467D62376472007B9EBF3C35C9D9FE3EDE04D99A990129332D53EBC8EE2555C0319A4F7C0DF63516F29CEDF2171D8B6DC34C9FCD075C2CA41EB728660
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!1..A...Qaq..".......2BR#...b%&6..'w.r.3f7W8.s5EUeF.g....CS$4.Vv..Tdt..G..(c..u.Hhx.......................!1.AQa..2.q....".s...3.4BRr.#......b.$c............?........uf.....t...;..[...W.h.....-.k.f..i.u..KQ..b.F...rM%/.8n.S..=9.....G$O;.f.}L..N..U._i.[.X...3.~....S.~..+t$...c.5......{..X/..#.G...}s....6......^....o~.$.\WA?...^*w[O.~..6..~....a....~..:..0.......{O...|.s.u._w.........i...........{K...._.?.../{.....A..8....<g.iu..<..................X......|]v....D..9.k.w.|-IF.Tv.-.&.........."'.4.b....z.._.Z.....G...u.xyt./_.q..m>..S.V.Xdc.bw.T.W......g..........}s.._..?....U]_.......`......>.|'.~xH....,...?........?.q....o../..R..;...Y.G....A"?......?.<..1...w..o.M.........tco.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000A.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12288
                                                                                                                                                                                    Entropy (8bit):3.9601337984542515
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:Qns+Q9vUWIQaR71EgReksXX0K4AeAXABXz83wqQaL8Yoii5TFYXXuELWP:LJvHsRphReJk2AFzWwqQS8bzJCXs
                                                                                                                                                                                    MD5:BA293FFEA163D1AC2C41708BF085FD72
                                                                                                                                                                                    SHA1:6FD1DBF4F6C3E7C1A8612DC3856CFE8F94849A18
                                                                                                                                                                                    SHA-256:3811AF7FE9C646822D5EC01B1735DB77A3A950A3251CF2ADF3A77F26154CD569
                                                                                                                                                                                    SHA-512:E5BA36D6FAFC47E6BB6423F11201B2370651E16A47F92774BB5787411D4477CD52FAE683DD3F72E2D0A98C2924B8CC449DE86FEB0EDB5513199575FE6D2654EE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:....>.......B...v.......0 ..x#......>...........v...^...@...h"...........................................................................................................................................I.......I.qk..B.....LZ9{S.....9{S.rr^...-C!.H.....&o.-....H.@....9{S.rr^...-C!.HW9{S..I.qk..B.....LZ.I............I.......I...................................................I.t.....I................................................................4..'...'.............A.........'.... ....N...^................_F..X(G..8.+.S........b...8....................................I.qk..B.....LZ............A.........'.... .................................9{S.....9{S.....9{S........................................9{S.....9{S.rr^...-C!.HW....8.......&o.-....H.@2................................I...............................9{Sj.#..9{ST.G..9{S.....9{S..Q.....H...............$.7................!.....z...,4. ............................"......$...7...............T.u.e.s.d.a.y.,. .J.u.l.y. .2.8.,.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000B.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):59707
                                                                                                                                                                                    Entropy (8bit):7.858445368171059
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:k76rvGc8WKC2/UX1uEgVRY/jvv9CblyL/T:k77Z5C2/Ow1e9CblCT
                                                                                                                                                                                    MD5:47ADB0DF6FDA756920225A099B722322
                                                                                                                                                                                    SHA1:851946B8C2BD0BB351BAEECA9E5BB6648A87D7CA
                                                                                                                                                                                    SHA-256:EC8CD7250F3D82E900E99114869777EE859EC73EFFABED108815F65742078C3A
                                                                                                                                                                                    SHA-512:85A9920E1CE4A2FCCEBAFA425C925DF33580FA3C3C00178F058539B2FBC0163866DB8A41B320E2EF2CD217F00FFA06A1A831C728D3F9F910C9EAC58B5DA76E2D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..A..Qaq"....2........B#..R.b3$..8xrC4&'W.%e.(.c.d.5E6Ff..h..SsTt..u...Gg..H.....................!.1..AQ.aq.".......2..st.BR..56.r#3.b.S.4c%...$d.CT............?....3.7...G:../P....z..K.:6..w......6....... .z7...~.....{gdF60...9....{...'[N....m.........z...g{.......7...4..1..=.z...._..p...m..Icd.~.v..9.P..0Z(.<j.......R6zm.....v.z...>x..)=g........zo{..w..f..y.t.....%.D..#.}.I.>).H.QM..cLD..x.../.^y.{.............y.=^.......I.T.......U..0_?...u..og..3.ky..K....6w...Dc......~........ik.z....N...en......_.....x....._u...4.{..P...>.....}.......>.R.....m.....[mt.....}.........|.....m......~....B.F.]C.36..q....yg...{]...+.DZv.9<.o..;..N.n&im.,....w.3...V.s...Y..e#$.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000C.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12288
                                                                                                                                                                                    Entropy (8bit):3.8499469520377754
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:0s1gWu9R5tzKO07ZKXplRlYkrCWVYq9nCuAmwwhg:J1g3OO0lEplRljCVynlW
                                                                                                                                                                                    MD5:4AACA71047E812FF9E1DAB4B638B2A56
                                                                                                                                                                                    SHA1:53DBC5CE39C53054470312497F65E810DE253DAE
                                                                                                                                                                                    SHA-256:F863886FBA1B9B3E90DB411147C4E2A94753B6364611191B34EC1C64A9E9B175
                                                                                                                                                                                    SHA-512:4DC885CE272AE2628D3BFD36A44ECA23EE50CABA28B9DCB64F42E3752425CF965F6DC632AFE6A3B6BDB86996E2409C33A516A90819EDDE5312089A570A8C43E2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>...........v........ .. "..2...>...d...<...v.......@....!..........................................................................................................................................0...<...0..q..k..k...6..I.......I.qk..B.....LZ0..q..k..k...6.0....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............s[o.%Y.(..h}.......N...^..............._.>...E.V.C................................................D....I.qk..B.....LZ............s[o.%Y.(..h}....................................0.......0.......0...........................................0..j....0..T.T..0.......0....|..0....;..0....h..0.......0.. .W.....'0..20....z...,4. ...."......$>........4..p..7......S.u.m.m.a.r.y........................0..30..80....z...y.. x.. ...........$...........7...7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.9.............0..

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000D.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:18:09], progressive, precision 8, 164x641, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):27862
                                                                                                                                                                                    Entropy (8bit):7.238903610770013
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:LTawAZvhbrXzDc6LERLQ/b5vXOl6pXQ/wD5OUMrdRUUhCplQg0ESSz:6wm/vT/b4wxoqbdUhWnSs
                                                                                                                                                                                    MD5:E62F2908FA5F7189ED8EEBD413928DEE
                                                                                                                                                                                    SHA1:CA249B4A70924B73BDA52972E9C735AEC35A0C5D
                                                                                                                                                                                    SHA-256:20ABE389C885E42B6EBE9E902976229BB6FD63C8C34CB61AA70B8B746209F90A
                                                                                                                                                                                    SHA-512:EE8D1821A918BE8714F431895E7223D08036E88A4FDB9A5485EFF246640EE969A69A8AA4E2E9DDC35BA75FB6D4E95092A286E90B477BD6998C313639C2C31F25
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:18:09......................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................!.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..P.v..+..n(a..Q..S\6....Y....D......} w#.b..]l.5.RU..k...... ]$.$.........f........?.z@2uU...7....?..|.Q..I.&.. ......"T4)wdH.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000E.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):20480
                                                                                                                                                                                    Entropy (8bit):5.418876134442375
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:CA+A2BMOzCgUSxylP3N+LQDIb0VVNAabYPWy0188CtDjn/Z9d6F1yKDPfgXXg:NsebITIc
                                                                                                                                                                                    MD5:F43DABD75B415A43449764A3EDA6FCF4
                                                                                                                                                                                    SHA1:3F91000F9F4C8ED09F387C0A8ACDC0E9FAB6F9A6
                                                                                                                                                                                    SHA-256:7756C6CD41347132D5EC694E38FF3FCE5FF47DF6276D2B50B3B369895A0E5AF2
                                                                                                                                                                                    SHA-512:259706E832115CCC1F11E2D76C93893FE4D9245FFD75F337E3FD138EF68955732D45D493FE47B31A814EEF502117FAFE21C4F2FD6F6A40B72C8EE436DCE0B2F8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:...@j..@................X@..@!...M.........@j..@@................L..@!...L.................................................................................@j..@X...............`L..@!...L.........................q..$.>?..[.Q.............:.....Mr6B......t..,j.{..pQ.......%.}...\......z..|.;...8..JYx.z............".5.....".5..................................................m(T%..._.*T".....+T!...}.,T'....S2T.*..".5.....".5.....".5..............0...........e....4.........................A..:4E.2..p1......(...`.i.....(...(...B.a.c.k.g.r.o.u.n.d. .-. .Y.e.l.l.o.w...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.r...P.a.g.e.V.e.r.C.o.m.m.e.n.t...P.a.g.e.O.v.e.r.i.d.e...P.a.g.e.N.a.m.e...2...0.0.0.1.9...1.....0...U.n.t.i.t.l.e.d. .p.a.g.e....P7......P7..$<I....Zl..UK......UK..o@...4L..2...:....... .......0.......X...............v&..m(...+.}.,...............0...........e....4........................yf.....F.Q.........(...pO;.....(.......S.t.a.t.e.m.e.n.t...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.r...P.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000F.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.085781209145456
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:bnPEPnsp6ND6mGDtTt8Eau8nXH29HZM1hUTo0rdHrrzEIcdXIAc9uh:4saGmGDP8EauWXW9IUTRRLmKs
                                                                                                                                                                                    MD5:058D63E50E4A9441791AE48A967EA4FE
                                                                                                                                                                                    SHA1:38A4AA73741A9A1C240D403E7E3FE352F2BA612B
                                                                                                                                                                                    SHA-256:477648957FDADD24C292ED06A70A7465CEE3B0CC87452202A8A28BFAF34F4783
                                                                                                                                                                                    SHA-512:CB28BF93F95445FEBC11E1275E29A03960598AC7EA00288AFC5A375E881E6E4CF22639580463B4BC2C72B55FA6EFFF3DA39D74613D9608130E424B99FAAB5DF1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>....... ...v....................................................?....?.............................................................................2...>.......|...v...H............................I.......I.qk..B.....LZ.........OtG.......~...OtG.......~.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............2|..o.......<.%`....N...^..................@..@I.~.8.:M.........f........................................I.qk..B.....LZ............2|..o.......<.%`........2|..o.......<.%`....................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4......7...7........................;........4...4...4......................#..............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000G.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.081681212632871
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:dsoItwjEZ6XlkEIXk944u/TTRyT4gerwFmvtvpvgvRNo:ds7Z4xIXk9nu/fRyTg
                                                                                                                                                                                    MD5:2F4DC3428075ECC6CB71193FBCD33D15
                                                                                                                                                                                    SHA1:7815DD4D67E50DB23EAF7E87A9A198901A833E54
                                                                                                                                                                                    SHA-256:3B072A60926E2670B7B02136BDC3CB01B3F1600AD427F7DB9E1AE18B86E25FD1
                                                                                                                                                                                    SHA-512:B6B8DABB062A665EF5A729E7EA05F0CBC13802E743D4215C9BA862927F20BF1DCBE94965F5DC9CA65727FE55336722517830122AC6ACAF5C6CA0A0B022384457
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZ#.g.....#.g.HW].-.Y.....#.g.HW].-.Y.....#.g..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................|........tM....N...^...............k....T.H.h(.#...........f........................................I.qk..B.....LZ................|........tM............|........tM.........#.g.....#.g.....#.g.........................................#.gj....#.gT.]..#.g.....#.g..B..#.gH....#.g..B..#.g..>.)#.g..J...................;........4...4...4.."..............#.g.#.g.#.g..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........#.g.....#.g....##.g............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000H.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.078981515830449
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:dsDJGyCBBAaZLSt0pSE3p6Xw9FGbToCrd6rfI3dX1LpBKEZr+wnog:dsWtlSqSE3sXw9gbTvRiA93o
                                                                                                                                                                                    MD5:798ACCFB9CCA8BB0700802B1FA93E950
                                                                                                                                                                                    SHA1:47C95BFE7C279F987AE4B76330EE38557B5BD9E8
                                                                                                                                                                                    SHA-256:BBDADC421D95E048865C8FF76E5F66E1B688B1DD76421474EFAB525DABA7050C
                                                                                                                                                                                    SHA-512:0477AFC2898E97654C7F38EEBAB35A2BF1EA24A47E71F662D002165E6BC1FAC94C6E14019FE5E508D26874087499D13EA4BE088D3868234F19F9DCAAC7479AA8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......$...v.......................................................................................................................................2...>...........v...L............................I.......I.qk..B.....LZ../......./.g}e.)..6.d.../.g}e.)..6.d.../..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............]..n......qT.y.....N...^.................S.x.F."..BK..........f........................................I.qk..B.....LZ............]..n......qT.y.........]..n......qT.y............/......./......./.........................................../j....../T.]..../......./..B..../H....../..B..../..>.)../..J...................;........4...4...4.."................/.../.../..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........../......./....#../............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000I.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.053572946564372
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:DVsP4m6HAb2t+XqoqEliKX5K9g+0TosrdnrwIddX9pPue0g:DVst2Ab2QVqEbXE9gxTNRrzD0
                                                                                                                                                                                    MD5:BBD7C16163156488DED83100AF1068A5
                                                                                                                                                                                    SHA1:E28D5898AD76E2AAAC35496EA3A5102052F988FA
                                                                                                                                                                                    SHA-256:873232A397E6536F2D9846264DAB95D3F2D6D4C18AF6F17D124830B3C35F073D
                                                                                                                                                                                    SHA-512:8BDF531F8473C52810310AC3E5EEC658DB6E2486A8F9F2CA9CA10C15D9FB0B56401A914B383A8C4E8D2CDFFFAEBE41EA0840CD076DA699F3572AE21470EB0507
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......$...v.......................................................................................................................................2...>...........v...L............................I.......I.qk..B.....LZ..........h;..2-ig.g8....h;..2-ig.g8.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................L.,......$c.!....N...^...................\_\M..PB.?.Y........f........................................I.qk..B.....LZ...............L.,......$c.!...........L.,......$c.!....................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4......7...7........................;........4...4...4......................#..............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000J.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.05292204036164
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:Fs7EsTLqCtt36BIEHhHcXzc9reCgBITo/rdqrZIqxdXQH2Wkg:FsFLqC73EH9cXzc9rcBITqRy9Gk
                                                                                                                                                                                    MD5:A8838559053300BE9F5B8A3FEA97D6F2
                                                                                                                                                                                    SHA1:96E707DC6EE5B63B71FA3BF57ED8FCA30104E87D
                                                                                                                                                                                    SHA-256:08C160C92E34B650A162059B231C64FC124C186E673B67BCBD6176C03BBC2B7F
                                                                                                                                                                                    SHA-512:EF874D15D4133D027F290C6018B39764ED05D05C7F02D5C6AA3DF782DC309B90796AC3A4E45A15426070B4D6E99FDA59233F89B3A65F32A4DA7FC8343090825F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......$...v.......................................................................................................................................2...>...........v...L............................I.......I.qk..B.....LZ<.m.....<.ms.W6.!.X.;Z(<.ms.W6.!.X.;Z(<.m..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............cu..;".(.A<..."....N...^.....................J.:Jp..,.........f........................................I.qk..B.....LZ.............cu..;".(.A<...".........cu..;".(.A<...".........<.m.....<.m.....<.m.........................................<.mj....<.mT.]..<.m.....<.m..B..<.mH....<.m..B..<.m..>.)<.m..J...................;........4...4...4.."..............<.m.<.m.<.m..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........<.m.....<.m....#<.m............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000K.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.069236555948024
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:Y1sLSCUAIY+t6DWEEDTX8vT9TjZHIrJTojxrdDrGIudX+1RIOh:+s5IJ/E2Xs9xHCT4RPmm
                                                                                                                                                                                    MD5:26C792757C5A52B53CAE30CC671F7015
                                                                                                                                                                                    SHA1:154692AF598772953BD1B3AE380084001A973BE4
                                                                                                                                                                                    SHA-256:E6EE4445E07AA1581E4FC42EA747CA18970532B37F674D9969548EAEF2E2571F
                                                                                                                                                                                    SHA-512:1E29C905F60404854357E81B7D131DF6DD07E55EB28F7058165EA9FD5AC0F208E146FBAA4F3BE5C6F2F1CDED59E21A34CD2089B50ACD9492F567A1789265D55F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ_"Y....._"YN..........Y._"YN..........Y._"Y..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............5.9wP.9..J..<D....N...^..................?..O.X.4...........f........................................I.qk..B.....LZ..............5.9wP.9..J..<D..........5.9wP.9..J..<D........._"Y....._"Y....._"Y........................................._"Yj...._"YT.].._"Y....._"Y..B.._"YH...._"Y..B.._"Y..>.)_"Y..J...................;........4...4...4..".............._"Y._"Y._"Y..z...y.. x.. ...........$........4......7...7........................;........4...4...4........._"Y....._"Y....#_"Y............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000L.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.081804607040545
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:YlsFqWqqWP6A7tnt1lU7aEYwDWXRW9XlHHraGToqrdmr7ITjjdXciDpRFqet3ZxN:esutnpUOEYqWXRW91HHWGTDR2Kj6w
                                                                                                                                                                                    MD5:CCEA01B6787443ED4D82D855E2CADB09
                                                                                                                                                                                    SHA1:5445476340D04C5EF8131DCB386938BA04EF8FEB
                                                                                                                                                                                    SHA-256:6C62CD30227931F0A390808342006C006786A7AE780C38228FDBBBF0B258535B
                                                                                                                                                                                    SHA-512:0AFC137767143A1B8F988F54C3974EAA96107243B4C9FEF06127A5FF08F533F27E117C6375FF3C4DEA45FE60575E9951EDE41F246C218385CEDD392C30F0BF6C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ._......._.....,......._.....,......._...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............mK(.b....L........N...^................x..\..N......xH........f........................................I.qk..B.....LZ............mK(.b....L............mK(.b....L.............._......._......._..........................................._.j....._.T.]..._......._...B..._.H....._...B..._...>.)._...J...................;........4...4...4.."..............._..._..._...z...y.. x.. ...........$........4......7...7........................;........4...4...4.........._......._.....#._.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000M.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.0883644648665305
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:YpUkscZg+4zQAltudHGEn6rRXg91zhXVqJToJrdvlxrsIGdXob920R14Ih3D2ASK:yUksO4kAlYAE8Xg959VqJTcRHAK4s
                                                                                                                                                                                    MD5:2528BA328337F168F0D786D7FDFC8F1B
                                                                                                                                                                                    SHA1:3B9A8C8EB2528555349A98073DCFF95AABFBCCD6
                                                                                                                                                                                    SHA-256:619ABA08E91DB224154858D2334E082EC4DA323A0C2F4445893AF30DA38B7CD8
                                                                                                                                                                                    SHA-512:5A0E00E0D00368D5E6CF15F79B521731F1C5357EE204E5405C4A85573F09CCECE1EFD2DC8055543EE9D83C215441299D73F77FDFF8E2F47837FCF0505B37DD29
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ.............d....6.<. ......d....6.<. ......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............y...9."%/..^......N...^................O(..\.D...N..e+........f........................................I.qk..B.....LZ............y...9."%/..^..........y...9."%/..^..........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000N.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.041935142515289
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:81sOdMQCIEXgmXI9ZGT4RjTHHG/GH+lw:qssMPXgmXI9ZGcRjT
                                                                                                                                                                                    MD5:555029F930B721F4278B3836AA6A2427
                                                                                                                                                                                    SHA1:C5F0B90DFDE763CF28F67F6EBF3C2D220FC1DD11
                                                                                                                                                                                    SHA-256:4D2248B975D587624F7E324D6A491BEFDF44DAA43D35ECFB1DC01ACE1F76902F
                                                                                                                                                                                    SHA-512:720AC9EDE633B2F3B0EDF8A4E849F5FE7137538EB9E6F1B3DE86C954667EDE8B62CFCDDA70B2D4C1D229452001ECEC3AC7EACD2CCC3E4D657F1DEF29E60409B7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ`e......`e...m.......G.r`e...m.......G.r`e...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............)..:f.3...DxI.....N...^................k.j..O..W.............f........................................I.qk..B.....LZ..............)..:f.3...DxI...........)..:f.3...DxI..........`e......`e......`e..........................................`e.j....`e.T.]..`e......`e...B..`e.H....`e...B..`e...>.)`e...J...................;........4...4...4.."..............`e..`e..`e...z...y.. x.. ...........$........4......7...7........................;........4...4...4.........`e......`e.....#`e.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000O.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.068840383544555
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:YFjs1aH+E6SItwz2E8SXE9NUToq0rdQrKIwdXEDKFK3RTl3CVNFKlVnr:ysQeSIjEDXE9NUTCRIUYKQhl3+NQlVn
                                                                                                                                                                                    MD5:2E7D24125D0F0C5DC122165D432EF00C
                                                                                                                                                                                    SHA1:601090A7BFCA82280D54EEE9E5C1EDE039B298B9
                                                                                                                                                                                    SHA-256:2A3F8C9C4A1FC26FB351E90CEC332753FD440716CC50C7076F11E376FE8C3B5E
                                                                                                                                                                                    SHA-512:54512477582FC1976DEA365BCA9FCD51649FCC42DAFEA53C0D2F2EA9E8E0C4737B30AD560F2738FA08ADB376C840DE6D0D7A0238030105B998697A8BAA120EE1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ...........:n.4bz{...q....:n.4bz{...q....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................Wg'.(.f........N...^...............'...o..@...............f........................................I.qk..B.....LZ................Wg'.(.f................Wg'.(.f........................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4......7...7........................;........4...4...4......................#..............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000P.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.090825837310026
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:isH9w949Fs/yTJ+hlEfBXY9d0TORfu38949j989b9p9mQ:isHs/yTfZXY9d0yRfu
                                                                                                                                                                                    MD5:FE7ABF381E9AA057EF48A4F10AA98283
                                                                                                                                                                                    SHA1:0FC4F6E727B9FB86AF322669D5DD5879A591B704
                                                                                                                                                                                    SHA-256:A57BD982C5A3A1437EC8C563D8A5E3915A29E7E97DE8DBF9474E31265E233AD1
                                                                                                                                                                                    SHA-512:FA4F06F2D05C90F1541A4A271E62688A96288BB224D3AF814672EEF947B380150469D9FABA8D7E94170EFDFAD09730DCFBF37C0E1BF29F1644BF93D5EDA69829
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ6.[.....6.[{....!z.9.m.6.[{....!z.9.m.6.[..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............H.q.eU.:..^...\....N...^...................,?.K...).X..........f........................................I.qk..B.....LZ.............H.q.eU.:..^...\.........H.q.eU.:..^...\.........6.[.....6.[.....6.[.........................................6.[j....6.[T.]..6.[.....6.[..B..6.[H....6.[..B..6.[..>.)6.[..J...................;........4...4...4.."..............6.[.6.[.6.[..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........6.[.....6.[....#6.[............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000Q.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.060346548709925
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:Y5sijj4ro7htS2EFnUXs9Gh/ZoOTohrd2tr4IKdXOD5TR+hSxV:KsLro7hPEFUXs9GoOTYRe02P
                                                                                                                                                                                    MD5:A63E0083A3AB97D74827024F4267624A
                                                                                                                                                                                    SHA1:A486612FD9C1B54BDBFB82AC8CC94FB167321D65
                                                                                                                                                                                    SHA-256:65727C5E08DEFA11A7E368DD9695B13952F8C3102C49D02326C02FF0350DD9FE
                                                                                                                                                                                    SHA-512:582248E58F88A7536538DCEFC9E0CFB8E0120123B25939E892DF400CF904BE19E67CF01065237BEE3B21DB00349BD64C4C6A230CA4D46F8401C80E6789A517EB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ............rb/.....\.....rb/.....\......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............9E.UCy.+.;v8.-....N...^.....................L................f........................................I.qk..B.....LZ.............9E.UCy.+.;v8.-.........9E.UCy.+.;v8.-........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000R.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.129803646565962
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:gOsI9F+xtQmOmtsEtdXE9Idxd/0ToTrdfokrJIQdXoekW08a:gOsA+xGEsE3XE9I98TmRfH9lG8
                                                                                                                                                                                    MD5:3DEE5BCE63C033C4700540CA523964B7
                                                                                                                                                                                    SHA1:B6181C197F4DBA1FDEB188D58BA113098D844AB3
                                                                                                                                                                                    SHA-256:9217D7E0990A6E0F88AC9E25BCA19101F4F1D02AA39D4F341E46348E9CC90417
                                                                                                                                                                                    SHA-512:5A695A02B92ED8E020A90E4AF6C443D0B10BEAF4D66FF429B1470A71A54D2117CFD055FCAAE2E5C9ABDEC8B725FD82B0E4CB4C742A0A67CE9EE6E123A651D6DD
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZ`:......`:.........;..`:.........;..`:...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............X....m........;....N...^...............9.3...sB..+...........f........................................I.qk..B.....LZ............X....m........;........X....m........;.........`:......`:......`:..........................................`:.j....`:.T.]..`:......`:..B..`:.H....`:...B..`:...>.)`:...J...................;........4...4...4.."..............`:..`:..`:...z...y.. x.. ...........$........4......7...7........................;........4...4...4.........`:......`:.....#`:.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000S.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.0701043913931345
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:uyBsStbzFjgt9t4Eno3aXWUQd94t9ToMrdlrSIJdXnh/AkqiuYyt0/V8aya:uyBs+jgd4E1XE94t9TBRp98WA
                                                                                                                                                                                    MD5:817677D145BB6534E1BCC317268F2FA2
                                                                                                                                                                                    SHA1:C412824BE208EB2AB2B5C7EA74A48C48F1F7A779
                                                                                                                                                                                    SHA-256:03B3E538EB5A46805E672877AC61388AAE4C47E77E3969F74B6D4FF1ABC8F4B9
                                                                                                                                                                                    SHA-512:8AAC4610CDB30B0D495A423153E4A7E6B9055B5084E0DF9C6E296C8F2820EF2875A4E376145FF3D3035065DF4A2A069305267E4BE4DA04AA85955C09FDFEE5EF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZ............ia...M........ia...M.........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............G.......!..h..W ....N...^...............d....h.A.<.J.O..........f........................................I.qk..B.....LZ............G.......!..h..W ........G.......!..h..W ........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000T.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.084272442868918
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:Rs4A78ImjLJsE7pXep9+5zeDT8RRL9zwC5EHkwCEdKZ:RsL78RJJ7pXep9kzeDoRRL9X
                                                                                                                                                                                    MD5:DAE46C9667A6DE0AF762E0D8C17D667B
                                                                                                                                                                                    SHA1:CBCCFCC1BF118071B714AA91A8137C156C120840
                                                                                                                                                                                    SHA-256:1AF3A73029FC81C95052D0B32882737B7116B9D5221767552673B8F7E558E67F
                                                                                                                                                                                    SHA-512:38EC1EBE84CE261186E4CBE70B001A56F1B77B0F57864DF331A89C60B8FCE8517A6EF23248FFFCDD6907A5FBC9CC137BCE8E6417850FC0C82132113296BDF072
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................}.......}...._.:f......I.......I.qk..B.....LZ.}...._.:f......}...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............y..Ty<..!.w....X....N...^...............W..d...K.....t.#........f........................................I.qk..B.....LZ............y..Ty<..!.w....X........y..Ty<..!.w....X..........}.......}.......}...........................................}.j.....}.T.]...}.......}...B...}.H.....}...B...}...>.).}...J...................;........4...4...4.."...............}...}...}...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........}.......}.....#.}.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000U.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.125702731831653
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:/esUxJaMHrc0tr5qEt4XU9qSBToYrdjrWIddXTYHyO9wR8aig:/esErc0yEiXU9qSBTZRvFK1wR8
                                                                                                                                                                                    MD5:8996E6F9172C2BBC4BDD8EA5AED52491
                                                                                                                                                                                    SHA1:7F5843B4329895607EA6486C0389A33086DBC65A
                                                                                                                                                                                    SHA-256:718F73412ABE657E9E1F67E8AA6D428998A80D581A9F2568FC230E11D613DC95
                                                                                                                                                                                    SHA-512:691C89C53AC03287BAF87C0DFDEEFA48B28F1D1EB2616DF5D92B435EDBEFB72B332E947F072327BA5916F00C8CA316AFE5B5A26BF2D860C7F872155A74B7A948
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......0...v...$.................................................?....?............................................................................2...>...........v...X............................s.......s....D."..V./.~.I.......I.qk..B.....LZ.s....D."..V./.~.s...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............jb....$.u#m.:,....N...^................Q.....A..(.............f........................................I.qk..B.....LZ.............jb....$.u#m.:,.........jb....$.u#m.:,..........s.......s.......s...........................................s.j.....s.T.]...s.......s...B...s.H.....s...B...s...>.).s...J...................;........4...4...4.."...............s...s...s...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........s.......s.....#.s.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000V.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.169629179330101
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:IQasNwf/V1qHSYtCOt8EPlOMcXHc9MypLx7TozrdQrSZIHdXx3UkRig:IQasqt1lY18EPUX89J7TmRIpN
                                                                                                                                                                                    MD5:A6AB7264B78DCDC873B9549BA97580CF
                                                                                                                                                                                    SHA1:3D02BEE7383DB0F66FA6955B9DF084688480A3B4
                                                                                                                                                                                    SHA-256:BB28D85FB98D33EB217C05F087F9460E5025F62995779BF3C53676276A7EE64F
                                                                                                                                                                                    SHA-512:599734BF5969BF09D0BE736D2E77F238FD121231A520C6FCFC984232C350CA6F2A6DA073D018699B9E90A0114890578A9B9E2212E6C3193164664D0C2C7CD3F4
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......0...v...$.................................................?....?............................................................................2...>...........v...X............................I.......I.qk..B.....LZ5.U.....5.UrB.........-x5.UrB.........-x5.U..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................v..#...F......N...^................ rQ...J...e.,.*........f........................................I.qk..B.....LZ................v..#...F..............v..#...F...........5.U.....5.U.....5.U.........................................5.Uj....5.UT.]..5.U.....5.U..B..5.UH....5.U..B..5.U..>.)5.U..J...................;........4...4...4.."..............5.U.5.U.5.U..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........5.U.....5.U....#5.U............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000010.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.121273422706357
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:ds1epNuP27I5hEBA7CXM92NT0RKt27NwYouPt:dsd2s0ACXM9cYRKt2D
                                                                                                                                                                                    MD5:ABCC5B8B594E1A358456E0910B0B4C6A
                                                                                                                                                                                    SHA1:26D3CC64113487BC9A81E415447335310DE11A3B
                                                                                                                                                                                    SHA-256:6166D2EEEE837421CAB6C3B454420EE0998C9B3F170DD0144B0FF9B83CE69A28
                                                                                                                                                                                    SHA-512:0BA97EACCC4067436519BE7098855E28048B85C485AAD1D7FF913D1E7D6D5408E7F1A735E1CDD7D948B0AEB27D04A17BF117F5F9252915E1F274BBB989804C38
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ..P.......Pbp.W.9....g..Pbp.W.9....g..P..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................?k.M.&..cD.}=....N...^...............02.4.aC...6..1i........f........................................I.qk..B.....LZ...............?k.M.&..cD.}=...........?k.M.&..cD.}=...........P.......P.......P...........................................Pj......PT.]....P.......P..B....PH......P..B....P..>.)..P..J...................;........4...4...4.."................P...P...P..z...y.. x.. ...........$........4......7...7........................;........4...4...4...........P.......P....#..P............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000011.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.128383493579288
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:9sFmlP3MVwtwOE7CW/Xs9nSMTiWToCrdSreIJRdX52TrqgB9:9sFHVwVE71Xs9SMlTvRK34
                                                                                                                                                                                    MD5:F371746CE67C0BC7D9B402CBC7741DFC
                                                                                                                                                                                    SHA1:0E7EFDF3F98012C0CC74630666768836D2CABC35
                                                                                                                                                                                    SHA-256:E9B2BBD13DD218DE513474398CE6CD00E76D01BB840A3CBBA07671216456A457
                                                                                                                                                                                    SHA-512:BA217410111BAF8B41C1FDB308E62F8FB1F531E94FEAEE1CF1264A9193C1F9F05EA39330FC1A54E9D44CA494ED1A3F35EBFE34AE5A78BA55AA777BFA549D1017
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZS.7.....S.7>I4...3I.....S.7>I4...3I.....S.7..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............{'}........j.O?.....N...^...................W..B...(............f........................................I.qk..B.....LZ............{'}........j.O?.........{'}........j.O?..........S.7.....S.7.....S.7.........................................S.7j....S.7T.]..S.7.....S.7..B..S.7H....S.7..B..S.7..>.)S.7..J...................;........4...4...4.."..............S.7.S.7.S.7..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........S.7.....S.7....#S.7............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000012.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.133280681170083
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:Fsdl9ry9EEEBXgB9SkTZRKmznEqoBEeyrj:FsBrbRXU9HdRKmL
                                                                                                                                                                                    MD5:B1D5D1FF4DFE0CC38D2D5BA94561637F
                                                                                                                                                                                    SHA1:2F6DF114B0BB315E29E31AAE667B5556F3B33034
                                                                                                                                                                                    SHA-256:718F348F5E351022D6758CB46CC83E935AB1A116BB4BCCFB0F9CA4AD16A3DB89
                                                                                                                                                                                    SHA-512:E723FA19FC5E822362FF9B9FD48F373A2FAEF32684374D3A143B6A6DB5E68CC094E3F005A9D45E9E657C3911A66E2ADFD15F6CAA21FC5BED58B8BF4979EC0B35
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZm.'.....m.'...%....q..m.'...%....q..m.'..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............j.`..n.8.k.X.3U....N...^.................|....O..LR..7U........f........................................I.qk..B.....LZ............j.`..n.8.k.X.3U........j.`..n.8.k.X.3U.........m.'.....m.'.....m.'.........................................m.'j....m.'T.]..m.'.....m.'..B..m.'H....m.'..B..m.'..>.)m.'..J...................;........4...4...4.."..............m.'.m.'.m.'..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........m.'.....m.'....#m.'............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000013.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.10247100185701
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:Fs3pQE1vTCtwyqGE2CHMXk9fAWTokrdSrJEImZEdX7mUqF:FsR1vTCBE2hXk9YWT9RKCZEW
                                                                                                                                                                                    MD5:F36578EA05B818A55B33051188A1C39D
                                                                                                                                                                                    SHA1:4110A178B76CBE73E9B3CA9A2E79EAA7AE67C719
                                                                                                                                                                                    SHA-256:08803027417B28B87761C4FB5AA262ECEC855C6A0DBCA087766647FB5AFBED14
                                                                                                                                                                                    SHA-512:9657F1160EA6F8FD0A46F365A4E676272C3931849314CA15D92C393534DA4D3CECC166DD9789A93F919B62FECB370689EA35598265FCB5DCE90E64CBFCA3B158
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ...........}]hz..| .)..K...}]hz..| .)..K.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............*A,a.W,....G.7h....N...^................B....M.[...Y.Q........f........................................I.qk..B.....LZ............*A,a.W,....G.7h........*A,a.W,....G.7h........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000014.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.123945634168215
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:EmsHOvHEl1tI+EG9CCZmoXMIo9XV7B5ToATrdSrdIHdXJqkZQleG:Emsfl1dEi3XMN9VTTPRK2Ele
                                                                                                                                                                                    MD5:AAAB750A68F59567BBDE50C0242A6DFC
                                                                                                                                                                                    SHA1:45314C7D24384189946070B650D388B41C205F4E
                                                                                                                                                                                    SHA-256:99A3BA7C13060386A6147640401C441DEBDBA69600D76C1A2497935B941DD3B3
                                                                                                                                                                                    SHA-512:8AE8F6C2B30363ACE1BE411D770320842139C5E6A2B197C81E6EC2DE65D5405056FC68843EA7273A548ECD6C205FA204E6B4E3647C3835B8CB1FFEFA143613EE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.ap......ap9..`..L.....M.ap9..`..L.....M.ap..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............(.Y..i.....&......N...^..................I..fF.....Q.M........f........................................I.qk..B.....LZ............(.Y..i.....&..........(.Y..i.....&............ap......ap......ap..........................................apj.....apT.]...ap......ap..B...apH.....ap..B...ap..>.).ap..J...................;........4...4...4.."...............ap..ap..ap..z...y.. x.. ...........$........4......7...7........................;........4...4...4..........ap......ap....#.ap............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000015.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.09398174852761
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:RsDGsaZTG7S2qs5tG9ryEnpDCZPiX49ixCNGTo/rdSrxIx2dXYLY5ANjDIr3qhq:Rsbqs50ME1hX49ixBT6RKV7
                                                                                                                                                                                    MD5:5CEF8A82EA1AFA32BE033EDF2E8FE6B4
                                                                                                                                                                                    SHA1:A7D63648A007CA00B83E332C23CDB0D55083CABA
                                                                                                                                                                                    SHA-256:C17F5664A910271F8F05923EE54E3BDDA14F41E620CB9E27AAC3039B333817CF
                                                                                                                                                                                    SHA-512:94F9273198A7F9E446F55FB71067260F7A3DB3AF7E587842257EF4C6ABE08CFBA47E755DA553C40AF2EF2BAF780CA4A31338E6435875682B5645E369A6F6CCC8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R...........................y.......y..M<......x.....I.......I.qk..B.....LZy..M<......x....y....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............._.......<L...I....N...^................U$.:fHO..3...j........f........................................I.qk..B.....LZ.............._.......<L...I.........._.......<L...I.........y.......y.......y...........................................y..j....y..T.]..y.......y....B..y..H....y....B..y....>.)y....J...................;........4...4...4.."..............y...y...y....z...y.. x.. ...........$........4......7...7........................;........4...4...4.........y.......y......#y..............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000016.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.149134405928681
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:BsmJ/kW5NtltM+EmCKBXc9kRvcuToDrdSrYIgdXYG4Op:BsDW3H1Em/Xc9kRzTuRKOz
                                                                                                                                                                                    MD5:45328B1167149DD486F52AE245CC2ADB
                                                                                                                                                                                    SHA1:BC661CD0BF1233633BC37FEACE962441999E88DC
                                                                                                                                                                                    SHA-256:78B8F2FFBB965F0035B9F25BB20DE3B737AF06B90F41F5E2264200A1ADE88683
                                                                                                                                                                                    SHA-512:B61773B6E819BE1AE0DDAD5FE0163FEBF5216CDB21C80010D498115CD29673912291BE57D26CCF42F2628BD619117375FCC167A9298CAB856A4EA3320623629F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZd.......d...g#......9.Z.d...g#......9.Z.d....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............4....N.6."..,[.....N...^.................J...H..7M............f........................................I.qk..B.....LZ............4....N.6."..,[.........4....N.6."..,[..........d.......d.......d...........................................d..j....d..T.]..d.......d...B..d..H....d....B..d....>.)d....J...................;........4...4...4.."..............d...d...d....z...y.. x.. ...........$........4......7...7........................;........4...4...4.........d.......d......#d..............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000017.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.109025073675677
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:KAsYWGI9QZh/BpKtBQcElCC5gXQ9eoiTogrdSrKIK2dXzam50QTmDC/9mrvPp:KAsVQrBpKL5ElCrXQ9gTJRKZ4
                                                                                                                                                                                    MD5:2BBD847D1F5730EDFD037015C40E1891
                                                                                                                                                                                    SHA1:11464F674EBED92452B994488228AFA5F3677878
                                                                                                                                                                                    SHA-256:A53534C74BC571EA6A3C476E8CB91AEED0178AF015E55E44A8099CB5069027E0
                                                                                                                                                                                    SHA-512:EEF8F052C818DC4AD1E6553C5980A978A7E0D96F1F5DF7F118AB0326308C87BD48DFB407D4C4256F65F0ECA5B2D4F42CC1C157EE81E1FE2614D1096E59DDE95F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......,...v... ...................................................................................................................................2...>...........v...T............................I.......I.qk..B.....LZ.H.......H.8.&.....W.C@.H.8.&.....W.C@.H...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............$..B.....P....h....N...^...............k......C..].*.C.........f........................................I.qk..B.....LZ............$..B.....P....h........$..B.....P....h..........H.......H.......H...........................................H.j.....H.T.]...H.......H..B...H.H.....H...B...H...>.).H...J...................;........4...4...4.."...............H...H...H...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........H.......H.....#.H.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000018.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.140339212486329
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:KnU7BsduU0ei1trIivKYE6tiC+GPXA9iuTonrdSrHIsdX4hEmZ0QkEWEJmLjjJ:KnUlsPi1NE6c7YXA99TyRKTMY
                                                                                                                                                                                    MD5:5A367554E7A91F5770F7B38471CA18A0
                                                                                                                                                                                    SHA1:FF933A6191B59A16C5CE14119D25386C0A8645C4
                                                                                                                                                                                    SHA-256:5E436649314C2A29BBF4EAE1D8A272827A3B7B1346A783E850DE22CD0DB514CA
                                                                                                                                                                                    SHA-512:86FA8E320E6AB8B670ADD25796984F7E4BD98DFC836D3D9535367A790CE8DF3C4E5A8286CB3F041D0464A7FD43916ADA69E8B5D656144E48B8CE9DB5E23403A7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......,...v... ...................................................................................................................................2...>...........v...T............................I.......I.qk..B.....LZV.......V.......#..O...V.......#..O...V....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............^.z;..=...C.X......N...^...................OI...5.>~........f........................................I.qk..B.....LZ............^.z;..=...C.X..........^.z;..=...C.X...........V.......V.......V...........................................V..j....V..T.]..V.......V....B..V..H....V....B..V....>.)V....J...................;........4...4...4.."..............V...V...V....z...y.. x.. ...........$........4......7...7........................;........4...4...4.........V.......V......#V..............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000019.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.148813157485757
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:QfXsV3ZUr9A/Ji9Gdhet0gxkEIWCCYuXI9L0xToOrdSruIDdXRrZr9qCNSAtt:QfXsMCsGdheGfEPFXI9LoT7RKj99
                                                                                                                                                                                    MD5:381A7235176F9AD59750064D4CFB7B14
                                                                                                                                                                                    SHA1:D646C641415E135DDF281D9990703BE9BB9E11E7
                                                                                                                                                                                    SHA-256:B2F51631508F3A8BACD6A8A1A01989D3B27F916816CABA03224897417F9D438F
                                                                                                                                                                                    SHA-512:7EB827408288BBCD9DCFFE006EE99C214C2AF0CEED77813EE8854BD682091B1777445906ADEAEA9D2FAC3E7949C8580EA17F1670B568486AEE71947CB08AFAD6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>...........v..."...................................................................................................................................2...>...........v...V............................I.......I.qk..B.....LZ.nb......nb....n2...Q..nb....n2...Q..nb..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...................d...8.@.......N...^....................kBK.ZK.J...........f........................................I.qk..B.....LZ..................d...8.@.................d...8.@.............nb......nb......nb..........................................nbj.....nbT.]...nb......nb..B...nbH.....nb..B...nb..>.).nb..J...................;........4...4...4.."...............nb..nb..nb..z...y.. x.. ...........$........4......7...7........................;........4...4...4..........nb......nb....#.nb............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001A.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.102208147053059
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:RsiwjgP86JoilYE3tQ2W+EVC/9Xvw970GEToxrdSrEdIedXCKK86uAZKWold:RspVwoiln3SaEV4Xo9YDT4RKEbX0s
                                                                                                                                                                                    MD5:D34160352A7F937E425C1145B873EBFB
                                                                                                                                                                                    SHA1:E6400ABB0AA90E568D067A9CB0025748B77292E0
                                                                                                                                                                                    SHA-256:9445C3895388DF94E154A3DFD28CDAC2312FA967E7B17B962B1315D061FC5E12
                                                                                                                                                                                    SHA-512:D0A118B01D1AF0CB810B76E4E170C8B7E9915D86C7797B3B66A34ED6278C2A99E84B5B326B5A8BBD91A657BF524AE151DE698A628FCA7C7957BD3C6117231DCC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ............W...0.h`.Ct<....W...0.h`.Ct<.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................b........t..2....N...^.................b...7A.............f........................................I.qk..B.....LZ...............b........t..2...........b........t..2........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001B.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.132131849301043
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:9sAhH2hU3BEsWM6X7s9eT2RKhMHYDBA2H:9s7hUO86X7s9eCRKh3
                                                                                                                                                                                    MD5:7D14CCFF6FDC86DA3CB9F117ED31D6CB
                                                                                                                                                                                    SHA1:34930881AE5EE6C9F2E6F45D6D85C1BD73B109B7
                                                                                                                                                                                    SHA-256:E6A214B45969EDA48CD84B42FC1BB4E088FD50E32B33A3E3E41867A5FDF462C1
                                                                                                                                                                                    SHA-512:26D8CB8287D2D97DFB3F99038829351299F3EF1AA90A0021930E42BFA9FD112955EF9F7B54E4DCCC3B42424D5997293884A87F91303DDA7889E4809CFBB7AD01
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZH.%.....H.%.;z...../..%bH.%.;z...../..%bH.%..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............ob..As...)....W....N...^................fF...O....3}..........f........................................I.qk..B.....LZ.............ob..As...)....W.........ob..As...)....W.........H.%.....H.%.....H.%.........................................H.%j....H.%T.]..H.%.....H.%..B..H.%H....H.%..B..H.%..>.)H.%..J...................;........4...4...4.."..............H.%.H.%.H.%..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........H.%.....H.%....#H.%............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001C.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.125685654281997
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:0d2sSiBYxghJ0b56tngKER35uCAZYXWt9XOQNpTomrdSrGIGqdX5C7laJkdRZaQx:pszs56xER3c+XY9XZTTDRKTAa
                                                                                                                                                                                    MD5:DBA0DECB4B2BBBDA4927431AEA35DB60
                                                                                                                                                                                    SHA1:3B89557EE998E5D788ED2C00BAC20815CAA8F91C
                                                                                                                                                                                    SHA-256:67A3D4761DD623FAC350D1DC9759D2BEA678233CAB6DB4802801F63C90DAE8A1
                                                                                                                                                                                    SHA-512:F08370CE3F164D02B8FE1E8BA051F90393E99286A5089935D5BA9250ED13B2160AB1C12CEA25CA15D1420C77DB676E6F4CD87DFD5CA815CB35A20CB3289EDBBE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ...........w.,8..T..l....w.,8..T..l......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............<.. .......H.6.....N...^.................;x*2.F.o.....o........f........................................I.qk..B.....LZ.............<.. .......H.6..........<.. .......H.6.........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001D.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.160442418314265
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:NsVrUaLP/6Uy0t0zqENAIWCp2hdXM9/zToq9rdSrskIddX7Hy3ZolOFyMiL8:NsL/6UHxENA1s2TXM97Tf9RKsH2
                                                                                                                                                                                    MD5:101D59F2E02D98B7978B2DE3F3DC32C6
                                                                                                                                                                                    SHA1:DD9F6869C4B98874C8AE8A375533BD92C5A5740C
                                                                                                                                                                                    SHA-256:E5A32EAAE0DCA71545965F4E8DA0BE8529F850BF98A58618C31D10DFCC0A2432
                                                                                                                                                                                    SHA-512:27176C1306AA5D47DADBDCC575D3C86DE85B5162EB8ACFDED284EBB86DEBC1CDB038AE3E41EEE12720D288224414D19DFA5EF7E6B8B9653C956E31EB964C095C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ................#.H...;R........#.H...;R.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............P..:.1W...9........N...^...............ZM....@.I..X.Q........f........................................I.qk..B.....LZ............P..:.1W...9............P..:.1W...9............................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001E.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.131111306769516
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:KEsFgoUmgsgugMNjF5tXiMEyrCQKX3A9eGv61ToWrdSrdIQSdXVl0Qagsg5gENgj:KEsNgMNjTpDEyr6XQ9eRTfRKjSzK
                                                                                                                                                                                    MD5:3E948E10EC7D62E82223E29C7EDEF128
                                                                                                                                                                                    SHA1:3A2A49C2287BDAAB753AAECB08C4C8519D99DFCE
                                                                                                                                                                                    SHA-256:E281D79BEB1AC6B7709C987C91DB1E8341BEAED55C84748F7956BDFA7C228A60
                                                                                                                                                                                    SHA-512:A3981CE40656DE4E358BD180884C50B58D2D1057250D6DA905A33E35A26D0380B8CB9427B47ECA6328AFD5BA84B80DE50AE1D13F0B3815C722479D52510FA812
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......,...v... ...................................................................................................................................2...>...........v...T............................I.......I.qk..B.....LZ................;cY..........;cY.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............>&.. .:z.G.P....N...^..................a..VM...}..N........f........................................I.qk..B.....LZ..............>&.. .:z.G.P..........>&.. .:z.G.P........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001F.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.136494884632802
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:Dsx/7pmaEXpXu95C3THRK2fZ4ZvRdZfYZbZ4ZO6ZJZg:Dsxpe5Xu9ADRK2fipRdaViz3
                                                                                                                                                                                    MD5:80056FCD2EDAD4C9A7B338CA274F9807
                                                                                                                                                                                    SHA1:562FD8F70A3D7AAF39E3F4A8B7DA0F8EDAC7ABD4
                                                                                                                                                                                    SHA-256:7FB621AB3C252A9F652C39212ABBA1FD38DEB19500CCDEBA7119010798C267CA
                                                                                                                                                                                    SHA-512:E992EBB4BBF0015721B56B3C888F84082E45E63DE986E284432AFEA27573B8DFDF1B6F9C61B865BBE5CA14D0AD34205550F70C7F9772688C959DDE40459A5432
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......(...v.......................................................................................................................................2...>...........v...P............................I.......I.qk..B.....LZw.U.....w.U1....J.....Xw.U1....J.....Xw.U..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................r.8P.>..v.....N...^..................2.bCJ....).1.........f........................................I.qk..B.....LZ.................r.8P.>..v..............r.8P.>..v..........w.U.....w.U.....w.U.........................................w.Uj....w.UT.]..w.U.....w.U..B..w.UH....w.U..B..w.U..>.)w.U..J...................;........4...4...4.."..............w.U.w.U.w.U..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........w.U.....w.U....#w.U............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001G.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8192
                                                                                                                                                                                    Entropy (8bit):3.6614931871154197
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:WKmi9F8/CKIiLCdj5NGEq3tfEGEG4IZOmEGd1BbAc4I8OgggH4I3YWfZ:79qKpiWV9qWjOYGhAU8cgX3n
                                                                                                                                                                                    MD5:262F900D11DACDF6EC021A5E505CFC29
                                                                                                                                                                                    SHA1:785A8DD955CD10A3DCED751A613C809E595A9A73
                                                                                                                                                                                    SHA-256:871C0C353CF4915545DBAA4420851C6640BE1C372EC22B4B7ABDA57D4B43EF8B
                                                                                                                                                                                    SHA-512:921A986B4AC795A1586D0DCEE314D0A73381DD21D17CC0869B235EA172F1205430EDCABC853B41F4DB757E4B8D54AA1C3AFA6F94C2701D337AFB4011C21DA331
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:....8............... .....................................................................................?.................................................8...............H.......................................D..F......:'..$.......$.4...>..p.....8wShx).*G..'..A.8w./Mck@d!...q.0`.%/Mc...$.4...>..p......$............$.......$................................................30B.....30Bz....!.i.aO../Mc...../Mck@d!...q.0`..2...\...^...l.........................$.30B./Mc.{e.......z..........T).....$.......$X......$..G....$.."....$..".....T)......T.v............../Mc..c..,0...e...B4.$...........GP..A..}.....J..................../.r...../.r.t.Q@.. 1.]}c...........I@R.@...E.D..J..a.....F./...J...6.....$.&.[ZA\..6.../.r.t.Q@.. 1.]}c/.r.....>.......x......./Mck@d!...q.0`.%30Bz....!.i.aO.....X.1\A...k............0...........e....4.............."...P.r.o.j.e.c.t. .O.v.e.r.v.i.e.w.......B.^....F...r.QH.....(...........(..."...P.r.o.j.e.c.t. .O.v.e.r.v.i.e.w...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001H.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):20480
                                                                                                                                                                                    Entropy (8bit):4.589550479137745
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:pUdRoYkCAorNfvmiDEIURtDnIByuAm7q44bDotbu6DSNexOFeJxmIvLumUeI:pUdGYkCAorlvmAEIURZnIo5me44bDotQ
                                                                                                                                                                                    MD5:1251AC262B31C0D3FA71C613623FF80D
                                                                                                                                                                                    SHA1:32E0079C915A3D565B3249A53FAA8572D8DB31D5
                                                                                                                                                                                    SHA-256:FF6EA6FF8827A3931A3C0A59D0FE1CA25437A6802AE684BBD99742A77531F6C7
                                                                                                                                                                                    SHA-512:E0F0769504A4B19BDD675923123AB7F65E69B3F5A9516510944910097640BCF818C431376819063CD41494BAD9304EECE4CC66D4F0D80767A18A128B058DF022
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:....>...........v.......P@..` ...I..........>...T.......v.......PH..` ...H..................................................................................>...`.......v........H..` ...I...............I.......I.qk..B.....LZ..v.......vk....>...u.L.....l.a.&'..@3........vk....>...u.LZ..v..I.qk..B.....LZ.I............I.......I...................................................I.t.....I................................................................4..'...'.............Q5j......Z#.E......N...^...............+..J. HI......7B............J....................................I.qk..B.....LZ............Q5j......Z#.E.....................................v.......v.......v...........................................vj......vT.<....v.......v..S....vH.`....v....&..v....'..v..8........v3..v8..v..z...y.. x.. ...........$........!..7!..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.3..............Z4...........................................4../4......p...............C.a.l.i.b.r.i.....

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001I.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:06:24], progressive, precision 8, 38x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):22203
                                                                                                                                                                                    Entropy (8bit):6.977175130747846
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:5q3R1VBvq3R1Flrk6Q0QPJJrR39joOVMJ25d1NkMhIwobbtAAAqYnLJZMJYZ2AC:xw6Q0WJR3FoOVMJIIlAAAqYnMJdD
                                                                                                                                                                                    MD5:2D3128554F6286809B2C8E99DE5FD3F6
                                                                                                                                                                                    SHA1:FC42CB04151D36F448093BDEFE33031A9B8D797D
                                                                                                                                                                                    SHA-256:14FA2D16310485AA1CE41F6D774A3D637E8CF8B03C4F72990155DF274FDB6BD9
                                                                                                                                                                                    SHA-512:D8531247A6E89ECABEA9C4A78F596CCE3493334EDF71AE4F7998FDDD0F80705948609C89756AB56FDFAB6D04DEC5F699A693801A772CA2EE2465BDD2CE5D2D5A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....XExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:06:24............................&.........................................................(.....................&...........*.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...H.....Go.Kxn.b..g...........%?_....O......q......7G......%%.V..8zm.].v?...jJ~._..>.......O;........o..rI.A.....n.a.........

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001J.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8192
                                                                                                                                                                                    Entropy (8bit):3.963285632405391
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:Xs7D0NI/kNbC5oAX17ETflR/CmfbpUeW9wPh6daMA3UFAjL:cickNbrK17elR/jbpUeGwPMd
                                                                                                                                                                                    MD5:71E20AD178CBBD0152FDCB74732D9743
                                                                                                                                                                                    SHA1:BFB1363807590283690349CDE5F160A0C1CB44BF
                                                                                                                                                                                    SHA-256:4454BFA098AA659EC9F1057A3F18896CC0B25F5877D03BBDCDEBD95962321BC9
                                                                                                                                                                                    SHA-512:8C13133E59F08F93D151129C1D7A22F01D5152A24FF6260F03298160CF11827491ED2D185A25DCCC48A5955C42A0C3BB9BEA4EE961645640D1DADC818FF19CF7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>...........v.......................................................................................................................................2...>.......Z...v...&............................I.......I.qk..B.....LZ.>..)....>..D...:V..S..>..D...:V..S..>...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................".2..O..1.....N...^................g.....I.p.D.dq.................................................I.qk..B.....LZ.................".2..O..1..............".2..O..1...........>.......>.......>...........................................>.j.h...>.T)....>.......>..L...>.H.]...>.......>...H...>...}.......Z4...........................................4../4......p...............C.a.l.i.b.r.i...................>...>...>...z...y.. x.. ...........$........4...!..7!..7................>.:.>.F.>.G.>...z...y.. x.. ...........$..

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001K.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):52945
                                                                                                                                                                                    Entropy (8bit):7.6490972666456765
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:cjvqR0XvFaGCTJffi0tgybmWDoTw71kHUAnjvawrlp2+NUO8dWSNl3PF2PjK/q09:cyRffflgybmWoTw1UUADHUbU21MjpAD
                                                                                                                                                                                    MD5:AD003F032F32FAC4672D4CE237FA5C5B
                                                                                                                                                                                    SHA1:AE234931B452F0D649D91291763B919CF350EA49
                                                                                                                                                                                    SHA-256:ADB1EBBE18D6CD8FF08AA9BF5C83CDB83BF9AA179698E34E93DBCDDE12F04D32
                                                                                                                                                                                    SHA-512:ECA25FA657ECE3A66D3E650628E0F65D3BADD38864C028AB6553950A1A66D7D55482C85E9E565573E9E5AAFA91C2D53235971C644A266D41EB69F8E72E3A843B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQ..aq....".....2....BR#r.b3$...C.Sc%...s5E......................!1.A..Q.aq"...2...#...B...Rb3..$..CSr...6............?......y_N.e.H7?........W..w....k|...S..d.4.>.RW5z.$.i.)V.O....>o...c..*&1.D..O..".ufbb..1...t..u=..K...m...~.....F..-.fb:i..=f..C.w.[{..~.7k....;..:..3....4.....$..m]...}....~q...9T.#..7.~..8...q.N;c..ffo.w...W..d........../t_........lWJE..).>..v;:=....Rrw#.m.n.n...E...vm.J}2N*..|.4...80.#..e....t.J..ZQ.x|g/....F..e....k+vK...M..W.X.e.L..~...j.....kz....=...n:O.:..[.L,.+R...Y..zKNI....,..{e..U.'...}.......|..t.]...~...b4......_.i..../.......m...a..n...v.j.?..Rc.$G|.31..#..$?.........h.w....-... .a.%z..u......u.A....Fm..J.......G..[...w.....:....w/.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001L.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12288
                                                                                                                                                                                    Entropy (8bit):3.5413940373627337
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:iseZq4a8Z/1NjKfbFjXg4RUAmnwRtchPJCruCxpl+1Il0G1F14239MFfEA8MZArj:vqxZBjKfbFbgYUPwRtiRguC3lEed1F15
                                                                                                                                                                                    MD5:BEDA8BE7E8A6F2735C5AF154B3EE3B13
                                                                                                                                                                                    SHA1:DC21D89E226B74E3F693D0A78009A99B11368AA2
                                                                                                                                                                                    SHA-256:9A42924EE1DF4C58EC65023322A96FD659703ABBC8CE82B27016B33AADAFAADC
                                                                                                                                                                                    SHA-512:82818804F8785E6A4FFB164DDCAAA13F4BC941E49DE49F70A0F13E830856FAA2676CB9D98A8675AB0D5B01B38A18344591FF2CB8AC6BE0EBF74AA39D9AA1C8C6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>...........v.......................................................................................................................................2...>.......@...v................................I.......I.qk..B.....LZ...9.....S..c...Gh..]N..S..c...Gh..]N....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'............./k.\.'..2..H.g......N...^.................W:GdL.......I............................................r....I.qk..B.....LZ............/k.\.'..2..H.g........../k.\.'..2..H.g......................................................................j......T.H.............\....H........3......O..............Z4...........................................4../4......p...............C.a.l.i.b.r.i............................z...y.. x.. ...........$........4...!..7!..7.................:..F....z...y.. x.. ...........$......

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001M.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):25622
                                                                                                                                                                                    Entropy (8bit):7.058784902089801
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:EhK81gTCyJ/Gf9Aw3t8w8EtdPeGDh6bEi1Ie1u4ZbvgwTwrSRh7ZKNpIGY:IjcRXwdJvtdGsUbEi1IeY8vgwTyC1+Y
                                                                                                                                                                                    MD5:F8CCFC24DEB1D991EBE085E1B2D7D9BF
                                                                                                                                                                                    SHA1:AF76C22A765434AEDA134924C517C84107F4FED5
                                                                                                                                                                                    SHA-256:7354001527AB554C44E7D6981B86DD933B7DC2E0D3DC8512AD3EECD843245C52
                                                                                                                                                                                    SHA-512:818BC3690B01B30BC571E4CF45EC8D1AFCAECBAB003532644381F1CF730A5B3486862D08F7579B2D3D89167AD7DF35028881245C9550B0DA23D1F81A720A9704
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!...1A.Qaq.........."2Rr.#.t6..B..3S$4..v.b..Cs.%5..8..cUV.(.DEe.&Ff...T.d.......................!.1A..Qaq...s4....2r..S"BR.3....b#C$.....c............?..D.."}:......&&...?3..W.q*.......]...m.Y.k1......K).J...uV.b.../.0.E.H..4..W_T.[t.V.w.9.x.qe.L..o.oL.....d.\.....6.|.o...}..H{Yn..E...6Y3.l.e..D.:,.n.%...t...m.........,+,..|..n.....6.*...f........6.../$../Vi..H...e.f.F.zn.).n.E..2sTn.i...Yb?6+H&...Bf..*....z.o.^7[..u.:o....t.s=.....(.s.....f.g....q9o.u1L.N...smzE..[>...+\O....j.<....j.c.W.............U..+.F/.'..W...T./W...>i01./....j.s."..Q...{...a._~OW...Rp.)*.e..W..Q4)<..'..W...q...'..U..z..g......U}...O....w....0F:.N..V.3W.|..'z0.]...j..U[v..g$D.Lc[.e...UW.m0+

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001N.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):20480
                                                                                                                                                                                    Entropy (8bit):3.1920134110609144
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:mMsBf98eOWwuKtjaUoKQYfRS76ip7+yKwbv:mMsBf98YwuKtjLoKQYfR46ip7+yKwbv
                                                                                                                                                                                    MD5:F8AE28B71F88894B649DDD4A788540FF
                                                                                                                                                                                    SHA1:085AF6E9B74EA95BDEECA983253302C23F9F5917
                                                                                                                                                                                    SHA-256:21075F61C1D31E382B543AEC5675A8029B693A16310CDBA53C183F5591B636A8
                                                                                                                                                                                    SHA-512:EE57FE8B0E7F986AB85A69E0A756D514A2044047C9A66B82A7ED1EF541B13008AAE48AEB38B4BCEF671ACD2E4FB14444872AE7F8F32947861EF592F60E845E4F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>...........v.......0 .../..............+r.....................+r..........I.qk..B.....LZ................................2...>.......B...v........-..............v........-..8....................I.......I.qk..B.....LZ....T..........;...@........;...@......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.....................+r.........N...^................l.&.k*H.L|.tCz.................................+r..............l.&.k*H.L|.tCz.....................+r.....................................................................................................j.e.....T.........................a..................... .H.......z.......R...................!..7......}.....W.i.n.g.d.i.n.g.s. .3.......................Z4...........................................4../4......p...............C.a.l.i.b.r.i.......................z... ..$..............

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001O.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):15740
                                                                                                                                                                                    Entropy (8bit):6.0674556182683945
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:Elv3GG8/OOs+GouFdxMlxjoPyerzkpuOo2vPMc62PaJseZC+BJoS/:EtNiwdxMlZoPhzkpuOo2PMc6rX8+B6+
                                                                                                                                                                                    MD5:FFA5EC40DC9A0FD10EB9E6355142D6A6
                                                                                                                                                                                    SHA1:3D3D6A7E086B3C610C08F1F3E3F883604F06F2A4
                                                                                                                                                                                    SHA-256:D74C3973C8D1F7C77274691AFB1AA934940674341D7EEE563BE75E563281BDFD
                                                                                                                                                                                    SHA-512:6FAF2A24D06E6008F3579C7CEC90C2887462BDF83FAD7372FBB74B8DE90340B580E9836F309B68A9794597A598F7DCDA661C9A58DA6D8187C69083B7A17C9CD9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!.1.....AQ..aq.g..8...."r....2.FG..#.E..7.Rb..Cc..D.v.B..3s..$d.%5Uu..&6fW'w........................!....1Aa...d..5e.6.q...Q..."2b.c..r3DE..BRs4U.#C.S.T............?...u.&0...cV.T.I...1..=4....Ce_.g.q.=F.M:>)...k..pm..h..=........S....)Ja8x...b.).=5.q..0......k.M.....1?-.G.b&.5..Ep.8t...'...R)..ta.F$bXO]tW.b.6#.t.XWN..ZW......].....G....x&&f..'L.....7...\...'.8...~`.sa...............................................X........qo...SMk...'.V...i..hb.}&?/.k.:>l.^....>Y...<}...&.jY.Gn.MKejyV......D......gf.0....t.nw..XQ...H.B.....=8.UkR.....Hm..w..]...k...#Z...F../.gjWvf.....w.aZ].2..5..^...VZv..._.7..a.|...:.B...,f...............~....m.;_.....-.e.y.w.[m.].bu.b.f+.E++\.....Y..7

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001P.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12288
                                                                                                                                                                                    Entropy (8bit):3.796762349876588
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:9sMnYz10rmNI41yXUaNNpRtGjy96hZW7KD64X/iEV91zAwCcTd:COQ0rmzmUKNpRtsyohgmxX/R31zA
                                                                                                                                                                                    MD5:44FD44FF537D0C703D49111124FA052B
                                                                                                                                                                                    SHA1:372622241B32C95F827D08B0904D9F9A925469D5
                                                                                                                                                                                    SHA-256:E541EEF912F99E55B1ED6F35066F3C991BA322A197A0BA174D62C330449A3A2D
                                                                                                                                                                                    SHA-512:CCAAE346986777BD63D5839B03233879A1F503FEBFE632033C5717F1702FA6041EF9C46AF1A1361E55E264A0F7664200082223D31EF1D5FCFE98C8BA69D6794D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>...x.......v........ ..`!..2...>...........v.......@................................................................................................................................................I.......I.qk..B.....LZ.w.9....w.....,.-.'.&..w.....,.-.'.&..w..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............g...F/.4..:.+.....N...^.................p..`.M.....`...................................................I.qk..B.....LZ.............g...F/.4..:.+...................................w......w......w..........................................wj.....wT.Q...w......w..n...wH.....w..9...w..V...w..........Z4...........................................4../4......p...............C.a.l.i.b.r.i...................w..w..w..z...y.. x.. ...........$........4...!..7!..7..............'.w%.w..w..z...,4. ...........$>........4

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001Q.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):55804
                                                                                                                                                                                    Entropy (8bit):7.433623355028275
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:gVvci05lhVbfBcWvBLeynluexaWqzww/u5:gVUZhHDljaHww/u5
                                                                                                                                                                                    MD5:4126992F65FE53D3E3E78F6B27FD49DC
                                                                                                                                                                                    SHA1:BC0D76B69310DA9B909D3EE4CECBFE5F386BFB45
                                                                                                                                                                                    SHA-256:3FBE3C1C238BD7DBC67F8CFF5F3BDDFD513C96A9851B9616477947D21DFF4B2E
                                                                                                                                                                                    SHA-512:624853F5E56D224C8188F122B2C4724F867D4099E7FAAFB9C945BE7E2907900ADCF4AE97AB08909CF94E96FB6F381E3B6396D560D93EB2731E4E69CBFE628F10
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d..............................................................................................!1...AQ.aq"2.....BR..8x..r#..9b....3....CS$.'.cs.......7Gw.(.4%5&..Wg.h......tEVfv..H..........................!1A..Qa.q...."2..u6....BRr.#...b..3s..d...7.Cc.$Tt..S4.5Ue..&..%.................?...,...8..{..S.y.N....%..q.8..H[5....o..xg........)c(.eO.YO..._D..x.U.....%.S.r.r._.^..Su.h.Q.t.:.#?....x..B.S...Q.....oqF..%..8'.qx....%.2JKjF..{y.w0.*a.RMb.c.Q{%....eW'..[IV..'ZW3...[...MN.....rO.:....$.i..7....Vrrr...I.r..M..Qo..j....q.^...N...J......%.J..)F...>$.....u........o...+......[...*..t....R}.I..R..S..GB..:......).6_[^Xft...F.1.....zP....,.#....MG.T..Q.F.....)Fi../.I...,%.voEb.b.Z..V3..FT.}..[Z{....wd.z.e.....QwW(.).t..\..'....:)<W.<..&k...caRT.X(..K.....:f...]...q..

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001R.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12288
                                                                                                                                                                                    Entropy (8bit):4.707148354513743
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:1ieTs4SHBCNNAAVtfCLa3JwqoiQyHG6HVtd/yXH9GqjFRtyMKT1D5iv7s9LWi:1if4YBCnAALfC+5wqoidfVtJMdRRtrKT
                                                                                                                                                                                    MD5:217B6B014E20CF5063525B35522A7D71
                                                                                                                                                                                    SHA1:FA5E2B0A9463C890F33ADEE5AF26A92F5D8F38C1
                                                                                                                                                                                    SHA-256:1E171F3A78144913A5EF6754612AADCF6A8D4A7C0C22E1B8917C6FA29253D0CB
                                                                                                                                                                                    SHA-512:9EA3D0836D6036A226DCEED96DB1BEE2B087A19D78D5F30936229F86841944BD13059988B6B2F169F71ECB6562E8BB7B0AD8BAE29365BA6ED50864472B66B621
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:....>.......^...v...2...0 ...+......>...........v...z...@....*...........................................................................................................................................I.......I.qk..B.....LZ............V...9{..x.......V...9{..x..c.....I.qk..B.....LZ.I..{.2`.I.M..F|..}.{.2...........I.......I...................................................I.t.....I................................................................4..'...'..............P.moG.@./p1.......N...^................e....O.!g.q....................................................I.qk..B.....LZ.............P.moG.@./p1...................................................................................................j.N.....T)................f............. .<............. .......'...8.....z...,4. ...."......$>........4.."..7......A.g.e.n.d.a.:.........................Z4...........................................4../4......p...............C.a.l.i.b.r.i...............................z...y.. x.. ..

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001S.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):41893
                                                                                                                                                                                    Entropy (8bit):7.52654558351485
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:pZvVQkUbOHxx3pvVmO5rsP5gUdXwFMuv53knzyncaXgRDqPU:pZkijV5wScXwFMYknzucaXgRyU
                                                                                                                                                                                    MD5:F25427EFECFEE786D5A9F630726DD140
                                                                                                                                                                                    SHA1:BC612A86FF985AB569ED1A1EA5FFC4FDB18FC605
                                                                                                                                                                                    SHA-256:5A36960DF32817E8426BD40A88F88B04FB55B84BAEF60F1E71E0872217FDB134
                                                                                                                                                                                    SHA-512:B102F34385196D630F198667E874F25ADBC737426FDAE0747EC799B33632E5DC92999C7C715DC84D904342738930267AB1709870BDAA842243E4C283FE5E1554
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................!.1AQ....aq......"......2...Xx..9BRr#.b3$..&..g.8....%F'G.(H.Ss..D5E..v..W..Cc.deu..7w.h.).....................!.1....A..Qaq...Ttu.6..."R..5...2B..S....bcs.Dd%&r3C...#$...Ue.............?..R...%.R...t.MQ*.l...v...V]..n...Zw....M....4..F.&&bb0.:]l......ay.r<..3.l.Q^.........I54.N2.8..2s...w..r6.......[1Zh....O...9..>...B......x]...r.\.\..v..~....y.QT.3.......=....r..}.l.....o;....M..C1....w)...+o1f.]...MoA.E..s5..i.\....miGsy..m\.Zj....I'YU.\tU6La5v.>.K..m.]1.......k..0....</5v.V7lY.e.vV.+./[....f..u{....s.}.Rb.Z.....Y.6]..m....V.\...Mr.=r...K...l..%..m^.......X.(..fG..[F*ly.jL.a4..vs..o.e..q.9km..w1.yg.....r_.*h.n..5i.-.{Y.l...<...'Or.s..Z....../JP.....\FV.S..............m

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001T.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12288
                                                                                                                                                                                    Entropy (8bit):4.578416856012263
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:PsAl7PU9J2FXdF9l8/6h2dU9+eOCkba9+Ho0XZ4ZO/EwHRtyWlchzexIkk9VmF8:EA9FXdHe/6WU9Clba9ujSo7Rt2hzexI9
                                                                                                                                                                                    MD5:62BDAC26D77C0BE799503611FFFE6D43
                                                                                                                                                                                    SHA1:194DEB9BB23AF24823DD71EE83928FB5DC383C4D
                                                                                                                                                                                    SHA-256:BD8B7708725D85F7B30F57C417ECAA0B6A12EE1E48128A5348BBA70218604175
                                                                                                                                                                                    SHA-512:A6B5B30F1C6EFA5677679A9707FBDEB1E8DEE95696DCC0C18D59741519EB440915E7DE1C66112E28491C2756367EE56001B840D97245A1A892D81FEC10B0958F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......,...v....... .. +..2...>.......|...v...H...@....*...........................................................................................................................................I.......I.qk..B.....LZ~...G...~...8V:..s.[x.b[~...8V:..s.[x.b[~....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............I."$.h....8."h......N...^...............|..,~..H..xjWI..........V...x....................................I.qk..B.....LZ............I."$.h....8."h...................................~.......~.......~...........................................~..j.A..~..T....~.......~....r..~.......~.. .7..~.......~.. .........Z4...........................................4../4......p...............C.a.l.i.b.r.i..................~...~...~....z...y.. x.. ...........$........4...!..7!..7...............~..;~...~....z...y.. x.. ...........$......

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001U.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):14177
                                                                                                                                                                                    Entropy (8bit):5.705782002886174
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:EbgGcV/hlvpfal7rgYa8S7auAxwfuSTmCSNoFQ6NO7L:EbgGcVnpwimnd38FdQL
                                                                                                                                                                                    MD5:7CDCE7EEBF795998DA6CAC11D363291C
                                                                                                                                                                                    SHA1:183B4CC25B50A80D3EC7CCE4BF445BCFBAA6F224
                                                                                                                                                                                    SHA-256:DE35AF949D4F83E97EE22F817AFE2531CC4B59FF9EE6026DCA7ECEBC5CF2737F
                                                                                                                                                                                    SHA-512:560FB15A9C12758D11BB40B742A6EAD755F15AD10D6C5DEBA67F7BC8A2AE67C860831914CBCBCDED9E6B2D1D5F26A636B9BCEF178151F70B4D027316F94F27E1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!.1..A....Qa".q..2.....&...B%6.'..R#3.$E.r457bS.DUFV.Wg(.......................1...3.Q..2Rr....s.4.!Aq.S.aC5B$%............?...n.Liq.}.{#....3/gg.1.M +..~3...q..+=..:.g.i1;P)7.....q..n.s"p...wx........v.t.f;..L/..~....y.r[.r.....n.n3..6i..g..}../........3..x.L.i?We..l.......~..<.;..6..o.....N.t.o6.l..~.......<...m.V...Q.7k.u./wq.t..;.I...}..{...>.L..3m..a....yd......6~.f..~Y..}+..<.[w..'-..?.v.7...v.u..4.......1];..u.MO.......s..p..ms.'.O-o...O......m.k.e....)t....i>..E|....,iOyD|.{......g.n...cu....=..........h.\.Q:?g/?.I.3._...t...d.n.0.%y....S.Q....S.&K.w..&wY<....%.g.v.....$y..#,i;.=...t...I6..yO..o.d..w\k...~......)..rK.......].u....N....e.s..kU.u..'}

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001V.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):49152
                                                                                                                                                                                    Entropy (8bit):4.645595810107098
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:1lXg3kXN9qLuVqFkG/ufQnLEB0vP6S8zmKXpbZ1SQT8otVXMRsQNjMWDMs5xRytb:c0NkQ8OHtxDQNjMZieGBE3pQNfu
                                                                                                                                                                                    MD5:04E6941414896F9B3BE95F73A09C2361
                                                                                                                                                                                    SHA1:BFD96679656EE371410CB5B7DB24281F6A553A52
                                                                                                                                                                                    SHA-256:3E1F5BEBEA9E0D268407062200ED20E36CA49687FC3102D6D52CD54DAD706F0D
                                                                                                                                                                                    SHA-512:7CB6488DB1E9B90F4E9BF282BC98387B42028CA5A09732EE1DAE4A665E6637EB2D44C3895D7F044166918337C2974A1619B1B1DA19F71F0282AC97431B400233
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:x...r....&......r%...&..8.... ..H@.. `.........x...r....%......r%..J&....... ..H@.. `..................................................................x...r....%......r%......x.... ..H@.. `.....................eV.M...N..L:.p.......p...]..$....iG.]...o@.).3.R..]........J'.?.....h....X:.X.<..J0..k.X:..........p3......p3.....................................................T.......T.....\.T$&..&..T#...bU.T....D..T....6..T.f.... T#E...........0...........e....4........................u.^s.Q.@.).~b.......(...@kO.....(..."...P.l.a.i.n. .a.n.d. .S.i.m.p.l.e...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.r...P.a.g.e.V.e.r.C.o.m.m.e.n.t...P.a.g.e.O.v.e.r.i.d.e...P.a.g.e.N.a.m.e...2...0.0.0.5.2...1.....0...U.n.t.i.t.l.e.d. .p.a.g.e.......................>F....i.hX.. ....... ...&N...S....2...n...h...........*.......h....p...........V...\.... .. #..........D.......u....c..,0...e...B4.$........{p.....G...^...?@kO.................... #...... #.."..,.7.I.-..e......eJ]..N.>...*....+.F....s.G....+..p..

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000020.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.351554167526851
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:Dosty+2uEYtUlwE8owXtCqF9iuQcfrdhSrgdYtX8eASF9biLHAFPZr:UsIu7OwE8VXtCqF9BQKRAOYx
                                                                                                                                                                                    MD5:8CD19441E5AC54A6BABD3756007B397C
                                                                                                                                                                                    SHA1:B64305354BCEF669B22046E8F7C9F03040D2AF9E
                                                                                                                                                                                    SHA-256:67E15F3BEBC665C70E492EF64A174D8CC2D8E673B756E37EFF66EDB6A81677B4
                                                                                                                                                                                    SHA-512:95B98F7F9287E1E85978F497C99038EF7BC9C0678F66519AC02D3047EA600892C6E26033FBE40DF194BEFB96D173DDFFED550B90C6751B79E9C4CD10D0F36D1B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZlQq.....lQq..A.....lf*.NlQq..A.....lf*.NlQq..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............f..U......D[J.....N...^...............\...m.jJ.....V..........f........................................I.qk..B.....LZ............f..U......D[J.........f..U......D[J..........lQq.....lQq.....lQq.........................................lQqj....lQqT.]..lQq.....lQq..B..lQqH....lQq..B..lQq..>.)lQq..J...................;........4...4...4.."..............lQq.lQq.lQq..z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4.........lQq.....lQq....#lQq............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000021.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 814x105, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12654
                                                                                                                                                                                    Entropy (8bit):7.745439197485533
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:JheN2cq6MLu6MLGu54cHeNzhcmhcDu53eNE3UPkhrxvu:Ji2Wix7fzVsbE3Zm
                                                                                                                                                                                    MD5:4BCCCDBB4273ECEBE216C84930A8D0B2
                                                                                                                                                                                    SHA1:FFBF617787E27BC94D9BAF89F2FE34A2BD42794B
                                                                                                                                                                                    SHA-256:474F9A8C25D5E21192315397EA995B1E11E2C1608157C6E0277688091BFD136A
                                                                                                                                                                                    SHA-512:DAD73A8C0E293B88685C0C71EF15E0DC95EE39B7FC9F849DE5D634173FD9FA0AF0AA96742D9E94BE03556AA4A817D5001C95A6736EAD5D5DF03661876785EB74
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....C....................................................................C.......................................................................i..............................................E.....................U....V...f..ASTc.......de.1Qq...!Rb....Ca."r.................................B....................b....Ra.....!Qc.....AS.1U.."C...2Bq...$#3%&.............?......3.....~......:..g..s"......:..g..s"..ic..Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. ..0...Q_..X..V5E~..c..X...@u...cTW...0...Q_..;.m.....@w...Q.+....*.4W...lUFh....v..._..wn...dW....y._..v..E~...*...@wn...dW....y._...v..U..@wn...d..{`;.|U.2g...*.3...:.0?ViN.z.@w...4.M.:m..`~..i7...q...I....J.`l...W..n..PQTiB...6....+..sj.*."...6....+..WA...x..A........(.N6`..AD.q.....'S...t.Q:.l.......f.]..N..0.. .u8..A........_W..Y...}.C...~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~.v..?U..^.r..}..Bep

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000022.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.324173927867155
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:/UXsfiRjZtAfFDatrymWbxEp8GXmCmt9B4cNrdhSrHYJcxtXtcD9RZ4oPh:0smtAfFGpWxEp/Xet9B4wRAaigyoP
                                                                                                                                                                                    MD5:89E6CF08240D8615E211A58D80F3F466
                                                                                                                                                                                    SHA1:2C1D92EADC311EE8AB62502AF2BD77C9F3235BF2
                                                                                                                                                                                    SHA-256:9DDC2E69D09C5B5D21FD491B1E1913DAFC9F4288A53B9DD338D8D9FE4830B591
                                                                                                                                                                                    SHA-512:4F8C9C6AED0A16F5CF9B073D72EB781755EB2BAE02F3BE9CB5BD083C0908E69613D693662DEEE3D2BDF1F0C6393E7B38E5C602ADA11F406EA4FA2F053B326D1C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.N)......N)-.......#.Jv.N)-.......#.Jv.N)..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............Y.....;.(..w.~.....N...^.................5....J.&2;..X.........f........................................I.qk..B.....LZ............Y.....;.(..w.~.........Y.....;.(..w.~...........N)......N)......N)..........................................N)j.....N)T.]...N)......N)..B...N)H.....N)..B...N)..>.).N)..J...................;........4...4...4.."...............N)..N)..N)..z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4..........N)......N)....#.N)............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000023.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 728x77, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2695
                                                                                                                                                                                    Entropy (8bit):7.434963358385164
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:N9YMsguOZgKAz2vcaQU4R8r4BU0/Rc4nbIQdsohw13ZmFLY6KsVvMdBL2mr:/hsEgNz2v5T/rQC67SoWniHK4EdBH
                                                                                                                                                                                    MD5:B23DE98D5B4AFC269ED7EBFDDECE9716
                                                                                                                                                                                    SHA1:10AF507A8079293A9AE0E3B96CF63A949B4588AA
                                                                                                                                                                                    SHA-256:646586CB71742A2369A529876B41AF6A472C35CC508D1AE5D8395D55784814F2
                                                                                                                                                                                    SHA-512:BBACBE205EC0A4F4E3AB7E2B1DEE36FCF087DDF77C7D18B53AEA4B15984A47C64E19F9B8D8FA568620619CEA0361D94FE7ABEA6E502EC6ECAEFE957F42ED7EE8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......M....".......................................,.......................1....!ABQRq.2a."CbS.......................................................Qa1A............?....{............i........l..-D.q.~..|cS.S...R\..d.8,!.....]f$....Q..di.;~5......vj......MqCe..=.*.f^..=.}.Cm]qCd..s=..u.e..v..t'.,.....S.s..N...>.d4'.,..k...N...d..9....G...y....6J.Y.l.{Vf...^B..i.3.z....:5W#4@.S\fj.%..Mb.5.v.5......S.E..#.v.I.....I......m..H....D..|.Y|...W.Wf..o..U.0.E..@.T.....................................'.S../...Z......!J..1K..rI...T.f.>.+.N..o.....\..^u........e..q.qK.GXP..-...F8".;5J...]Y......j.a.,R.......J.N........z}<qu..J.)`.}X:..}.............B...[. ......,B.).b.......(Y.O....c\.o.e&.W.#Bo..N|..N8.#J.>1D.1..b.&....q.#..UT%,.d.....m&..^...VXA..b.nbTV~.....^........q..#./.I..=Q..=..Y.*.Ib...VZ+......Y.........'.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000024.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.3354780409918
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:ksjM9Cp0o3Btm5ZE/ErfWXl1VW9FK7cxrdhSrhdaztXdc9rrYs:ksrp0oRsbE/yfWXlTW9FK70RAWz2
                                                                                                                                                                                    MD5:C54DC9B8DF739B5CCD36FDCF110DAE82
                                                                                                                                                                                    SHA1:C805EF84FE7B03789816D19AA66971CA99459FC7
                                                                                                                                                                                    SHA-256:579CA4E2ACCE33888FB5C8EE971DF901B84CA0743D5354287040FE4BE3E96DE2
                                                                                                                                                                                    SHA-512:FEE12DB7857EFBC75A8B1057FF2FAF8FAAC1B5F775019C9254DBA31F6313018823300BDA7534884F77E324E035F14DC04B3736E1C3691C28D0375AA703449B28
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.{.......{.j.B.....D.....{.j.B.....D.....{...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............*...h./....C......N...^.................sA...A.aD.a...........f........................................I.qk..B.....LZ..............*...h./....C............*...h./....C............{.......{.......{...........................................{.j.....{.T.]...{.......{...B...{.H.....{...B...{...>.).{...J...................;........4...4...4.."...............{...{...{...z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4..........{.......{.....#.{.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000025.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 69x630, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):11040
                                                                                                                                                                                    Entropy (8bit):7.929583162638891
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:u99+91V42ho91V42ho91V42ho91V4235z9pUkDCyixxo4PS6b8tEy3BcWWhhSy0b:ubKD4/D4/D4/D4uzX38u4PNYJ2zhhmb
                                                                                                                                                                                    MD5:02775A1E41CF53AC771D820003903913
                                                                                                                                                                                    SHA1:2951A94A05ECF65E86D44C3C663B9B44BAD2BC9D
                                                                                                                                                                                    SHA-256:83245F217DEAE4A4143B565E13C045DBB32A9063E8C6B2E43BB15CD76C5F9219
                                                                                                                                                                                    SHA-512:5A1FCC24BDD5EE16BC2C9BACF45BCECF35ED895EAC22D2C4EE99C1B7E79C8E8B9E5186E3D026BA08FF70E08113F0A88FBF5E61C57AF4F3EA9BA80CE9F33410E9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....C....................................................................C.......................................................................v.E.............................................S..........................Aa..!12Qqw.....3568rv........".....4Btu.....#Rs.(W..bg.................................D.....................1..2.!4Aqrs....Qa......t..."3BRb....#.$S.Cc..............?...K/h._+.N6.-.a...5...;.r....,...0B.s(..zp..4.%r|q..E.Q^.../...C.R..?u.q8XN.>.e..:..gJ...._.n>.70G,..(........3b.&.5m...Q../...7Ie..k....e.l6..&..`Gt.P.Y^r...=..Y.e...N.B...O.#..J+........u.V;G.'.....V.]8..C.]..........E.....c..w&lX..f..\T.J?...F.,..m|..93........,.....+.R..WG...%.....(@.....p].iEz<.8.^...J.h.....a8P.1......(z..y~.........H.Z^.>..<.....L.k..IG...R.(.%..m....&u...B|.....@]ey.W.J...!d..R.8...[..>8....(.G......!.)X.....,'..F2.Z.t..Aw./..Z..#..i.kK.......b.i...qR.(....RE.............O.XP.#..(...9J..]...,.2.[w....KrW'...tY.......{~.:.+..

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000026.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.502749958427735
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:GRlsAl2cY1lglxs0PJc+otUEP3F7OXS9vtckHcWZrdHr7XtXmqfKlglnl4Il/loE:WsN2fPdoWEP3FqXS9GunZRLD2Q
                                                                                                                                                                                    MD5:A05D6654C2AD114E9C0B217A129F9528
                                                                                                                                                                                    SHA1:0EC08073C1FCD4445690C7FFD1186D32B8B3A303
                                                                                                                                                                                    SHA-256:802A1EB6955772020E1C6DB486C607B2CBB12FE00A370FB839EE6B31DAFD0A65
                                                                                                                                                                                    SHA-512:0F5499803B9F887A25C7AD36ED27C5B54E153D4513A009A62F26D1219F73901A6E9DEF133256038695541EC1D5917F40F2E69115D0E38CAFD7FB0418C45CE82A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......p...v...d.....................................................?....?........................................................................2...>...L.......v................................I.......I.qk..B.....LZ./......./...b....xW.._./...b....xW.._./...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............,,..S.&.O.*|m=....N...^.................d.2..N.?u.............Z................................... ....I.qk..B.....LZ.............,,..S.&.O.*|m=.........,,..S.&.O.*|m=........../......./......./.........................................../.j...../.T%c.../......./...G.../...H.../...>.../......./. .3...................;........4...4...4..".............../.../.../...z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4........../......./.....#./.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000027.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 105x441, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2268
                                                                                                                                                                                    Entropy (8bit):7.384274251000273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:N9YMn9H5gXlM26vroVXWxyNnl1LmLR+rn4FOeewGhDbby:/h9SlMdgm09ll8R2/rby
                                                                                                                                                                                    MD5:09A7AE94AA8E517298A9618A13D6E0E2
                                                                                                                                                                                    SHA1:FA5181A7414BA32F816BF0C4278EC20C615E8B1A
                                                                                                                                                                                    SHA-256:3C68C7EE798E62A4A99C740153F3980D7DF029605C843410942C7F85E794823B
                                                                                                                                                                                    SHA-512:074E9A2BE2039D0AFEAD360157550B934FABD0CB86B5AF476C1FBC885EE60331F5A68EAF70BF76E23C8248A20FB900346839F4AA8892370B5889E64948DCC6E2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........i..".......................................3......................!.A..1Q."q.2BRa.b...#$................................... .......................!12AqQ.............?..D.z.4....;.....7...3.t<!..d.O.....+O+.;.z6.4cz7E.........U.Z)-..@..y...........}(W...<.xv/...5.ew......yN....n.Tk.Tm.Ty.vA=...T..U....h...e.8.5%....'......e^......L.g.$.~e..O.._...... .F`.....xnL.<.......]jfv...}..\G..c.......-%...#.C.|.].`..^..W..c..B..5D.QSTaZ.5A=....BU..z%.4.h.6..=..U...W.$..l...7.:...........IPQT_...~..i..x....~.l.|.n.J..TV.21.Tg.....................j.z!+.-............"j.j...)*..TT...."....T.Tc.**j..............j.z!*.h...&.&.&..e.%..TksTW%G.?".l+$..c._9..[x...TU..........i~X..#'.qm?ttO.....}*.i...q.....9..r..?..W..d.w...f;..q...tZh..0.....2.......OD%Q-.......$......56.K.O...y._..*_C.k..p9.p..O..vu...'........0v

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000028.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 76x97, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):784
                                                                                                                                                                                    Entropy (8bit):6.962539208465222
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:869YM8fij0W/xfuCp7ovv1bidiMn3bGi6AETQcdH8SADjoZgV6v9jUEvS3/g:N9YMWeI424diMn3yinsQeHvADu9QEvJ
                                                                                                                                                                                    MD5:14105A831FE32590E52C2E2E41879624
                                                                                                                                                                                    SHA1:078FA63FC7DB5830E9059DF02D56882240429D90
                                                                                                                                                                                    SHA-256:D0A3A1C3CD63C4023FE5716CBE2C211307D0E277E444D9EF76C7FC097A845FD4
                                                                                                                                                                                    SHA-512:8FC0ED24E8EC14C46EA523D9265DE28F85C5FC57AA54AD5B9CA162E95F79221E2AD3DD67D1293CF756B67F3D3DECAE122254134EA8D4D00DDED02114B5383947
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......a.L..".......................................-........................!A."1.Qbq....2Ba.........................................................1............?.....3.Ty\......vs....>.>..a.W..s89.d...Z}......rz...`...Z.r.do....u.W.%....gf.>.L..xz....B8=w...g.~g."HD...$..IKJ......nn..*ly..I....L...\q...Q;6.KrxZ.,...j$..ZQ..)f...q`.*..C1..cZ2]-..\.~..J.....^..(.f..9m?..C.NI.UL..X.fy.Z.........+n....r."Z...d..R./\.#...kd.D.5.!...h.3*s-+.......Xjt..}i..rK..y.../>u..]N.....Y..J......1.x./.....F6.......I...._3...k.sM.+..v;.%|.f.~.......:y....S....UKovh...W'........lF... .................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000029.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8192
                                                                                                                                                                                    Entropy (8bit):2.737856157895753
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:e0sPAYCznMcdPknXb9kLuRCPwrggxBg/TT:eJPAtnRZ6JkKRCP0ggxBg/n
                                                                                                                                                                                    MD5:5D8D938837F1351783DF19038B8E4288
                                                                                                                                                                                    SHA1:3C2EA729FC3979C168A21191E6515C9AFD5B0E71
                                                                                                                                                                                    SHA-256:0AC1643073CB60A10FBEFE0AA061B5C419A6EF385FFCA1C2F2E0C71BF0DD9765
                                                                                                                                                                                    SHA-512:571C8ECBC0B03D00882D3AA862AE39DC69BAFF551B3B6271317AC9BA515318D0325733AF80E4A27F5858F023E808307EBD5E1F4D01477EE34923C50029B47A6A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>...........v.......................................................................................................................................2...>...........v................................I.......I.qk..B.....LZ...............&.1....A.......&.1....A.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............2t....>.4FD...iP....N...^...............U{..R.H..y.{...............................................^....I.qk..B.....LZ............2t....>.4FD...iP........2t....>.4FD...iP........................................................................j.......T.l...............Q.......Q.......>............. .3...................;........4...4...4.."...........................z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4........................#...............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002A.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 95x498, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3009
                                                                                                                                                                                    Entropy (8bit):7.493528353751471
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:aRCTf+0hagMrbAZMJShPdvF/5OzlQFlDF7npkDdWvVBTEnBLT6NrgCX0:D+0YgMrApL553JtEdEVcL2NcX
                                                                                                                                                                                    MD5:D9BD80D40B458EDB2A318F639561579A
                                                                                                                                                                                    SHA1:83BA01519F3C7C1525C2EA4C2D9B40F28B2F2E5E
                                                                                                                                                                                    SHA-256:509A6945FACFB3DDC7BE6EE8B82797AD0C72DB5755486EE878125A959CC09B59
                                                                                                                                                                                    SHA-512:C368499667028180A922DD015980C29865AEF4A890C83E87AE29F6A27DC323DD729E6FB1C34A2168A148E6A7A972F65A5FC8ACE6981AF1D4E7057D99681CB366
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....C....................................... ! ..''**''555556666666666...C......................&.....&,$ $,(+&&&+(//,,//666666666666666........_.........................................:.......................r.!12BQ...3Aaq.."CRb.....#4$c.S.....................................................1A............?..p..-.....u0$.......l......)..o.FTd..DG....... .t*e..jO..Z.U......r..j.O.,..VD./.....V5D.&......A..Zi....E.N....*..........#..M<|.2.Y.../QO.x.cTM4......+.F;V.x.de*....]e..O.x.c\Y........r..j.O.,..T...hw..k.^.[B..J.sEl.w.x.m.5%zzt0..T.......b..<\.3Q..W</..!.xh6..Z..\.+M.o.Y..1............#.........|.a.l.KR>..U......e....@...\.1Z...Y...[....F.6.t.#..Z,.x.Q..[`.X......#........W</..TM..-H...V....Tf..........r..j.x.df.f.....#..l.KR>..U......e....@...\.1Z...Y..Y.us....D.)....Uh....FkYm.m`P...W .V.g..FjVj.\..1Q6.t.#..Z,.x.Q..[`.X......#........W</..TM..-H...V....Tf..........r..j.x.df.f.....#..l.KR>..U......e....@...\.1Z...Y..Y.us....D.)....

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002B.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 700x114, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2266
                                                                                                                                                                                    Entropy (8bit):5.563021222358941
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:TuRCTP9rSTfIEe1HbcVY1YbDXq8eCI0bf2QQe0GVDQAzZw:aRCTN7HbcW1YbDXq+I07Ien0AVw
                                                                                                                                                                                    MD5:DB8A181E3F0EAD4A9472099E42ED6BE3
                                                                                                                                                                                    SHA1:92096AF05CC6167B1AA816811A1160B809393FA2
                                                                                                                                                                                    SHA-256:E9746B4E9AE9CE7B3B0068779DB3E113E2DFC9880F25373D745D0E700E69A906
                                                                                                                                                                                    SHA-512:A9E246E10E28D057090BA9F034ECE6131780D7F794C5C9421523388997C7EDFBB49BC32B863B6C6668911B359C304AA54969B48CB9234950D5CECD2A6F3EFFF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....C....................................... ! ..''**''555556666666666...C......................&.....&,$ $,(+&&&+(//,,//666666666666666......r...........................................5.......................!1AQ..2a...."Rq..#3BSr..C..................................................................?...X.....U...j...F.W.V]'KV.uWt.iT...{.......`.(.....V%..=.....z......V..ct+.U.B...@.............................................{.....5.........0...x4....c..;...........+......|.7E.%.9.1+}..d.........+.V#.P.HUL.E...g.li...8.>U.";0pi.]5.\..zo..."@.........................................y.6.mLN..S.....@...i..A..p.......~|V9.+.Xy.........+,L.....7Z7..p...-X...\.....:-...i....v.1...-..H....9.zk....l....^.......:.."^.t.Q.F...X..B..$............................................a.%f&3..1.5+.X..'b7bwr.).e.x....!...H...aa_..kD...b..g..p..K^.k..qX.[,.........Q...U..x...YMvj...w..:k.....j.W.8..4....c.u.}m.....o.=@.......j.S.t.|.....5h.y.%.~...G

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002C.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.350710158249168
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:Yul0si0Glqo0OgGtKY/EgjqBXoiqB9SOol7rdQqrqBtZ0BXAFc4l:Y+0sWlZ0OgGl/EwKXoiK9SOkRQy20E
                                                                                                                                                                                    MD5:9B9E2F138EF16ACA97883105F97345D5
                                                                                                                                                                                    SHA1:DA860F8F55A25DCE9813A0E91E4A4E7D45406BC3
                                                                                                                                                                                    SHA-256:006DF665A30AB6D30BBE11528C0B7C6372A2FB0F6F2654761BA6AAA9015C2A09
                                                                                                                                                                                    SHA-512:C2E5B1096241885B92AD165CC468A2984FCD4A69FC1F9C5C574687D3EDCDBFCD9A2147DB8A6CE008CA7A2CCCDA6E58DD6403FA154193FF17659EA1C2E641E935
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZO.......O....1R.1......O....1R.1......O....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............]..8v....."`u;......N...^..................3E..p..JI........f........................................I.qk..B.....LZ............]..8v....."`u;..........]..8v....."`u;...........O.......O.......O...........................................O..j....O..T.]..O.......O....B..O..H....O....B..O....>.)O....J...................;........4...4...4.."..............O...O...O....z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........O.......O......#O..............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002D.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 813 x 99, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):99293
                                                                                                                                                                                    Entropy (8bit):7.9690121496708555
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:Moq1jVORV5NO5xLCBaaNk4vhpCr1CH/DATOQlWvHMHojiaAMrxArLFRZPj19AWFz:eVEbouBaIk4T8uDGOQlVHvaAMkhDh95V
                                                                                                                                                                                    MD5:EA45266A770EEA27A24A5BB3BE688B14
                                                                                                                                                                                    SHA1:9F0B23B3C8EBA4FC3C521E875EF876FBE018F3C8
                                                                                                                                                                                    SHA-256:EDAD0F03E6FF99FEF9EF8E8B834CE74F26CD23C5F8C067F5CEE66F304181E64D
                                                                                                                                                                                    SHA-512:D4EE36BDA897BBD643A699A0332DD00DE9CDCC6F46D861789BAD259A4BF87868AE3B4CFAAB6DFAF29941C7055B77A95D76BAA86A4A0DB2BF3BAF7E3317F03EB9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...-...c............sBIT....|.d.....pHYs...........~.....tEXtSoftware.Macromedia Fireworks 8.h.x....tEXtCreation Time.05/15/06.8.p....prVWx..[Oh\E...y3kv........`.%m.R..6.1.4).o..Ki...D.......P!.].=..K...C[....f.}o7VPJIg...{3.|....d.....i..=.4.u0...n y......@j..Q..f)..mQ...4-SJ..9.d.?..5\-....:b.W..i...c.5..{..pj#.....B1C/.I.......].Su.k?.2..:.9Q...5.U...UZ...e..U.c],..2.}...1..)W./..Epr.Zt.....K.=..{......e..."...v..B.4.#....A.V1.".V}t..[..2f..Y..V9.".6.......(..gbm.P.....Y%2.c.z.:Q.2.<tYF.....u.@..KJ.;u.q:.].....$.....V....Hqk..DW.l.e.j.Z.YP?:'R..*.<........6...m@..r..j2..HK"|..L.Nc..D..y.9..B4$.......`.3.m1LE....7(OU\+./.O...%6T..w......h....).I.&n...*......#..W.41...5.#.`..I...<.?.|..*+Q.....#i........$,..n...`.s....[..E. T.w..j.,&-.r..;a....#.>(.P......f...MU\3*..;B....)..5....z..(....-...a.....}y.l..E...z>......&..g.$.....*T...N....E:./.>..#...^..E.0..%......(..@..W.X.NDM.<~.]A.>..fW.O.y.'...Z...h..).F..

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002E.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.346149369648355
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:YuUecsEzNkK2a9tVk/cEVpydXnc96iolrdQqrW/2BX2D1oDyJp:YLecs+0a9PNEPyXc96iURQy5c7
                                                                                                                                                                                    MD5:602E4AEB04DD3B2532E97D5344E8A722
                                                                                                                                                                                    SHA1:9D5992C051C2ABA323A945FF79912319D457D528
                                                                                                                                                                                    SHA-256:C1A355EED0E833B485C0AA9365E1D4556143B6D85A3A317E980754A5D3BD5F48
                                                                                                                                                                                    SHA-512:988AACDA3E852B102E03E47E4771B702136A9AF112F94C60EADAABB212DDD4B054EC05ACB8B3A930BC1550E7B042984E80F492DF407F56476C2545018C87CE0E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ.-.......-.,....(.Fd.WP3.-.,....(.Fd.WP3.-...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................>.J..<..S.~G.....N...^...............e2~/Q#.E....:........f........................................I.qk..B.....LZ...............>.J..<..S.~G............>.J..<..S.~G...........-.......-.......-...........................................-.j.....-.T.]...-.......-..B...-.H.....-...B...-...>.).-...J...................;........4...4...4.."...............-...-...-...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........-.......-.....#.-.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002F.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 780x107, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2898
                                                                                                                                                                                    Entropy (8bit):7.551512280854713
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:N9YMTXc4gpw+EIWnqQ5G+NE9VTzRFvS4+Xh+AKrNx+JuCluc3Eeky8etajhDCFex:/hDc4rPIoNEzbS4+XhOrGJu1cUHeoVey
                                                                                                                                                                                    MD5:7C7D9922101488124D2E4666709198AC
                                                                                                                                                                                    SHA1:00CC44A1B84D4D94A0ACE8834491EB5F65D04619
                                                                                                                                                                                    SHA-256:20016E5FA1A32DCE5AF4E92872597E36432185A7BB2E61C91F362BD68484529B
                                                                                                                                                                                    SHA-512:882944B2CF040485899128E03B7499C540D481E45FE8017DBF4FE0330157B2D8ABB7334DDB31C112BA0EFE3722A554883917C54155A7F60044D2D7F3D848260F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......k....".......................................2...........................c.....TUb...Sa...QRqr..............................!.....................Q...R..!..............?...$.)m.1...%%bV.J..H....-.%a[...I"WJ..:.X.:TT.$.......N.-NR.E..-NR.E...9..E....$.k.....B.I,I)..J...kr..+)..I,Yj..YbI..+,J..e..Z..V.e.$V..TV.X..V.YQZ.EQ..U%PY[.[.R.EP............................| F.. ...j*...!m.!j.I%.j.$...YeEYYEEUE..eY[.hEEUeEil.....%..el...V..TUYA.U.UTTUT.Z..UQQUQE...V.,...UlE.U[.lEP.P.@......................................R1...AR1m.....#..$:.T.p..IJ.t.....A..AH.,5..]F!a.XJFaa. ..a.!*.aa. X.e.......bB.b..,HX[,!..,,.c0.,..U..X..(,,...B(.,..4..B.`..".a..-......"...........................>D..IKEb...t.....)u.....)K.%+L\.J]i)*b.JR.IIL\i)u....T............T.....qs.it.iJ...])ZJb.....X....U.A...V1..B.R1....X...,.c...,%X...,%#0...,H

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002G.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.323811415538564
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:6xsgrLnMnlWwESh0WXHYW9C8RQyRzp+PLnOICoKhY:6xsgrrMnQXWX4W9C8RJRV+PrOICo
                                                                                                                                                                                    MD5:705BEEEE524F2EC56CBCFD94E178511E
                                                                                                                                                                                    SHA1:74EDBC9D7810D8A55F9102D60023DB189E87E112
                                                                                                                                                                                    SHA-256:642E068798245FE9BFE048C9F5D6955CC2FCF0DDF0C03162FB258B316A64FB8A
                                                                                                                                                                                    SHA-512:6306C969179814A55197D4E65C36751BACED5204AC20BFC478404515CFC401373DF573A69F0BAF1FDA2009B091AE681BE3C97DDFBADF74E0E3000918F20E5329
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ>.......>...C`......>.>...C`......>.>....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............aq.$z.....7........N...^..................?...N.....L..........f........................................I.qk..B.....LZ............aq.$z.....7............aq.$z.....7.............>.......>.......>...........................................>..j....>..T.]..>.......>....B..>..H....>....B..>....>.)>....J...................;........4...4...4.."..............>...>...>....z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........>.......>......#>..............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002H.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 613x144, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):29187
                                                                                                                                                                                    Entropy (8bit):7.971308326749753
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:RwjBOlCk+nYnGagKJWJhwMJiRO22ZIm4VXvXx1tA6BQs:i8snY3JW7uROlEfbtVL
                                                                                                                                                                                    MD5:DF99CAAAB9A7DE97B63343E60A699AB6
                                                                                                                                                                                    SHA1:B84334135CFB73BC6EF55F85926770D5AC6DFEA8
                                                                                                                                                                                    SHA-256:74C131777E7C437FD654427417097BC01B0813BA8E1E50E4B937BD50A1BEBCDB
                                                                                                                                                                                    SHA-512:5D15AAAA8B71DDFE01A7C0ADE16D9E1F5E9AAE484BCD711B38CCB103ED9564CAAC23A0031471167B660E15972D70179C2A387509B213C05D60261042A0456025
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....C....................................................................C.........................................................................e..............................................`.............................!1Qq...2ARa..."#.....3BSbr...$4C...Tcs......%&DUd...E....56Fe....................................H........................!1Qa..Aq..."b....2R...BSr..#...3..Cc....$%4...............?...b.d.8T1.;#.S.DO...~.R.......3.xe...z.6..."m..k...;*.'.f.5^.....m..<$....8.R.j.D.v..>...*dT..vGbt...I......sEWp.r3.. ..G...6.....w...l.S..q...b.....-R....^Zu5+u6...A..Z].:...5..Uzn.,l.L.....?%.*.S.+zVg7.=.s.Q.....8..:,c.......ZE...>'IF..W.0.d.......c.e.d.V.t..S$.DNR.[....g..#i.$. .U.SK2.....k...J5u u\R.....T.[4..A.O..,.T..................] .i...B.m.^f....._...{S.....<......:..|D...+...NA....Y.^f.1|..%K~1..B..^...S..v=.c..g.tX[..kTJ..t.gr....R..@.F....5j..2.K.9..g.1N.....*.U...^w......>+.l.v...@N....%Qd...t.Ni.....0;lggm...K".+!.,.....[J...>..?f.]._;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002I.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.354986804394009
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:Esk/qAr/r/DEgM+tuiIhqEYYOt7lOkXGiIqbk9CioprdQqrMhIquBXcbk90/ry/D:EsBgM+XEYY64kXbk99QRQyZv
                                                                                                                                                                                    MD5:755A2CFE763C7C0E98C9D3118FBAF2DF
                                                                                                                                                                                    SHA1:6C1D53CB7BEED9B351CE4271619A60BBFCA3A8EA
                                                                                                                                                                                    SHA-256:C5BF4D153B480E60CD847D3971D6064506D0BF4634A30DBDED367C6F7B4339DA
                                                                                                                                                                                    SHA-512:695F2B17EF2C235F4062B9E64FD3FF33AC3B02DE6CB1110D6004DE013330F06AD4F246F25348F48C75D7109936CCC10DD7A292B568E091DDA2C22AB62F291A1C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZz.......z..k.../.".$Z$.z..k.../.".$Z$.z....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................^..p...e.fH./....N...^..............."Fju.ScK.v.t..}.........f........................................I.qk..B.....LZ...............^..p...e.fH./...........^..p...e.fH./.........z.......z.......z...........................................z..j....z..T.]..z.......z...B..z..H....z....B..z....>.)z....J...................;........4...4...4.."..............z...z...z....z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........z.......z......#z..............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002J.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 276x139, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4819
                                                                                                                                                                                    Entropy (8bit):7.874649683222419
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:/hnQiz+ET2/hDi+tv34VtpWfowTHgegb6hhLT1NTS:5nQ6TAhLtvIzMvbi6hhF0
                                                                                                                                                                                    MD5:5D6C1F361BC04403555BE945E28E53FC
                                                                                                                                                                                    SHA1:00C254F7B3BC0289590C2BBDBB39C8EC2E2B2821
                                                                                                                                                                                    SHA-256:131D637CDC5D0B094FB9FAD17F4D2A1ACE0D03613588155AACAA2D1CB4E16DA9
                                                                                                                                                                                    SHA-512:34D2C0929FCC3CC10D0A2121BD55BFA9A07062C2A7B8F101071164C946895DBCB2777641E79DE4193D57A3F0778DD4F1351FAF333B7E4B4DBE31A32DD69C51F9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222...........".......................................<........................!1..AQaq"...2B...#Rb..r..$3CS.cs..................................................!1A............?.............u....p.p($.Y...9,j...V.*..S86yh.G.#m.5..9...6Y.."C.R:.[..-.7U3c:..].;.....f.?%..<T...&F.Lh.N...m]..x.D.g<B.....k..S........>j.K....#U..Z....<e.:..8....o..xq.[..4v..U..y...k... k....A#..A...pn.jJ.I.7:..{.b..ns.t,...8.Td.I....m.I.5Z.).-.. ]..X.Do%.....?..4jV.`llt.E...5...u.|..\F.=.F.r<...5dV....xc.%..&...4,...f...3..H.<......eQ...P.J....7...lLc..?..-.fR..7.#.6.......}:.]'.ny..........e;u.Y..$0...i..-....f..9(....}..T,.Inb...+=Cca7....WULA1@.s...4uY5.N.f.c..].ks.....3v..~..k..m)...f gNE`S......#.....Z..6.uc.m...#k.s.f*.l.$6..?..xC.Cm.`...N2..&H...._.&.E...[....f.Z./...!.a{K..#.V.5..v.B....1...9..B.&....%s.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002K.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.362692090950811
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:2sCqGS1uWkPmV0REVCBXab0T9DkRQyUADodGL/Tdt:2sN1uWkPKZ8BXgk9DkRJXo
                                                                                                                                                                                    MD5:C6B8178AC658AAF54FA16CD99BD7CF18
                                                                                                                                                                                    SHA1:A544DA63667D428A40C50320AA2486E102EB9341
                                                                                                                                                                                    SHA-256:9B67CC664CF62D7C5A838425F8E810FDBCC1EDB9079ABBCB7AD8CAEEAD8372D9
                                                                                                                                                                                    SHA-512:8823589D90BC9A61EEB04788ECA9FF7178EF50DAFF6D25FEB8E7F858C7D7A2289A61CF0DCBFCDF985ED998905DD70386CA07DC7B64F213F05E06D32160C9986B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......V...v...J...................................................................................................................................2...>...2.......v...~............................I.......I.qk..B.....LZ..@.......@...E.-........@...E.-........@..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............D.:.....7..Qz.j(....N...^..................`.G.SZ.............f........................................I.qk..B.....LZ............D.:.....7..Qz.j(........D.:.....7..Qz.j(...........@.......@.......@...........................................@j......@T.]....@.......@..B....@H......@..B....@..>.)..@..J...................;........4...4...4.."................@...@...@..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4...........@.......@....#..@............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002L.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 814x45, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1717
                                                                                                                                                                                    Entropy (8bit):7.154087739587035
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:N9YMzO6BOfqH/dAIWpdAIWpdAIWpdAIWUtr/SD:/hzJgfqHaPYPYPYPUt/i
                                                                                                                                                                                    MD5:943371B39CA847674998535110462220
                                                                                                                                                                                    SHA1:5CA79B7BD7E0E93271463FAEF3280F1644CBA073
                                                                                                                                                                                    SHA-256:9C552717E8D5079BBB226948641FF13532DF3D7BE434C6CE545F1692FA57D45A
                                                                                                                                                                                    SHA-512:812541836C8B6F356A4D530E5CCF1CFDCC4CA54AF048CAC19FE86707CE5EA0F41D73C501821AC627AD330291EF58C040DFC017923A7886CEEC308048DA2CE7C9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......-...."........................................&.....................U.....1T..S.R.Q.................................................R....Q.a............?..d.. ...............................................+A...Z+E...V+E...U..R.....}........Q..Ah....Ah..b.AX..b.PZ+A...V+E...V..J*....Q...b.Q..Ah....Ah..b.Ah..b.PZ*.(.@z.?.`;2.......................................................Q...b.Q..EZ*.(..Z>.G.....`Z+E......J*....F+D...F+E.......b.Q...h....PZ+E...V+E......J*....F+D...F+E..............[u#...a-...f<.9^[...l0..H..6.Kn.t...&..3a...GG...[u#..8.y6.q..%.R:8....6a.+.3..a-....l0..H..9^M..f..m..3a...GM.q..m..6.Kn.tq..%.R:l.W.lg...[u#...a-...f.r..c8.....f..m..0.....l0..H..6.Kn.t...&..3a...GG...[u#..8.y6.q..%.R:8....6a.+.3..a-....l0..H..9^M..f..m..3a...GM.q..m..6.Kn.tq..%.R:l.W.lg...[u#...a-...f.r..c8.....f..m.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002M.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.362155719104064
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:o1zzsMPuMGhVnt2O5EKd79hSBXk0B9OXoFrdQqraqmcBXR8Y83og:SsvhJUmEKd5hSBXk0B9IERQyaPcteo
                                                                                                                                                                                    MD5:9A4047FAAE18CBA1AB0064F7A41FF9A2
                                                                                                                                                                                    SHA1:DCF1BE01DD4F38B5EA28B000765FE1964D73A3AA
                                                                                                                                                                                    SHA-256:DC08F8E146EF70417879371F1F44266A3170F8D22CCDA17D270BB1E14641E25C
                                                                                                                                                                                    SHA-512:A5084BF1A9FA2BD95EB58DF124A589ECE995552118CBA257258D409BA3575679CF2D3B705CE6324C4B9FEB025CF29ACBF4DF2699002D8421F4C86199EDB5B4DB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ............_.$....tw......_.$....tw.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.......................[..$D.....N...^...............YW.wG.;D.....#!.........f........................................I.qk..B.....LZ......................[..$D...................[..$D.....................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4......................#..............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002N.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 262x277, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3555
                                                                                                                                                                                    Entropy (8bit):7.686253071499049
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:/h3JeYCQV5Hn++9HBdAjU78S/mjLLwqnqahJD:53Je8b+EBdAjm8S/mjLLRnphJD
                                                                                                                                                                                    MD5:8A5444524F467A45A5A10245F89C855A
                                                                                                                                                                                    SHA1:ACE68D567B02B68275E0345C86DB1139C0EC1386
                                                                                                                                                                                    SHA-256:7D2B01F17354D9237A6AB99D5B9AFDF0E1CC43687125848B0C2DEDFB44CE3843
                                                                                                                                                                                    SHA-512:8151B447B60D110C32EC1EF286B941FFC09B99140F41BBACF5A1650A385FF4D13C0DDB2878E9A470FC7CFCC95A1AB6E44F6DE72562B0FFE093DC8A3C3C7FCC14
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222...........".......................................2........................!1AQ.a."2q.B..#R...3C................................ .......................!1.AQBq............?........)&vD.)3Hn*..X+....r...tmL.k..(.E...R. .Z..&...,fJ...!...6..S\t3.=...g&..Bqe.)_U.....1......-..fl.................J...u.i.mU..K..v.w.0O..E.h..D~K.(..9.,8..E.}.............i.\.....t."v..q..C............<..|3.........................*Q..../c.....f.}8....D..|k..Z......0..~..c..e..m(...|.c..'.5.5............==bx.5x.8...T;....=.--.pc...I;.V.m..,(....}...NH.ho....Q..U.E$.~...w.t>.S\....'f.{.+.g._.t....;>.....P...........-..G.h..2...J.% !.E97Ir.D..N....j...oE._...._...".?.......#".S.........Q.Tc.I..*I..k.......=$.........sk1Jp.\K.....F.3.Q..q..J....N..[l.&....OR4bB|..2ul....J...B.$&H..9#j.f.n./........?R~....B.I.@..........m

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002O.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.366888658407293
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:IstnmJR+1in+EWXE7l9s+ERQyESJoyU22XUOGt:IsVU+MLWXEp9PERJS
                                                                                                                                                                                    MD5:81A1400FA40D33C2ED1C6E051CB71812
                                                                                                                                                                                    SHA1:7A11692D57572C3BBF6B35488D2E51602A13D06F
                                                                                                                                                                                    SHA-256:B90CE6FF48DD2A4A7875F5435BD240CB944BC5E94732C845BCD7D5E05C7C2BB9
                                                                                                                                                                                    SHA-512:22681A4070593D281ABD59265060EFD92F2F6AC4BBED978BC410A08DA91218F429E64EACF5CE9AC525C1AAA67F81086C7FED1C5D9CB97E25BA996395109F9511
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ...............m.PD.4]........m.PD.4]....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............JND.#.:.0...N......N...^..................G..D..9....-........f........................................I.qk..B.....LZ............JND.#.:.0...N..........JND.#.:.0...N......................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4......................#..............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002P.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 70x626, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3428
                                                                                                                                                                                    Entropy (8bit):7.766473352510893
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:/hdu7isPwAp7zesusUyYAatNG87llTONQYS:5di5tfuQ9atNZlaC
                                                                                                                                                                                    MD5:EE9E2DF458733B61333E8A82F7A2613D
                                                                                                                                                                                    SHA1:A86704C969F51B86D6A05ED51C6C60214ED9FA89
                                                                                                                                                                                    SHA-256:BE4F0E6C89FCE91B9EBD2623567F7DFC259E0E3C77C9158742B8F64B724DF673
                                                                                                                                                                                    SHA-512:BFB5D6DD6B66EE21E946E90D1E482384CD10244308562DDA814189602681DADDE5752B80519E5B8515F115A71BD6BB4317A59BE65B8B5E3474AED119F8303569
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......r.F.."........................................H............................!Qaq.."12.....#3ARbr...$B...cd...&CSu.....................................+.......................12..aAQ.!#q.."................?...#...3.Za......rV.5&...../"..i.t...j..W........d.FL.V.2K....]t.f.d.NK..:.....f...... ......2.[...#..D...ZK....p.z.E.N..T..L.-....1....2.\.6FIr2..zS\U#..........fB\t..5J..~q...D....A.......!....MY..../.HY..../e.M.Y.n.~..,....'..Pc...l...d2..m.f.it$..qx-z*...._..].cOO....n..&.....FIA.....2J2..d:<qc..6.I.G.N....f.K..Dx.-.......`....2.FZ."K7.r}..<.P.Z.da.Y.....8..s....G.....b.e..g .S.......FL.Z,&..q.MG.J+..x\..m...qN=.....)..`...&Y...S....u6{.z.g.....@......FL.ZL&.Iv.w..8....U..v...*.q.B.v_./A..#.#.g.j........*J;...u...W.Ao...%....#$.....M..^\{W.SO...s,.N.....c).,.B.Gv...."k..z."..S]H.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002Q.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.321488175455504
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:ABsocp7o3RJFt7p5a7EXNrx78XB292dooardQqro28M9BXT1u9cuF1:4so2o3/Fb2EXNrx4XM9qtaRQyoZiTcF
                                                                                                                                                                                    MD5:CA09F196767BC39D7D9FEBCF5529C3BE
                                                                                                                                                                                    SHA1:DF307C1DC0A7965123F6CB8EB982CF1B076AC126
                                                                                                                                                                                    SHA-256:EC190478598B4C9D082101C962669E9445E711487CEFF28B797689FFC20B9894
                                                                                                                                                                                    SHA-512:CEBFC55AF852BF82CC5EB0666345F90A43602005CD5D28D31F4F07E531FB2143B6B9FA8F78325626A3F3928270E1CAF87DB6E76CBB61577CEA33750DAAF95201
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ~.S.....~.S\...2.%`.a.~.S\...2.%`.a.~.S..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............C`...Ad..)..........N...^...............X....T.D.$..-...........f........................................I.qk..B.....LZ............C`...Ad..)..............C`...Ad..)...............~.S.....~.S.....~.S.........................................~.Sj....~.ST.]..~.S.....~.S..B..~.SH....~.S..B..~.S..>.)~.S..J...................;........4...4...4.."..............~.S.~.S.~.S..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........~.S.....~.S....#~.S............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002R.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 177 x 123, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):65589
                                                                                                                                                                                    Entropy (8bit):7.960181939300061
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:2Hlrjw3xL//DPgff+9j6yPWvHMHjkbfnwHO3AW3GL:2H2zDUU+yPVHITwNfL
                                                                                                                                                                                    MD5:8B48DA9F89264D14B83FF9969F869577
                                                                                                                                                                                    SHA1:E1BD58E2D80FEEF56DC514F3F0B3AB9669F22F95
                                                                                                                                                                                    SHA-256:62AD3C277E54F03F1ADB44062407346F789E63859B7AFABFD64BE6AF5E9F66EC
                                                                                                                                                                                    SHA-512:03B783EC968DF3F648504D068D64DD1AE110E28110FE5B3401C9D04F44897DBE0CBB5680D42CA4C665FA94A6CED4B559106EB3C06C9BF2C5B14951ECBFFAC8AE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR.......{.....;Za.....sBIT....|.d.....pHYs...........~.....tEXtSoftware.Macromedia Fireworks 8.h.x....tEXtCreation Time.05/15/06.8.p....prVWx..Y=.+I....t.y...,^vv....;. "|. .i7.....$.2g..']pH@p..]b....H.H.......d'@ B...U.xm..3{3k?..5n.._}U...3......~..>...g.....f..t...t:...p>..Si..d:..k:.Lf..t6.K.i....d<...x.8\.8.+lc...)i.$.r.....x.t.BG.R.cm.c...p.:&.6.4..K.......^...~b].0....oBYv..u.'.=.K.Q.g)6.....4.!.M......4.=....G.%.Sr........nxC.F..t.U........1...J.t..eQ....".... |...81.$D.!.>...........$...^.vY..EY8tb..'.P.g#O....S*..0'.V....x.W..........k.......s.C.S...J%.iVb..].........3....j.}*.z....+.s..@..K.....\x.C..e.Qq.....;N.....;....,....^.*..$F..{G...8.#....8'..&....8..5.....3(P._....S......|".....u.cr....+a-....&V..x...iI-<|a.{E.c.X.......?..&.C....'........(.x....>...M.?.9..#X......l...0...Z.F..<.z.0}Q..Z1..........?h..`E$K.2o.A*c^.......*..D..uL=.}.#*0.. M!.A.C......|_..(.Y........!E... .O...`;....M+..x.u~g...q>...N."D^..K..x..D.`.!.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002S.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.358954476008653
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:GBsZR8SKKWWuAgEmd9XCG9/cRQyGyowSNJl36:GBsbsKWtA9mzXV9/cRJVo
                                                                                                                                                                                    MD5:CC58116ADF0CB31E6AEB9B82736F88BB
                                                                                                                                                                                    SHA1:9CA41F8A0EDC7E73D46ED4EE0E3805203088D323
                                                                                                                                                                                    SHA-256:EE2FD46E5864BA247524AEA159C4D960503D86CDE264412C027D4A89A7E99336
                                                                                                                                                                                    SHA-512:9A4C3ECAAF5582C966CE6179D291ED6A8A9A7C07E919D087EA9EDB1F373628D2351D0779269E0220C245899029C4877778D6EE18F7E110D61FB304E9545B3528
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......V...v...J...................................................................................................................................2...>...2.......v...~............................I.......I.qk..B.....LZ.x;......x;....-.o<d.J..x;....-.o<d.J..x;..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............VY..]...7.....N....N...^.....................@._!/.z..........f........................................I.qk..B.....LZ............VY..]...7.....N........VY..]...7.....N..........x;......x;......x;..........................................x;j.....x;T.]...x;......x;..B...x;H.....x;..B...x;..>.).x;..J...................;........4...4...4.."...............x;..x;..x;..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........x;......x;....#.x;............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002T.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 17x608, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1873
                                                                                                                                                                                    Entropy (8bit):7.534961703340853
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:N9YMw9kGzE4xTdow1C3kyIkyM66KeJY3fOxJ:/h8HzE4xTdoUCUyxyD6LCvSJ
                                                                                                                                                                                    MD5:4FC8500BD304AD127AF4B5E269DFF59B
                                                                                                                                                                                    SHA1:9A5E3432358A0FCDECE86AEB967319B93A65D14A
                                                                                                                                                                                    SHA-256:B4DAA90D5A53FCBC85119050B5B76962443C4DD18D7F42CDC6D4E0AD8EFAD872
                                                                                                                                                                                    SHA-512:E5E07054A522EB91EFD39722AFB3776389632B8F5F923C1D29796716D68CEC93BE5E44F79913804CEC7ED631FF520CBBBAAB841E01FB90AF8E8ADF84DCD47481
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......`...."........................................>.......................tu.....45.!#$%1s."fr...2Fq..AQe.Eav............................... .........................!AQR.............?..e4.bbu."m.G......u.S.-Qq.b.a..'#..E.......u.|:.f[O..jS.S.&....=.....[.....S...N.~~...'...q....N.T.Oyf..a.6..%.I.1j.e~.4..[5.WW.Y..Xp.gn...u.......Gb.O.W..k.!mJgfq....~.F.......m..}bn4.5........s,F...z.b)..O..*...5).-.-\....=`.fP....%...A..Q.&..9.....QQbD.%.:u.f...r$.10..W.F.T..MI...9...ZQH._..).....D..n.F].........*.:.j...!6Z..S....0...B.6..Ga..S.O.....U8S_.J.>...i..?..<.P..........M..F.T.C..7.E...`.4BKcMh1j....4y...+.|.^......2[.WG.W..+......E..r/V^".R...."..6..hht..f...........;E..Kx....)}Le.A.x.>..$/).._S.n.L......}..H^Sw...2. .v.io...../.........x.>..$/).._S.n.t^;O.....n...[.S...h.v.io...../....:/...[..7yK.c-

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002U.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.486838157878419
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:+sk4U/v9z7H1HtUEeIX+T9MhrNowrdQVru2YBX1mkA9g8gmlO1:+s+5HZWEXX+T90hRRQ5e0c
                                                                                                                                                                                    MD5:E6AE51940C034591570F3561D935AB00
                                                                                                                                                                                    SHA1:87FDFAAAFB6D1BEE19D0199CBABC54296A737C95
                                                                                                                                                                                    SHA-256:8F2420BC47B0F38DD45752605396E64422CD02A6B19ACF69AFBFBCA04E761BCC
                                                                                                                                                                                    SHA-512:CF086FED134F4BC6040289F65CE2557963AE2FF79BA1CA8A71B2BA8540734AB64727C0BD2A0DF9DE0EA4D66D55A307FC02FC0F1344A153E3DF339E2BBAE5AC9E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......n...v...b...................................................................................................................................2...>...J.......v................................I.......I.qk..B.....LZ...............2Q.E.X.e.......2Q.E.X.e.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............<r.g.....O...*f....N...^................>...o.N.....H..........Z........................................I.qk..B.....LZ............<r.g.....O...*f........<r.g.....O...*f........................................................................j.......T$c...............G.......H.......>............. .3...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002V.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 357x69, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):5465
                                                                                                                                                                                    Entropy (8bit):7.79401348966645
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:X0cZneDWlIKmXwxacOHHI6EhzNlSSDDgafbofgt7mGrw:XleDWlIJwQHihRdgu8imGk
                                                                                                                                                                                    MD5:8470F9A96B6C6CAD9EE60961E96D19B2
                                                                                                                                                                                    SHA1:AFE1F01FFA4E4CB06B1D770C9C59DA75B434D1AC
                                                                                                                                                                                    SHA-256:2DF453410796AEC7B9EFEC00059B6CE64BCF67313A95AE458BA600EA5DE14811
                                                                                                                                                                                    SHA-512:CAE5C2ED091BA49761F0348516D53491E578FB165F32F93AC7DAD927383E9A398B06229FAC6A8233777DF708E5001AE0037A1FA960293BDA49892C40B37F2240
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....C....................................................................C.......................................................................E.e.............................................8...............................!"1...2A#Qa.$34bBDSqt..........................................................?.....`0.....O...3Sd..@..5.0....Q.pw....;....!pN.DR....`0......N^...k.=.u.e.7{.b........?z....zV...M.....P:a.SPj.....WRK.=x.2.h..2..AS..s..A..|.Z/f$D.YX1pr......}G6._.~..)j...+.s.r".{..q..-.^@...#w|.H..*.K)....g...y..`0......2.w@.Ro.d....@...K....}...&... y..f.y.0.|DC..>p.[E.2......v..N.)Z..4.RF.D.8]..Z.|f/..+\ID.r/.o........0i..*.G.O..uj..RN. ....j...xnF...Q.Ls.U.c.D0m....z.k.P;f...b.=..L.hH.,./;.U..`sa.I...?*...I....M.0<.u....!..C..U.T.....s.Q......_..7K..*.....?....R\&=.<.u..oQ}WZ..Yu...{Fe3.h...@.s..mW.G..^....1.W.#[.q2.&u.c.G......`J./..X.C....M;.....3k$}.i.3...#/x.m.Oh.}FH]. ..5NNDIS.-.M~...6..w.d....P.;..k...........v*..T..L.P...s.!B.4..w

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000030.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 14x341, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3361
                                                                                                                                                                                    Entropy (8bit):7.619405839796034
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:zDqnxqMt6gGr/Nln5ANln5ANln5ANln5ANln5ANln5ANln5ANllHN6:CxqMQr/rn5Arn5Arn5Arn5Arn5Arn5AN
                                                                                                                                                                                    MD5:A994063FF2ABEB78917C5382B2F5FA8C
                                                                                                                                                                                    SHA1:BD5C4D816B04A2B6596DFE38DB01228F553FACCC
                                                                                                                                                                                    SHA-256:D72900E8DA72D1A7F3729971AA558E1E9B6E9CF9A0D51E83852E567256DBBFEF
                                                                                                                                                                                    SHA-512:CF2279033DD3EDFE6F6F9E5C517BEBD9A52863EEFD90F57F7A5AE0E0485E705254BE7ED6B50E6CA142669687727AE85E2E6035F69930B75F2E6D3EEFA961EF88
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....C....................................................................C.......................................................................U..........................................>...............................8H........59...$%&7F#'Ddf.....................................>.................................58EG........!#124$%&ACFbcde............?...n.p..v..a.~.._.>......#....8.....w.G...&.W...i...%6m..K;...4."...=..?.~......P..O...j.l..AW.jo..,..=d.h.ta..../.."...z|).J.......Ww._..<Wp.3+8...-5...G:..2.D..I>o..K.F;-.....#...`...6..T...M.....OOgV~..5...np...P..TYr...........b..{r.2.9..].DA.%C....=.v.z......CK."..R..l..y}.i..;.{....JzS.....~.?..Z....=c.h~*..p.@(@..G.....O.]...Hsd.xf".V]..S"..w...4e>....3*U.7..|M.x...|\......FD./.cIe.;.bId..+=...w.......[.k>....}.u...j.xZ.....Q4..+.....B....1O~\......I..h....LaXJ%&.w.<C...n/`.W..U.W.U.}~...}>..^.0.J.....@....LN.b.......5W...m].Eu...:....G..:4.=4ixx..@_0=.mab.T.U.....w..~.V.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000031.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.334568261888991
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:usz9G/Mm/EeXii9CW8RQyPQcB6yQfeBLgg:usz9GueX19CW8RJPQcB6yQfeB8g
                                                                                                                                                                                    MD5:8F99227D034F1DD8DB871CDCD899FD56
                                                                                                                                                                                    SHA1:2223AD1C68A4B60EE8320D0CC5191EF3594A1D40
                                                                                                                                                                                    SHA-256:C26CB578B353E2BABABF68EF53E7D506E1460D34BE9E582BB2F2F4741050A9EF
                                                                                                                                                                                    SHA-512:37F8110C0C185BA76A2ADE7BDE8140BED24B1D8AC969823D33D4F5B9A60425F81304B34E00CF517198559946AE19AF559775E94585A586BB41D87333CF3E4703
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZmX{.....mX{u#...1Zu..w..mX{u#...1Zu..w..mX{..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............H.Y...7G.A.<h.....N...^................/..].4H.UR6.kk.........f........................................I.qk..B.....LZ..............H.Y...7G.A.<h...........H.Y...7G.A.<h..........mX{.....mX{.....mX{.........................................mX{j....mX{T.]..mX{.....mX{..B..mX{H....mX{..B..mX{..>.)mX{..J...................;........4...4...4.."..............mX{.mX{.mX{..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........mX{.....mX{....#mX{............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000032.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:15:20], progressive, precision 8, 604x784, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):140755
                                                                                                                                                                                    Entropy (8bit):7.9013245181576695
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3072:i/aDiblRsFcOco8dofE5Zx1+NQI8Wh9aiOe5NTO:mnbM+TxaAi98W3aiOwTO
                                                                                                                                                                                    MD5:CC087700C07D674D69AFDFDA0FA9825C
                                                                                                                                                                                    SHA1:F11113DF69DACDB255C6CBCFB29C1D1CCE40B346
                                                                                                                                                                                    SHA-256:A7FA7F092EFF43030A56342C39A765F8D5CC48C7DB815DDFC8C1E5EC40117FAE
                                                                                                                                                                                    SHA-512:843202D975EFA91E73287052A893584B6E5AE601F91612B56539AA2F73D1AD3F997FCAD1E711E0F483A2E91D46D9643D0B026B43F4E94116A5D2FB6551536034
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:15:20.............................\.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................{.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.......J...\O.,......../$..........OE.m.o......T....Z..l.g.-....m.?...Y....3......"....].j.X.k.S.k.....4..R....{....?F.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000033.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.341165459307067
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:YRsM8ugcKukXEuVrXWf9Md4MRQyPFHzy4:KsNhcHhuVrX89q4MRJt
                                                                                                                                                                                    MD5:49E2105EEC3FF2F586AAD34750049D1A
                                                                                                                                                                                    SHA1:14A7D85A506C5930C4AFBB7F739C8FD0D13B93CE
                                                                                                                                                                                    SHA-256:97250E0A17DC65CD9EA2D583AEDF1605AF5394D6F1713A95B5A0146F3BF04766
                                                                                                                                                                                    SHA-512:EFDDA0F690F65520BDDDDBCB2A8D3F0F04964ABD336EF1F74083E4DB84FAEDA91B4DE2838691A44929F64EDEC9D2A5B981980BFAB27887F1D9C6ED5988A0DCCC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZN.l.....N.l.,...2Xt...s.N.l.,...2Xt...s.N.l..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............:.u."B.....`.@u!....N...^......................E.XQ.*..........f........................................I.qk..B.....LZ............:.u."B.....`.@u!........:.u."B.....`.@u!.........N.l.....N.l.....N.l.........................................N.lj....N.lT.]..N.l.....N.l..B..N.lH....N.l..B..N.l..>.)N.l..J...................;........4...4...4.."..............N.l.N.l.N.l..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........N.l.....N.l....#N.l............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000034.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:13:06], progressive, precision 8, 570x779, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):129887
                                                                                                                                                                                    Entropy (8bit):7.8877849553452695
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3072:QS1x1rXglsteJ79wHi4vNQR5yBlUdOSILe9hSj9jeWMPjdlOJ:vvglst1HiwWR5yBA2LeS9jd1
                                                                                                                                                                                    MD5:737E96E41D79D3BDACE7AB4F8CBF6274
                                                                                                                                                                                    SHA1:E6202A41A4F86B27D9EBCAEF7670B16C0ED67CF2
                                                                                                                                                                                    SHA-256:7966F3D8A2D61ECB49A35E163781858E052C0B122A18A1238AFE27B57E2850E8
                                                                                                                                                                                    SHA-512:D398C8521DB2FB3F8456FE792CF37472F3B851DD7298DB20E2DB79144F8E846D051878E77E5EF5D00E6840EDB90C6E2D97935BC1023A15FC45038CCE731E9895
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....iExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:13:06.............................:.......................................................&.(.................................3.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................u.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...W..I:..*....a....Aa ...w.T.M.v.........3x.......8Y....$.."-..m.I.0~sxB[@..=...:..\.Y?....@O.L;9i..U....?.5">+9.s\Z..vN

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000035.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.34687570437097
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:YJsXwPFuyRfEr7yXnM9ei8RQykXrViVmtV7VLViVR/VRV:KsXwNuTr7yXnM9ei8RJkXrViVmtV7VLA
                                                                                                                                                                                    MD5:63A73A063E13B981EB46A9AA9CD4CE98
                                                                                                                                                                                    SHA1:A389A344693AC90CDB8D3C5C2BA9D28D9186B014
                                                                                                                                                                                    SHA-256:231BFF170F5721828CB19931EA8AE97D420144B91A22ABF823C0C385455A3A4E
                                                                                                                                                                                    SHA-512:EC9807E914E8615755D14186762B14AF304F91DCD1916E079E12742C709EE041F80A65254549520DC36DAA1E56FB9F6C020B36AEC8F4826E6F78EC497253DBE0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ..q.......q......)..7.`..q......)..7.`..q..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............=......`..ut......N...^................W.-.ArA................f........................................I.qk..B.....LZ.............=......`..ut...........=......`..ut.............q.......q.......q...........................................qj......qT.]....q.......q..B....qH......q..B....q..>.)..q..J...................;........4...4...4.."................q...q...q..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4...........q.......q....#..q............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000036.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):84941
                                                                                                                                                                                    Entropy (8bit):7.966881945560921
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:X3sWfhTVd+xu6rA6SOONM0/YFXnviDwoPCaNSm+z/ze/fWNj7GfigeKyCGzw+QKW:nsOhdDJOwY1voPCaom+z/zeHAfGihCG8
                                                                                                                                                                                    MD5:CB84C108A76C2AFFCAC2551A3C1EAD56
                                                                                                                                                                                    SHA1:8BB7C2A12B056C1ED12EBBAE5BC9F60CCE880FFE
                                                                                                                                                                                    SHA-256:139BB0E79F89C3DDEF79B1716A5FBAB4C07DF5785FB3CDF6B4EEDDBF6C078452
                                                                                                                                                                                    SHA-512:6EF85144E9A7ACD0FF2E52A5FF42093153EFB69127B1C8549EEBC49B6CC196A46B65EE39A2CAD0206F6A41476D8B5B35D29EAC9942B8F84972B32E14CAFEED27
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d....................................................................................!.1A.Qa..q...........".2..BRbr#.T.3C....S$.cs.D..4%5......................!1A..Qaq."2..BR....3...b#.r.C4.............?.......m.q..'O.....r......_.1....8h....?.....O]~..k......GO...''._...!....o........''..g..H?k.......1...?.....z......>...+0..................GO...''._.........}.O.Z|.L?...........?.........[~t.......}......NO.....v.......J.......?..g..H?k......GO,m..r}o.z.....}......dC.9?..g..H_..........?.....O]~...m...C?.z..f....W.=u.B..m..C.-?.a.....3._.?.......o....np.M....g..H_............9?..g..H...../..kO...''._...!~...o.....0.M....g..H.........../......O]~.~...o.......7..+.... ..l?.}........&....3._./....?.........W.=u.C..m..C.+?..o.W.=u.A.^.O....:......_.........}..t

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000037.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.3407313392744715
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:YuusuouMoB/UdCxgtDh1jWVEe+h6XWLD9a1oTBrdQqrjxXTy8BXVdF9LA/qY2WCf:YhsD0xgJjOEP0XWLD9a12BRQyFjy8r
                                                                                                                                                                                    MD5:C71EFBB002170695297ACAA394F7612E
                                                                                                                                                                                    SHA1:EA641806026F2FF17040DF8EA59F03988351012D
                                                                                                                                                                                    SHA-256:1E8FA23127F32022C87DBF3CE7BCC58EEA9893E3BD45DD8B04227908BA86B174
                                                                                                                                                                                    SHA-512:D9081D880BF9B474C8A6435BFEF49555F92B6D711E0AAC70CD478141B4D5D8E4707E2E9047B4051DCCCF3618B2DAE62055850D38BE1BD193FA6650C9290244FF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZW&......W&...,t..+D....EW&...,t..+D....EW&...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................mJ.$....X%2....N...^...............1.[E..\@..B..,.........f........................................I.qk..B.....LZ................mJ.$....X%2............mJ.$....X%2.........W&......W&......W&..........................................W&.j....W&.T.]..W&......W&...B..W&.H....W&...B..W&...>.)W&...J...................;........4...4...4.."..............W&..W&..W&...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........W&......W&.....#W&.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000038.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 40 x 623, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1569
                                                                                                                                                                                    Entropy (8bit):7.583832946136897
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:KArPoy/sSfmBL0EGEsRgeTLLXFnViAAEslVorlP0i8OmO57EnGAkYelBKMN:9oQPTgeL5ViAe8rQs7HAkrlc+
                                                                                                                                                                                    MD5:07DB3F43DE7C1392C67802E74707DAA6
                                                                                                                                                                                    SHA1:C173ADB1999065C5E1E6DBEF934B4D4D7AF0CC23
                                                                                                                                                                                    SHA-256:51E05999A1C9F17DF28CB474E57DD8E64BDAB824874A532C20A23766A01F8967
                                                                                                                                                                                    SHA-512:E509255519D4E521E82332FF418DD5A6BBBC8476399A0D9C3D81542C1CABA535B2D79E5BC90F73F9EE8468643302137671934ABD600FC696F16161C91FEAC111
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...(...o.....>.c.....PLTE................................................................................................................................................................................................a.o.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.Y.. ..........}%.../].`<..y....V...m.....<....)..;Ki..'9...2.:.c...t..V..d.t;-y.Z.=K>B.."{Lj.~G..|..ENC.!Sw,....";.p..g....E.B..S.-...k..P."..E......l[./D.-.....Q+.G<>.+..b...#..y(...{a.M..J...<....v.W..F.qm.`.....(.mk.nX....l.Px8.0\Z....7G...$*.....&..Z.VJ.~......J.2|...2H..../...=.)q....ZT" .,%..h.p....Z$.!........r...Hh.f. ....P .d..1d....2.3h....;.A.... ....d..g4...A..^.....2.ew..."h...y/..j.h..B.......%.2.%..{r...+dG.=9h....P1...A...c...^h.]Q0.8x....q .!3....ZW"Z.!3...G.vC.GG..".&..X!3.|xB..V.P!.+zS..NX!3.....Nh.y(.Z.1.h..B...Z+....l8Xcu.B...K...@U..@Q...mB...x...&L C....mB.....@kC...Y.,.... ..e\F.B..........y..e\..:$(....Z.a...yn...f..z.~Q.{o...].ln.r....^.@.{..c.7..{...

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000039.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.330758611890806
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:aFsJ1PE7N5tONE+YlLAIX1mOI9GnloNrdQqrFheYBXlm429tqhF49lnT:aFscN5AEplkIX4OI9GnlsRQyFIY6
                                                                                                                                                                                    MD5:6CB9DEBB6B22F824C5BE3F40CFDFBBBA
                                                                                                                                                                                    SHA1:06DE15D28ABCB256711ED485096EC92B41FEFF67
                                                                                                                                                                                    SHA-256:B7B2EF4B2F78F9FAD43EC08233031AC0C836BD383CA3A7C99DD9D327F5B74DA6
                                                                                                                                                                                    SHA-512:88AB3E95A3AEAF1F4745A0BE8CB3E8B84EBFC6DB4D8D759CA242666BFE4894449CB79E8EAE9114544457928693FAB23589CBAFAF6F6AA3945EF83DFD93DEC4AE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.............8.......R.....8.......R.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............L.....-0...uW.....N...^...............u....{.L..N.............f........................................I.qk..B.....LZ.............L.....-0...uW..........L.....-0...uW.........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003A.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):40035
                                                                                                                                                                                    Entropy (8bit):7.360144465307449
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:MQhziQo1RKGlyyzYjlxuxwRUj/BN837xRmwH2uDTCn8qXFQziN:ThzrSzalg6O563l4uTC8q1Ig
                                                                                                                                                                                    MD5:B1DDD365D87605F96D72042CB56572F6
                                                                                                                                                                                    SHA1:ADF71DAD1A62B8A58A657C2EDBDD665A19EB846B
                                                                                                                                                                                    SHA-256:06E09DE80C3F32254DA4FE6B2CBAD7C05EF144DD54B8C65745E195BBF7317A2E
                                                                                                                                                                                    SHA-512:9C686092CC9524F34EA6CEC9AAE936A6225BCC54DE38DE1786EBA8F532959A80FF885E8664A09E4C318D7CA4B278E807D3D1F135BE55F30979B844FF5EC9699A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!1....AQ.aq.....".3.5...2B#s.$%..Rr.CS4&6...bE'7.c.DTtU...d.eu...VFfv.Gw.....Wg......................!...1AQaq........"2..4..Rbr#3$...B.s5Cc.S%.D............?..^.f....R*.N{.{f.....O.r.V.;U..~...U.(..>M._.yI.{8,..^.t...s`...j.O..U5t.&&..h.G.6Da.;.....J.......E..QD...C...}..N...tR.....~..].J:.V$.*.r......]...W......4.[.)6..Y_.....4...........m._'HR.a......]U=.....n...0.W..]..K..){.+...w...f...<|..1/.|.....b..-..y....]U#Ctn.7m.._.|..2I;|....tM....q.q.}.N)....'...9&...nR...R..}.........m._.LZ}u.../K....9.~..?.{....V.#..dx.Zk.:=..:.j].....E#....E~w%....J..[S..[......gr...vb.r]..<..ut..i...[P.w....:..Gkn>......#..m...9km`......t).up.....w....VOR.{&.nQI..}...wD.7Ey#n....MO.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003B.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.667550072578901
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:D79sdcV66MFt794E3/L7UXJ9K8otfrdQqrLVa6BXWwhJN:9sN6MFwE3/sXJ9K8QRQy46D
                                                                                                                                                                                    MD5:C31EF0F42585878BB3B340F3DB2767BE
                                                                                                                                                                                    SHA1:881F875701DA160481C5C7DF8F6E78A1060B172D
                                                                                                                                                                                    SHA-256:F997908D5D7A9B799D1741A67A6128859B035861AF864DA66AED3BED29997221
                                                                                                                                                                                    SHA-512:07A2F66BF995C12F3F478FCAADD60EF28E142E979CA8BA11D5AAC353275FF048639AD81A9434417CA5A554CBD0C0AC4603772B5A0BF6731C5A5AD6B756B86B0D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>...........v...~...................................................................................................................................2...>...f.......v................................I.......I.qk..B.....LZ..1.......1.X......:.....1.X......:.....1..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............J*......6C.!Z.S.....N...^...............C..G..pD..P_..........f...................................:....I.qk..B.....LZ............J*......6C.!Z.S.........J*......6C.!Z.S............1.......1.......1...........................................1j......1T.]....1.......1..B....1H......1..B....1..>.)..1..J...................;........4...4...4.."................1...1...1..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4...........1.......1....#..1............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003C.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:10:32], progressive, precision 8, 594x773, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):242903
                                                                                                                                                                                    Entropy (8bit):7.944495275553473
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6144:YVxOYlZX2kCWfYoFMXC/sBFC9r+4iEGM4rrcPoWmwkU6FJ:+OwZ2kbFMC/L99ifvokU6/
                                                                                                                                                                                    MD5:C594A4AA7234EF91E6C2714CFE1410F1
                                                                                                                                                                                    SHA1:C0F720D4CE3196852814D0B7347F0CAA0C6FD526
                                                                                                                                                                                    SHA-256:10C833E47BE1C8496F949A6B059C2D79212A4DD66BDE62116EA337FA4FE0B654
                                                                                                                                                                                    SHA-512:7313F6545A334F9E2DE5430B2DB5C419C4C8A40E075338DAFCD74970BCC6309786946E5DFB57531612BF4C6269495655706D920FD99922FDACFF9796710DA9C0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:10:32.............................R.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................{.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...v&.F;-v;}FH..Z...N..)Y.......h;C....G.0W..ww...MI..Z+..\.........c..4.1.~.Yo.Y6.&. q...............l.A#.~s?yYg..7ky...r

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003D.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.343714518251993
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:YvdsjZFtlJhYEXMRqXU4m9+G4wRQyiUSm:Ws3t3hFXMRqXU4m9+5wRJRS
                                                                                                                                                                                    MD5:8B1D73509BC70ED5B0DC273EC05504FD
                                                                                                                                                                                    SHA1:70A0487D38FB9D7818F375021C6DE3FB85BCC518
                                                                                                                                                                                    SHA-256:A15E14483330FC18337401C16010C996554154D0708179A2CF79639876D9B826
                                                                                                                                                                                    SHA-512:F735A63FD57B28DA804CF9C1905689EEEEE63B54CD07908654D9A1E77214E94081C47FB555B97F0327845BDD10052D005FFF1F67C45039C2F7BDC5C0668B540D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZnS0.....nS0......8jlW ..nS0......8jlW ..nS0..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................*\.h.6...c.w....N...^...............e..E..WA...?^..........f........................................I.qk..B.....LZ...............*\.h.6...c.w...........*\.h.6...c.w.........nS0.....nS0.....nS0.........................................nS0j....nS0T.]..nS0.....nS0..B..nS0H....nS0..B..nS0..>.)nS0..J...................;........4...4...4.."..............nS0.nS0.nS0..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........nS0.....nS0....#nS0............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003E.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:12:29], progressive, precision 8, 598x766, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):70028
                                                                                                                                                                                    Entropy (8bit):7.742089280742944
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:ub4bgbB7g9cKCmSzaNF0jAdAzQKTEFBQqUp/i0yG1pidLHTVX:ub4bIB7Qg2OjbzjgWp/i0yGCZx
                                                                                                                                                                                    MD5:EC7811912ACA47F6AEB912469761D70D
                                                                                                                                                                                    SHA1:C759BC2D908705D599B03BDB366C951B11F99A4E
                                                                                                                                                                                    SHA-256:FBB4573E3BEE1B337077691BEBAE15D6FAC52432405D31396D526D7694A8283D
                                                                                                                                                                                    SHA-512:881828150993A8C56E36CDA2051D89C1F6E0322643902C9506392C163E8734A2933A46486F40E5BC8C8D0164E180605E52620EF22FE14540AEA787A38B22E98E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....7Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:12:29.............................V.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................}.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....H.yM..? .Z.. .^.x..p.8.A...K.... .\{..)..y....t..=.^y)..v.@.W>. .h.. ..p.:.\)(.$....$.I).....!....E..Z.....&.5.).

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003F.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.348403142068751
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:esq0LEzljaE5VUXMI9WcMRQyLhpsZFUpqLu:esqcEzBXUXMI9WcMRJLhpsZFUpOu
                                                                                                                                                                                    MD5:ADAFFAD0C5A6BA80D9658CACB3BBE892
                                                                                                                                                                                    SHA1:1274C41B0EADBDA36828ABB111D5C0F51D6E187D
                                                                                                                                                                                    SHA-256:B7EB79982D35AE117D474273BF4C93B50857DE00E3BDA969DED778ACFDD71D85
                                                                                                                                                                                    SHA-512:91E63987A6FB8D76BE4955869EB34066F4C6FAF7ED26FBBF51A4B975B0B892F5852E60E9D5E36481384443B076CA86C1B5A204B8B732632FB35191398485E2AB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ;.#.....;.#.....3R.M.J.;.#.....3R.M.J.;.#..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............,.A...e...[.........N...^...................WUJ..=.............f........................................I.qk..B.....LZ............,.A...e...[.............,.A...e...[..............;.#.....;.#.....;.#.........................................;.#j....;.#T.]..;.#.....;.#..B..;.#H....;.#..B..;.#..>.);.#..J...................;........4...4...4.."..............;.#.;.#.;.#..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........;.#.....;.#....#;.#............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003G.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:19:29], progressive, precision 8, 221x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):24268
                                                                                                                                                                                    Entropy (8bit):6.946124661664625
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:d2wiieoHTRh5a1HAteZCWOZIM+L7WhNjYn:8wHFHJ+/OZIKhNO
                                                                                                                                                                                    MD5:3CD906D179F59DDFA112510C7E996351
                                                                                                                                                                                    SHA1:48CDB3685606EDD79D5BCDF0D7267B8B1CCBD5A8
                                                                                                                                                                                    SHA-256:1591FD26E7FFF5BE97431D0ED3D0ADE5CFC5FA74E3D7EC282FD242160CE68C1F
                                                                                                                                                                                    SHA-512:2048CBA13AF532FF2BCC7B8B40541993234BD1A8AB6DE47B889AF3F3E4571F9C5A22996D0B1C16DD6603233F6066A1A2A97C16A6020BEDD0826B83BAD0075512
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:19:29.....................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................$.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....)......[]t.\Z..g......A....&D.$LH._..X..Xl...`....cZ.X.........>......f.Z.X...]..~L.S..@..I$..I.IO.....x...s.g.[f.h{9..

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003H.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.324690894028583
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:qsRRwMswXKE4XSI9uBgRQypQES6yX1Ebvf:qs/wM14Xb9uBgRJpp2
                                                                                                                                                                                    MD5:D1B92896717A1B0E505B430997637CBD
                                                                                                                                                                                    SHA1:B7D67627D7F1090FEEA93B17EFE2A2E91A2F05B8
                                                                                                                                                                                    SHA-256:12464C4AE6968CB3C74738247963AB9F7802FA8B509C50A9A64BD345E050372B
                                                                                                                                                                                    SHA-512:CB40E5F1E37E57F51C08743CB74019D7D4FDC9E3F90EF85FEF2A75BA1E60244627AF966870F1DD8FE725D158ED0D77FCC0B2CA856BAA7552B5467AF6350961DC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ _...... _.......d.v.. _.......d.v.. _...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............."y{...?|...x......N...^...............5...;2.E..k..M@.........f........................................I.qk..B.....LZ.............."y{...?|...x............"y{...?|...x........... _...... _...... _.......................................... _.j.... _.T.].. _...... _...B.. _.H.... _...B.. _...>.) _...J...................;........4...4...4..".............. _.. _.. _...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4......... _...... _.....# _.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003I.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):47294
                                                                                                                                                                                    Entropy (8bit):7.497888607667405
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:aQ10VrIBdBvDpQrQ7P9/FUOLG2vTSeG9lkCsMKzXeMBk3CBp:aC0JIBL+QsOLG2+ZAC1KqM2I
                                                                                                                                                                                    MD5:7A450E086AD14BA7D89BA5DB3D3AE6C7
                                                                                                                                                                                    SHA1:E7AEAFCFCE476390E18C19456BDF6529D863D518
                                                                                                                                                                                    SHA-256:BDD997068701ED3A00A224EB694B003C01AC69B857FE7B4147D6C34875B1632B
                                                                                                                                                                                    SHA-512:9B6D50A6CDB6081DA107A2CDDB1BD2811A5764994C8E3F67D56CA81084BE0D068C27435154E867199F38688EA65E8DE02A56DCAC47D0F5E55F0FBB6598814938
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..A..Qa"..q..2.......B#...R%.r...$&b...3Ss.4dU6F.cE..'GC..t..5eufW......................!.1..AQ.aq..".....2BR......r.#3.d...b..Ccs.t......$4T...SD%5Ue&Vf............?..M.7(..).:.a.q.......>..[:O...afQ.uCO..U.....go.l..p..YqVklQ.{i.w&.]Z.\+JQw._.n.'.h..,.bj..X.].k&.Q.>gU..f...1|....[...jQ.%Zb.......t..........*..V..j.6....Vj..i.....?...IY.P.....$.j........[l.....S.4.J9.U\.......7I..[..=*N5....xW..../...=?n....uG.D..S.>...8..3........n.S....]k.*...4.>.R.o..{..l.H.#.^....<amG.m&.......,....wDY.W.m.X....We.IR.Nu...y..Z.l.._S.mr.m...y.]m.R.MT...6.5.5}.K..#%..k].7.Y.q]...%.r.7.R^jR..z.K.T[t.a..d.)glW.r.v,.`....O..^..o:.Uc.\..D....f..D......yt.Q...Y.....

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003J.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.500763140704855
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:YsO7XdTEwBXC9gA8DERQyp7iqWClie8r:YsO7XCwBXC9WDERJp7iqWCliDr
                                                                                                                                                                                    MD5:0B1E7A62FC387D49F39EA3222EF48FA6
                                                                                                                                                                                    SHA1:76E1D501BC56F845542422BF96ED2907C4FC84F2
                                                                                                                                                                                    SHA-256:A3A1DB976875EB06A6CF7F32288C98575357AA5A682E6BED04E5F7CCCF42D450
                                                                                                                                                                                    SHA-512:1AAA685AFAEB900CEAAD81A5C75412AA30027E09D90C5A2DDA6D2E675A781BC8424EEA08730253F5424D09D72AA3303D526B9FC4F10CAFB99AF1043FABBA18EB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......n...v...b...................................................................................................................................2...>...J.......v................................I.......I.qk..B.....LZ.[.......[..'7w.<.HDc.Ga.[..'7w.<.HDc.Ga.[...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................vW...>Cr.........N...^..................-.a.O.."...........f........................................I.qk..B.....LZ...............vW...>Cr................vW...>Cr...............[.......[.......[...........................................[.j.....[.T.]...[.......[..B...[.H.....[...B...[...>.).[...J...................;........4...4...4.."...............[...[...[...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........[.......[.....#.[.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003K.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 60 x 336, 4-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):347
                                                                                                                                                                                    Entropy (8bit):6.85024426015615
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:6v/lhPtnlx/QulkWNY2V18A6Akp7eee1VDjMHCyLezyKUX5Gp:6v/7RrIubiA6AkpNhiyKe+
                                                                                                                                                                                    MD5:78762C169F8B104CB57DFF5A1669D2DF
                                                                                                                                                                                    SHA1:9638B71B584CD636834016A635ABF8D9C0887711
                                                                                                                                                                                    SHA-256:E64FDCD0B108737D8B8F7B677029F924031D6BBAA50585D9C3DEF7C7E92ECAF2
                                                                                                                                                                                    SHA-512:5ED899AAF73B72DEC32E171FFA112382667D5BF3FBA98C92E313E66C0A6975EA97068F4CD32B62283F18DBD5345C11E3610F7EEAC2F2DE71FC44593180B9CEAC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...<...P.............PLTE......................=l......bKGD....H....cmPPJCmp0712....Om......IDATh......@..aI...B..C..l...^.%.`....>.]..|0.....a...hb...0......q.......p"....;...K..x=...p...y.yy~J....|...\.......y..X.......'...>1...Ky..f....&........N`..f0..b...3.......`Z.3..3.....o.......4.&........SV...4.....IEND.B`.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003L.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.3553680121126614
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:AsOk6A9V2nat0wkjE6LXA2w99+RxoqKrdQqr8Wu0s2BXjz49nZyCbTR:AsCS2naPKEcXs99+XARQy870s2UzH
                                                                                                                                                                                    MD5:6CE0A7A63B185015C22DD52B2AD20699
                                                                                                                                                                                    SHA1:581304B676963586A0B0931275AB07C42A0C24BB
                                                                                                                                                                                    SHA-256:416B96F61EB231A67E3EB623DFFE50041CB1B41AD2DB81542070595B0A27919E
                                                                                                                                                                                    SHA-512:73807D36CF08FE7EE00A36D1E4C03E9E72128E3AC3AFBABDF201D085D2498AE36879764267E219AF6607F58620AD039A2B5001C551C1DF30DC1B8140FB2E39AE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.........EU.g.=..d...j..EU.g.=..d...j....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................\...*....o~....N...^.................h.7..N.....}..........f........................................I.qk..B.....LZ................\...*....o~............\...*....o~....................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4......................#..............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003M.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 40 x 617, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):827
                                                                                                                                                                                    Entropy (8bit):7.23139555596658
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:6v/7Hs2NwBW1mtjeSfaTHHy05riYUtr8y8PQvPYzzg979Reip0QPqc:oOsotazy4rStr8y8PQIzWea0Qv
                                                                                                                                                                                    MD5:3E675D61F588462FB452342B14BCF9C0
                                                                                                                                                                                    SHA1:86B62019BC3C5BE48B654256B5D10293FC8C842A
                                                                                                                                                                                    SHA-256:639EADAD468B6B32B9124B1F4395A8DA3027FF7258D102173BA070AE2ED541AE
                                                                                                                                                                                    SHA-512:E6EA855B642ED36FA82F8E469A826DC57EB0C36E307045FF8D166F67AF9242C87840833BE31FBE4706DC54100E999D6A3D3A78D0633A3114735818874AD34758
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...(...i..........`PLTE...................................................................................................bKGD....H....cmPPJCmp0712....H.s....qIDATx^...0.Cg.;......@j..2c.=~KP.[H~..@..8...?U.g.n.a=.=.).....3..u^(.....L....5..........8.}..T.f.n.a=.=.).....3..u^(.....L..r....s..8.....W]....,..9..G?.a..`c.z...E.p...)Y.P.....#....@9.7].....,..9..G?.a..`c.z...E.p...)Y.P...`b....0.b.+~{.Pu...1..<..0._.l.@O.y.(...V3%..J....s... .(g.+.qyWu...1..<..0._.l.@O.y.(...V3%...%R.L.Q..x..R.<t.o......7.............:/.E..j.da@i..`b..Z......u.>.?...7.............:/.E..j.da@.Dj..9.W....s. .....:.......L...">w..7... .....:..."...L..."..a....D..Ya.l....E.{.@&.|.._...7..D..Ya.l.....{.@&.|....0.J.."z.0s..s....=g ..>........"z.0s..s....=g ..>..l..1...y..g......IEND.B`.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003N.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.322416554578252
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:OsLXk1SKsEXndwXX6Hw92Bq7RQys96pVFa6pO3M:OsTk1xJXnCXX6Q92BARJyE
                                                                                                                                                                                    MD5:57406FB7145D00941D921179DF31D2EE
                                                                                                                                                                                    SHA1:61A0643FCE9EF1A41B8C9E3A53ECA3D58BCBABD0
                                                                                                                                                                                    SHA-256:DCAE8831EB0F1453B79FAD54CB4C274C0470A79B68B5A6054593871534F6FE3F
                                                                                                                                                                                    SHA-512:1B2CDEF2215748456C39115044072EC00868BE41CD74BDC577A009331BFC44A280E0F557D437050C17341D4F9FB2AF8BDE6D4C433D2D5BBA9BA591D200750FB3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.C*......C*].E...jU.dT...C*].E...jU.dT...C*..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............A.Z..c.."".,?.il....N...^...............&)J..9.B...t@...........f........................................I.qk..B.....LZ............A.Z..c.."".,?.il........A.Z..c.."".,?.il..........C*......C*......C*..........................................C*j.....C*T.]...C*......C*..B...C*H.....C*..B...C*..>.).C*..J...................;........4...4...4.."...............C*..C*..C*..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........C*......C*....#.C*............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003O.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 50 x 600, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4410
                                                                                                                                                                                    Entropy (8bit):7.857636973514526
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:E/pQuIhKZ7u06dICH3AroiTe8DGTl55poBUmLNjpH7MvDHjfm:MpdZtPbknnRPpkLNVMvu
                                                                                                                                                                                    MD5:2494381A1ACDC83843B912CFCDE5643B
                                                                                                                                                                                    SHA1:98F9D1CC140076D1AE5A9EA19F47658FD5DF0D66
                                                                                                                                                                                    SHA-256:5EEBE803E434A845D19BC600DF3C75E98BB69BD0DE473CEEC410D1B3A9154E28
                                                                                                                                                                                    SHA-512:0E64CC3723DC41D94910F7ADFB6A0DFB5049350FD15A873695614E4A89ABD78B166BA4E9C8CB95E275FB56981539DECD2A7F28FBC25E80DD5E2DEA8077CC9489
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...2...X.......E.....PLTE...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................B..(....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.].\TU.?3"...(..L........q.Q...H.*j......W..Xd.ie.f..%.XT...em..m.m.vkik...>.}..}|..{'.U..~......}....s.............,CVu.x.:C..5...;.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003P.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.358397868806064
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:Yu6s4RDVTkttMjPEZUncf0LHX5f9QzPoFrdQqrBwZaBXZ5Ffx5:YNswVTkKPEZnf0LXJ9eP8RQyhnZ
                                                                                                                                                                                    MD5:7CA92AF3D20A9ACDB07732294F61282D
                                                                                                                                                                                    SHA1:CBC3C332C7BB634E0D9D306CD322CB6013C620EB
                                                                                                                                                                                    SHA-256:95DE7A7610EDBF2E04FB85CA96FB267C218C9F26BA76A27B6A4068ACBF277395
                                                                                                                                                                                    SHA-512:94634955228EFA63F86B21CE3BDE469D143793F2BC90E03516A08A89526ADAE5BFDD79EBBFAF89AACB3E860D4408D4A18A571EEB4F61A1F39F5A14BB11A6619E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ.............>..(B..O.hS.....>..(B..O.hS.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............N..L<..yW.7(......N...^................g...KD..Q.M..8........f........................................I.qk..B.....LZ..............N..L<..yW.7(............N..L<..yW.7(..........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003Q.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):136726
                                                                                                                                                                                    Entropy (8bit):7.973487854173386
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3072:SIXmy5Tl704vW2ZKkvV8UU0ZWUF0BJwySIdgz816YzDc1+opecYPn:Sny5Tl704fZFV8UU6LGXwyS4xohpQPn
                                                                                                                                                                                    MD5:4A2472AC2A9434E35701362D1C56EDDF
                                                                                                                                                                                    SHA1:16FA2EA2D2808D75445896E03B67A93000EEDDD8
                                                                                                                                                                                    SHA-256:505F731CB7707EFAB2EB06685B392DC7E59265A40B55AAE43E5DC15C0A86CBA4
                                                                                                                                                                                    SHA-512:5E28D8FB2AC62ED270968072A30013334461F7CAE96058AF9EAA6E10912989DC47112D2133892BF61F7A516B77C6FF71BA2A000B750A9F95C787E538B09595C2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQaq".....2B....R#..b3...r...C$...X.....Sc...9.%'.(Hs4Dgw..T..5GW.x.)......................!.1..AQa"2.q.......B..#c........b6.Rr.3s$.&..S...C4.%5............?.........(......(......(......(......(......(......(......(.G/.GE&...)..P.x..B.({i2Y;.z?G...Yfc.)H..^....#.....}3..Sc^.H..+...M.a.P.....GS.....H_.3..<....1f........1.<.\..nn-..s.s.\9Y....=.......S.0.......N..cA..Io..r.3..........ay.....K.....,.;9..Q......xO.Fa.2..>........{4k.....|....?U....3.8..._/3....#.. t.y......yY.......e.<........#.....B.....Z.%.Y..S.ye.W4...l.......X...%.@y}>....l.yi..D..W......L..._D.Q....)...E....n.%...*..K.4#.8`..I....h..h.o..I......-...hB...3..u.(5..........n...,.@....a.t.9.....@.s.>.&...@

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003R.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.347053447784285
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:5g3Bsoxinvp/EKHYXX9qVrn8RQyoxeSqON5FqO4Uy:5gRsoAvOAYXX9qVrn8RJGeSqON5FqHUy
                                                                                                                                                                                    MD5:4E91FC2C47C3EA5495A7D46E30852B6C
                                                                                                                                                                                    SHA1:676724436A7007269EC87500FBA76068DF689D52
                                                                                                                                                                                    SHA-256:74A23C613D7A30A51C3E107F6304ED069B4EA02E9174FDA2100E83EB28C32DAC
                                                                                                                                                                                    SHA-512:2A0C95CA81915784F1056306B86CED0DCE15BF54992530FCC637C7B45CBBE8571249D0D0FC7CF3394F10229F1D88B78FAED6A2E8F7E20C826F1859731EA41A1B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.jk......jk.c.7...,..qI+.jk.c.7...,..qI+.jk..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............C>>b1..("..Gy......N...^...............qW...x.L.3....Q!........f........................................I.qk..B.....LZ.............C>>b1..("..Gy...........C>>b1..("..Gy............jk......jk......jk..........................................jkj.....jkT.]...jk......jk..B...jkH.....jk..B...jk..>.).jk..J...................;........4...4...4.."...............jk..jk..jk..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........jk......jk....#.jk............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003S.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 77 x 627, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):5136
                                                                                                                                                                                    Entropy (8bit):7.622045262603241
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:djzuNKb3XHco17p2wolIxIx7lpskdsC/ddWNKeabJbMojpxLDTu1:VzuNKb397pwlIxKp7qs3bJb5FBTw
                                                                                                                                                                                    MD5:FA38AFA965141EA3F17863EE8DCCDE61
                                                                                                                                                                                    SHA1:2B4611E651AF7549C1AA73932B1136B561A7602F
                                                                                                                                                                                    SHA-256:E1CB1A0EC9BE62D5445C73AA84DF38234002A7E164EE830C9DF24997802CB5D2
                                                                                                                                                                                    SHA-512:A372674F5CA343321BA9C413D346070709F7685706C9C6C3DC7F61846B59253A5E6FE800DBA10AE870FD3887439B2AA106FBBB51751E92A163938A4393C43E28
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...M...s.....}8nv....PLTE.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................z`.....tRNS...................................................................................................................................................................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003T.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.448589456328403
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:psVrqFDV2VW6HaGESXkn9e/YRQy/2lEcqJ+RzTJ:ps9I6HCSXkn9e/YRJOqO
                                                                                                                                                                                    MD5:28CF2BF53FF8FA4AB19B1BD42AF94CDE
                                                                                                                                                                                    SHA1:4A0F575E16CEB91F5EB6B12A76E10CB857A0B8F9
                                                                                                                                                                                    SHA-256:7162DC48C7679628B51A0C7A50B28E62321A985BC034BF4CFB0E746350F49C9F
                                                                                                                                                                                    SHA-512:04E06A6D66E1C0F67B37DB5849CFB20CBACBF11926DD7509C53C2D323A077B9C8A4548AFEF232A9353DDA4153981B6DE9809B8F64FA7BDAAE92F3981ED98F332
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......h...v...\...................................................................................................................................2...>...D.......v................................I.......I.qk..B.....LZ.............J........S.....J........S.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............5..?..0.*..L.....N...^...............$....d.H..=..}..........f........................................I.qk..B.....LZ..............5..?..0.*..L...........5..?..0.*..L.........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003U.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):52945
                                                                                                                                                                                    Entropy (8bit):7.6490972666456765
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:cjvqR0XvFaGCTJffi0tgybmWDoTw71kHUAnjvawrlp2+NUO8dWSNl3PF2PjK/q09:cyRffflgybmWoTw1UUADHUbU21MjpAD
                                                                                                                                                                                    MD5:AD003F032F32FAC4672D4CE237FA5C5B
                                                                                                                                                                                    SHA1:AE234931B452F0D649D91291763B919CF350EA49
                                                                                                                                                                                    SHA-256:ADB1EBBE18D6CD8FF08AA9BF5C83CDB83BF9AA179698E34E93DBCDDE12F04D32
                                                                                                                                                                                    SHA-512:ECA25FA657ECE3A66D3E650628E0F65D3BADD38864C028AB6553950A1A66D7D55482C85E9E565573E9E5AAFA91C2D53235971C644A266D41EB69F8E72E3A843B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQ..aq....".....2....BR#r.b3$...C.Sc%...s5E......................!1.A..Q.aq"...2...#...B...Rb3..$..CSr...6............?......y_N.e.H7?........W..w....k|...S..d.4.>.RW5z.$.i.)V.O....>o...c..*&1.D..O..".ufbb..1...t..u=..K...m...~.....F..-.fb:i..=f..C.w.[{..~.7k....;..:..3....4.....$..m]...}....~q...9T.#..7.~..8...q.N;c..ffo.w...W..d........../t_........lWJE..).>..v;:=....Rrw#.m.n.n...E...vm.J}2N*..|.4...80.#..e....t.J..ZQ.x|g/....F..e....k+vK...M..W.X.e.L..~...j.....kz....=...n:O.:..[.L,.+R...Y..zKNI....,..{e..U.'...}.......|..t.]...~...b4......_.i..../.......m...a..n...v.j.?..Rc.$G|.31..#..$?.........h.w....-... .a.%z..u......u.A....Fm..J.......G..[...w.....:....w/.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003V.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.416733092084718
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:zWBSls8q92lNtWlEbLjXXAXgu9+G3drdqrbmBiBX9Q2m/DAd:BsJ2lNUEbYXP9+GNRy7k5/M
                                                                                                                                                                                    MD5:DC6DC39E1338019965A6486CAAD383F5
                                                                                                                                                                                    SHA1:4284CED3053AECD8C319BADEF876D8425DAC503B
                                                                                                                                                                                    SHA-256:4E9A8D886374ECD360F44FEAA7EC315A97EDF65CE03C80EAF20E181B8B13401A
                                                                                                                                                                                    SHA-512:0BAD41DF532606F50DE5E8C5ADF454D33AFD04679F5346861EE9FF19D00F3F1F4E70CDB70519DD087BDC6EBB5A698A48A83EB157847DFDC0A8726AEC69085BEA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......h...v...\...................................................................................................................................2...>...D.......v................................I.......I.qk..B.....LZ.........e..s.!.7.q.....e..s.!.7.q.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................r41......A......N...^...............-....|9G.iA...P........f........................................I.qk..B.....LZ...............r41......A.............r41......A......................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4......................#..............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000040.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):79656
                                                                                                                                                                                    Entropy (8bit):7.966459570826366
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:2kuUliOeU4os8ii3nF3Hxro/qxXD9u/kjYgMZqoEs6ZUldm:3uUsOXYIAixR2k7WAZV
                                                                                                                                                                                    MD5:39FF3ACAE544EAC172B1269F825B9E9F
                                                                                                                                                                                    SHA1:2D40DE8D90BD21D56314D3F99CEF4FBAE3712C0F
                                                                                                                                                                                    SHA-256:70475431CCA3C91A4EFA3B8F04864371D2D3A45696674A1A0562FE9CD8DB287C
                                                                                                                                                                                    SHA-512:3B9F3B32696AB7779864E83DC0C45960114A130BEE0CF4D0643DE57FF952171E5D775AA49141EE31A28A9B5D052B26EB421F26EA736D7EF4B3A7EC812CA411CB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!.1A.Qa"..q.....2#..BRb..r3$.Cc..Ss.4...D%5&..T...'7....................!1.A..Q.aq..."2.....B3.r.#..R...bc$4..D.s%............?..Y..T.o.\......=.a..j..'^..s..[../........Y.......<...(..4.....7y..Ln.[9.cK.ilN...u@$.V.9.V?3..s.KL.z..w.jW.C.............@.~+.o?o8...k....,.m..9.".....q.....d....z.W...q...~...'..e..>..f#...S.....F....pU.......7..N.vfK......S..G.#.....}.c.........RXt.bq1.`.....[+8\.*.N..:......}.....r..........')......Na...&...m......c...a4_%d.............co..0.n.L.Q..E.Lt..y.|..F..4.i(>.._..\.eNL8..?z9I:hLgC.@.p....g.t......'.I!d..?1f..R..........|..4.wJ*..%g..~0bt.....*...v.......O...:.~.>~..o.x...9.@>...s.&.E.0/G.c..t.<..F.t.A.z. ......;.........Gp.P

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000041.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.468149180538293
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:EPssc1icL8bwDs3y+t5EfEWn0qlBXsp9zoo9rdqr25aiYRXz2W49WDxWc3ukW9WD:EPsFL8bwQ3y+72ESXQ9zosRy28iY7P
                                                                                                                                                                                    MD5:29EE043A320CAB2A63299A11F700A95A
                                                                                                                                                                                    SHA1:F8FDAF2DB178FBDCB76D49D36DE6D85E56D05A10
                                                                                                                                                                                    SHA-256:ED4C4B585E93F26351A986142EB3D3A26AB418D02D032E29722AA0202FCF38E5
                                                                                                                                                                                    SHA-512:34E19220F031A311D45C4516810E74A31690391462C20F1B7CF142C9ED7E98ADA17B7B6D7F7AB5DA9636DCDB70054F3B67496613B6B31E90825170592A850D30
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......p...v...d.....................................................?....?........................................................................2...>...L.......v...............................................'..?...D.I.......I.qk..B.....LZ........'..?...D.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............e.+...".ns;=......N...^...............s.U..@.M..8.nAfH........f................................... ....I.qk..B.....LZ..............e.+...".ns;=............e.+...".ns;=..........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4........................#...............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000042.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):40884
                                                                                                                                                                                    Entropy (8bit):7.545929039957292
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:MCBOA4d+ElOXJ/3pI7cRBiL7L6qERqGz65WXzZqJsKQSbIsTT6XB:hIAU+2cGdLX6qBG4WDZl4Ihx
                                                                                                                                                                                    MD5:7379775A1E2AB7FAB95CFFCE01AE05F3
                                                                                                                                                                                    SHA1:3D3DDFD8AC7E07203561BAE423D66F0806833AB3
                                                                                                                                                                                    SHA-256:9301DB6D2D87282FCEE450189AEACE16D85F64273BF62713A3044992B6B7A9E9
                                                                                                                                                                                    SHA-512:4B5006E620E80D3A146944649CF4CA619782CAD7E8C4CD0D1DE0EBCA0FA05EACB7378DAFCEED3E26F5698B07F19604614D906C8F51F898660E2F129D8DEC6F62
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1A.....Qaq....".....2....BR#S..br...3T...C$.7(Hx....4D.G..Xh.cs..'..t...%...8.....................1...!AQ..a...q"2.4Tt.......R3S....Br...#s...Uu.bc.de..$D..6..C%E..............?...z...;sB.yv...........]t.\...n...../....m....M.=.3G+..x+.....S).*&.J../..8..O/+..sG...p...<!....~.c..C.w..,[oHom.wc-.J.~.......L[..6...'..i_..S;...!Y.z.q].EK..M.x...i.x.+.;.+...}....#......f.)........e6V..p.;........s.)..Ml.J......IU.6...<9+9.^..l..Y...[._...2..^..j.ia...._..3.;...~..<3...;......z.^.......]..Qk.,...Yk...3.3Jy^p.}....q...I...&..t.......;..9.g.GH;..'...%...)..[..y..../...zCn..>...'...1e.Y..;....]..7...N>t..m-.j.............H^..T\.q.ru...}...eTn]I'r.^].#..wOY....v

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000043.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.328351458280037
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:Ylu8snjHNW2uqcmEa+DXHw9bJfERyr4IU:WsjHNW2ubDfDXHw9b1ERyMI
                                                                                                                                                                                    MD5:1824458046A999E4C017DC794D9BC321
                                                                                                                                                                                    SHA1:460A1AE1DF1113740594B240D0D45105BA763A54
                                                                                                                                                                                    SHA-256:CD588DAC6B0E3A1D1544F41A2ED7BF786ACF8A0C453D8E022D3D15368F197832
                                                                                                                                                                                    SHA-512:581A9D56FDBB0A202FD0585933EF433796213579419FA317A81AA03DF20DC50CFC9D031E10E2174AA82B9B17156FAE1CC41CC1A35ADD8C81830B85071A9486F2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ.d......d..[..3...V....d..[..3...V....d..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............bie......$r.eV.4....N...^.................p...!J...S.q..........f........................................I.qk..B.....LZ............bie......$r.eV.4........bie......$r.eV.4..........d......d......d..........................................dj.....dT.]...d......d..B...dH.....d..B...d..>.).d..J...................;........4...4...4.."...............d..d..d..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4..........d......d....#.d............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000044.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:05:55], progressive, precision 8, 612x618, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):68633
                                                                                                                                                                                    Entropy (8bit):7.709776384921022
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:tapXpSTJDOkFGdJdBk/slsbfsw1imaapnbvD8:U2OjJr6b07m1bvD8
                                                                                                                                                                                    MD5:41241EE59AB7BC9EB34784E3BCE31CB4
                                                                                                                                                                                    SHA1:98680761A51E9199CF3C89F68B5309FBEC7EE3CB
                                                                                                                                                                                    SHA-256:035B26DF61855A3F36DBD30FDAB0C157C04C9E8AE2197EA4D4AEB3E82E6A4C2B
                                                                                                                                                                                    SHA-512:3EE331D5BCEE4AD5D3FC9661D4AB4053F7D351591A094334F963C33C9D0E32CCCABE9334AD7C308108CE99617E064FE848DCD469ACD8D83FBE5C4452DE523D8F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:05:55.............................d...........j...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?../$.W:SZ./...9.....-...u......r.....].c...@W_.7...+......v.+PD.I..-<1.pDn-\.....p.$....0.}V....\..>.~..XN.o..l(E....ik..o.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000045.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.427279459888687
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:56BsVc/8/yy0QtEwCyPEg3LaCJvevf1XrY9/DoZrdqr2NmRXI55sY8taoFp:56sv0QHEg3lmX1Xc9/DYRy3y8I0
                                                                                                                                                                                    MD5:8B5C3365A0187F8ECF010D2B0756B81A
                                                                                                                                                                                    SHA1:932E3D04B6DBA3B7D2AE4FEA2F4517BAFADDB683
                                                                                                                                                                                    SHA-256:24EA6F49A717F91DC73D99CC19DD9B4243839C90493C3610FFB1A30642FE7F7A
                                                                                                                                                                                    SHA-512:E477DA27731478ABD4393A122999111A89C398EB5414DE018CEC2A8C1F3452B73A0D3C92CAEBD857303961E1E04A4C4BFAB92E8D755BC0F98E4C76C4E809719E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......t...v...h...................................................................................................................................2...>...P.......v................................I.......I.qk..B.....LZdIS.....dIS..dO..L....dIS..dO..L....dIS..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............i!$....-F0+.:;.....N...^..................;..dD..._S.e.........f...................................$....I.qk..B.....LZ............i!$....-F0+.:;.........i!$....-F0+.:;..........dIS.....dIS.....dIS.........................................dISj....dIST.]..dIS.....dIS..B..dISH....dIS..B..dIS..>.)dIS..J...................;........4...4...4.."..............dIS.dIS.dIS..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........dIS.....dIS....#dIS............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000046.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 176 x 513, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):11043
                                                                                                                                                                                    Entropy (8bit):7.96811228801767
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:YyroOCsBI9pkCFsHHX2RE6VOlPuIqmBtJNBfAr+ADP1IATaNeTyZ4GF+WQQ6Qwq2:BUOCsB2kCGH32RiPDtDBfArPDP1I/eyM
                                                                                                                                                                                    MD5:8E9AB9C28B155A66BC5C0DA5E2A4EFB5
                                                                                                                                                                                    SHA1:972E61F162D48F1CEE21963ECBB2FE439105DB55
                                                                                                                                                                                    SHA-256:B243A24FA13BC8523450E22F408F9EFF15301C938F8CA52A57018B58CE6785DE
                                                                                                                                                                                    SHA-512:12062D69E676B3B34AFCEF25AC17B40294282D5BAB6C0110680293D7CC96EC17EBCFE104C284E64A30EE3C483E319E9C37C03F6EE82C79632180E45C7A684E8C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR..............`....`PLTE............................................................................................... .......bKGD....H....cmPPJCmp0712....H.s...*YIDATx^.]...,.N.8.i......0..e..y.......8.6....Fo.........=...F..._..........O..{..............3.|.L.|.............>.....v..n.1J...k...."....7........J._.5LQ`..k...._Z.W.x:..k...g..._.....u<.Q{...1...q6.cs...l............30.g...< W...a.5..>O....9}..c..........s|I.).>.fo4.<q......>...c.:.u..co.#.7,.O..G./.K.|..q.p...(.(....iH.......m..+.7...../..{W.l....b....?.`^.q.9L&.>.hN2`1..m...]$.0J....rBy......{.._...G....;.r.Q..;..,...9..F...t;.+..2.Ub......V...8.k..5.........'[..s.H..).......%j._.&.....BN..V..q...T...#..........0.E&.o7....$..m..8g.f._$..k.8...5......HgQ...L..\.........)B.I.r.(..8.a..$N.9.=..o..Q..(.e.a..O.....c.= .......$0..X.S,..(p......$..l.c.I...=."......g....^..#~,&.a9iK..ZNE`...pFJ.@Wd?.<..Bt.E.......e...i.%d...}.!..B......9.........B}.....5...;..hL.D.....4z.....|.)

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000047.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.354245514473734
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:3bssw33qEiNqTt4v/wEQL4MXTM9iqjxoFrdqrG+KBbUhRXoE9Btx:os4viNqT2nwEQcMXTM9iqlkRywCh
                                                                                                                                                                                    MD5:5B5CCA57A8D1F97AAC11824C0D8E361A
                                                                                                                                                                                    SHA1:76D0E84173CB6BF984263C2FDB4BBDEE030FC1ED
                                                                                                                                                                                    SHA-256:A75FF6F922280F5B6C415E588C8016A59B7F1ECA086A2FE7E98C5F8CC926ACA7
                                                                                                                                                                                    SHA-512:D6F167B20CB2FD6146CAA576DB17FC9257F248DCF2614BA783069581CF7F4CE1E43ED6AF1C64923F7BF0B8AFDAFE14E9758D5D721F2B1A30D6876B6400A917E6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ../......./...]...2.^.Y.../...]...2.^.Y.../..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............h.E+.".....>.S1^....N...^.................u|[D.O.......T........f........................................I.qk..B.....LZ............h.E+.".....>.S1^........h.E+.".....>.S1^.........../......./......./.........................................../j....../T.]..../......./..B..../H....../..B..../..>.)../..J...................;........4...4...4.."................/.../.../..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........../......./....#../............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000048.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 40 x 650, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):647
                                                                                                                                                                                    Entropy (8bit):6.854433034679255
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:6v/71rwqZMXVs99W1YvpLp/Fvl+f43ocLtuplb+CrGotLRd:+wqWXVs99rpLpNvr3pIx3b
                                                                                                                                                                                    MD5:DD876AA103BEC3AC83C769D768AD39FB
                                                                                                                                                                                    SHA1:1833603AA9B6A7E53F9AD8A336F96CCE33088234
                                                                                                                                                                                    SHA-256:1262DD23AD54E935CFA10FEB1BE56648E43BEF1116696CA71D87E6E033B1CA7D
                                                                                                                                                                                    SHA-512:946DB2277213104A3B29EC4388578B05027B974A3093B4CCAD8847397AA51AE308BC6A199E5705E1F901D6E4B1BA34D8DECFD6E5B6685184A307D749D7CFAEDD
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...(.........xk....`PLTE.........................................................................................>.S.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.)..1..7w....6.*.H`T6.ha.k.............b!....Ba..C..P.4K..@.....h.E..X....PX+.P.-.....@@"...o.O4....xZ<...B...B..,A..y.s<......b!....Ba..C..0_p. .......=..,...i. ...=.j..N...........{4+...xZ<...B....|.....$.K<.vyE..X....PX+.P.-.:... .'p......\,...i. ...=.j........K.....%J..S+.....q..k.H.@DD.s...:..J.K.DDL.\.@`,.DD.:.(]..N....KD....A M.....F..S+.....1.sq........\.t..;..../...~k...4.DD.:..]..N....KD........@DD.s...:..J.K..[...Q....V......IEND.B`.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000049.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.367157037777987
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:asoQ/JH50O2+CtMpLMMEjFLOXsLw9D5oVrdqrKUQBCug2RXEE2HkutysytAg:asf05+CyREjF6X2w9D5kRyKsuHrA
                                                                                                                                                                                    MD5:35EF6E3C5D4CF257A59188B6620DF609
                                                                                                                                                                                    SHA1:4441013203283EF51908FBB45FE75D92B473CE52
                                                                                                                                                                                    SHA-256:9C4920B5993CFD48F272A5B71C103F89BAABF95FE1A7B687009453E0663A87E4
                                                                                                                                                                                    SHA-512:8D56880865EEAEA323633C080E3F968BDBC39878CA18E411A9BDE819C4E267ED020533B4DF09D0D97523F35FBEC6800F802381E78B5D9BA3158E54E597A1F746
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ..8.......8..'. ..~.....8..'. ..~.....8..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............uB.,.?.]\......N...^................NZ.[.OC..V...7G........f........................................I.qk..B.....LZ..............uB.,.?.]\............uB.,.?.]\.............8.......8.......8...........................................8j......8T.]....8.......8..B....8H......8..B....8..>.)..8..J...................;........4...4...4.."................8...8...8..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4...........8.......8....#..8............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004A.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:27:10], progressive, precision 8, 102x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):52912
                                                                                                                                                                                    Entropy (8bit):7.679147474806877
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:DB/nIviNJD9C8kfJj6TkVr4q24FsUpjPc021si:DdnIvi3D9C8Cl6Dq24ayPCz
                                                                                                                                                                                    MD5:1122BF4C2A42B4FA7F29D3C94954A7C9
                                                                                                                                                                                    SHA1:3750077A830FE21735A43ABD35C63BA9A4D4B0DE
                                                                                                                                                                                    SHA-256:423B0DD1A93B391D15B1DC8D8757C3BF5725FF2E7A59E6E3140033E2876B67F6
                                                                                                                                                                                    SHA-512:4626EFE2EDED2361D6296B57F994DC434CC9D02357A8A6A67D84A544FB8A1CFE0005EA98F846AB963BED7F2B6CE96BC9181182C9459843A52A98D3A731A4FE73
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:27:10............................f.........................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....]+\.9.9.P.d..Z.?~>.-...]6=....*.......S.9G...b<$..Z..........>.v.o:.o%.e...z.F`...[.wo..z.....k..E...5....G..7.......c2..

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004B.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.336696124902262
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:isHa/aAavGGc/EkgKXCAkK9bJ0RyLr70vaAacPahazjaO:isH+N0GTskgKXfkK9bJ0RyLr4vNhkOj
                                                                                                                                                                                    MD5:48046444EA87660CD4382EB9B392925F
                                                                                                                                                                                    SHA1:587F99E671DBBD844C6FBD871089C9AD2B9E2B2E
                                                                                                                                                                                    SHA-256:313388591133F63F13E641E1831FDB0C356888523304BDFCFCC7F910F35F674F
                                                                                                                                                                                    SHA-512:1EBE5D1F8ADE6893C2E39175FDFE0FDA181B50FF101EDA1226732C48BAA03606265F05E1DE1D10204B7C576FCAAAB9269DC20F71188A181550A7BBD00A6D0917
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.*.......*..Rc....6.QH%.*..Rc....6.QH%.*...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................G..D...7.%.8^....N...^..................CtNI.zc.+-!.........f........................................I.qk..B.....LZ...............G..D...7.%.8^...........G..D...7.%.8^..........*.......*.......*...........................................*.j.....*.T.]...*.......*...B...*.H.....*...B...*...>.).*...J...................;........4...4...4.."...............*...*...*...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4..........*.......*.....#.*.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004C.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:18:09], progressive, precision 8, 164x641, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):27862
                                                                                                                                                                                    Entropy (8bit):7.238903610770013
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:LTawAZvhbrXzDc6LERLQ/b5vXOl6pXQ/wD5OUMrdRUUhCplQg0ESSz:6wm/vT/b4wxoqbdUhWnSs
                                                                                                                                                                                    MD5:E62F2908FA5F7189ED8EEBD413928DEE
                                                                                                                                                                                    SHA1:CA249B4A70924B73BDA52972E9C735AEC35A0C5D
                                                                                                                                                                                    SHA-256:20ABE389C885E42B6EBE9E902976229BB6FD63C8C34CB61AA70B8B746209F90A
                                                                                                                                                                                    SHA-512:EE8D1821A918BE8714F431895E7223D08036E88A4FDB9A5485EFF246640EE969A69A8AA4E2E9DDC35BA75FB6D4E95092A286E90B477BD6998C313639C2C31F25
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:18:09......................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................!.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..P.v..+..n(a..Q..S\6....Y....D......} w#.b..]l.5.RU..k...... ]$.$.........f........?.z@2uU...7....?..|.Q..I.&.. ......"T4)wdH.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004D.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.488970049303086
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:usDkqh0E3sTuLMjMtRqE5zQWXr9Jw8/oVrdqruGG7RXmTLWNf3vn5:usBaoMIWE5cWXr9H/MRyAWcn
                                                                                                                                                                                    MD5:62E97E0FA2D18E4945E6B997DA9FAB12
                                                                                                                                                                                    SHA1:ADD39E107D6097F4804555496CB3CAF5066D4DC6
                                                                                                                                                                                    SHA-256:61FC753D6CD80102977D9488FE4E315E755B76D41A9893050C5C15C65DD3006C
                                                                                                                                                                                    SHA-512:013FFBE9F89965CD3A65E1863BD32DE7BF07CA9A85D13D258BDCC2A49C0FF501AD7C12F32AAF469E61D34B0A3B8949351C648A567AC2B96DB2EBCF2B3137AA6B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......r...v...f...................................................................................................................................2...>...N.......v................................I.......I.qk..B.....LZ."L......"L..K.."g3.. .G."L..K.."g3.. .G."L..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............~...{.....G).i....N...^...............w^!.$.rJ...$C%........f..................................."....I.qk..B.....LZ.............~...{.....G).i.........~...{.....G).i.........."L......"L......"L.........................................."Lj....."LT.]..."L......"L..B..."LH....."L..B..."L..>.)."L..J...................;........4...4...4.."..............."L.."L.."L..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........."L......"L....#."L............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004E.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 50 x 556, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):977
                                                                                                                                                                                    Entropy (8bit):7.231269197132181
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:6v/7QiFJaY/z+obuqFA4fypjQSbtBK+lcqNGSbb7XTJArRRzN5DjNRkPmu5cCbR2:x0QY7xbjy9pY0JPXLTWroeuCCbX0
                                                                                                                                                                                    MD5:B7F74C18002A81A578A4EE60C407A8D3
                                                                                                                                                                                    SHA1:70A7D4BB1B3ADF4397D168AD0D81B286F88EBDE0
                                                                                                                                                                                    SHA-256:95F59A0433050180D4C0E8858B83363D51BEA6752A8B7CA516A8677854D8F5B6
                                                                                                                                                                                    SHA-512:13186A7CDCE80BCA9D2238666D6D7A989FA1887EABFA5D8A9A63EEC304DFD4BE8EFF652205FA56E1D1CEE7D3680AF8C70A952AF73AB3C246400E8D4EBECBDBA9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...2...,........A....PLTE...................................................................................................................................................................................$.y.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^...0.D_.......cck.....%a...X.a0Y...-..!.G...[....(.r.H.$...1 .zq.4V.e|a.6.X..4..kl.%....=w....6..TN.....{.4..T/.z...../.....3..!~..t.#b..^.....E!.SFb ...-.....^...,..C.!.b...i._c...s.X.w.. lsQH..H.gKc@@...i. ....m...;Ci....@G.; V{..lO..\.R9e$..{.....P...E.+.2.0D.B,..P...56.?......K.6..TN....^z.4..T/.z...../.....3..!~..t.]b........E!.SFb ...-.....^...,..C.!.b...i._c..Y.O...?.9k2.M.?5 .n.P...,...d._..%M?....6....,.1..R.4.a.R.+..U.Q..P...vd..T........j .]@....."..lJ../.90.4...Y. ...9.%...{......Hc%.....i..%M?aG..H....o.q.......4.......X.d9.r..CI.O.5.Ri0?.s\b....w...>/k..4V.)Y....P...vd..T........j .]@....."..lJ../.90..2..MP..l..?....K.X.....IEND.B`.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004F.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.3160422056811765
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:ws1BWFvUfWE3TBXI9z8sRyMILCqt6DCA2V:ws1evEjBXI9z8sRyMILC26DCRV
                                                                                                                                                                                    MD5:83847C399D93BB2F9384E4339D319EF2
                                                                                                                                                                                    SHA1:7648D742F2AD72DB290BFB1E145031F6B70D3BB5
                                                                                                                                                                                    SHA-256:A8E803CE092466352F05D31CC9FEA695AFC40F28FC6A97FB241D16453B9282B4
                                                                                                                                                                                    SHA-512:6D95DCCFCD6D8CEEDDE7D5F624A6BEF1A9570035F49C5315F39A45EA9145C6046B6FD94ABD3DCF5D48F7FF43E65A2C24A840F8B985247472C42F2EFC8249F699
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z.........................../6....../6..Z.F..........I.......I.qk..B.....LZ/6..Z.F........./6...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................-n..&:.".......N...^...............r....jzB..#.`RI.........f........................................I.qk..B.....LZ.................-n..&:."................-n..&:."............/6....../6....../6........................................../6.j..../6.T.]../6....../6...B../6.H..../6...B../6...>.)/6...J...................;........4...4...4.."............../6../6../6...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4........./6....../6.....#/6.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004G.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):34299
                                                                                                                                                                                    Entropy (8bit):7.247541176493898
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:BrSX4V3P8AIc4KLkHeXRUer0zrhOmXfvG0yH82I:tSXuIc4K2eBtswKsHg
                                                                                                                                                                                    MD5:E9C52A7381075E4EBC59296F96C79399
                                                                                                                                                                                    SHA1:BE295AD24D46E2420D7163642B658BF3234A27EA
                                                                                                                                                                                    SHA-256:D56CEFE9EE2FAE72E31BDBA7DD2AA4426EA22E3CEB22EF68C8F63F9F24D5A8BC
                                                                                                                                                                                    SHA-512:95CC96DD4459EBAE623176033BA204CCDC50681A768F8CBAE94C16927D140224E49D5197CAE669C83C77010C5C04C1346CF126BEF49DB686F636C5480342A77F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.......................................................................................!.1..A..Qaq......".#4.2r3.$.%...B.5U&6....Rb.Cs.7..cDTEFVf'...S..dtevw.u.........Gg.....................!1..AQ.aq.2....."#3.4....r..BRb$CS.D............?..5..............#....v.q.m.}\..{....;...r....h.....J..q|..'.;\..6..v......e...../.k..|.8..i..|..]..3e.m....n..Z.GS..n".y..w.-...[a...7A.....i.4.)9\..~C...=.........s..\V]c.D1<./.g.l.&v..~.h..]....zb>G..y:vNS.\......LU....t.{*..Z#.?..v-...wn.rR...P.....y\=.v....../..9_...m4...V.|.+.o.#.......xj....}..>.s.>C...m.[;.>.p...=^.i.X.(..1...{.F#N.W...xi.z...4..u[{...yO.....8..}\..2...KlX.nbya...2.&.F...R.b.k.7.GV.x.h.y\.Q..O<\>......-...=...r......\......Z.Z...Jf.'....z..Y.q>.p....o..K....h..R..c.lg?......A.Z...Y.q3.L|.'5...

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004H.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.345866528987482
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:+sVWc4EvthJhEZEHSFLjXpaJi973o7BrdqrnyEJQRXGzuWd8tPO9:+s54Ev76EyFPXgQ973uBRyzyL2uPO
                                                                                                                                                                                    MD5:01D643A818204117C747E799801A183C
                                                                                                                                                                                    SHA1:74EAC5D4A281EA784C21559F4D2AD6EAB7C2DCC4
                                                                                                                                                                                    SHA-256:9856D41F661699EC9F96244724814DCD560B8B6A4C47BC22D23FABD23078A023
                                                                                                                                                                                    SHA-512:DCDCE8F70E3FCB1989FA9258EF2DC18ED5FB2DFEDF50814A415D78256BE57C30E855F5225A4291D9BF675FE53C8B33815FF20C7D04B6B43BC1B1ECF5CE429255
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ...........3>...-(.O......3>...-(.O........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............57m...%Wl........N...^................e...M...J............f........................................I.qk..B.....LZ..............57m...%Wl..............57m...%Wl............................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4........................#...............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004I.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 171 x 552, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):10056
                                                                                                                                                                                    Entropy (8bit):7.956064700093514
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:edmu1fpj5DVHuooK4EpGLbAdT+dBXYBR8D1V2p6KwoPR6KUX9ojwRpgA:2Pp/B4LbAF+dBo/1E3S6JScpgA
                                                                                                                                                                                    MD5:E1B57A8851177DD25DC05B50B904656A
                                                                                                                                                                                    SHA1:96D2E31A325322F2720722973814D2CAED23D546
                                                                                                                                                                                    SHA-256:2035407A0540E1C4F7934DB08BA4ADD750FCB9A62863DDD9553E7871C81A99E3
                                                                                                                                                                                    SHA-512:BC7DC1201884E6DAFDC1F9D8E32656BFAEE0BB4905835E09B65299FE2D7C064B27EAA10B531F9BECF970C986E89A5FD8A0B83F508BBA34EB4E38B3F7F5FC623A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR.......(.....!..t....PLTE.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................4.....bKGD....H....cmPPJCmp0712....H.s...#.IDATx^.w`......$..B....... ....fz5..6`l\.8...Nsz{.//y./....{.7}g.....e.....~.......s...f.....%c...6....O.PJ...Y.oi...9..'j.2..6.-

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004J.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.283041707467262
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:ilbsY9O21NLz2EtJTEXh2aLnXzj9zsoprdqrQpBPuRXrILWwj7xkwLOlGi:ilbsOz2EXEfrXX9zsQRyQpB2g6
                                                                                                                                                                                    MD5:AA3F57502746DEEC56AFE942517A0E39
                                                                                                                                                                                    SHA1:DA8F5261238C95439FA94EF55C6B8F7281D86A50
                                                                                                                                                                                    SHA-256:F5834C6494AD50633D41096825CB835355A723310D069100BFE8E06F698D1521
                                                                                                                                                                                    SHA-512:1ACD2F4FB32399F951BBC041B842ED2661115D565A6D1878D5921C0387F77940A6E81183769CFB592D6C64F5F198BA2F8CEA6B9F065E7E22632BA2AF3B296FEF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.UR......UR.....;ef....;.UR.....;ef....;.UR..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............'_V.p...:.J.........N...^...............ng..BP\@..qq.A..........f........................................I.qk..B.....LZ............'_V.p...:.J.............'_V.p...:.J...............UR......UR......UR..........................................URj.....URT.]...UR......UR..B...URH.....UR..B...UR..>.).UR..J...................;........4...4...4.."...............UR..UR..UR..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4..........UR......UR....#.UR............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004K.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:11:38], progressive, precision 8, 577x757, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):84097
                                                                                                                                                                                    Entropy (8bit):7.78862495530604
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:cgHTEuD99rHwA5MSadIV2MApVmfJkAKOQ/Z1I7ngpDDyHfKFVITrU:HHjXidIhApV88/jIEmrU
                                                                                                                                                                                    MD5:37EED97290E8ECB46A576C84F0810568
                                                                                                                                                                                    SHA1:18D9FACB4CFA3CBF63B882CABCF30B203EDF4126
                                                                                                                                                                                    SHA-256:140DD943D0F0CFE6AAA98470B7D1A7CB62CA02CB1D8F522DD2AC77433232EF41
                                                                                                                                                                                    SHA-512:E0F57314C136211B8253EB2AC0093DED82198E7170D4F97C40D82FD4EC4123D2AAFE3EB4EBC3E7523C4DF4D77619408773871BDE15B6DC6C4049C71D5B9D4222
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....hExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:11:38.............................A.......................................................&.(.................................2.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................z.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....b.xH......T..I...S.q.~..../s.R.x.....8.a..vE.5...-.G.A.4...._......$K..d.@NC.q....J.....>e".I.%...I0).R.I$........M3.F .

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004L.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.327288474398738
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:BBDnsOo3xjEOyvwtgStKI5EMxLXim9LooVrdqrdGWSRXzv8RDHlv:BBDnsrxjEbvw2I5EEXv9LoERyom
                                                                                                                                                                                    MD5:F79473BD2523BC20490CC52B7BFCE947
                                                                                                                                                                                    SHA1:40916C2C3410EEC67479E9B67A1142D023E83247
                                                                                                                                                                                    SHA-256:8E262AF29F9CE9F4447E7CFF6C3EA75FDBEEE21555D299969BF1C772B82ACA7C
                                                                                                                                                                                    SHA-512:B1CE8021196B98AA8CD1A104DA7E0C15FD11D28BE3CF03ABC14324A8DEBDCB6875144E99F14BA3BC07155687C339DE0CFFA9D56CAE398B62C695C8497C734BC4
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......L...v...@...................................................................................................................................2...>...(.......v...t............................I.......I.qk..B.....LZ.v.......v.U"t........D.v.U"t........D.v...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............9b.Uk&.....e.].....N...^...............4.r...B..\...........f........................................I.qk..B.....LZ............9b.Uk&.....e.].........9b.Uk&.....e.]...........v.......v.......v...........................................v.j.....v.T.]...v.......v...B...v.H.....v...B...v...>.).v...J...................;........4...4...4.."...............v...v...v...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4..........v.......v.....#.v.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004M.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:26:15], progressive, precision 8, 216x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):64118
                                                                                                                                                                                    Entropy (8bit):7.742974333356952
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:ORG4azGOKXzkEmR4bdRSbxONOoz0khbSb4J/5GZK5SWUlRwUYdv1M:ZXzGXzJdhRmgHfIb4J/5GZK5SWUldYdq
                                                                                                                                                                                    MD5:864EEA0336F8628AE4A1ED46D4406807
                                                                                                                                                                                    SHA1:CFCD7A751DFDBE52A20C03EE0C60FDFFA7A45B93
                                                                                                                                                                                    SHA-256:7CE10D1EA660D2F9CF8B704F3FAB2966A4CE2627D9858D32C75D857095012098
                                                                                                                                                                                    SHA-512:0CAA0C54C14571C279A75F0D5922F78A17803CF6EE1724D66819F7F5944C0F5B25CB586BB686A52808CDF2F8FEB3E4864052A914884054EF7DE44124A8CA951E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:26:15.....................................................................................(.....................&...........s.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................#.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....NC+n....<.=.7..&.8A56..@^.Q..\\...E.>..".&G.......J .'....$.I)........0.../..mv...D....<v0=..ugc+..l.o...=.c.......x.&D..{`8...v

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004N.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.344334150083745
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:GsTyI7q2dkNllEXX+alh9b54wRyvyR2dIfC3dHf:GsTyI7q2dylyXXLlh9b54wRyKR2dIfC9
                                                                                                                                                                                    MD5:14DDACF6EE473B9AD3292A9824E63331
                                                                                                                                                                                    SHA1:4C26284A29A1766FBF68CE9AB3D01DF377F396F2
                                                                                                                                                                                    SHA-256:616C3D434C252FA0E8CD6BF2BD2DF1369CAAC30A3FEB144B8CF12313CFEE3E0E
                                                                                                                                                                                    SHA-512:3262DEEDD18DE51C82163B04C1A8492A49224FB7951044940672A4A30F188BBFDE3CF8AE79767B1AB8CA535940C6E7FF732259E8C9E0BC3CA5073E014C78AB98
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZns......ns..Gr...a:.k...ns..Gr...a:.k...ns...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............5.iR....(.....yt....N...^................f....=I..>g!W..........f........................................I.qk..B.....LZ............5.iR....(.....yt........5.iR....(.....yt.........ns......ns......ns..........................................ns.j....ns.T.]..ns......ns...B..ns.H....ns...B..ns...>.)ns...J...................;........4...4...4.."..............ns..ns..ns...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........ns......ns.....#ns.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004O.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:09:29], progressive, precision 8, 609x675, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):65998
                                                                                                                                                                                    Entropy (8bit):7.671031449942883
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:klZtmExaFrtWgpc+Sg+DKeplHClpHfRtPMbe:VEWWl+SNDKqlH8p/vse
                                                                                                                                                                                    MD5:B4F0A040890EE6F61EF8D9E094893C9C
                                                                                                                                                                                    SHA1:303BCBA1D777B03BFD99CC01A48E0BB493C93E04
                                                                                                                                                                                    SHA-256:1F81DDE3B42F23F0666D92EBF14D62893B31B39D72C07AEE070EAE28C2E6980E
                                                                                                                                                                                    SHA-512:8F07E4D519F2FD001006BB34F7F8274B9AF9EC55367B88D41D24E5824FCE4354FD1290CE4735E43930829702ED53F41DF02C673904A7091E9354C28E029AD4EF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:09:29.............................a.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..-O..s(...gO..@...[..+....+...H.'m........L.......@.......[k...S..O..p.'{X..3......]W..w.+.V....[.-.....2..i..i$.p.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004P.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8192
                                                                                                                                                                                    Entropy (8bit):3.2505395761033795
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:uBsJ1Q0lCeJ+WEcwqPXjmS97zqaQR07bqOxuS0dEnu4lyB:+sE0lnIc1XjmS971QR07piS
                                                                                                                                                                                    MD5:2A6C7EC5DBADB390A3D62796E226632A
                                                                                                                                                                                    SHA1:77E3407FD837BF6EE7493DEB52E932CD8EC9AD9D
                                                                                                                                                                                    SHA-256:81F13B77CFEB9A02A3ABDEA07FF08832597DD469FD16DB23DD0FAF7FF2198C95
                                                                                                                                                                                    SHA-512:0A0C1EE61B0F677541955AFDDC37BA31E3D406E12A0D2A1D86BAB72C856D4E6B416F5017C073E8E35FE74DB2FC224924EC2486866D65334411F7EDA9A8EED43E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>...........v.......................................................................................................................................2...>...j.......v...............................9.......9...m...c......I.......I.qk..B.....LZ9...m...c.....9....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............d..................N...^..................e...N....U..........&...................................>....I.qk..B.....LZ.............d.......................d.......................9.......9.......9...........................................9..j....9..T.a..9.......9....D..9..H....9....N..9....?.#9....9...................;........4...4...4.."..............9...9...9....z...y.. x.. ...........$........4...*..7*..7...........Op.b..F.$..i.................;........4...4...4.........9.......9......#9..............................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004Q.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):32656
                                                                                                                                                                                    Entropy (8bit):3.9517299510231485
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                                                                                                                                                                                    MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                                                                                                                                                                                    SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                                                                                                                                                                                    SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                                                                                                                                                                                    SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004R.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12824
                                                                                                                                                                                    Entropy (8bit):7.974776104184905
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                                                                                                                                                                                    MD5:2628353534C5AD86CBFE57B6616D46DD
                                                                                                                                                                                    SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                                                                                                                                                                                    SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                                                                                                                                                                                    SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004S.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):32656
                                                                                                                                                                                    Entropy (8bit):3.9517299510231485
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                                                                                                                                                                                    MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                                                                                                                                                                                    SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                                                                                                                                                                                    SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                                                                                                                                                                                    SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004T.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12824
                                                                                                                                                                                    Entropy (8bit):7.974776104184905
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                                                                                                                                                                                    MD5:2628353534C5AD86CBFE57B6616D46DD
                                                                                                                                                                                    SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                                                                                                                                                                                    SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                                                                                                                                                                                    SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004U.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):32656
                                                                                                                                                                                    Entropy (8bit):3.9517299510231485
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                                                                                                                                                                                    MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                                                                                                                                                                                    SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                                                                                                                                                                                    SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                                                                                                                                                                                    SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004V.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12824
                                                                                                                                                                                    Entropy (8bit):7.974776104184905
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                                                                                                                                                                                    MD5:2628353534C5AD86CBFE57B6616D46DD
                                                                                                                                                                                    SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                                                                                                                                                                                    SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                                                                                                                                                                                    SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000050.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.355522107182247
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:Yu6sbg+Mi6Uwtg+8mEya7SXx9zmjd5rd3rtxPFWRXWTBDBpPJt:YNst6UwKWEya+Xx9zmbRbNWMLJ
                                                                                                                                                                                    MD5:FDC0296D2718DCE2596CAEE140701694
                                                                                                                                                                                    SHA1:6450ECCAA114EBE44809D70567F0A64D931C6FCE
                                                                                                                                                                                    SHA-256:0C63C08C2EF14573A10568F30550FFC4D4E9179749E4A58704215211F7B0239B
                                                                                                                                                                                    SHA-512:4820287AB3F5C9030EA8C133B2A480DC903547AAA105252E1031C21D281606A3CD74BEB4779F374CD0C9D1DFFF9BFC9DD238015119386F4522714B6130B8ED5C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ..9.......9K]oy......~s..9K]oy......~s..9..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...................K..O.....D....N...^.................c...{N._..'.A.........f........................................I.qk..B.....LZ..................K..O.....D..............K..O.....D...........9.......9.......9...........................................9j......9T.]....9.......9..B....9H......9..B....9..>.)..9..J...................;........4...4...4.."................9...9...9..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4...........9.......9....#..9............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000051.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):39010
                                                                                                                                                                                    Entropy (8bit):7.362726513389497
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:6tCjwO+E+KW0ZtOgepcoWW4pAWQ6/KWcR474HOAZaDfK:68j+E+KW0HOgep/72/NKWcRNefK
                                                                                                                                                                                    MD5:9700DE02720CDB5A45EDE51F1A4647EC
                                                                                                                                                                                    SHA1:CF72A73E1181719B1CC45C2FE0A6B619081E115E
                                                                                                                                                                                    SHA-256:7E6A7714A69688D9FFDF16AA942B66064A0C77FCD9B3E469F89730B4B9290C3E
                                                                                                                                                                                    SHA-512:5438921467D62376472007B9EBF3C35C9D9FE3EDE04D99A990129332D53EBC8EE2555C0319A4F7C0DF63516F29CEDF2171D8B6DC34C9FCD075C2CA41EB728660
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!1..A...Qaq..".......2BR#...b%&6..'w.r.3f7W8.s5EUeF.g....CS$4.Vv..Tdt..G..(c..u.Hhx.......................!1.AQa..2.q....".s...3.4BRr.#......b.$c............?........uf.....t...;..[...W.h.....-.k.f..i.u..KQ..b.F...rM%/.8n.S..=9.....G$O;.f.}L..N..U._i.[.X...3.~....S.~..+t$...c.5......{..X/..#.G...}s....6......^....o~.$.\WA?...^*w[O.~..6..~....a....~..:..0.......{O...|.s.u._w.........i...........{K...._.?.../{.....A..8....<g.iu..<..................X......|]v....D..9.k.w.|-IF.Tv.-.&.........."'.4.b....z.._.Z.....G...u.xyt./_.q..m>..S.V.Xdc.bw.T.W......g..........}s.._..?....U]_.......`......>.|'.~xH....,...?........?.q....o../..R..;...Y.G....A"?......?.<..1...w..o.M.........tco.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000052.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.417187092538865
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:xsds812bvLqxoEN1XN4r9kk+jsRb/36iA81B1pHi:xsdsCqvLKV3XNG9kk+ARb/36iACB1pH
                                                                                                                                                                                    MD5:6C52B8C46DA975D0CF8B4202F233EC4D
                                                                                                                                                                                    SHA1:CB7AAE5BF416383415CFBC4AD66921119663F91B
                                                                                                                                                                                    SHA-256:D4D6CF859AA173B81549B438993BB28F705B44D2B846720BF91093389BBE65AD
                                                                                                                                                                                    SHA-512:B71BE7B4514B75989383A75DABEFB5424F6C33ED99851C69B2DA53883BBC98C025EAC8D1173A78A37849BEE1F39EB2EE7E984DF91BE4CE0B39CF148AC9DD50D6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......h...v...\...................................................................................................................................2...>...D.......v................................I.......I.qk..B.....LZV[......V[.(\X..h...E.`V[.(\X..h...E.`V[...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............SK....9..}.x.....N...^...............J]..I..E....V'VJ........f........................................I.qk..B.....LZ.............SK....9..}.x..........SK....9..}.x..........V[......V[......V[..........................................V[.j....V[.T.]..V[......V[..B..V[.H....V[...B..V[...>.)V[...J...................;........4...4...4.."..............V[..V[..V[...z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4.........V[......V[.....#V[.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000053.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):25622
                                                                                                                                                                                    Entropy (8bit):7.058784902089801
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:EhK81gTCyJ/Gf9Aw3t8w8EtdPeGDh6bEi1Ie1u4ZbvgwTwrSRh7ZKNpIGY:IjcRXwdJvtdGsUbEi1IeY8vgwTyC1+Y
                                                                                                                                                                                    MD5:F8CCFC24DEB1D991EBE085E1B2D7D9BF
                                                                                                                                                                                    SHA1:AF76C22A765434AEDA134924C517C84107F4FED5
                                                                                                                                                                                    SHA-256:7354001527AB554C44E7D6981B86DD933B7DC2E0D3DC8512AD3EECD843245C52
                                                                                                                                                                                    SHA-512:818BC3690B01B30BC571E4CF45EC8D1AFCAECBAB003532644381F1CF730A5B3486862D08F7579B2D3D89167AD7DF35028881245C9550B0DA23D1F81A720A9704
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!...1A.Qaq.........."2Rr.#.t6..B..3S$4..v.b..Cs.%5..8..cUV.(.DEe.&Ff...T.d.......................!.1A..Qaq...s4....2r..S"BR.3....b#C$.....c............?..D.."}:......&&...?3..W.q*.......]...m.Y.k1......K).J...uV.b.../.0.E.H..4..W_T.[t.V.w.9.x.qe.L..o.oL.....d.\.....6.|.o...}..H{Yn..E...6Y3.l.e..D.:,.n.%...t...m.........,+,..|..n.....6.*...f........6.../$../Vi..H...e.f.F.zn.).n.E..2sTn.i...Yb?6+H&...Bf..*....z.o.^7[..u.:o....t.s=.....(.s.....f.g....q9o.u1L.N...smzE..[>...+\O....j.<....j.c.W.............U..+.F/.'..W...T./W...>i01./....j.s."..Q...{...a._~OW...Rp.)*.e..W..Q4)<..'..W...q...'..U..z..g......U}...O....w....0F:.N..V.3W.|..'z0.]...j..U[v..g$D.Lc[.e...UW.m0+

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000054.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.329553671676991
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:YualXsP8CTLskftVke5EHGKVXkWcx9A+j49rd3rUMx6ndXCVlZ7pN:YJsHXskf15EmCXfo9A+YRbMY3
                                                                                                                                                                                    MD5:0EA3C0D6E1A506C42FF4CC95594D3371
                                                                                                                                                                                    SHA1:E0DAEF8BC2D7668CE851B138C40E6A0A4184A803
                                                                                                                                                                                    SHA-256:2304698C78D2515C4976BA219F7B3349552CD9AD032672623C3C56BDB049807B
                                                                                                                                                                                    SHA-512:2B07708AD4374A4A224FEB1B3135437B6B58ED401983BDDCD7EBEDBE9F78FBF3352237B13465099781D42DF85039037DC37AABDA0DCEDCC3651F924A8862B0AF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZs.......s...,y&..W.|..s...,y&..W.|..s....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'............._\.......}..H.......N...^................l;..B..".p.C.........f........................................I.qk..B.....LZ............_\.......}..H..........._\.......}..H............s.......s.......s...........................................s..j....s..T.]..s.......s....B..s..H....s....B..s....>.)s....J...................;........4...4...4.."..............s...s...s....z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4.........s.......s......#s..............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000055.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 50 x 500, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2033
                                                                                                                                                                                    Entropy (8bit):6.8741208714657
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:P37XYSDTz+UUl7DHt7Ah8l1+4ZfFclFUXwobKXlZr:v7j3z+UoDN0h8ugf2AwobMN
                                                                                                                                                                                    MD5:CA7D2BECCBC3741D73453DCF21D846E0
                                                                                                                                                                                    SHA1:E34B7788498E33FFF0CFB00125E6BA9E090F6CED
                                                                                                                                                                                    SHA-256:E9EAD0BFC09D32CB366010CDFEDE1C432A2D1D550CB7332BADAC1BEE9482BC86
                                                                                                                                                                                    SHA-512:7FE2C3654262B1EEBED4F6D83DA7D3450E1BE52500A3964185FC0092041506A237A2728E5D7EEA0A3814E413E822B803B789C49CF744D51816A2E4EDE5B4247B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...2.........H'......PLTE........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................[....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.\.W.G...=a.ewA..a.!r( ...%Dc..x.x....N.OO...3=...S...........~.z.D.0...g.2P.7.*M.#'....z.......3TPj.Z.[5....V..z'L3...a.j9..C>..9.z

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000056.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.331472004340808
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:zYTNsl/2LyKUxCtQExEkJLQXH94fj41rd3rgx7dX59Tfp7hh:Gs+yKUxCicE8MXH94foRb8T7h
                                                                                                                                                                                    MD5:BD7405FB3DDEC6D07FD0CBFE8E904AFE
                                                                                                                                                                                    SHA1:5B304E783C3EE7B0084B1C2728403C2E2F7695FB
                                                                                                                                                                                    SHA-256:8FF0BBE29B59C451FE0812703E1A5E68D5CD2EDA656578F90F6E110A68732DA0
                                                                                                                                                                                    SHA-512:ADD96D9002EE94F0E67DB20E60BB8E7CD3265B10E2FCB025FC7FB8158219C6A2EFFDE7504E31443B2FB8FA51FDAB4CFCABD3697F9DB338DB75CB0EC59789D6C9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.J.......J.......5vUQ....J.......5vUQ....J...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............x.j.=.m..Z:.i.w.....N...^...............@......B.w.>*5..........f........................................I.qk..B.....LZ............x.j.=.m..Z:.i.w.........x.j.=.m..Z:.i.w...........J.......J.......J...........................................J.j.....J.T.]...J.......J...B...J.H.....J...B...J...>.).J...J...................;........4...4...4.."...............J...J...J...z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4..........J.......J.....#.J.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000057.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):55804
                                                                                                                                                                                    Entropy (8bit):7.433623355028275
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:gVvci05lhVbfBcWvBLeynluexaWqzww/u5:gVUZhHDljaHww/u5
                                                                                                                                                                                    MD5:4126992F65FE53D3E3E78F6B27FD49DC
                                                                                                                                                                                    SHA1:BC0D76B69310DA9B909D3EE4CECBFE5F386BFB45
                                                                                                                                                                                    SHA-256:3FBE3C1C238BD7DBC67F8CFF5F3BDDFD513C96A9851B9616477947D21DFF4B2E
                                                                                                                                                                                    SHA-512:624853F5E56D224C8188F122B2C4724F867D4099E7FAAFB9C945BE7E2907900ADCF4AE97AB08909CF94E96FB6F381E3B6396D560D93EB2731E4E69CBFE628F10
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d..............................................................................................!1...AQ.aq"2.....BR..8x..r#..9b....3....CS$.'.cs.......7Gw.(.4%5&..Wg.h......tEVfv..H..........................!1A..Qa.q...."2..u6....BRr.#...b..3s..d...7.Cc.$Tt..S4.5Ue..&..%.................?...,...8..{..S.y.N....%..q.8..H[5....o..xg........)c(.eO.YO..._D..x.U.....%.S.r.r._.^..Su.h.Q.t.:.#?....x..B.S...Q.....oqF..%..8'.qx....%.2JKjF..{y.w0.*a.RMb.c.Q{%....eW'..[IV..'ZW3...[...MN.....rO.:....$.i..7....Vrrr...I.r..M..Qo..j....q.^...N...J......%.J..)F...>$.....u........o...+......[...*..t....R}.I..R..S..GB..:......).6_[^Xft...F.1.....zP....,.#....MG.T..Q.F.....)Fi../.I...,%.voEb.b.Z..V3..FT.}..[Z{....wd.z.e.....QwW(.).t..\..'....:)<W.<..&k...caRT.X(..K.....:f...]...q..

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000058.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.454229981226856
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:Z25sU68nrC0BdEzXrf9slsRMz+8W8p/r:ks0r/6zXrf9slsRMz
                                                                                                                                                                                    MD5:2B7180C086EF989F468EAADB856D4104
                                                                                                                                                                                    SHA1:2CE7026BCEEFFB5C960FAFC33446772ED08C15DD
                                                                                                                                                                                    SHA-256:9432CE78BA3DFC778E890FD32B49BFC5A09A87AB51BD34D58CC7BDB2A904F9B5
                                                                                                                                                                                    SHA-512:1277170CF54010165E649F3B956BA85C1861ADDB757D7DA958CBE16C4B73795C25194E9E3EBB067161BBDA25B39EEBDE7BF9ABE412FCA13CCDE90983DF0BF76B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......n...v...b...................................................................................................................................2...>...J.......v................................I.......I.qk..B.....LZ.).......).L.._...9+.Q/..).L.._...9+.Q/..)...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'............. ...I...?...u1;....N...^.....................]G...(............f........................................I.qk..B.....LZ............ ...I...?...u1;........ ...I...?...u1;..........).......).......)...........................................).j.....).T.]...).......)...B...).H.....)...B...)...>.).)...J...................;........4...4...4.."...............)...)...)...z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4..........).......).....#.).............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000059.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:08:07], baseline, precision 8, 595x450, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):59832
                                                                                                                                                                                    Entropy (8bit):7.308211468398169
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:HS9SYFtN0+CRa9mfJy4zBAiIJhzrkHDV2hJK:yAmta+Tyy4zBIJW5WK
                                                                                                                                                                                    MD5:DCDD543A4E0BA2C1909BA095D46FFBCB
                                                                                                                                                                                    SHA1:B86C89537138FE07255354202D3EAD0B53B3C54D
                                                                                                                                                                                    SHA-256:28F334B77068F71F5F92A95695433B950610204A0E5580CE567DB8FAD4993ECB
                                                                                                                                                                                    SHA-512:5408C3259B7F3288A4BEB04342799AD5FE3A6F0EC7E92353B29B7E7E538DFA9903B39637226919E0421BC422635D25F5F8069DC7441864DC03E1B909BF5C2C84
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....fExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:08:07.............................S.......................................................&.(.................................0.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................y...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?......;R~+'....xh..~.n-}.......Te................^B..IU_....._...S......h.......!....9...A}6V=J......C..c.....Ug.Wh......

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005A.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.31006546384068
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:htsNAfzybCb0SWE2X0o93S0RMdG4fip20Kk:Tsm+I0S2Xh93S0RMc
                                                                                                                                                                                    MD5:8659A4F8ABE1EBB808BA1DC06FE9A4D5
                                                                                                                                                                                    SHA1:08898489841B78DAACD20E71D521988B0D95FDFD
                                                                                                                                                                                    SHA-256:EC157C2232430D98D43E12A958665ADF65E0C6370B121809EAE98BF377336B66
                                                                                                                                                                                    SHA-512:545F1A358EAFD5A133B8C361334611E27E049EA2688A3E0EC4E2EA1A508ACED3FCB38FCB3F7788562EDAF615AD0BC8008A125DFE1415F92D9DD8371F8429E090
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................E.......E.B..y...P...I.......I.qk..B.....LZ.E.B..y...P...E...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............uL.....70._.......N...^..................y..A.;....\.........H........................................I.qk..B.....LZ............uL.....70._...........uL.....70._.............E.......E.......E...........................................E.j.....E.T.^...E.......E...B...E...C...E...>...E...|...E. .3...................;........4...4...4.."...............E...E...E...z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4..........E.......E.....#.E.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005B.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):33032
                                                                                                                                                                                    Entropy (8bit):2.941351060644542
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:ofmqvnCfmqsp1Ue5xzMq+Qh0dffUmS0w5xzMq+Qh0di:AGAp1rmSl
                                                                                                                                                                                    MD5:ACF4A9F470281F475EA45E113E9FB009
                                                                                                                                                                                    SHA1:B20698DDA5E5AFDD86BB359A6578C9860D5DF71F
                                                                                                                                                                                    SHA-256:5DC2367A80588A7518DB5014122510BF0FD784711015EF83A8718336584F82D0
                                                                                                                                                                                    SHA-512:998B7DB9DB08FD15A293267E2371052E436E024AF8D34F96D3C8FF04B1316678DFC1674C921CB404121FF381A4FC39DC759E6698F19D42A6261CBD39469B0A08
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:....l...........................Ac...... EMF........$...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC........................F...(.......GDIC............^...........F...........EMF+*@..$..........?...........?.........@..X...L........................."B...B...B...................?...........??.....n............;...<..@<...<...<...<...<...=...=.. =..0=..@=..P=..`=..p=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...>...>...>...>...>...>...>...>.. >..$>..(>..,>..0>..4>..8>..<>..@>..D>..H>..L>..P>..T>..X>..\>..`>..d>..h>..l>..p>..t>..x>..|>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...?...?...?...?...?...?

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005C.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 3005 x 184, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12180
                                                                                                                                                                                    Entropy (8bit):5.318266117301791
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:k1bHyG/fKOOOOQJUg+g2S+kEm6alfsfsfn32:+bSG/yOOOOQ+g+gOab32
                                                                                                                                                                                    MD5:5C859FF69B3A271A9AAB08DFA21E8894
                                                                                                                                                                                    SHA1:3156302A7450ADFF4D1B6EC893E955D3764D4DD4
                                                                                                                                                                                    SHA-256:B4A8E9A67EE0B897615AC4CCE388FFC175AB92D9E192E6875C79A4E7C1B5BB6E
                                                                                                                                                                                    SHA-512:4CF518136EEBCA4F400A115D9B7BB0CAC9FA650BF910B99E15F04A259B7D3EFCFFD6796886FE09DB08C37C332B14BC8500845C09C8EAE1F2306F90E98D3C99E0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR..............;j.....sRGB.........pHYs..........+..../9IDATx^...dW...S=.dL$.............-.`...'...x.7.D...(...$.?cO....9S]=.v...Z.......{..wNuf.&.....a.k5~...._..\.yk..v.....}{._.Q...5...._9o.n.....}7.].1v..t......q....3.<..0<.p.......0....s...... @....... @....... @....... @....... @...X.'..U-..... @....... @....... @....... @....... @......,I......+..... @....... @....... @....... @....... @........z...r.. @....... @....... @....... @....... @....... .$.C.KJ[.... @....... @....... @....... @....... @........&`.=X`.%@....... @....... @....... @....... @....... @....../)m.. @....... @....... @....... @....... @....... @ ....`.)....... @....... @....... @....... @....... @....K.0.....J....... @....... @....... @....... @....... @...`.....\.... @....... @....... @....... @....... @......,I......+..... @....... @....... @....... @....... @........z...r.. @....... @....... @....... @....... @....... .$.C.KJ[.... @....... @....... @....... @....... @........&`.=X`.%

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005D.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.359078600272797
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:AsYuYDzE6t6s0qEPEczowLMRBXrg6SB9Ys4p5vZrdMrwhcPgQXi49oah:AsAfE6EsnEsAowuBXpSB9YdhRMwggY
                                                                                                                                                                                    MD5:B9D2A99C226913D8049CC0AB53A38F10
                                                                                                                                                                                    SHA1:EA5AD36AB080BA12AB1178FFFD305C4240AC1C4E
                                                                                                                                                                                    SHA-256:0E51BA0E875D80E932BD11346AC21BC550E0B8578F214DC42FCB81FCDA16ACE5
                                                                                                                                                                                    SHA-512:D5ABE7DE6B176BFBF261C03BB50898A67F43286ED2E793A3321D7208E9825C962835E1626882B0584D0F0B9C08542B2B674886AF2316ECC2E76CA75152E23B4A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.-.......-.5O;....[[q.*..-.5O;....[[q.*..-...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................Q.14.........N...^...............d.g3...C..}no...........f........................................I.qk..B.....LZ................Q.14.................Q.14...............-.......-.......-...........................................-.j.....-.T.]...-.......-...B...-.H.....-...B...-...>.).-...J...................;........4...4...4.."...............-...-...-...z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4..........-.......-.....#.-.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005E.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 39 x 600, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2104
                                                                                                                                                                                    Entropy (8bit):7.252780160030615
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:2PPEOtz2P/LJtVRaqBG8qFOPvHlcEXgkuwf+j:2PZFSjJDjqFOPPlXgG+j
                                                                                                                                                                                    MD5:F6C596F505504044DF1E36BA5DA3F09B
                                                                                                                                                                                    SHA1:BCF17EC408899B822492B47E307DE638CC792447
                                                                                                                                                                                    SHA-256:EDBB86F160050FBF1F9860276802BAE292DBFD0BC98E3EA90D43D981E9F0C54A
                                                                                                                                                                                    SHA-512:E8D067A1932CED8746FE7D665EEC34EA92A98AFF3DF26FFA9DD02742DDEA3C5654124A88A649FA33DB596F96A5FC9CB2C693D03132F1C8B254ACB56DB4763BD8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...'...X.......:....PLTE.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................{.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^..c.%i.F...m.m.f.m.m.m{&....X...9.....M.WUW.d.N.O...E$...$...)H....n....N.k..v.....v1L[w)w.}..!...Y.X.V.D.......[....;..[..;....

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005F.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.348656919121389
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:VMs2svCWDUXTE2zXklW9Nv4RMt4QvCCw:VMsxvCWSAOXuW9Nv4RMt4Qv
                                                                                                                                                                                    MD5:43214806250CEC8AD074B5C0B695B8CB
                                                                                                                                                                                    SHA1:C1F859DE8C96357EC4E6DCA19D61CF4A0B1D6AE9
                                                                                                                                                                                    SHA-256:43DF2AAB8F74B769326EF571813C56DBCC055B2DF6B0D2F9F1390B9C0E554638
                                                                                                                                                                                    SHA-512:91B64EC50CD5046B34121B3CFEE1C31F910AE3AC2EEFEA0259B16D4046752EC4798A3E8C67A265DC7E1481B871E09EF2C19A739C01216116FE7B26ABC6402308
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ<......<.........1j.<.........1j.<...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............#lm.L....?FD8/.6....N...^.................$!.JND.O..%*&.........f........................................I.qk..B.....LZ............#lm.L....?FD8/.6........#lm.L....?FD8/.6.........<......<......<..........................................<.j....<.T.]..<......<..B..<.H....<...B..<...>.)<...J...................;........4...4...4.."..............<..<..<...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........<......<.....#<.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005G.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):14177
                                                                                                                                                                                    Entropy (8bit):5.705782002886174
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:EbgGcV/hlvpfal7rgYa8S7auAxwfuSTmCSNoFQ6NO7L:EbgGcVnpwimnd38FdQL
                                                                                                                                                                                    MD5:7CDCE7EEBF795998DA6CAC11D363291C
                                                                                                                                                                                    SHA1:183B4CC25B50A80D3EC7CCE4BF445BCFBAA6F224
                                                                                                                                                                                    SHA-256:DE35AF949D4F83E97EE22F817AFE2531CC4B59FF9EE6026DCA7ECEBC5CF2737F
                                                                                                                                                                                    SHA-512:560FB15A9C12758D11BB40B742A6EAD755F15AD10D6C5DEBA67F7BC8A2AE67C860831914CBCBCDED9E6B2D1D5F26A636B9BCEF178151F70B4D027316F94F27E1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!.1..A....Qa".q..2.....&...B%6.'..R#3.$E.r457bS.DUFV.Wg(.......................1...3.Q..2Rr....s.4.!Aq.S.aC5B$%............?...n.Liq.}.{#....3/gg.1.M +..~3...q..+=..:.g.i1;P)7.....q..n.s"p...wx........v.t.f;..L/..~....y.r[.r.....n.n3..6i..g..}../........3..x.L.i?We..l.......~..<.;..6..o.....N.t.o6.l..~.......<...m.V...Q.7k.u./wq.t..;.I...}..{...>.L..3m..a....yd......6~.f..~Y..}+..<.[w..'-..?.v.7...v.u..4.......1];..u.MO.......s..p..ms.'.O-o...O......m.k.e....)t....i>..E|....,iOyD|.{......g.n...cu....=..........h.\.Q:?g/?.I.3._...t...d.n.0.%y....S.Q....S.&K.w..&wY<....%.g.v.....$y..#,i;.=...t...I6..yO..o.d..w\k...~......)..rK.......].u....N....e.s..kU.u..'}

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005H.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.340523492187993
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:e1sXf+HkefKstmcEYXL7oRcX1Vc9sqsapy9rdMrpIjCFX049v0p9qx:gsGHkefKs5EQWcX1Vc9sqHgRMeCx29q
                                                                                                                                                                                    MD5:75E5EA25B98CDBF2944173FDCDA52E4C
                                                                                                                                                                                    SHA1:68E87E4587F82A61A2EB845D923AA7024EA480CF
                                                                                                                                                                                    SHA-256:883C1B25D87BE2C926329F96733AB25838DB1F793DBB63C59D5C2AD4B070B9B0
                                                                                                                                                                                    SHA-512:35368376474D2ECDED3C5732AAEFAB65046F132D72D3047F5960E79BB99C874191CE393240C8E4E6AE72076EA9F0992FC3FB835375881BB3D6EEF1F45D4FED44
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ..m.......m|M}..'.#.|..{..m|M}..'.#.|..{..m..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............`..8.\a.....M......N...^...............y..[..fH.%....r........f........................................I.qk..B.....LZ............`..8.\a.....M..........`..8.\a.....M.............m.......m.......m...........................................mj......mT.]....m.......m..B....mH......m..B....m..>.)..m..J...................;........4...4...4.."................m...m...m..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4...........m.......m....#..m............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005I.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:44:07], progressive, precision 8, 611x163, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):36740
                                                                                                                                                                                    Entropy (8bit):7.48266872907324
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:3nwDxjTvoE0Rjwit4rjucDILWg7/Da0JgGQ8e1S8SA/Khos0:SxjTmZw7nucDILj77a0JgGQvScb
                                                                                                                                                                                    MD5:9C205C8D770516C5AA70D31B2CA00AF3
                                                                                                                                                                                    SHA1:9A1002F0CF7F92F1BE2BB25BAD61CEBFAC282482
                                                                                                                                                                                    SHA-256:E111F96490755C7D71E87C88ACAEA38AFE55BB865B1A14A83C5BD239648D5E2C
                                                                                                                                                                                    SHA-512:A3E105208B32831265428572B0937DD3C17B793D8611B2DA8D4939F1BEC6050999D375E3F6B87D53AD49DFA0EAE737B0141D37597AA42116C310761973D4A134
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:44:07............................c.........................................................(.....................&...........n.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d................................................................................................................................................."...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..o...4.gP.~.c...K{...V.=...].<.........vS.........s....(.t......X......kk7....~-...yF}^c.Z.\.G./.?t...>....:.>......./.ib..).

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005J.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.434639305748568
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:LRsv18Ce0umgqMtmoypxELLC5XlN9NsapylrdMrreExFXUcskPOBHU0g:LRs7u3vUxpxELaXf9NTIRMrVU00
                                                                                                                                                                                    MD5:B1B14E5069822B419E69C94B33D6FA42
                                                                                                                                                                                    SHA1:CCE60887D412DD944B18998F4343A98431EEE11F
                                                                                                                                                                                    SHA-256:99D0166CBE73DB2B03C10D60B47B478EC3A0FBE5755F62A46EBB52BAAA55793D
                                                                                                                                                                                    SHA-512:4A8C6F30664D3F9E206E75AB370D604A4EA832301E4BF8B968E11F2FE66A9A3A30400016F2BFC152CDFEF5EAADB5B31F69220CED5046F0F4A2D7338D22E97A68
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......l...v...`...................................................................................................................................2...>...H.......v................................I.......I.qk..B.....LZ6.7.....6.7...6."u!}j.\t6.7...6."u!}j.\t6.7..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............t=.f........s/J....N...^................l.#.w;G.....i.........f........................................I.qk..B.....LZ............t=.f........s/J........t=.f........s/J.........6.7.....6.7.....6.7.........................................6.7j....6.7T.]..6.7.....6.7..B..6.7H....6.7..B..6.7..>.)6.7..J...................;........4...4...4.."..............6.7.6.7.6.7..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........6.7.....6.7....#6.7............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005K.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):53259
                                                                                                                                                                                    Entropy (8bit):7.651662052139301
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:dCiCBBenRYWDBCipMYGTbYGLHbXxoP/qEF+MU50qyJ30h2W474S/Aq/xc4674bi5:dCiIQXBCiwbDLHD0/sFyVel4Pi4UgE
                                                                                                                                                                                    MD5:2EE369ABB7936F8C28FF0ABDD224EA05
                                                                                                                                                                                    SHA1:FE9D304A7B49E31EAE439369ABC548E265149636
                                                                                                                                                                                    SHA-256:FB12D59B8BE911247BBAFDD416852E8B74B028005A141CB4DBBBA109B4B6ED2C
                                                                                                                                                                                    SHA-512:5CF396CA472C32AE988600176114106CB1619404DD899A3867A5AB43DC90583B771EF69B14EF50E56A21F038BF51D8463C6ADD2DE9D4CB523F6290E24A4DECB3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..AQa....q........"2..R..Bbr..#S....3$.....C.4v..(X.DtEUV.....cs..Td.5uf'Wgw8Hh........................!1Q.Aa....q.2...."R...r..3.t..U...B#S.4ub..C$d.5Ee&'7c.D%sT..............?.....?...k,lk^...M".Yo5.Qp.&s}b.m.:...W.x}.*.a......N1..d-n.-..^..b..TZ.W..."....F....^......ve5...^...2.:i...........~u2pK.z./&..u..L[I....Y....@y{|>..MN=:....Q[..H....a........|%..4fV....).....^.9b.f...F...p.=.W...aZ.........Z.t.n.....z3..[..lVh..\.N-.._.sK.y.._e.G.jig.a.7^....u...*.p.5.a.].........u/u..D.yl.XA..f.z..~.x.....N.....b=.uv.2.t.'.N.-.H..n.v.a.A[.Z.....T2...._...:....h..l.E..sm..a.3I...RE...fWb.Ek.0.#.)..Y#T...........u{....U....s.].7_H.2.`O6...P......}..4LR....]4.mid...

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005L.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.319524164022326
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:Wsq4Z1/it5r/nTEXDJxGXxPD9COswQxpy5rdMrZH0FXbD9KoldAMF:Ws91/iT/TEXqXVD9COTQx0RMR099j7
                                                                                                                                                                                    MD5:7E6271284FA188A2AE31D0D80AE91F50
                                                                                                                                                                                    SHA1:11E2271458159B38FDE2464B2487038B54896A96
                                                                                                                                                                                    SHA-256:B165CF780506BC4986ABB172E7CCDC8083F27564D54A39D240E1A6B85F30B043
                                                                                                                                                                                    SHA-512:25EF6DC40762DBF70D670D0DBF99FA39FC4D996E2E6B9A4CE43CDCAC2B1F88EE3E9F11DD255C4B1A07B430793080783F1DDBC35866D1FA22479D85F311675D8E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ..q.......q.....=A..&a@S..q.....=A..&a@S..q..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............uJ@..'..0A/H.....N...^...............g..C...H.Q..8..)........f........................................I.qk..B.....LZ.............uJ@..'..0A/H..........uJ@..'..0A/H............q.......q.......q...........................................qj......qT.]....q.......q..B....qH......q..B....q..>.)..q..J...................;........4...4...4.."................q...q...q..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4...........q.......q....#..q............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005M.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):60924
                                                                                                                                                                                    Entropy (8bit):7.758472758205366
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:kU7O7+CFqO6DkxTgPzo2wqggrrX8QvN1I/ZLBttB9+dPFXbc:hVuqJDaTqo2wq1L84N1I/Z1tT9X
                                                                                                                                                                                    MD5:D58C51D2CF586A5E14A9EC8529C3B0A8
                                                                                                                                                                                    SHA1:F4811A353797C29B1E3F5A61B125C46E1534D587
                                                                                                                                                                                    SHA-256:F927C7825851974A2149868146970706523A49165133CEE6027A43E8C9ABDF27
                                                                                                                                                                                    SHA-512:34B963173AFBDF07432F4B983D29F10376E4771FE666E9D50B1A81DA0B9F6001FD86B4A08B9711386DE153BF6E03C8E932E2D181C8EAF94EFF34D20FCA7570E0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d................................................................................................!1AQ.aq....".....2B...Rbr#.s.4...3$.5u.6v..CSc...DT..f..t..&F........................!1..A.Qaq....."2....B.s....Rbr..#4...35...CSc.$...DTdt..%..............?....O<......X.O.Fg..{.W&u.u.T~.|r;g!.._X..N.p.4.........................................................yK..xd...6..|%....\j..e.=...Y..f..I.|-....e...$R.j.......~.W#....{.....V.k.|F..z^..:.~..f......"x.....L..K..r../.;..[..l...;.U...W...X.........8.....y?..B...m.......j..Q.g3..G.K....GL.o..n7a..Y..[.'.........x........\......~...f...0\Wc.n?k.|.....1.ww;..2..?...r4uF.MXdB6..W..mG2NJ.E........u...2.q...Z..=(l)jU.X...U.\X.......O<......X.O.Fg..{.W&u.u.T~.|r;g!.._X..N.p.4.......................................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005N.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.32828272512874
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:wsBDmD8kE7MtaHEJtAcXG99psPpy5rdMr9dRUFXxxM9xk3WpzFPl66:wsn7MmEBXc9p+MRMyz8l6
                                                                                                                                                                                    MD5:D2A03C7213BE08C59F4A7E6DAEA5A66D
                                                                                                                                                                                    SHA1:2057F62BBDE0E474E6717E721C8274C19BDEECA6
                                                                                                                                                                                    SHA-256:92F0049A7233B4E0BF60C88013FE3CD9410211D2BC4202109815EC7CADC81153
                                                                                                                                                                                    SHA-512:DEE888129694623CB8DFA0F6547815D59605DE02687F039F2ECC8CA98F0BADBD9C0B0275363DC4CFBF02B46BFD51EA5ACFE2925028EEE6F64607C0C7EDBC5FC6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZm)......m)...0.(,...1.zm)...0.(,...1.zm)...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............0'...iB.?.'.#u.7....N...^...............f6sL.1.O................f........................................I.qk..B.....LZ............0'...iB.?.'.#u.7........0'...iB.?.'.#u.7.........m)......m)......m)..........................................m).j....m).T.]..m)......m)...B..m).H....m)...B..m)...>.)m)...J...................;........4...4...4.."..............m)..m)..m)...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........m)......m).....#m).............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005O.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 39 x 579, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):515
                                                                                                                                                                                    Entropy (8bit):6.740133870626016
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:6v/7su2/c30mqkg9VgFHe7Ll8UmJX/N+1Zmkk8f3lbtI4:4mc38gFHe18lkk8f3lbth
                                                                                                                                                                                    MD5:E96BE30D892A5412CF262FEE652921CA
                                                                                                                                                                                    SHA1:8190A0BFE21D04BC6F3A406E91B87CA69C03A2DE
                                                                                                                                                                                    SHA-256:0E31DA4DFCFF4A36C64C1CE940362D2309769F36369E4C43C317D5F2FA15658E
                                                                                                                                                                                    SHA-512:D647F51ABBD013226A6ADD0D551D058C633F867F9AF5A9E099B85D6E291D220F7B85958B07381CD4C7C4F72356DBAFE2A86932AE398E28C56CDDF0744E92EE24
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...'...C........b...`PLTE..................................................................................................bKGD....H....cmPPJCmp0712....H.s....9IDATx^..I..@.C..<..?mo.#C((.J}...~..B...b.I.i.\<.e.....(p.I.EO...q.x.......dRz....K..b0.:.<c.o..0.x\:...F....I&..ap....."P@....DO...q)p*..@Y.CL2)=......1.........4....._.G..^`..lDO...q...X....SL..z....K..#.L#..I6..ap.Ls.,....7&..ap.p..lI...,GO...q.....k.n1..4......3=.f.x.$..4.....o....x.$+..0.x\.,&6...............IEND.B`.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005P.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.366459686374186
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:isr0mFjmn/iRS7tca3EPA8HnBXLHB9+6sZxpyxrdMrRp/2FXvAEs6+kYSBErzTIg:isBjI/iRS79EPFXLh9Jwx0RMD/2NILA
                                                                                                                                                                                    MD5:80608DDAF7352189928EA9641A515B65
                                                                                                                                                                                    SHA1:866E7F78EC4EE08D59378A11AF57E34CFAB10E54
                                                                                                                                                                                    SHA-256:F7A392C5C574F2BBB2FE8BE8E25E61AEBA12B704CFEBE31368E6FDAAAB92884E
                                                                                                                                                                                    SHA-512:CE05487FDABAA45297B234D0DF100B1F47B9AC6F639A4E451BB89229487D08A7C6116BFA257B3190397B7B2914F93AE89B70F5A1823B0FF2B852137E437B020D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ.q.......q....7.B.w.-.q....7.B.w.-.q...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............B.3sd. D...`.}....N...^...............#JB%.eRO...W...\........f........................................I.qk..B.....LZ..............B.3sd. D...`.}..........B.3sd. D...`.}..........q.......q.......q...........................................q.j.....q.T.]...q.......q..B...q.H.....q...B...q...>.).q...J...................;........4...4...4.."...............q...q...q...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4..........q.......q.....#.q.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005Q.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 30 x 700, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1547
                                                                                                                                                                                    Entropy (8bit):6.4194805172468286
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:dZeDNYbS+238CTUFPA6SXG5qSacX9q73eXu0vC3dU+OB2gbwHRuZ:dykp9FzBBacXQ3uNC3n7xuZ
                                                                                                                                                                                    MD5:0BA36A74DFBF411FAB348404CCEC3348
                                                                                                                                                                                    SHA1:4C619790E517416E178161028987DF1CD3B871CC
                                                                                                                                                                                    SHA-256:2E7AAF26BEC32148B96442E8FFF1BD2CEF2D72630969F23B9A2ABEDB6CFEC93B
                                                                                                                                                                                    SHA-512:90AF53DB7C413E2ADB970AC345F73E4ED8AF626E179C929E6560118F7A9E98DC7C5FF02B2B3F6C98D397E0FE2D85F3427C6928C328872149E176FA8A99E91F54
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...............\....PLTE.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................D......bKGD....H....cmPPJCmp0712....H.s.....IDATx^.WSTA........b.0gPPP0..E.9b@L(.c.N.U>..@......;...}..B.(....$......5..XS...I....).!....D^.uE...\..5........F."o..-...m.n. .^.....q= .

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005R.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.31111723782572
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:IvsPpggw2gCJnEDXv9WkYRMuWEZgtwMx3Lw7:CsPpgP2jJEDXv9nYRMZMgthx3L
                                                                                                                                                                                    MD5:401C9F9B49C457A47795E5850747E0BD
                                                                                                                                                                                    SHA1:1292E734720DBB6C2B11E43E308999C504E6B34D
                                                                                                                                                                                    SHA-256:70C7A700418550BD16E544B6031B0BA4BF7F93BA29AE933EE38A1549687C9101
                                                                                                                                                                                    SHA-512:F8C6C159833763C24FBA7688DB629ECB85A089521B107FF5F16715FF90EAA91A66A5B4B58DE2CFF31CB21E2EC4707B2AA25F1115E571B176B998DB5A1FE81299
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ..X.......X..{........F...X..{........F...X..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............i...rK.....w.......N...^...............0.4..LG.V..Z...........f........................................I.qk..B.....LZ............i...rK.....w...........i...rK.....w..............X.......X.......X...........................................Xj......XT.]....X.......X..B....XH......X..B....X..>.)..X..J...................;........4...4...4.."................X...X...X..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4...........X.......X....#..X............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005S.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):95763
                                                                                                                                                                                    Entropy (8bit):7.931689087616878
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:EoES7mhTyzabUaE77xAOmq0zVruQlttNxlipxVWssMU2YhRy2v6pKKYhQzwMc2:zz7mhTyzabUa4b4xuQlttnlGx8x9h02M
                                                                                                                                                                                    MD5:177DD42CA99CAA2CCBF2974221680334
                                                                                                                                                                                    SHA1:35FD86B3DD082A6D4930C67BC0E05D3B5817465A
                                                                                                                                                                                    SHA-256:525A857D0EDA855A64D3619DF58B1C2D013A73E60FA0D49B155ECFCB2C134C7C
                                                                                                                                                                                    SHA-512:6FB6D9A6C97B1115C3246690A2F339CD612899AC25ACBA00296EAEAA0A1D094E7339D670969764FE23EB7C08FCDD01C6F78FBC0735D504D5E02AD342901719B3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!..1AQa...q......."...2..B#Rb3..r$...6..C4....Ss%5...tu.c..Dd.EU7....................!.1.AQ..aq......"r..2...4Rb#3$B.Ss............?..H..dV....U..-..0]Cp.%O.Z.Y.e.=/.q.....j76.w@s...5.&&&5...n..w..>.1....;.vR..[.......=.......KtY]u3.g18...).r....&.IZ'.....g..4kY..X..b.......y<...r1........e.._...X...w....op.m%Jr31...S.Vo.._....OI\]....F..V-....\...2j..X.....y.p.$4.....&#..]..n.V..x..P...F..C.f....])..~..Z\.....,..#..v..v...2V.k.SuaydO../[.*c._..oTV<Z.s.[...o.x..>....-....v...#....-.X..L.Z./#.XG.-.0......%w..H.@aZ....C.}...N~.;..R......5.D......I.... .R........s.>..ks....(...S...9....2=. :^.. p.+?(....$..Q..I.........=|..`2. v..t......U*.8.u.. ...'...*...2;u....& 3..$.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005T.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.330392645049963
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:+sW7RFCUetWPap9XEyLgmvXuHEb9FU7pytrdMrOzVQFXhBeNIFJ:+sGFCUeKa/Ey00XuHEb9W7gRM+VQme
                                                                                                                                                                                    MD5:57E60278AEF81E82039A0F65E4D94EAE
                                                                                                                                                                                    SHA1:9E2D97B32F9B30AC7CD128EEDBF854180294B8D5
                                                                                                                                                                                    SHA-256:E0CF18553581AC7B2BCCF2E4B75DA68418A3BD04F3A5B6CA7B908E9E4845F638
                                                                                                                                                                                    SHA-512:D50758343C16473FA729ED954E15004544FD768D89F377AF59B23714BE61F4A9EC5A5AC48036F9608E4F7D3BB41CCD1123FEF3F387CB4FAC2F0CFB4F0B606014
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.Z......Z......0frm..3.Z......0frm..3.Z..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............c......'.n...^....N...^................&.J5#.O..a.............f........................................I.qk..B.....LZ............c......'.n...^........c......'.n...^..........Z......Z......Z..........................................Zj.....ZT.]...Z......Z..B...ZH.....Z..B...Z..>.).Z..J...................;........4...4...4.."...............Z..Z..Z..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4..........Z......Z....#.Z............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005U.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):67991
                                                                                                                                                                                    Entropy (8bit):7.870481231782746
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:3PC0XJjsmsKuZRG1pXuZ6z3wARnV9AEnieCc7cllJcHJ:qyMBzkUZ0gq25c7Z
                                                                                                                                                                                    MD5:1271B1905D18A40D79A5B9DB27EE97EA
                                                                                                                                                                                    SHA1:9618608FBD7342DE6C71220A36C3F4995BA9C13E
                                                                                                                                                                                    SHA-256:5B321A4D81BD499B289B1755F6450A42047C494DFBC112DBD56DA4CED2C15C1A
                                                                                                                                                                                    SHA-512:C32DD26047F6B8AA061085B38AC2B8335868E1BFD8731DB65544309223A955FA4BF45B06AC8D244408658F51A1775B6F19FF0FFC804989DE706DE8EB36F1436F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1..AQa..q..".........2...BR#b.r.3...$.'...)..C%7gw..(.S.W89.......................!1.A.Qa.q".....2...#....B.t......rc.$%67Rb3s&'CUu.v....S.d5.V4T.e.............?...?..Wj.e.e.......w/..E..eOw_.....6......u..C6h.,..;.g.D8Z..-)O..jy..e;.u.g..w..[.L""k'w.......'1'.[......=..P...S.9a.V./O....q=8xk]...........9......F...e9'....9.O.... .&.....p......c.4...mr...?.......L..'.....0....+..|_...POM=7.?.2.a....};.Z..y./....>./.C.<...;.....|.1>...........S.8.o.O...+..n2...k../.X..9...Y...:.....\...Dk......q.K..\.Wuh.!Z?.mu...R.5.A.S.h.0..[..v..+M.....aUi*.k..?#..._...X..R.&]..[..;../]L..f..V......*.e...ut&.#.J.5....c%..o.$..v.<K.6..T.IP.....6X.*.uf..t0^..-.)m$.!.q(.j.f;..WB6.b.B..R.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005V.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.341491427501756
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:YsdLYIgXl02+ztMNEEvlLo/XDc9RUG7pylrdMr7k/PdvFX08og9NXlqekViwlLo9:Ysuv+zxEd6X49SG7IRM7EPVHp
                                                                                                                                                                                    MD5:47FD11EBF524416469F1C13886A8EAFF
                                                                                                                                                                                    SHA1:B83AD9EE1EEADF1650B8E365A10C78D97F5BF700
                                                                                                                                                                                    SHA-256:9620761674AC6B955D863BE06B84931600523C6C6298E298030377F9027F8D26
                                                                                                                                                                                    SHA-512:0B11D56D6EDDCA543060AD24FEEF568046F9E4E6C0009354973839D4F1D57DCBE5E5A24E3697DFDA9E76482D7F7FB315B481393376181BD7B1247464F01D024F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.........................................I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................g.z...U..._....N...^................J.gT8{M....>..........f........................................I.qk..B.....LZ...............g.z...U..._...........g.z...U..._....................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4......................#..............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000060.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:06:24], progressive, precision 8, 38x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):22203
                                                                                                                                                                                    Entropy (8bit):6.977175130747846
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:5q3R1VBvq3R1Flrk6Q0QPJJrR39joOVMJ25d1NkMhIwobbtAAAqYnLJZMJYZ2AC:xw6Q0WJR3FoOVMJIIlAAAqYnMJdD
                                                                                                                                                                                    MD5:2D3128554F6286809B2C8E99DE5FD3F6
                                                                                                                                                                                    SHA1:FC42CB04151D36F448093BDEFE33031A9B8D797D
                                                                                                                                                                                    SHA-256:14FA2D16310485AA1CE41F6D774A3D637E8CF8B03C4F72990155DF274FDB6BD9
                                                                                                                                                                                    SHA-512:D8531247A6E89ECABEA9C4A78F596CCE3493334EDF71AE4F7998FDDD0F80705948609C89756AB56FDFAB6D04DEC5F699A693801A772CA2EE2465BDD2CE5D2D5A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....XExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:06:24............................&.........................................................(.....................&...........*.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...H.....Go.Kxn.b..g...........%?_....O......q......7G......%%.V..8zm.].v?...jJ~._..>.......O;........o..rI.A.....n.a.........

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000061.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.422696057964803
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:eAsAxunucRMh8EDuX/9Se4RM8viP8rfz8m+ZZ:eAsmcucWDuX/994RM8o
                                                                                                                                                                                    MD5:01F135C6450399A98BC2228697FECC1F
                                                                                                                                                                                    SHA1:54A548E65C4E1956E6D632DF3300CDDEACF546B6
                                                                                                                                                                                    SHA-256:42612214CC6BCF038DBA49FA379C0B784FCD197C9F6DE208BD242B99687625C8
                                                                                                                                                                                    SHA-512:0EB4600BAFD386A58959EC1AD8CB9CF06241984ED9057C558FE585EA2DBC50317078BF4902922406B045810104B828ACD34E25E6929D62AAAB46C60014E88494
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......l...v...`...................................................................................................................................2...>...H.......v................................I.......I.qk..B.....LZ..".......".f.....N.A.>...".f.....N.A.>..."..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............#...9.....k<kc....N...^.................L..xBJ.....E.........f........................................I.qk..B.....LZ..............#...9.....k<kc..........#...9.....k<kc..........."......."......."..........................................."j......"T.]...."......."..B...."H......"..B...."..>.).."..J...................;........4...4...4.."................"..."..."..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4..........."......."....#.."............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000062.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):15740
                                                                                                                                                                                    Entropy (8bit):6.0674556182683945
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:Elv3GG8/OOs+GouFdxMlxjoPyerzkpuOo2vPMc62PaJseZC+BJoS/:EtNiwdxMlZoPhzkpuOo2PMc6rX8+B6+
                                                                                                                                                                                    MD5:FFA5EC40DC9A0FD10EB9E6355142D6A6
                                                                                                                                                                                    SHA1:3D3D6A7E086B3C610C08F1F3E3F883604F06F2A4
                                                                                                                                                                                    SHA-256:D74C3973C8D1F7C77274691AFB1AA934940674341D7EEE563BE75E563281BDFD
                                                                                                                                                                                    SHA-512:6FAF2A24D06E6008F3579C7CEC90C2887462BDF83FAD7372FBB74B8DE90340B580E9836F309B68A9794597A598F7DCDA661C9A58DA6D8187C69083B7A17C9CD9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!.1.....AQ..aq.g..8...."r....2.FG..#.E..7.Rb..Cc..D.v.B..3s..$d.%5Uu..&6fW'w........................!....1Aa...d..5e.6.q...Q..."2b.c..r3DE..BRs4U.#C.S.T............?...u.&0...cV.T.I...1..=4....Ce_.g.q.=F.M:>)...k..pm..h..=........S....)Ja8x...b.).=5.q..0......k.M.....1?-.G.b&.5..Ep.8t...'...R)..ta.F$bXO]tW.b.6#.t.XWN..ZW......].....G....x&&f..'L.....7...\...'.8...~`.sa...............................................X........qo...SMk...'.V...i..hb.}&?/.k.:>l.^....>Y...<}...&.jY.Gn.MKejyV......D......gf.0....t.nw..XQ...H.B.....=8.UkR.....Hm..w..]...k...#Z...F../.gjWvf.....w.aZ].2..5..^...VZv..._.7..a.|...:.B...,f...............~....m.;_.....-.e.y.w.[m.].bu.b.f+.E++\.....Y..7

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000063.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.309203156720785
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:qsEUXJ9qBEjA3X4W9K3ARMEk+sWXQsIFwi:qsEUXJ9LjA3X4W9kARM0sWXQsIFw
                                                                                                                                                                                    MD5:CD83BBDF1BD369D854BB19B603C9DE96
                                                                                                                                                                                    SHA1:6E46606215E69D6FD1CE537BFAA0BECD12A1319C
                                                                                                                                                                                    SHA-256:D73879F65B2F4A3B87F0DBC3E5D8A8618A5A268BD2B03AB95416BAF7B03862D9
                                                                                                                                                                                    SHA-512:E89E0B71C6211436D82D7EAEFC42395F5830EE9CE082C74DB1FFCA654A3A886C8D462C37090E27602C7B82F90CF5195F65DE2E36CDA03FB1795552040F95BF85
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZAIe.....AIe.Q...7.4.J..^AIe.Q...7.4.J..^AIe..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............Dy.\Q.B..b....6....N...^...............a.2G..[E......3.........f........................................I.qk..B.....LZ............Dy.\Q.B..b....6........Dy.\Q.B..b....6.........AIe.....AIe.....AIe.........................................AIej....AIeT.]..AIe.....AIe..B..AIeH....AIe..B..AIe..>.)AIe..J...................;........4...4...4.."..............AIe.AIe.AIe..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........AIe.....AIe....#AIe............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000064.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):86187
                                                                                                                                                                                    Entropy (8bit):7.951356272886186
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:AbmHwD7za0syWMetp3TdPFzoJamVdAQZCiUit9qbYN6LerhWMzIWgN1EeaYhJM:1QnzsyTeP3TPAdAQZCi5qbYEKrhWWMNO
                                                                                                                                                                                    MD5:FEE4785DF76E93A9DC2F4501CBAEAE12
                                                                                                                                                                                    SHA1:8FB4527BDE05EF208FCDB168098A07707C27501F
                                                                                                                                                                                    SHA-256:F091DED5E283AF6848670A3172E7C43C6099875D39B3FC69C2BDBA914F609602
                                                                                                                                                                                    SHA-512:7E99D33151A0D3873D6A819C98EA8E62D928C087B7BA2080F11C7BCF746AD60A44D4FF6EE3D2D2E8DFA4BF1FC6285ED56BB83F91C2FC6FC4FDFF2000105F10B1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................1.!Aq...Qa."...2..BR#...br......6v.7..3.CSc...$4.s..&dt%u.f.......................!1.AQ..aq........"2.B#....Rb3..t.5u.67.8.r..$....C4.cs.Sd%.DEUe&.............?............w.....c.....i.A.....3...7.......7..P......%.........?Th..l./?.;.....$}..=5Oa...F.c.A/...D.D..]..y..3e.5\%.fo2.X.*]q.5Ee.}..i..md.T....#...-...Mu...9...-+..~w5O.);..G..'.;..).....A_...M.vV..y.q......,<.3.(...._K:..XM.......w.......9..T.......?b..a-%.c;.}..>....|.,lZKCEB.t...fw|.Sw^..Y..:.J.................t._P..v..j.1.R8.R....G..W*H<(Xi........i..xcu...WM.dqM>'W..g....M.q.....+.....b'..~....>..T.~Jc....fj.X.x..9...N.w.6:..>.......&.(h..u...t._...)_k#7Za...cZ....P...Y..;.V.,..xo.....f........Y...\6...M'L._

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000065.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.68130634150897
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:8sKNwwgxc6xEtUFJVXs92HIRMZnwuQBBwo4NLE:8sKNwwgq6OKDVXs9AIRMZnwuQBBwPLE
                                                                                                                                                                                    MD5:4D0935B3F5238C4D067F324EF6F56F7D
                                                                                                                                                                                    SHA1:0A9526ED7D2A0F611283561A192A1B51249E0D4A
                                                                                                                                                                                    SHA-256:B271C9D08327C2B0EBF6E36A46CB914E15CD996AB17E9A8032F7A8FAED80681E
                                                                                                                                                                                    SHA-512:FFFB370FA5B9758D4BDEC9BEB294C24971FA113571A3466DDD68D3C72A35E38CF52E5110632FDC713800172996FB26B7B5DE8C903415AAE50F41ADA4B8C5F722
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>...........v.......................................................................................................................................2...>...t.......v................................I.......I.qk..B.....LZ.V.......V..`k..$.3..K.V..`k..$.3..K.V...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............^.t].U.)y...g7.....N...^...............?x..3.O..,..*.........f...................................H....I.qk..B.....LZ.............^.t].U.)y...g7..........^.t].U.)y...g7...........V.......V.......V...........................................V.j.....V.T.]...V.......V...B...V.H.....V...B...V...>.).V...J...................;........4...4...4.."...............V...V...V...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4..........V.......V.....#.V.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000066.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 85 x 470, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):11197
                                                                                                                                                                                    Entropy (8bit):7.975073010774664
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:p9wNdtRKcVHso6zsqm06xaqZdingVzLZ7/PGSIz/yycRTbChh/JzhbEx15RGb:mdtMcVHqgAqTinMzLZ7/uSIz/yTR/mhF
                                                                                                                                                                                    MD5:DDC3CC30794277500EFE4BC6667EC123
                                                                                                                                                                                    SHA1:EFC9642C1F95B5FC38764476AE481649C016FA0C
                                                                                                                                                                                    SHA-256:7F5B660A1A0BF46C75AAF19B4F77A0E086DE003EC03AFC1F58D871D55AA5BA9E
                                                                                                                                                                                    SHA-512:25232A84604C3959634D33090238FEC8D51E40AD84EB3A08BB8522A81BE1E83378649C014E98E1DFCDF46B7BFAC92D8D2429211CD11D7EE0334C9C3DF7C1B6A6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...U.........1x5.....PLTE....................................e........................................................s...............x..........................o..............................................................................................................................................................~.............................m...............................................j...............................................p.......z......................................................x..............|........................................v.......................y..........................................................h...........................................................................P..{....bKGD....H....cmPPJCmp0712....H.s...(SIDATx^.}i@S..N....h...!..)....AI%..p.L."a..)..`U..,h..:O.b.:.j+.Z).b..zN.s..{O...&|..N}...${....~.....k}.[k}{.o^.D_..W:35ly..7rL....6n0.A...b

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000067.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.329988257088939
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:aszoj487p2tqYnVElLJMXSYp9xU3c0pyprdMr1EyPFX82JCh6lF:ass7p2gIElOXSO9yXERM9izO
                                                                                                                                                                                    MD5:3DA66D7B3EB549FFBD52114FDF5DB773
                                                                                                                                                                                    SHA1:8430534547DD9A11C4D6707DF1BB2963B9B7B88D
                                                                                                                                                                                    SHA-256:6A030C8203FBB471439E6A7A3C4BCB2D84A70067CD04E6A235C23BFEF477B1EA
                                                                                                                                                                                    SHA-512:76439446C5E7859EC74E3F9BF720430F0A662EC7244C591A5B65CD4BCE1D5D12F02CC3EE01975B9EE207B327451D11E354839F66472298C02BC09E25CA949971
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.o.......o..f5..%,..d,g..o..f5..%,..d,g..o...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............R.v....%.2R..MQ....N...^................,u....C...jl..5........f........................................I.qk..B.....LZ............R.v....%.2R..MQ........R.v....%.2R..MQ..........o.......o.......o...........................................o.j.....o.T.]...o.......o...B...o.H.....o...B...o...>.).o...J...................;........4...4...4.."...............o...o...o...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4..........o.......o.....#.o.............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000068.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 88 x 574, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):19920
                                                                                                                                                                                    Entropy (8bit):7.987696084459766
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:DRSgtAxJx7bzvAsVSqQElOT4uHmpmvNYT9aPU+QtsC2LgfIqJZnbeyRB:DsgaN7bzvAsVdK4uGQFUZ6bU/p3
                                                                                                                                                                                    MD5:1BDAD9B3B6DE549162F9567697389E1C
                                                                                                                                                                                    SHA1:5D9C09159F07A3A9BDCC6C4B9BD9CB72D0184E6F
                                                                                                                                                                                    SHA-256:0908A4CFA23F93011176D47F45843E9CA2973030421996E8E27484781F54B0EC
                                                                                                                                                                                    SHA-512:475040779AC247BB5C3E11862FB55FBDDFA12D759EE86A33E11BC1F3B656D6CD0F9B25146C0113E43E1D8001D8867D3BC3BF7E6FE21F3A0016CB1F8B70B7A15A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...X...>......y=h....PLTE..................................t........iw..............................................._n|...Tds...ky......................................................p~.....................................................dr.................v.............................................n{.......ap}..........x.....z...................u......................|..Vfu............r.....w........................................~...................Zjx...................................Yiw............w..|....................Xgv{.....y...........................jx..............\lz.........}..z.....t..[ky........u..y.....gu................................{..........}.....u....................~...........y....r.....bKGD....H....cmPPJCmp0712....H.s...JfIDATx^...\.W./.}....Sy...(..4....D.-.....H...% .$"D.Qr.......`..;...6...N......s...^...L.....Y{.GQU`..~...j....{...-Ax.K..&.....F..I\i..

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000069.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8192
                                                                                                                                                                                    Entropy (8bit):2.9115189068321428
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:agsyrX0RtiNpE1Le9NVSL6MhwnXeT9RCqs4pyFrdMrHf0/FXK9zcejYp:agsG0RApE1MN0fcX49kqdYRMHIw0
                                                                                                                                                                                    MD5:1EB272EB93B2DD8224D141933EC2B3EA
                                                                                                                                                                                    SHA1:39EA327442192111122A915CE3C31EC9FD23CED6
                                                                                                                                                                                    SHA-256:C3FB2EE3E4EE8ECD61B7279702FC155C3F63CA1FDA976F714E90859C48E82F81
                                                                                                                                                                                    SHA-512:230C54D41FD5106610EE0BE865CCEEB82AF7D863CC72DBA2E48E518ED5D517AB315CB7F780C6C5FF4599E1669126C24F5F182F31985CCB05B11FC6281917DE6D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>...........v.......................................................................................................................................2...>.......H...v................................I.......I.qk..B.....LZz`b.....z`b...w. m.!.#dz`b...w. m.!.#dz`b..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............+..^07...(..W.J....N...^...............EZ..Z..J.<.Wz96.........f........................................I.qk..B.....LZ............+..^07...(..W.J........+..^07...(..W.J.........z`b.....z`b.....z`b.........................................z`bj....z`bT.]..z`b.....z`b..B..z`bH....z`b..B..z`b..>.)z`b..J...................;........4...4...4.."..............z`b.z`b.z`b..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........z`b.....z`b....#z`b............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006A.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):179460
                                                                                                                                                                                    Entropy (8bit):7.979020171518325
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3072:oiKXvL7lv0am/R1vrdH+9dK6zPQ6bbnGDpcGGDNMIOIMAT8q9Vc02Q57S4A+vMFz:+vlvC/HvgA6fGqGGJlO1qZ71W6CzDn
                                                                                                                                                                                    MD5:4E131DBFEC5C2462273CA7B35675B9D9
                                                                                                                                                                                    SHA1:CA037F444D819A118AC37D7AA3782B9BF94C1616
                                                                                                                                                                                    SHA-256:2A4A3530D652E227DDD5ADC096A95F6034718F7C380B07DB622022D768815059
                                                                                                                                                                                    SHA-512:C333ECEB1439D0238BF44FB7896E62DBA4C645B70413AA0F99C1F10E8DCD20C2EEE5C83F2E9DDE9A2494C85A6D8D13CFFFC4160E2F598E17867015F5244D656A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!.1AQ.aq...".....2Rr..Bb..#34.....CSs.$5c.t....%.Dd.6.T..u.U....E.7w........................!.1A.Qaq......2."r.3....BRb.#4......CsSc...$.5..%.DT.t67d..Uu...'............?..c.......p..z..i.....z......kj........F>f......3N...M....RM.&..-.~.Q..'.....q.a..w...-~......g.{..&.......V.n.D....>FS!n.....@..)...W..q..Wr{..J.gf.{.M$.P@m.,..9..&m.D...w.._...-.O........s.....h.k~......(.K...V..l.-...+.9.k......*......#.p#.O..9M..mF...C.......7+.AI....4vw.;..H......e..Q.u[.eUK.....z.....[.Kt...s..Lf.4..l{.....sh.............=..;..iqkj.m.a...NH......v..H..$..q.y......c...U[Mcf.......+...S-...^....4..T..YtL.x.v.;.....<...Ik|B.$.s8......3.+.8.l.. h.:....%B..W..I.QRS..,*x.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006B.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.352329065183147
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:c1012s6sQlF7RpPEdXt9Z+cRM1GbuRBo:EM2s6sQ37P8dXt9Z+cRM1GbuR
                                                                                                                                                                                    MD5:3AB54C4ED3E370DC61F70D8D3ABCB81E
                                                                                                                                                                                    SHA1:E1B1E547FD13C1A4131FE7F9F8E7F86389819DAB
                                                                                                                                                                                    SHA-256:B3B68731CB8EB097D3FDFE74344550AEEE8F648810EDFA56386DFC021278FC53
                                                                                                                                                                                    SHA-512:C3532F8CCEB0FE30DCE59D0ED32A3EF7E3098BBFDBF3C8E2C98A8E28315308B581C926930C5FEBDE563822AD56365E79A4058F1699CDC8E7C9E82DE7CC3145A9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZJ.......J..C7....H.ePyJ..C7....H.ePyJ....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............FeG.>..@.bN.I.....N...^...............#......D....`...........f........................................I.qk..B.....LZ..............FeG.>..@.bN.I...........FeG.>..@.bN.I..........J.......J.......J...........................................J..j....J..T.]..J.......J...B..J..H....J....B..J....>.)J....J...................;........4...4...4.."..............J...J...J....z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........J.......J......#J..............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006C.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):109698
                                                                                                                                                                                    Entropy (8bit):7.954100577911302
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3072:rDlmvIWr0aRtNCfShCWBxyCHMlcVG0Ezy4FR:rDliIfot8ahCWBcCHDVwR
                                                                                                                                                                                    MD5:8D804A60E86627383BED6280ED62F1CF
                                                                                                                                                                                    SHA1:E23FF14B10AD0762DD67FBA3CD6EFC85647C0384
                                                                                                                                                                                    SHA-256:494547E566FB7A63DD429EB0699FE41AA8998F8EA2F758D813FE3D56C3075719
                                                                                                                                                                                    SHA-512:0FB19F3D00159F2748C3A54E952E551B9FEA6910D67A54DECA8D099992E50383EADB92768FF1F75CFFAE82A7A157B1E0F77A2F0BE7EC64FD2324304FDCA46577
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...............................................................................................!"#.123..AQB$..aq.RCS...b..c4%..rs..D&....5E6'..TdUte...u.....FV...7.......................!"..1A2B..QaqR.#.br3.........C%...$5.....c4U..Eeu&SsD.6T..................?.....O.C.....^..R<A.g...[....3.....r.0.....nX.S....}...[.?Z.....A.?..~~I..rY|N.o...9......!...o7r../-.y...'5.3.U.s".-.0.1......SS...&.Q.j.*.$m.e..:x....`}...EP.?.7..~G(so.......O.....z.N..<....~^a.e...........p9.?<._..|......~.<@.D.9..G..?.?z.y?z.C.U.w..[.,..A.+........s......g...G.^....pz.xY.....d8.y.X...P..O(A.O..~:._.......<...o..4s..^.^b..x......_a.....|{c...:..X.....}.._...[?..NK.c...}.<......H.G....+x.Z..|....n...o....`.nk.#.%x......-|...|7......N!=././..w.8x.".8....'x........w...,>....j[w8a..}..lS..?.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006D.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):4.34699938466665
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:+BsRCyIrD3tp/E3y2XQIXHiI9JsPpy5rdMrlOzFXPRCd6ll:OsV4D3DEfRXHr9JO0RMQzkO
                                                                                                                                                                                    MD5:B1336DDA0C398B11E7BA475A6117A162
                                                                                                                                                                                    SHA1:CF10050EE74AF9694E57698B0F65C46E5C828FBA
                                                                                                                                                                                    SHA-256:8DB9EF970D1D83F81CD4D42E1DDD365428FD65FC5178C18D67406C1EF06F990B
                                                                                                                                                                                    SHA-512:A83FEF10D04DF74BF23179163D31962222C3C4DFD442EBC6FAE9A044BAE3A86343683C470E0B7FE56AE27FA5ABCE280CA6067C78A332084CE8546A993D54801F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ5.......5...7.....+.%+.5...7.....+.%+.5....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............`...u....O....J....N...^....................-vN.T..............f........................................I.qk..B.....LZ.............`...u....O....J.........`...u....O....J.........5.......5.......5...........................................5..j....5..T.]..5.......5....B..5..H....5....B..5....>.)5....J...................;........4...4...4.."..............5...5...5....z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........5.......5......#5..............................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006E.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):41893
                                                                                                                                                                                    Entropy (8bit):7.52654558351485
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:pZvVQkUbOHxx3pvVmO5rsP5gUdXwFMuv53knzyncaXgRDqPU:pZkijV5wScXwFMYknzucaXgRyU
                                                                                                                                                                                    MD5:F25427EFECFEE786D5A9F630726DD140
                                                                                                                                                                                    SHA1:BC612A86FF985AB569ED1A1EA5FFC4FDB18FC605
                                                                                                                                                                                    SHA-256:5A36960DF32817E8426BD40A88F88B04FB55B84BAEF60F1E71E0872217FDB134
                                                                                                                                                                                    SHA-512:B102F34385196D630F198667E874F25ADBC737426FDAE0747EC799B33632E5DC92999C7C715DC84D904342738930267AB1709870BDAA842243E4C283FE5E1554
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................!.1AQ....aq......"......2...Xx..9BRr#.b3$..&..g.8....%F'G.(H.Ss..D5E..v..W..Cc.deu..7w.h.).....................!.1....A..Qaq...Ttu.6..."R..5...2B..S....bcs.Dd%&r3C...#$...Ue.............?..R...%.R...t.MQ*.l...v...V]..n...Zw....M....4..F.&&bb0.:]l......ay.r<..3.l.Q^.........I54.N2.8..2s...w..r6.......[1Zh....O...9..>...B......x]...r.\.\..v..~....y.QT.3.......=....r..}.l.....o;....M..C1....w)...+o1f.]...MoA.E..s5..i.\....miGsy..m\.Zj....I'YU.\tU6La5v.>.K..m.]1.......k..0....</5v.V7lY.e.vV.+./[....f..u{....s.}.Rb.Z.....Y.6]..m....V.\...Mr.=r...K...l..%..m^.......X.(..fG..[F*ly.jL.a4..vs..o.e..q.9km..w1.yg.....r_.*h.n..5i.-.{Y.l...<...'Or.s..Z....../JP.....\FV.S..............m

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006F.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):2.6072368476613397
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:5CE/ddCSlEARoDlPV9bUA1slYoHPjOlmjlq+:MEyARgnZ1ZMPX
                                                                                                                                                                                    MD5:6C0BF22356ED1043D34E94B75984B289
                                                                                                                                                                                    SHA1:D5A77910102FFE2C944E6EF547B1FAD10EAECA40
                                                                                                                                                                                    SHA-256:C788876B2DF49EA888C09451D51A4E36F3C36D0B191951062C74C29CCB29C55C
                                                                                                                                                                                    SHA-512:8107376279B449DB4F86DD4F3E32C4E6CBB1065B34FA06E9255E90957D6FBD68C8397600E68D47DA47D8E2E719A2B34E82997A032D53ABA785CECDBED2CFA6A3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:...........................................?..?......................................................................................................................................................................g.....xK-:............aT..K........:"&.....6...x.H:"&..J5.@....=?.....J5......g.....xK-:..........................................................................A.{..8..A.{..T..A.{..]..A.{..d..A.{..r.......n.....`......................4..~...1...(...(.......C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.\.r.o.o.t.\.T.e.m.p.l.a.t.e.s.\.1.0.3.3.\.O.N.E.N.O.T.E.\.1.6.\.S.t.a.t.i.o.n.e.r.y.......S.t.a.t.i.o.n.e.r.y.........1.......S.t.a.t.i.o.n.e.r.y............A.{..1... ..$....S.t.a.t.i.o.n.e.r.y.......:"&.....:"&.....6...x.H.J5......J5.@....=?....2...........0...`....................J5.A.{.O7................................c..,............................c..,0...........W...7$.N.i^u.K:B...............A.{.A.{..1... ..$....S.t.a.t.i.o.n.e.r.y...

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006G.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                    Entropy (8bit):3.409452104940445
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:YTr7tkfosmaR10GsL+0KtrZCrBJmQEtaDsNF/hZVbsPJmQEtaDssDEZxlYJmQEt2:ImfHmK0l+08jJJDbPUErl7p/SKQj
                                                                                                                                                                                    MD5:DAE5FE09741088BAACC9F6C79420FD15
                                                                                                                                                                                    SHA1:12F5FF3B7D97CA42F4F9C95F040C9A5393152D7D
                                                                                                                                                                                    SHA-256:33E026086BBEAFB86E7FAA4AA9C21AB8118C84EBDB2DA4735F5D591E30C4FF18
                                                                                                                                                                                    SHA-512:56214A65D1FEBE4AEC9E3412EECFF640473653F8D25F1C86DC5F848DAD5B446A76E2475F169C6344AC30C804B688B33676459282B042B9BACFB8AD91D4547BFF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........0.......................................................?...............................................................................................h.........................................'.......'i....>.;...Mm.X7......X7....3i...D.l...S......q1gn3.......'i....>.;...Mm..'..X7....3i...D.l.X7...........X7......X7..................................................X7..w...X7X.....X7..4...X7......X7..$..b.`T.9....eT(P...J.T&d................4..(.....x.(.....b.`.....b.`.pn.I...Q./..S]......S].pX{...b.....2...v.......4....................X7.b.`...e..J.......................b.`.....S]...c..,0...e...B4.$........[.-...I.......9........................e.......eq...A....J.zS]......S].pX{...b.......eq...A....J.z..e..J.K...E...)#.x..J..b.`.pn.I...Q./..b.`.....>.................'i....>.;...Mm.X7....3i...D.l......................J........'..c..,0...e...B4.$..............E........................................0...........e....4..................T.o. .D.o. .L.i.s.t........s.)..O@

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006H.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12288
                                                                                                                                                                                    Entropy (8bit):3.9112658940238667
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:RsRzu6/MRDVwFtWXMgTCP3L+Rz+9v6p4FWKMJn6e5DjV9aVtydpRz3:msH15RzWWkW
                                                                                                                                                                                    MD5:3294B081C8CF9FD199CE11EE1F77CF52
                                                                                                                                                                                    SHA1:C8FC282B6FD3EBC52DC9953739360E8B46EBC50D
                                                                                                                                                                                    SHA-256:3C83B2E563AADD74F8D6A5394EB13B504E796FBCBBCC13F9B0F8EA117EFEB5E8
                                                                                                                                                                                    SHA-512:0013E77FC71F65C8EC16AFAFF9FB49397D575B8E244FA32D7260DDB9FC3E7BD0E5D31CEA2DA5F3D4F8D537D75B6C890589ED1A5F38822050FC926C9956FD896B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>...........v.......X .. "..2...>...d...<...v.......@....!...........................................................................................................................................I.......I.qk..B.....LZ....;........."...t........."...t........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............m......2....7#.....N...^.................38tI..h.Wro.........h...L...............................D....I.qk..B.....LZ............m......2....7#.................................................................................................j.......T&n....................H.........K.............$...........-...J.....z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.5............(...#...8.....z...,4. .......$>........4...4.@..7.....................D..n4..o4..p4...4. .F

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006I.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:05:55], progressive, precision 8, 612x618, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):68633
                                                                                                                                                                                    Entropy (8bit):7.709776384921022
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:tapXpSTJDOkFGdJdBk/slsbfsw1imaapnbvD8:U2OjJr6b07m1bvD8
                                                                                                                                                                                    MD5:41241EE59AB7BC9EB34784E3BCE31CB4
                                                                                                                                                                                    SHA1:98680761A51E9199CF3C89F68B5309FBEC7EE3CB
                                                                                                                                                                                    SHA-256:035B26DF61855A3F36DBD30FDAB0C157C04C9E8AE2197EA4D4AEB3E82E6A4C2B
                                                                                                                                                                                    SHA-512:3EE331D5BCEE4AD5D3FC9661D4AB4053F7D351591A094334F963C33C9D0E32CCCABE9334AD7C308108CE99617E064FE848DCD469ACD8D83FBE5C4452DE523D8F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:05:55.............................d...........j...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?../$.W:SZ./...9.....-...u......r.....].c...@W_.7...+......v.+PD.I..-<1.pDn-\.....p.$....0.}V....\..>.~..XN.o..l(E....ik..o.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006J.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):20480
                                                                                                                                                                                    Entropy (8bit):4.084379266366291
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:lrRbV5MCQjvzRruadSEwLrFw/gEod2G6vEmXODTnE7jaXawPWU6nRJvZwAx01+30:xRb3w/962o3E7Q0RJi4rMRf
                                                                                                                                                                                    MD5:64ACE86BE299BE85057EFB314B6D16A1
                                                                                                                                                                                    SHA1:15E4674C521210587222FA3C1696B8B11C8249D7
                                                                                                                                                                                    SHA-256:05F5F7EAD64E1F506FE8CAC235F94A004E858C8622B3AB769016B276053EDD8D
                                                                                                                                                                                    SHA-512:B1E2D0DAC2EEF2CA396423A23D2CB760E4BF8C17BC07F21FB1FDF0641C60F92DE261FA1984BB01A1645F990187F8C6C1F07A3168451ED366B9C57B2CD0441EBF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:^...>.......L...d... .... ...9..^...>...........d...h...@...@;...........................................................................................................................................I.......I.qk..B.....LZpd..1...pd..T..8.Y..t[..0.q..#..lk....0.pd..T..8.Y..t[.pd...I.qk..B.....LZ.I...........pd......pd......pd...........................................0$.....0 .....0$.....0..)...0 ....pd. .N.&pd.....'pd...@.....'pd.2pd...z...,4. ...."......$>........4..`..7......L.o.w. .P.r.i.o.r.i.t.y......................pd.:pd..pd...z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.2.3............0..z... ..$........................................2..7.........1.h...?.......?...?....rA\.-?>...o.u.t.l.i.n.e.L.o.c.I.D...o.u.t.l.i.n.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.4........?ff.A......'pd.%pd..pd...z...,4. .......$>........4.@.4..`..7.....................D..n4..o4..p4...4. ..1.......pd.*....pd.....%pd.#...'pd.&...9pd.....

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006K.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:08:07], baseline, precision 8, 595x450, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):59832
                                                                                                                                                                                    Entropy (8bit):7.308211468398169
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:HS9SYFtN0+CRa9mfJy4zBAiIJhzrkHDV2hJK:yAmta+Tyy4zBIJW5WK
                                                                                                                                                                                    MD5:DCDD543A4E0BA2C1909BA095D46FFBCB
                                                                                                                                                                                    SHA1:B86C89537138FE07255354202D3EAD0B53B3C54D
                                                                                                                                                                                    SHA-256:28F334B77068F71F5F92A95695433B950610204A0E5580CE567DB8FAD4993ECB
                                                                                                                                                                                    SHA-512:5408C3259B7F3288A4BEB04342799AD5FE3A6F0EC7E92353B29B7E7E538DFA9903B39637226919E0421BC422635D25F5F8069DC7441864DC03E1B909BF5C2C84
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....fExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:08:07.............................S.......................................................&.(.................................0.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................y...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?......;R~+'....xh..~.n-}.......Te................^B..IU_....._...S......h.......!....9...A}6V=J......C..c.....Ug.Wh......

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006L.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):20480
                                                                                                                                                                                    Entropy (8bit):3.250693438832101
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:DCHXTBeDMPNQPHwNSg6VkgnRJ6RNuhbwqf:DCHXTBeDMVQPHwNSLFnRMRNuhbwq
                                                                                                                                                                                    MD5:8ED002F83D5D4BD56BC43B9AF10DB9EC
                                                                                                                                                                                    SHA1:7559094FE97AEDA56DB925E4FC2106BCF96EC876
                                                                                                                                                                                    SHA-256:3C0CA3E4E0BC165FD2683E674ED783AB7B1B6F564B9E860869B5CBB03164E6E0
                                                                                                                                                                                    SHA-512:425DF66A80D787935F682EDB1BDA3D750F89B92F6E2ABE9885D4B9BA408E416D02C52C9606B26D6A6EDABE9B2B1EE8B9CF27D32046108A50838528BD46EB191B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...>...........v........ ...-..2...>...B.......v.......@....,...........................................................................................................................................I.......I.qk..B.....LZ....P.......8n......D.....8n......D......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............\To<...1..2........N...^..................=.W.J.._.js7................................=.W.J.._.js7............=.W.J.._.js7..........\To<...1..2....................................................................................................j.^.....T'........................-..................... .L.........3...I.....z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.6................3...9.....z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006M.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:modified
                                                                                                                                                                                    Size (bytes):53259
                                                                                                                                                                                    Entropy (8bit):7.651662052139301
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:dCiCBBenRYWDBCipMYGTbYGLHbXxoP/qEF+MU50qyJ30h2W474S/Aq/xc4674bi5:dCiIQXBCiwbDLHD0/sFyVel4Pi4UgE
                                                                                                                                                                                    MD5:2EE369ABB7936F8C28FF0ABDD224EA05
                                                                                                                                                                                    SHA1:FE9D304A7B49E31EAE439369ABC548E265149636
                                                                                                                                                                                    SHA-256:FB12D59B8BE911247BBAFDD416852E8B74B028005A141CB4DBBBA109B4B6ED2C
                                                                                                                                                                                    SHA-512:5CF396CA472C32AE988600176114106CB1619404DD899A3867A5AB43DC90583B771EF69B14EF50E56A21F038BF51D8463C6ADD2DE9D4CB523F6290E24A4DECB3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..AQa....q........"2..R..Bbr..#S....3$.....C.4v..(X.DtEUV.....cs..Td.5uf'Wgw8Hh........................!1Q.Aa....q.2...."R...r..3.t..U...B#S.4ub..C$d.5Ee&'7c.D%sT..............?.....?...k,lk^...M".Yo5.Qp.&s}b.m.:...W.x}.*.a......N1..d-n.-..^..b..TZ.W..."....F....^......ve5...^...2.:i...........~u2pK.z./&..u..L[I....Y....@y{|>..MN=:....Q[..H....a........|%..4fV....).....^.9b.f...F...p.=.W...aZ.........Z.t.n.....z3..[..lVh..\.N-.._.sK.y.._e.G.jig.a.7^....u...*.p.5.a.].........u/u..D.yl.XA..f.z..~.x.....N.....b=.uv.2.t.'.N.-.H..n.v.a.A[.Z.....T2...._...:....h..l.E..sm..a.3I...RE...fWb.Ek.0.#.)..Y#T...........u{....U....s.].7_H.2.`O6...P......}..4LR....]4.mid...

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2278
                                                                                                                                                                                    Entropy (8bit):3.8522755899979275
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:uiTrlKxsxxYxl9Il8ug7GkzENxfqRItrR2mqczd1rc:vkYIBzkxMOrwmq9
                                                                                                                                                                                    MD5:F9DD62E8C8DF0D767B37974CA508CF5A
                                                                                                                                                                                    SHA1:8396B0D94B2D69462AA4C7C489FA774504729C01
                                                                                                                                                                                    SHA-256:3B3B774F69F5F8545BBB53422039D124D7938EA3B950961D89725BFFC24AEA91
                                                                                                                                                                                    SHA-512:31895BE923D545BBE5A48675624F756631C9D6F539ACFEBD9DC8CD83DED57E31DF82C1A9FAF62D4025B94C901CAEF83D1BF70AE132F9B717296DBF9CDBD91ADF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.J.1.m.u.g.S.o.z.s.S.9.x.S.Z./.Q.v.O.c.+.E.J.4.u.2.c.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.N.V.v.1.T.d.V.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.k.C.s.a.h.k.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2684
                                                                                                                                                                                    Entropy (8bit):3.9009056803114883
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:uiTrlKxJxH6yxl9Il8ug7wm1yyyB3BYATnldAnVu1G+OAod/vc:k6WYIwm1yhB3B/LlQr3Ax
                                                                                                                                                                                    MD5:DCDEF2851258B5BFC2BD72B81DD14F86
                                                                                                                                                                                    SHA1:211EFA77523DB5E4EB014D91B8D9078A66CFE624
                                                                                                                                                                                    SHA-256:F88069303FBDBF69E1BF24BF7AE7CE632D2D8D232DC01441D98A90542DF8CC59
                                                                                                                                                                                    SHA-512:74DABA20B5011562855B96985BF63B61DF36A4FC468A5214F8ABF368CBEDBFDC4694F609C35C66F61EC294A96989095C7CE4293BEA7B22EFDF43FFE4C42F95E4
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.H.X.L.G.R.5.H.j.D.k.3.C.i.F.b.L.a.m.K.N.+.n.c.g.T.0.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".U.w.g.S.7.Q.B.0.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.k.C.s.a.h.k.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4542
                                                                                                                                                                                    Entropy (8bit):3.9950236558058614
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:EYI8KrDN0SV51P9fTXfGlLZ+GrHIpzeNi0DxarHK:E0KrFFjfyLZhzYMioeK
                                                                                                                                                                                    MD5:49FCCB52CAEB9CDF016C64393D329FAF
                                                                                                                                                                                    SHA1:6BF341CDA2288522ABF9C5AA463852CD8CA0AD06
                                                                                                                                                                                    SHA-256:2C12E177DF32BCF9BFDD2A673056DC3407C6DD1E5FEEB9B93854B69B6D52DBCA
                                                                                                                                                                                    SHA-512:EEC7F462AA263B3746D85F3F5C540E5CEAFD816BBE6CBD2A037B9C1465F6DCA543B355164AB7B3BFF03ACA380C8998231A0120869C4A8559237F5CA4D1C6B9DE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.q.Y.a.6.3.X.Y.9.b.4.Y.b.C.Z.g.f.0.u.y.E.6.v.n.x.e.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".2.M.x.W.u.y.9.V.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.k.C.s.a.h.k.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):56763
                                                                                                                                                                                    Entropy (8bit):5.060943754762371
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:00Z+z30IFPV3CNBQkj2Ph4iUx7aVKflJnqvqqdKgfSRIOdBlzStAHk4NKeCMiYoC:jZ+z300PV3CNBQkj2PqiU7aVKflJnqv+
                                                                                                                                                                                    MD5:B67E4E1FD9987999A6BC979ED6AB67E7
                                                                                                                                                                                    SHA1:74AF26E4E4E58502D6F7F9B2C3F9456E1C89F1EA
                                                                                                                                                                                    SHA-256:3953CE4BD52C236BC5A16C2A8A0827B70A77142E74A6AB76890BAF95C0F6C217
                                                                                                                                                                                    SHA-512:9FE68F137C432F8CDE01A9009A4BB31E99A3A6D19191ED20A1CDBE7849BD4817798C7712AA695272C105B3715088593BB43A00601015B97F3EE2F8379544594A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:PSMODULECACHE.N.......%...I...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\SmbShare\SmbShare.psd1T.......gsmbo........gsmbm........Enable-SmbDelegation.... ...Remove-SmbMultichannelConstraint........gsmbd........gsmbb........gsmbc........gsmba........Set-SmbPathAcl........Grant-SmbShareAccess........Get-SmbBandWidthLimit........rsmbm........New-SmbGlobalMapping........rsmbc........rsmbb........Get-SmbGlobalMapping........Remove-SmbShare........rksmba........gsmbmc........rsmbs........Get-SmbConnection........nsmbscm........gsmbscm........rsmbt........Remove-SmbBandwidthLimit........Set-SmbServerConfiguration........cssmbo........udsmbmc........Remove-SMBComponent........ssmbsc........ssmbb........Get-SmbShareAccess........Get-SmbOpenFile........dsmbd........ssmbs........ssmbp........nsmbgm........ulsmba........Close-SmbOpenFile........Revoke-SmbShareAccess........nsmbt........rsmbscm........Disable-SmbDelegation........nsmbs........Block-SmbShareAccess........gsmbcn........Set-Sm

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):64
                                                                                                                                                                                    Entropy (8bit):1.1628158735648508
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:Nllluldhz/lL:NllU
                                                                                                                                                                                    MD5:03744CE5681CB7F5E53A02F19FA22067
                                                                                                                                                                                    SHA1:234FB09010F6714453C83795D8CF3250D871D4DF
                                                                                                                                                                                    SHA-256:88348573B57BA21639837E3AF19A00B4D7889E2D8E90A923151AC022D2946E5D
                                                                                                                                                                                    SHA-512:0C05D6047DBA2286F8F72EB69A69919DC5650F96E8EE759BA9B3FC10BE793F3A88408457E700936BCACA02816CE25DD53F48B962491E7F4F0A4A534D88A855E6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:@...e.................................L..............@..........

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\SPLC071.tmp

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):65536
                                                                                                                                                                                    Entropy (8bit):0.4260807311316498
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:grmM+No7ej9GU6EepOlF3S2BAOCcNafqrNsylVlsolDPZ1XKDST:grYiej4KbmckO8/2
                                                                                                                                                                                    MD5:653EEE62FCCA443177122D7399A19E65
                                                                                                                                                                                    SHA1:AFED64A3E72EC85B6A36A1496E68F317DD283280
                                                                                                                                                                                    SHA-256:76893E2F8DBB47DBB7DCEE5DD46E861D01FEA4F53FC5C14638BE00AE80E10AD8
                                                                                                                                                                                    SHA-512:F84EEFB3A8887812A2BD9EBDD7ADA87A2500C9BF4BDFEE10D8C83BEE3A4EA6E8006EFC4799FCA86D4DF604315B2636DA81C3921F6E8D5E0685FCBD5C8116F93B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:................................XM...p.. EMF....p...............l.......D........... ...............?....f..P.r.i.n.t. .t.e.s.t.....%...........%...........R...p...................................C.o.n.s.o.l.a.s.................................................................................................Y........X...8.v&.t....l+.v.&.t....(.....X...X.....P.8...s......,@......................H...8.............`.X...............H...KE........x....)u1...1.1.(.8.w..vP")u......$...*u..8.4.8....v..*u..........$.dv......%.......................................................b...........d...................................................T...T..........................@?@.@'...5.......L.......................P... ...........................................................T...T..........................@?@.@............L.......................P... ...................................T.......'...5..................@?@.@'...5.......L.......................|...L.o.c.k.B.i.t. .B.l.a.c.k. .R.a.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5b0e4k3q.qig.ps1

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):60
                                                                                                                                                                                    Entropy (8bit):4.038920595031593
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                    MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                    SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                    SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                    SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bcpk4pwm.r5b.ps1

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):60
                                                                                                                                                                                    Entropy (8bit):4.038920595031593
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                    MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                    SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                    SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                    SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_igvedmbq.sdo.psm1

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):60
                                                                                                                                                                                    Entropy (8bit):4.038920595031593
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                    MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                    SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                    SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                    SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n4wjezcl.vwc.ps1

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):60
                                                                                                                                                                                    Entropy (8bit):4.038920595031593
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                    MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                    SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                    SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                    SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tn4rwuox.ygr.psm1

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):60
                                                                                                                                                                                    Entropy (8bit):4.038920595031593
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                    MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                    SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                    SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                    SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x1ay33nj.ug1.psm1

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):60
                                                                                                                                                                                    Entropy (8bit):4.038920595031593
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                    MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                    SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                    SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                    SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{005FFFF3-2ADC-44AA-8D97-C439F4EE565A}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 95x498, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3009
                                                                                                                                                                                    Entropy (8bit):7.493528353751471
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:aRCTf+0hagMrbAZMJShPdvF/5OzlQFlDF7npkDdWvVBTEnBLT6NrgCX0:D+0YgMrApL553JtEdEVcL2NcX
                                                                                                                                                                                    MD5:D9BD80D40B458EDB2A318F639561579A
                                                                                                                                                                                    SHA1:83BA01519F3C7C1525C2EA4C2D9B40F28B2F2E5E
                                                                                                                                                                                    SHA-256:509A6945FACFB3DDC7BE6EE8B82797AD0C72DB5755486EE878125A959CC09B59
                                                                                                                                                                                    SHA-512:C368499667028180A922DD015980C29865AEF4A890C83E87AE29F6A27DC323DD729E6FB1C34A2168A148E6A7A972F65A5FC8ACE6981AF1D4E7057D99681CB366
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....C....................................... ! ..''**''555556666666666...C......................&.....&,$ $,(+&&&+(//,,//666666666666666........_.........................................:.......................r.!12BQ...3Aaq.."CRb.....#4$c.S.....................................................1A............?..p..-.....u0$.......l......)..o.FTd..DG....... .t*e..jO..Z.U......r..j.O.,..VD./.....V5D.&......A..Zi....E.N....*..........#..M<|.2.Y.../QO.x.cTM4......+.F;V.x.de*....]e..O.x.c\Y........r..j.O.,..T...hw..k.^.[B..J.sEl.w.x.m.5%zzt0..T.......b..<\.3Q..W</..!.xh6..Z..\.+M.o.Y..1............#.........|.a.l.KR>..U......e....@...\.1Z...Y...[....F.6.t.#..Z,.x.Q..[`.X......#........W</..TM..-H...V....Tf..........r..j.x.df.f.....#..l.KR>..U......e....@...\.1Z...Y..Y.us....D.)....Uh....FkYm.m`P...W .V.g..FjVj.\..1Q6.t.#..Z,.x.Q..[`.X......#........W</..TM..-H...V....Tf..........r..j.x.df.f.....#..l.KR>..U......e....@...\.1Z...Y..Y.us....D.)....

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{00B5361E-409A-420D-86BD-205ED72A406F}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):40884
                                                                                                                                                                                    Entropy (8bit):7.545929039957292
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:MCBOA4d+ElOXJ/3pI7cRBiL7L6qERqGz65WXzZqJsKQSbIsTT6XB:hIAU+2cGdLX6qBG4WDZl4Ihx
                                                                                                                                                                                    MD5:7379775A1E2AB7FAB95CFFCE01AE05F3
                                                                                                                                                                                    SHA1:3D3DDFD8AC7E07203561BAE423D66F0806833AB3
                                                                                                                                                                                    SHA-256:9301DB6D2D87282FCEE450189AEACE16D85F64273BF62713A3044992B6B7A9E9
                                                                                                                                                                                    SHA-512:4B5006E620E80D3A146944649CF4CA619782CAD7E8C4CD0D1DE0EBCA0FA05EACB7378DAFCEED3E26F5698B07F19604614D906C8F51F898660E2F129D8DEC6F62
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1A.....Qaq....".....2....BR#S..br...3T...C$.7(Hx....4D.G..Xh.cs..'..t...%...8.....................1...!AQ..a...q"2.4Tt.......R3S....Br...#s...Uu.bc.de..$D..6..C%E..............?...z...;sB.yv...........]t.\...n...../....m....M.=.3G+..x+.....S).*&.J../..8..O/+..sG...p...<!....~.c..C.w..,[oHom.wc-.J.~.......L[..6...'..i_..S;...!Y.z.q].EK..M.x...i.x.+.;.+...}....#......f.)........e6V..p.;........s.)..Ml.J......IU.6...<9+9.^..l..Y...[._...2..^..j.ia...._..3.;...~..<3...;......z.^.......]..Qk.,...Yk...3.3Jy^p.}....q...I...&..t.......;..9.g.GH;..'...%...)..[..y..../...zCn..>...'...1e.Y..;....]..7...N>t..m-.j.............H^..T\.q.ru...}...eTn]I'r.^].#..wOY....v

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{03F9617D-5A48-47E2-9A5E-D8F41361E559}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 88 x 574, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):19920
                                                                                                                                                                                    Entropy (8bit):7.987696084459766
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:DRSgtAxJx7bzvAsVSqQElOT4uHmpmvNYT9aPU+QtsC2LgfIqJZnbeyRB:DsgaN7bzvAsVdK4uGQFUZ6bU/p3
                                                                                                                                                                                    MD5:1BDAD9B3B6DE549162F9567697389E1C
                                                                                                                                                                                    SHA1:5D9C09159F07A3A9BDCC6C4B9BD9CB72D0184E6F
                                                                                                                                                                                    SHA-256:0908A4CFA23F93011176D47F45843E9CA2973030421996E8E27484781F54B0EC
                                                                                                                                                                                    SHA-512:475040779AC247BB5C3E11862FB55FBDDFA12D759EE86A33E11BC1F3B656D6CD0F9B25146C0113E43E1D8001D8867D3BC3BF7E6FE21F3A0016CB1F8B70B7A15A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...X...>......y=h....PLTE..................................t........iw..............................................._n|...Tds...ky......................................................p~.....................................................dr.................v.............................................n{.......ap}..........x.....z...................u......................|..Vfu............r.....w........................................~...................Zjx...................................Yiw............w..|....................Xgv{.....y...........................jx..............\lz.........}..z.....t..[ky........u..y.....gu................................{..........}.....u....................~...........y....r.....bKGD....H....cmPPJCmp0712....H.s...JfIDATx^...\.W./.}....Sy...(..4....D.-.....H...% .$"D.Qr.......`..;...6...N......s...^...L.....Y{.GQU`..~...j....{...-Ax.K..&.....F..I\i..

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{05235BC0-6FED-4502-8CA5-EDD9621F1426}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 176 x 513, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):11043
                                                                                                                                                                                    Entropy (8bit):7.96811228801767
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:YyroOCsBI9pkCFsHHX2RE6VOlPuIqmBtJNBfAr+ADP1IATaNeTyZ4GF+WQQ6Qwq2:BUOCsB2kCGH32RiPDtDBfArPDP1I/eyM
                                                                                                                                                                                    MD5:8E9AB9C28B155A66BC5C0DA5E2A4EFB5
                                                                                                                                                                                    SHA1:972E61F162D48F1CEE21963ECBB2FE439105DB55
                                                                                                                                                                                    SHA-256:B243A24FA13BC8523450E22F408F9EFF15301C938F8CA52A57018B58CE6785DE
                                                                                                                                                                                    SHA-512:12062D69E676B3B34AFCEF25AC17B40294282D5BAB6C0110680293D7CC96EC17EBCFE104C284E64A30EE3C483E319E9C37C03F6EE82C79632180E45C7A684E8C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR..............`....`PLTE............................................................................................... .......bKGD....H....cmPPJCmp0712....H.s...*YIDATx^.]...,.N.8.i......0..e..y.......8.6....Fo.........=...F..._..........O..{..............3.|.L.|.............>.....v..n.1J...k...."....7........J._.5LQ`..k...._Z.W.x:..k...g..._.....u<.Q{...1...q6.cs...l............30.g...< W...a.5..>O....9}..c..........s|I.).>.fo4.<q......>...c.:.u..co.#.7,.O..G./.K.|..q.p...(.(....iH.......m..+.7...../..{W.l....b....?.`^.q.9L&.>.hN2`1..m...]$.0J....rBy......{.._...G....;.r.Q..;..,...9..F...t;.+..2.Ub......V...8.k..5.........'[..s.H..).......%j._.&.....BN..V..q...T...#..........0.E&.o7....$..m..8g.f._$..k.8...5......HgQ...L..\.........)B.I.r.(..8.a..$N.9.=..o..Q..(.e.a..O.....c.= .......$0..X.S,..(p......$..l.c.I...=."......g....^..#~,&.a9iK..ZNE`...pFJ.@Wd?.<..Bt.E.......e...i.%d...}.!..B......9.........B}.....5...;..hL.D.....4z.....|.)

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{05F68F2C-4741-421A-8BC0-A89CA2DA9314}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:11:38], progressive, precision 8, 577x757, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):84097
                                                                                                                                                                                    Entropy (8bit):7.78862495530604
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:cgHTEuD99rHwA5MSadIV2MApVmfJkAKOQ/Z1I7ngpDDyHfKFVITrU:HHjXidIhApV88/jIEmrU
                                                                                                                                                                                    MD5:37EED97290E8ECB46A576C84F0810568
                                                                                                                                                                                    SHA1:18D9FACB4CFA3CBF63B882CABCF30B203EDF4126
                                                                                                                                                                                    SHA-256:140DD943D0F0CFE6AAA98470B7D1A7CB62CA02CB1D8F522DD2AC77433232EF41
                                                                                                                                                                                    SHA-512:E0F57314C136211B8253EB2AC0093DED82198E7170D4F97C40D82FD4EC4123D2AAFE3EB4EBC3E7523C4DF4D77619408773871BDE15B6DC6C4049C71D5B9D4222
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....hExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:11:38.............................A.......................................................&.(.................................2.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................z.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....b.xH......T..I...S.q.~..../s.R.x.....8.a..vE.5...-.G.A.4...._......$K..d.@NC.q....J.....>e".I.%...I0).R.I$........M3.F .

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{0616AE66-BE56-4803-920C-A1C05E923E03}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:05:55], progressive, precision 8, 612x618, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):68633
                                                                                                                                                                                    Entropy (8bit):7.709776384921022
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:tapXpSTJDOkFGdJdBk/slsbfsw1imaapnbvD8:U2OjJr6b07m1bvD8
                                                                                                                                                                                    MD5:41241EE59AB7BC9EB34784E3BCE31CB4
                                                                                                                                                                                    SHA1:98680761A51E9199CF3C89F68B5309FBEC7EE3CB
                                                                                                                                                                                    SHA-256:035B26DF61855A3F36DBD30FDAB0C157C04C9E8AE2197EA4D4AEB3E82E6A4C2B
                                                                                                                                                                                    SHA-512:3EE331D5BCEE4AD5D3FC9661D4AB4053F7D351591A094334F963C33C9D0E32CCCABE9334AD7C308108CE99617E064FE848DCD469ACD8D83FBE5C4452DE523D8F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:05:55.............................d...........j...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?../$.W:SZ./...9.....-...u......r.....].c...@W_.7...+......v.+PD.I..-<1.pDn-\.....p.$....0.}V....\..>.~..XN.o..l(E....ik..o.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{0B94219C-D5BA-43E6-B308-0198C37BF2DF}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):52945
                                                                                                                                                                                    Entropy (8bit):7.6490972666456765
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:cjvqR0XvFaGCTJffi0tgybmWDoTw71kHUAnjvawrlp2+NUO8dWSNl3PF2PjK/q09:cyRffflgybmWoTw1UUADHUbU21MjpAD
                                                                                                                                                                                    MD5:AD003F032F32FAC4672D4CE237FA5C5B
                                                                                                                                                                                    SHA1:AE234931B452F0D649D91291763B919CF350EA49
                                                                                                                                                                                    SHA-256:ADB1EBBE18D6CD8FF08AA9BF5C83CDB83BF9AA179698E34E93DBCDDE12F04D32
                                                                                                                                                                                    SHA-512:ECA25FA657ECE3A66D3E650628E0F65D3BADD38864C028AB6553950A1A66D7D55482C85E9E565573E9E5AAFA91C2D53235971C644A266D41EB69F8E72E3A843B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQ..aq....".....2....BR#r.b3$...C.Sc%...s5E......................!1.A..Q.aq"...2...#...B...Rb3..$..CSr...6............?......y_N.e.H7?........W..w....k|...S..d.4.>.RW5z.$.i.)V.O....>o...c..*&1.D..O..".ufbb..1...t..u=..K...m...~.....F..-.fb:i..=f..C.w.[{..~.7k....;..:..3....4.....$..m]...}....~q...9T.#..7.~..8...q.N;c..ffo.w...W..d........../t_........lWJE..).>..v;:=....Rrw#.m.n.n...E...vm.J}2N*..|.4...80.#..e....t.J..ZQ.x|g/....F..e....k+vK...M..W.X.e.L..~...j.....kz....=...n:O.:..[.L,.+R...Y..zKNI....,..{e..U.'...}.......|..t.]...~...b4......_.i..../.......m...a..n...v.j.?..Rc.$G|.31..#..$?.........h.w....-... .a.%z..u......u.A....Fm..J.......G..[...w.....:....w/.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{0DF87176-CE52-48AE-8855-7D4B4BA27D10}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 813 x 99, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):99293
                                                                                                                                                                                    Entropy (8bit):7.9690121496708555
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:Moq1jVORV5NO5xLCBaaNk4vhpCr1CH/DATOQlWvHMHojiaAMrxArLFRZPj19AWFz:eVEbouBaIk4T8uDGOQlVHvaAMkhDh95V
                                                                                                                                                                                    MD5:EA45266A770EEA27A24A5BB3BE688B14
                                                                                                                                                                                    SHA1:9F0B23B3C8EBA4FC3C521E875EF876FBE018F3C8
                                                                                                                                                                                    SHA-256:EDAD0F03E6FF99FEF9EF8E8B834CE74F26CD23C5F8C067F5CEE66F304181E64D
                                                                                                                                                                                    SHA-512:D4EE36BDA897BBD643A699A0332DD00DE9CDCC6F46D861789BAD259A4BF87868AE3B4CFAAB6DFAF29941C7055B77A95D76BAA86A4A0DB2BF3BAF7E3317F03EB9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...-...c............sBIT....|.d.....pHYs...........~.....tEXtSoftware.Macromedia Fireworks 8.h.x....tEXtCreation Time.05/15/06.8.p....prVWx..[Oh\E...y3kv........`.%m.R..6.1.4).o..Ki...D.......P!.].=..K...C[....f.}o7VPJIg...{3.|....d.....i..=.4.u0...n y......@j..Q..f)..mQ...4-SJ..9.d.?..5\-....:b.W..i...c.5..{..pj#.....B1C/.I.......].Su.k?.2..:.9Q...5.U...UZ...e..U.c],..2.}...1..)W./..Epr.Zt.....K.=..{......e..."...v..B.4.#....A.V1.".V}t..[..2f..Y..V9.".6.......(..gbm.P.....Y%2.c.z.:Q.2.<tYF.....u.@..KJ.;u.q:.].....$.....V....Hqk..DW.l.e.j.Z.YP?:'R..*.<........6...m@..r..j2..HK"|..L.Nc..D..y.9..B4$.......`.3.m1LE....7(OU\+./.O...%6T..w......h....).I.&n...*......#..W.41...5.#.`..I...<.?.|..*+Q.....#i........$,..n...`.s....[..E. T.w..j.,&-.r..;a....#.>(.P......f...MU\3*..;B....)..5....z..(....-...a.....}y.l..E...z>......&..g.$.....*T...N....E:./.>..#...^..E.0..%......(..@..W.X.NDM.<~.]A.>..fW.O.y.'...Z...h..).F..

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{0E125D8D-54AF-4373-8FC5-A323CA34F540}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):14177
                                                                                                                                                                                    Entropy (8bit):5.705782002886174
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:EbgGcV/hlvpfal7rgYa8S7auAxwfuSTmCSNoFQ6NO7L:EbgGcVnpwimnd38FdQL
                                                                                                                                                                                    MD5:7CDCE7EEBF795998DA6CAC11D363291C
                                                                                                                                                                                    SHA1:183B4CC25B50A80D3EC7CCE4BF445BCFBAA6F224
                                                                                                                                                                                    SHA-256:DE35AF949D4F83E97EE22F817AFE2531CC4B59FF9EE6026DCA7ECEBC5CF2737F
                                                                                                                                                                                    SHA-512:560FB15A9C12758D11BB40B742A6EAD755F15AD10D6C5DEBA67F7BC8A2AE67C860831914CBCBCDED9E6B2D1D5F26A636B9BCEF178151F70B4D027316F94F27E1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!.1..A....Qa".q..2.....&...B%6.'..R#3.$E.r457bS.DUFV.Wg(.......................1...3.Q..2Rr....s.4.!Aq.S.aC5B$%............?...n.Liq.}.{#....3/gg.1.M +..~3...q..+=..:.g.i1;P)7.....q..n.s"p...wx........v.t.f;..L/..~....y.r[.r.....n.n3..6i..g..}../........3..x.L.i?We..l.......~..<.;..6..o.....N.t.o6.l..~.......<...m.V...Q.7k.u./wq.t..;.I...}..{...>.L..3m..a....yd......6~.f..~Y..}+..<.[w..'-..?.v.7...v.u..4.......1];..u.MO.......s..p..ms.'.O-o...O......m.k.e....)t....i>..E|....,iOyD|.{......g.n...cu....=..........h.\.Q:?g/?.I.3._...t...d.n.0.%y....S.Q....S.&K.w..&wY<....%.g.v.....$y..#,i;.=...t...I6..yO..o.d..w\k...~......)..rK.......].u....N....e.s..kU.u..'}

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{15A504DA-F92E-410D-A5FC-9991D21512FB}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):47294
                                                                                                                                                                                    Entropy (8bit):7.497888607667405
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:aQ10VrIBdBvDpQrQ7P9/FUOLG2vTSeG9lkCsMKzXeMBk3CBp:aC0JIBL+QsOLG2+ZAC1KqM2I
                                                                                                                                                                                    MD5:7A450E086AD14BA7D89BA5DB3D3AE6C7
                                                                                                                                                                                    SHA1:E7AEAFCFCE476390E18C19456BDF6529D863D518
                                                                                                                                                                                    SHA-256:BDD997068701ED3A00A224EB694B003C01AC69B857FE7B4147D6C34875B1632B
                                                                                                                                                                                    SHA-512:9B6D50A6CDB6081DA107A2CDDB1BD2811A5764994C8E3F67D56CA81084BE0D068C27435154E867199F38688EA65E8DE02A56DCAC47D0F5E55F0FBB6598814938
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..A..Qa"..q..2.......B#...R%.r...$&b...3Ss.4dU6F.cE..'GC..t..5eufW......................!.1..AQ.aq..".....2BR......r.#3.d...b..Ccs.t......$4T...SD%5Ue&Vf............?..M.7(..).:.a.q.......>..[:O...afQ.uCO..U.....go.l..p..YqVklQ.{i.w&.]Z.\+JQw._.n.'.h..,.bj..X.].k&.Q.>gU..f...1|....[...jQ.%Zb.......t..........*..V..j.6....Vj..i.....?...IY.P.....$.j........[l.....S.4.J9.U\.......7I..[..=*N5....xW..../...=?n....uG.D..S.>...8..3........n.S....]k.*...4.>.R.o..{..l.H.#.^....<amG.m&.......,....wDY.W.m.X....We.IR.Nu...y..Z.l.._S.mr.m...y.]m.R.MT...6.5.5}.K..#%..k].7.Y.q]...%.r.7.R^jR..z.K.T[t.a..d.)glW.r.v,.`....O..^..o:.Uc.\..D....f..D......yt.Q...Y.....

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{1CE901A7-7591-4761-8533-5010B8136879}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 276x139, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4819
                                                                                                                                                                                    Entropy (8bit):7.874649683222419
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:/hnQiz+ET2/hDi+tv34VtpWfowTHgegb6hhLT1NTS:5nQ6TAhLtvIzMvbi6hhF0
                                                                                                                                                                                    MD5:5D6C1F361BC04403555BE945E28E53FC
                                                                                                                                                                                    SHA1:00C254F7B3BC0289590C2BBDBB39C8EC2E2B2821
                                                                                                                                                                                    SHA-256:131D637CDC5D0B094FB9FAD17F4D2A1ACE0D03613588155AACAA2D1CB4E16DA9
                                                                                                                                                                                    SHA-512:34D2C0929FCC3CC10D0A2121BD55BFA9A07062C2A7B8F101071164C946895DBCB2777641E79DE4193D57A3F0778DD4F1351FAF333B7E4B4DBE31A32DD69C51F9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222...........".......................................<........................!1..AQaq"...2B...#Rb..r..$3CS.cs..................................................!1A............?.............u....p.p($.Y...9,j...V.*..S86yh.G.#m.5..9...6Y.."C.R:.[..-.7U3c:..].;.....f.?%..<T...&F.Lh.N...m]..x.D.g<B.....k..S........>j.K....#U..Z....<e.:..8....o..xq.[..4v..U..y...k... k....A#..A...pn.jJ.I.7:..{.b..ns.t,...8.Td.I....m.I.5Z.).-.. ]..X.Do%.....?..4jV.`llt.E...5...u.|..\F.=.F.r<...5dV....xc.%..&...4,...f...3..H.<......eQ...P.J....7...lLc..?..-.fR..7.#.6.......}:.]'.ny..........e;u.Y..$0...i..-....f..9(....}..T,.Inb...+=Cca7....WULA1@.s...4uY5.N.f.c..].ks.....3v..~..k..m)...f gNE`S......#.....Z..6.uc.m...#k.s.f*.l.$6..?..xC.Cm.`...N2..&H...._.&.E...[....f.Z./...!.a{K..#.V.5..v.B....1...9..B.&....%s.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{1D36C74F-6CC7-4BE0-8B27-EA1F0CB843E5}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12824
                                                                                                                                                                                    Entropy (8bit):7.974776104184905
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                                                                                                                                                                                    MD5:2628353534C5AD86CBFE57B6616D46DD
                                                                                                                                                                                    SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                                                                                                                                                                                    SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                                                                                                                                                                                    SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{1E4520C4-8C17-4447-8DAF-F2C78257DD2C}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):136726
                                                                                                                                                                                    Entropy (8bit):7.973487854173386
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3072:SIXmy5Tl704vW2ZKkvV8UU0ZWUF0BJwySIdgz816YzDc1+opecYPn:Sny5Tl704fZFV8UU6LGXwyS4xohpQPn
                                                                                                                                                                                    MD5:4A2472AC2A9434E35701362D1C56EDDF
                                                                                                                                                                                    SHA1:16FA2EA2D2808D75445896E03B67A93000EEDDD8
                                                                                                                                                                                    SHA-256:505F731CB7707EFAB2EB06685B392DC7E59265A40B55AAE43E5DC15C0A86CBA4
                                                                                                                                                                                    SHA-512:5E28D8FB2AC62ED270968072A30013334461F7CAE96058AF9EAA6E10912989DC47112D2133892BF61F7A516B77C6FF71BA2A000B750A9F95C787E538B09595C2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQaq".....2B....R#..b3...r...C$...X.....Sc...9.%'.(Hs4Dgw..T..5GW.x.)......................!.1..AQa"2.q.......B..#c........b6.Rr.3s$.&..S...C4.%5............?.........(......(......(......(......(......(......(......(.G/.GE&...)..P.x..B.({i2Y;.z?G...Yfc.)H..^....#.....}3..Sc^.H..+...M.a.P.....GS.....H_.3..<....1f........1.<.\..nn-..s.s.\9Y....=.......S.0.......N..cA..Io..r.3..........ay.....K.....,.;9..Q......xO.Fa.2..>........{4k.....|....?U....3.8..._/3....#.. t.y......yY.......e.<........#.....B.....Z.%.Y..S.ye.W4...l.......X...%.@y}>....l.yi..D..W......L..._D.Q....)...E....n.%...*..K.4#.8`..I....h..h.o..I......-...hB...3..u.(5..........n...,.@....a.t.9.....@.s.>.&...@

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{219A411E-9F5B-40F4-8DEA-67F33B6B0556}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:10:32], progressive, precision 8, 594x773, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):242903
                                                                                                                                                                                    Entropy (8bit):7.944495275553473
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6144:YVxOYlZX2kCWfYoFMXC/sBFC9r+4iEGM4rrcPoWmwkU6FJ:+OwZ2kbFMC/L99ifvokU6/
                                                                                                                                                                                    MD5:C594A4AA7234EF91E6C2714CFE1410F1
                                                                                                                                                                                    SHA1:C0F720D4CE3196852814D0B7347F0CAA0C6FD526
                                                                                                                                                                                    SHA-256:10C833E47BE1C8496F949A6B059C2D79212A4DD66BDE62116EA337FA4FE0B654
                                                                                                                                                                                    SHA-512:7313F6545A334F9E2DE5430B2DB5C419C4C8A40E075338DAFCD74970BCC6309786946E5DFB57531612BF4C6269495655706D920FD99922FDACFF9796710DA9C0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:10:32.............................R.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................{.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...v&.F;-v;}FH..Z...N..)Y.......h;C....G.0W..ww...MI..Z+..\.........c..4.1.~.Yo.Y6.&. q...............l.A#.~s?yYg..7ky...r

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{27B95F47-3BA5-428A-82EB-BCEF79253CED}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 76x97, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):784
                                                                                                                                                                                    Entropy (8bit):6.962539208465222
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:869YM8fij0W/xfuCp7ovv1bidiMn3bGi6AETQcdH8SADjoZgV6v9jUEvS3/g:N9YMWeI424diMn3yinsQeHvADu9QEvJ
                                                                                                                                                                                    MD5:14105A831FE32590E52C2E2E41879624
                                                                                                                                                                                    SHA1:078FA63FC7DB5830E9059DF02D56882240429D90
                                                                                                                                                                                    SHA-256:D0A3A1C3CD63C4023FE5716CBE2C211307D0E277E444D9EF76C7FC097A845FD4
                                                                                                                                                                                    SHA-512:8FC0ED24E8EC14C46EA523D9265DE28F85C5FC57AA54AD5B9CA162E95F79221E2AD3DD67D1293CF756B67F3D3DECAE122254134EA8D4D00DDED02114B5383947
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......a.L..".......................................-........................!A."1.Qbq....2Ba.........................................................1............?.....3.Ty\......vs....>.>..a.W..s89.d...Z}......rz...`...Z.r.do....u.W.%....gf.>.L..xz....B8=w...g.~g."HD...$..IKJ......nn..*ly..I....L...\q...Q;6.KrxZ.,...j$..ZQ..)f...q`.*..C1..cZ2]-..\.~..J.....^..(.f..9m?..C.NI.UL..X.fy.Z.........+n....r."Z...d..R./\.#...kd.D.5.!...h.3*s-+.......Xjt..}i..rK..y.../>u..]N.....Y..J......1.x./.....F6.......I...._3...k.sM.+..v;.%|.f.~.......:y....S....UKovh...W'........lF... .................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{29A6CEFE-527B-4006-8280-EE505A3D86C5}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 3005 x 184, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12180
                                                                                                                                                                                    Entropy (8bit):5.318266117301791
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:k1bHyG/fKOOOOQJUg+g2S+kEm6alfsfsfn32:+bSG/yOOOOQ+g+gOab32
                                                                                                                                                                                    MD5:5C859FF69B3A271A9AAB08DFA21E8894
                                                                                                                                                                                    SHA1:3156302A7450ADFF4D1B6EC893E955D3764D4DD4
                                                                                                                                                                                    SHA-256:B4A8E9A67EE0B897615AC4CCE388FFC175AB92D9E192E6875C79A4E7C1B5BB6E
                                                                                                                                                                                    SHA-512:4CF518136EEBCA4F400A115D9B7BB0CAC9FA650BF910B99E15F04A259B7D3EFCFFD6796886FE09DB08C37C332B14BC8500845C09C8EAE1F2306F90E98D3C99E0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR..............;j.....sRGB.........pHYs..........+..../9IDATx^...dW...S=.dL$.............-.`...'...x.7.D...(...$.?cO....9S]=.v...Z.......{..wNuf.&.....a.k5~...._..\.yk..v.....}{._.Q...5...._9o.n.....}7.].1v..t......q....3.<..0<.p.......0....s...... @....... @....... @....... @....... @...X.'..U-..... @....... @....... @....... @....... @......,I......+..... @....... @....... @....... @....... @........z...r.. @....... @....... @....... @....... @....... .$.C.KJ[.... @....... @....... @....... @....... @........&`.=X`.%@....... @....... @....... @....... @....... @....../)m.. @....... @....... @....... @....... @....... @ ....`.)....... @....... @....... @....... @....... @....K.0.....J....... @....... @....... @....... @....... @...`.....\.... @....... @....... @....... @....... @......,I......+..... @....... @....... @....... @....... @........z...r.. @....... @....... @....... @....... @....... .$.C.KJ[.... @....... @....... @....... @....... @........&`.=X`.%

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{2C62267B-7817-4567-85F1-167F1B05E353}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):53259
                                                                                                                                                                                    Entropy (8bit):7.651662052139301
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:dCiCBBenRYWDBCipMYGTbYGLHbXxoP/qEF+MU50qyJ30h2W474S/Aq/xc4674bi5:dCiIQXBCiwbDLHD0/sFyVel4Pi4UgE
                                                                                                                                                                                    MD5:2EE369ABB7936F8C28FF0ABDD224EA05
                                                                                                                                                                                    SHA1:FE9D304A7B49E31EAE439369ABC548E265149636
                                                                                                                                                                                    SHA-256:FB12D59B8BE911247BBAFDD416852E8B74B028005A141CB4DBBBA109B4B6ED2C
                                                                                                                                                                                    SHA-512:5CF396CA472C32AE988600176114106CB1619404DD899A3867A5AB43DC90583B771EF69B14EF50E56A21F038BF51D8463C6ADD2DE9D4CB523F6290E24A4DECB3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..AQa....q........"2..R..Bbr..#S....3$.....C.4v..(X.DtEUV.....cs..Td.5uf'Wgw8Hh........................!1Q.Aa....q.2...."R...r..3.t..U...B#S.4ub..C$d.5Ee&'7c.D%sT..............?.....?...k,lk^...M".Yo5.Qp.&s}b.m.:...W.x}.*.a......N1..d-n.-..^..b..TZ.W..."....F....^......ve5...^...2.:i...........~u2pK.z./&..u..L[I....Y....@y{|>..MN=:....Q[..H....a........|%..4fV....).....^.9b.f...F...p.=.W...aZ.........Z.t.n.....z3..[..lVh..\.N-.._.sK.y.._e.G.jig.a.7^....u...*.p.5.a.].........u/u..D.yl.XA..f.z..~.x.....N.....b=.uv.2.t.'.N.-.H..n.v.a.A[.Z.....T2...._...:....h..l.E..sm..a.3I...RE...fWb.Ek.0.#.)..Y#T...........u{....U....s.].7_H.2.`O6...P......}..4LR....]4.mid...

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{3020D168-67A6-43E9-A293-146214488189}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):25622
                                                                                                                                                                                    Entropy (8bit):7.058784902089801
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:EhK81gTCyJ/Gf9Aw3t8w8EtdPeGDh6bEi1Ie1u4ZbvgwTwrSRh7ZKNpIGY:IjcRXwdJvtdGsUbEi1IeY8vgwTyC1+Y
                                                                                                                                                                                    MD5:F8CCFC24DEB1D991EBE085E1B2D7D9BF
                                                                                                                                                                                    SHA1:AF76C22A765434AEDA134924C517C84107F4FED5
                                                                                                                                                                                    SHA-256:7354001527AB554C44E7D6981B86DD933B7DC2E0D3DC8512AD3EECD843245C52
                                                                                                                                                                                    SHA-512:818BC3690B01B30BC571E4CF45EC8D1AFCAECBAB003532644381F1CF730A5B3486862D08F7579B2D3D89167AD7DF35028881245C9550B0DA23D1F81A720A9704
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!...1A.Qaq.........."2Rr.#.t6..B..3S$4..v.b..Cs.%5..8..cUV.(.DEe.&Ff...T.d.......................!.1A..Qaq...s4....2r..S"BR.3....b#C$.....c............?..D.."}:......&&...?3..W.q*.......]...m.Y.k1......K).J...uV.b.../.0.E.H..4..W_T.[t.V.w.9.x.qe.L..o.oL.....d.\.....6.|.o...}..H{Yn..E...6Y3.l.e..D.:,.n.%...t...m.........,+,..|..n.....6.*...f........6.../$../Vi..H...e.f.F.zn.).n.E..2sTn.i...Yb?6+H&...Bf..*....z.o.^7[..u.:o....t.s=.....(.s.....f.g....q9o.u1L.N...smzE..[>...+\O....j.<....j.c.W.............U..+.F/.'..W...T./W...>i01./....j.s."..Q...{...a._~OW...Rp.)*.e..W..Q4)<..'..W...q...'..U..z..g......U}...O....w....0F:.N..V.3W.|..'z0.]...j..U[v..g$D.Lc[.e...UW.m0+

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{37DBEC22-4FFF-403D-A836-B18F1F218504}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):25622
                                                                                                                                                                                    Entropy (8bit):7.058784902089801
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:EhK81gTCyJ/Gf9Aw3t8w8EtdPeGDh6bEi1Ie1u4ZbvgwTwrSRh7ZKNpIGY:IjcRXwdJvtdGsUbEi1IeY8vgwTyC1+Y
                                                                                                                                                                                    MD5:F8CCFC24DEB1D991EBE085E1B2D7D9BF
                                                                                                                                                                                    SHA1:AF76C22A765434AEDA134924C517C84107F4FED5
                                                                                                                                                                                    SHA-256:7354001527AB554C44E7D6981B86DD933B7DC2E0D3DC8512AD3EECD843245C52
                                                                                                                                                                                    SHA-512:818BC3690B01B30BC571E4CF45EC8D1AFCAECBAB003532644381F1CF730A5B3486862D08F7579B2D3D89167AD7DF35028881245C9550B0DA23D1F81A720A9704
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!...1A.Qaq.........."2Rr.#.t6..B..3S$4..v.b..Cs.%5..8..cUV.(.DEe.&Ff...T.d.......................!.1A..Qaq...s4....2r..S"BR.3....b#C$.....c............?..D.."}:......&&...?3..W.q*.......]...m.Y.k1......K).J...uV.b.../.0.E.H..4..W_T.[t.V.w.9.x.qe.L..o.oL.....d.\.....6.|.o...}..H{Yn..E...6Y3.l.e..D.:,.n.%...t...m.........,+,..|..n.....6.*...f........6.../$../Vi..H...e.f.F.zn.).n.E..2sTn.i...Yb?6+H&...Bf..*....z.o.^7[..u.:o....t.s=.....(.s.....f.g....q9o.u1L.N...smzE..[>...+\O....j.<....j.c.W.............U..+.F/.'..W...T./W...>i01./....j.s."..Q...{...a._~OW...Rp.)*.e..W..Q4)<..'..W...q...'..U..z..g......U}...O....w....0F:.N..V.3W.|..'z0.]...j..U[v..g$D.Lc[.e...UW.m0+

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{38FD630B-8152-4FF9-8A17-FD889C6E8EA9}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 69x630, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):11040
                                                                                                                                                                                    Entropy (8bit):7.929583162638891
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:u99+91V42ho91V42ho91V42ho91V4235z9pUkDCyixxo4PS6b8tEy3BcWWhhSy0b:ubKD4/D4/D4/D4uzX38u4PNYJ2zhhmb
                                                                                                                                                                                    MD5:02775A1E41CF53AC771D820003903913
                                                                                                                                                                                    SHA1:2951A94A05ECF65E86D44C3C663B9B44BAD2BC9D
                                                                                                                                                                                    SHA-256:83245F217DEAE4A4143B565E13C045DBB32A9063E8C6B2E43BB15CD76C5F9219
                                                                                                                                                                                    SHA-512:5A1FCC24BDD5EE16BC2C9BACF45BCECF35ED895EAC22D2C4EE99C1B7E79C8E8B9E5186E3D026BA08FF70E08113F0A88FBF5E61C57AF4F3EA9BA80CE9F33410E9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....C....................................................................C.......................................................................v.E.............................................S..........................Aa..!12Qqw.....3568rv........".....4Btu.....#Rs.(W..bg.................................D.....................1..2.!4Aqrs....Qa......t..."3BRb....#.$S.Cc..............?...K/h._+.N6.-.a...5...;.r....,...0B.s(..zp..4.%r|q..E.Q^.../...C.R..?u.q8XN.>.e..:..gJ...._.n>.70G,..(........3b.&.5m...Q../...7Ie..k....e.l6..&..`Gt.P.Y^r...=..Y.e...N.B...O.#..J+........u.V;G.'.....V.]8..C.]..........E.....c..w&lX..f..\T.J?...F.,..m|..93........,.....+.R..WG...%.....(@.....p].iEz<.8.^...J.h.....a8P.1......(z..y~.........H.Z^.>..<.....L.k..IG...R.(.%..m....&u...B|.....@]ey.W.J...!d..R.8...[..>8....(.G......!.)X.....,'..F2.Z.t..Aw./..Z..#..i.kK.......b.i...qR.(....RE.............O.XP.#..(...9J..]...,.2.[w....KrW'...tY.......{~.:.+..

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{39284A90-D704-4543-800C-916739F246E7}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):95763
                                                                                                                                                                                    Entropy (8bit):7.931689087616878
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:EoES7mhTyzabUaE77xAOmq0zVruQlttNxlipxVWssMU2YhRy2v6pKKYhQzwMc2:zz7mhTyzabUa4b4xuQlttnlGx8x9h02M
                                                                                                                                                                                    MD5:177DD42CA99CAA2CCBF2974221680334
                                                                                                                                                                                    SHA1:35FD86B3DD082A6D4930C67BC0E05D3B5817465A
                                                                                                                                                                                    SHA-256:525A857D0EDA855A64D3619DF58B1C2D013A73E60FA0D49B155ECFCB2C134C7C
                                                                                                                                                                                    SHA-512:6FB6D9A6C97B1115C3246690A2F339CD612899AC25ACBA00296EAEAA0A1D094E7339D670969764FE23EB7C08FCDD01C6F78FBC0735D504D5E02AD342901719B3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!..1AQa...q......."...2..B#Rb3..r$...6..C4....Ss%5...tu.c..Dd.EU7....................!.1.AQ..aq......"r..2...4Rb#3$B.Ss............?..H..dV....U..-..0]Cp.%O.Z.Y.e.=/.q.....j76.w@s...5.&&&5...n..w..>.1....;.vR..[.......=.......KtY]u3.g18...).r....&.IZ'.....g..4kY..X..b.......y<...r1........e.._...X...w....op.m%Jr31...S.Vo.._....OI\]....F..V-....\...2j..X.....y.p.$4.....&#..]..n.V..x..P...F..C.f....])..~..Z\.....,..#..v..v...2V.k.SuaydO../[.*c._..oTV<Z.s.[...o.x..>....-....v...#....-.X..L.Z./#.XG.-.0......%w..H.@aZ....C.}...N~.;..R......5.D......I.... .R........s.>..ks....(...S...9....2=. :^.. p.+?(....$..Q..I.........=|..`2. v..t......U*.8.u.. ...'...*...2;u....& 3..$.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{3A08E9A4-7043-421D-A1BD-40467DA8C032}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):53259
                                                                                                                                                                                    Entropy (8bit):7.651662052139301
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:dCiCBBenRYWDBCipMYGTbYGLHbXxoP/qEF+MU50qyJ30h2W474S/Aq/xc4674bi5:dCiIQXBCiwbDLHD0/sFyVel4Pi4UgE
                                                                                                                                                                                    MD5:2EE369ABB7936F8C28FF0ABDD224EA05
                                                                                                                                                                                    SHA1:FE9D304A7B49E31EAE439369ABC548E265149636
                                                                                                                                                                                    SHA-256:FB12D59B8BE911247BBAFDD416852E8B74B028005A141CB4DBBBA109B4B6ED2C
                                                                                                                                                                                    SHA-512:5CF396CA472C32AE988600176114106CB1619404DD899A3867A5AB43DC90583B771EF69B14EF50E56A21F038BF51D8463C6ADD2DE9D4CB523F6290E24A4DECB3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..AQa....q........"2..R..Bbr..#S....3$.....C.4v..(X.DtEUV.....cs..Td.5uf'Wgw8Hh........................!1Q.Aa....q.2...."R...r..3.t..U...B#S.4ub..C$d.5Ee&'7c.D%sT..............?.....?...k,lk^...M".Yo5.Qp.&s}b.m.:...W.x}.*.a......N1..d-n.-..^..b..TZ.W..."....F....^......ve5...^...2.:i...........~u2pK.z./&..u..L[I....Y....@y{|>..MN=:....Q[..H....a........|%..4fV....).....^.9b.f...F...p.=.W...aZ.........Z.t.n.....z3..[..lVh..\.N-.._.sK.y.._e.G.jig.a.7^....u...*.p.5.a.].........u/u..D.yl.XA..f.z..~.x.....N.....b=.uv.2.t.'.N.-.H..n.v.a.A[.Z.....T2...._...:....h..l.E..sm..a.3I...RE...fWb.Ek.0.#.)..Y#T...........u{....U....s.].7_H.2.`O6...P......}..4LR....]4.mid...

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{3A5A6130-28D4-42C3-A134-6AC434086B8E}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 40 x 650, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):647
                                                                                                                                                                                    Entropy (8bit):6.854433034679255
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:6v/71rwqZMXVs99W1YvpLp/Fvl+f43ocLtuplb+CrGotLRd:+wqWXVs99rpLpNvr3pIx3b
                                                                                                                                                                                    MD5:DD876AA103BEC3AC83C769D768AD39FB
                                                                                                                                                                                    SHA1:1833603AA9B6A7E53F9AD8A336F96CCE33088234
                                                                                                                                                                                    SHA-256:1262DD23AD54E935CFA10FEB1BE56648E43BEF1116696CA71D87E6E033B1CA7D
                                                                                                                                                                                    SHA-512:946DB2277213104A3B29EC4388578B05027B974A3093B4CCAD8847397AA51AE308BC6A199E5705E1F901D6E4B1BA34D8DECFD6E5B6685184A307D749D7CFAEDD
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...(.........xk....`PLTE.........................................................................................>.S.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.)..1..7w....6.*.H`T6.ha.k.............b!....Ba..C..P.4K..@.....h.E..X....PX+.P.-.....@@"...o.O4....xZ<...B...B..,A..y.s<......b!....Ba..C..0_p. .......=..,...i. ...=.j..N...........{4+...xZ<...B....|.....$.K<.vyE..X....PX+.P.-.:... .'p......\,...i. ...=.j........K.....%J..S+.....q..k.H.@DD.s...:..J.K.DDL.\.@`,.DD.:.(]..N....KD....A M.....F..S+.....1.sq........\.t..;..../...~k...4.DD.:..]..N....KD........@DD.s...:..J.K..[...Q....V......IEND.B`.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{40DBB311-21E5-4699-92FD-89A4AC2D65C3}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:08:07], baseline, precision 8, 595x450, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):59832
                                                                                                                                                                                    Entropy (8bit):7.308211468398169
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:HS9SYFtN0+CRa9mfJy4zBAiIJhzrkHDV2hJK:yAmta+Tyy4zBIJW5WK
                                                                                                                                                                                    MD5:DCDD543A4E0BA2C1909BA095D46FFBCB
                                                                                                                                                                                    SHA1:B86C89537138FE07255354202D3EAD0B53B3C54D
                                                                                                                                                                                    SHA-256:28F334B77068F71F5F92A95695433B950610204A0E5580CE567DB8FAD4993ECB
                                                                                                                                                                                    SHA-512:5408C3259B7F3288A4BEB04342799AD5FE3A6F0EC7E92353B29B7E7E538DFA9903B39637226919E0421BC422635D25F5F8069DC7441864DC03E1B909BF5C2C84
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....fExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:08:07.............................S.......................................................&.(.................................0.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................y...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?......;R~+'....xh..~.n-}.......Te................^B..IU_....._...S......h.......!....9...A}6V=J......C..c.....Ug.Wh......

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{4195FC67-D1E8-41FE-B603-6BAE937AEAE8}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):41893
                                                                                                                                                                                    Entropy (8bit):7.52654558351485
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:pZvVQkUbOHxx3pvVmO5rsP5gUdXwFMuv53knzyncaXgRDqPU:pZkijV5wScXwFMYknzucaXgRyU
                                                                                                                                                                                    MD5:F25427EFECFEE786D5A9F630726DD140
                                                                                                                                                                                    SHA1:BC612A86FF985AB569ED1A1EA5FFC4FDB18FC605
                                                                                                                                                                                    SHA-256:5A36960DF32817E8426BD40A88F88B04FB55B84BAEF60F1E71E0872217FDB134
                                                                                                                                                                                    SHA-512:B102F34385196D630F198667E874F25ADBC737426FDAE0747EC799B33632E5DC92999C7C715DC84D904342738930267AB1709870BDAA842243E4C283FE5E1554
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................!.1AQ....aq......"......2...Xx..9BRr#.b3$..&..g.8....%F'G.(H.Ss..D5E..v..W..Cc.deu..7w.h.).....................!.1....A..Qaq...Ttu.6..."R..5...2B..S....bcs.Dd%&r3C...#$...Ue.............?..R...%.R...t.MQ*.l...v...V]..n...Zw....M....4..F.&&bb0.:]l......ay.r<..3.l.Q^.........I54.N2.8..2s...w..r6.......[1Zh....O...9..>...B......x]...r.\.\..v..~....y.QT.3.......=....r..}.l.....o;....M..C1....w)...+o1f.]...MoA.E..s5..i.\....miGsy..m\.Zj....I'YU.\tU6La5v.>.K..m.]1.......k..0....</5v.V7lY.e.vV.+./[....f..u{....s.}.Rb.Z.....Y.6]..m....V.\...Mr.=r...K...l..%..m^.......X.(..fG..[F*ly.jL.a4..vs..o.e..q.9km..w1.yg.....r_.*h.n..5i.-.{Y.l...<...'Or.s..Z....../JP.....\FV.S..............m

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{41C18F98-6DD0-4D55-AD34-69334DE3C7BA}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 50 x 556, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):977
                                                                                                                                                                                    Entropy (8bit):7.231269197132181
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:6v/7QiFJaY/z+obuqFA4fypjQSbtBK+lcqNGSbb7XTJArRRzN5DjNRkPmu5cCbR2:x0QY7xbjy9pY0JPXLTWroeuCCbX0
                                                                                                                                                                                    MD5:B7F74C18002A81A578A4EE60C407A8D3
                                                                                                                                                                                    SHA1:70A7D4BB1B3ADF4397D168AD0D81B286F88EBDE0
                                                                                                                                                                                    SHA-256:95F59A0433050180D4C0E8858B83363D51BEA6752A8B7CA516A8677854D8F5B6
                                                                                                                                                                                    SHA-512:13186A7CDCE80BCA9D2238666D6D7A989FA1887EABFA5D8A9A63EEC304DFD4BE8EFF652205FA56E1D1CEE7D3680AF8C70A952AF73AB3C246400E8D4EBECBDBA9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...2...,........A....PLTE...................................................................................................................................................................................$.y.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^...0.D_.......cck.....%a...X.a0Y...-..!.G...[....(.r.H.$...1 .zq.4V.e|a.6.X..4..kl.%....=w....6..TN.....{.4..T/.z...../.....3..!~..t.#b..^.....E!.SFb ...-.....^...,..C.!.b...i._c...s.X.w.. lsQH..H.gKc@@...i. ....m...;Ci....@G.; V{..lO..\.R9e$..{.....P...E.+.2.0D.B,..P...56.?......K.6..TN....^z.4..T/.z...../.....3..!~..t.]b........E!.SFb ...-.....^...,..C.!.b...i._c..Y.O...?.9k2.M.?5 .n.P...,...d._..%M?....6....,.1..R.4.a.R.+..U.Q..P...vd..T........j .]@....."..lJ../.90.4...Y. ...9.%...{......Hc%.....i..%M?aG..H....o.q.......4.......X.d9.r..CI.O.5.Ri0?.s\b....w...>/k..4V.)Y....P...vd..T........j .]@....."..lJ../.90..2..MP..l..?....K.X.....IEND.B`.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{45FDD123-8F25-4BED-BD7E-5B34F1B22BDD}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):179460
                                                                                                                                                                                    Entropy (8bit):7.979020171518325
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3072:oiKXvL7lv0am/R1vrdH+9dK6zPQ6bbnGDpcGGDNMIOIMAT8q9Vc02Q57S4A+vMFz:+vlvC/HvgA6fGqGGJlO1qZ71W6CzDn
                                                                                                                                                                                    MD5:4E131DBFEC5C2462273CA7B35675B9D9
                                                                                                                                                                                    SHA1:CA037F444D819A118AC37D7AA3782B9BF94C1616
                                                                                                                                                                                    SHA-256:2A4A3530D652E227DDD5ADC096A95F6034718F7C380B07DB622022D768815059
                                                                                                                                                                                    SHA-512:C333ECEB1439D0238BF44FB7896E62DBA4C645B70413AA0F99C1F10E8DCD20C2EEE5C83F2E9DDE9A2494C85A6D8D13CFFFC4160E2F598E17867015F5244D656A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!.1AQ.aq...".....2Rr..Bb..#34.....CSs.$5c.t....%.Dd.6.T..u.U....E.7w........................!.1A.Qaq......2."r.3....BRb.#4......CsSc...$.5..%.DT.t67d..Uu...'............?..c.......p..z..i.....z......kj........F>f......3N...M....RM.&..-.~.Q..'.....q.a..w...-~......g.{..&.......V.n.D....>FS!n.....@..)...W..q..Wr{..J.gf.{.M$.P@m.,..9..&m.D...w.._...-.O........s.....h.k~......(.K...V..l.-...+.9.k......*......#.p#.O..9M..mF...C.......7+.AI....4vw.;..H......e..Q.u[.eUK.....z.....[.Kt...s..Lf.4..l{.....sh.............=..;..iqkj.m.a...NH......v..H..$..q.y......c...U[Mcf.......+...S-...^....4..T..YtL.x.v.;.....<...Ik|B.$.s8......3.+.8.l.. h.:....%B..W..I.QRS..,*x.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{46FD76D0-16BA-4E77-A1CF-760AD50BD16A}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 177 x 123, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):65589
                                                                                                                                                                                    Entropy (8bit):7.960181939300061
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:2Hlrjw3xL//DPgff+9j6yPWvHMHjkbfnwHO3AW3GL:2H2zDUU+yPVHITwNfL
                                                                                                                                                                                    MD5:8B48DA9F89264D14B83FF9969F869577
                                                                                                                                                                                    SHA1:E1BD58E2D80FEEF56DC514F3F0B3AB9669F22F95
                                                                                                                                                                                    SHA-256:62AD3C277E54F03F1ADB44062407346F789E63859B7AFABFD64BE6AF5E9F66EC
                                                                                                                                                                                    SHA-512:03B783EC968DF3F648504D068D64DD1AE110E28110FE5B3401C9D04F44897DBE0CBB5680D42CA4C665FA94A6CED4B559106EB3C06C9BF2C5B14951ECBFFAC8AE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR.......{.....;Za.....sBIT....|.d.....pHYs...........~.....tEXtSoftware.Macromedia Fireworks 8.h.x....tEXtCreation Time.05/15/06.8.p....prVWx..Y=.+I....t.y...,^vv....;. "|. .i7.....$.2g..']pH@p..]b....H.H.......d'@ B...U.xm..3{3k?..5n.._}U...3......~..>...g.....f..t...t:...p>..Si..d:..k:.Lf..t6.K.i....d<...x.8\.8.+lc...)i.$.r.....x.t.BG.R.cm.c...p.:&.6.4..K.......^...~b].0....oBYv..u.'.=.K.Q.g)6.....4.!.M......4.=....G.%.Sr........nxC.F..t.U........1...J.t..eQ....".... |...81.$D.!.>...........$...^.vY..EY8tb..'.P.g#O....S*..0'.V....x.W..........k.......s.C.S...J%.iVb..].........3....j.}*.z....+.s..@..K.....\x.C..e.Qq.....;N.....;....,....^.*..$F..{G...8.#....8'..&....8..5.....3(P._....S......|".....u.cr....+a-....&V..x...iI-<|a.{E.c.X.......?..&.C....'........(.x....>...M.?.9..#X......l...0...Z.F..<.z.0}Q..Z1..........?h..`E$K.2o.A*c^.......*..D..uL=.}.#*0.. M!.A.C......|_..(.Y........!E... .O...`;....M+..x.u~g...q>...N."D^..K..x..D.`.!.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{4833BD3B-DA12-4927-B5DE-75B8D0887E4C}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):55804
                                                                                                                                                                                    Entropy (8bit):7.433623355028275
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:gVvci05lhVbfBcWvBLeynluexaWqzww/u5:gVUZhHDljaHww/u5
                                                                                                                                                                                    MD5:4126992F65FE53D3E3E78F6B27FD49DC
                                                                                                                                                                                    SHA1:BC0D76B69310DA9B909D3EE4CECBFE5F386BFB45
                                                                                                                                                                                    SHA-256:3FBE3C1C238BD7DBC67F8CFF5F3BDDFD513C96A9851B9616477947D21DFF4B2E
                                                                                                                                                                                    SHA-512:624853F5E56D224C8188F122B2C4724F867D4099E7FAAFB9C945BE7E2907900ADCF4AE97AB08909CF94E96FB6F381E3B6396D560D93EB2731E4E69CBFE628F10
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d..............................................................................................!1...AQ.aq"2.....BR..8x..r#..9b....3....CS$.'.cs.......7Gw.(.4%5&..Wg.h......tEVfv..H..........................!1A..Qa.q...."2..u6....BRr.#...b..3s..d...7.Cc.$Tt..S4.5Ue..&..%.................?...,...8..{..S.y.N....%..q.8..H[5....o..xg........)c(.eO.YO..._D..x.U.....%.S.r.r._.^..Su.h.Q.t.:.#?....x..B.S...Q.....oqF..%..8'.qx....%.2JKjF..{y.w0.*a.RMb.c.Q{%....eW'..[IV..'ZW3...[...MN.....rO.:....$.i..7....Vrrr...I.r..M..Qo..j....q.^...N...J......%.J..)F...>$.....u........o...+......[...*..t....R}.I..R..S..GB..:......).6_[^Xft...F.1.....zP....,.#....MG.T..Q.F.....)Fi../.I...,%.voEb.b.Z..V3..FT.}..[Z{....wd.z.e.....QwW(.).t..\..'....:)<W.<..&k...caRT.X(..K.....:f...]...q..

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{4D69FFD3-6C89-4E2E-9CC7-2210420AB274}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):109698
                                                                                                                                                                                    Entropy (8bit):7.954100577911302
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3072:rDlmvIWr0aRtNCfShCWBxyCHMlcVG0Ezy4FR:rDliIfot8ahCWBcCHDVwR
                                                                                                                                                                                    MD5:8D804A60E86627383BED6280ED62F1CF
                                                                                                                                                                                    SHA1:E23FF14B10AD0762DD67FBA3CD6EFC85647C0384
                                                                                                                                                                                    SHA-256:494547E566FB7A63DD429EB0699FE41AA8998F8EA2F758D813FE3D56C3075719
                                                                                                                                                                                    SHA-512:0FB19F3D00159F2748C3A54E952E551B9FEA6910D67A54DECA8D099992E50383EADB92768FF1F75CFFAE82A7A157B1E0F77A2F0BE7EC64FD2324304FDCA46577
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...............................................................................................!"#.123..AQB$..aq.RCS...b..c4%..rs..D&....5E6'..TdUte...u.....FV...7.......................!"..1A2B..QaqR.#.br3.........C%...$5.....c4U..Eeu&SsD.6T..................?.....O.C.....^..R<A.g...[....3.....r.0.....nX.S....}...[.?Z.....A.?..~~I..rY|N.o...9......!...o7r../-.y...'5.3.U.s".-.0.1......SS...&.Q.j.*.$m.e..:x....`}...EP.?.7..~G(so.......O.....z.N..<....~^a.e...........p9.?<._..|......~.<@.D.9..G..?.?z.y?z.C.U.w..[.,..A.+........s......g...G.^....pz.xY.....d8.y.X...P..O(A.O..~:._.......<...o..4s..^.^b..x......_a.....|{c...:..X.....}.._...[?..NK.c...}.<......H.G....+x.Z..|....n...o....`.nk.#.%x......-|...|7......N!=././..w.8x.".8....'x........w...,>....j[w8a..}..lS..?.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{4EE3AE71-1596-45E7-AC5E-B6957DBEA285}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 814x45, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1717
                                                                                                                                                                                    Entropy (8bit):7.154087739587035
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:N9YMzO6BOfqH/dAIWpdAIWpdAIWpdAIWUtr/SD:/hzJgfqHaPYPYPYPUt/i
                                                                                                                                                                                    MD5:943371B39CA847674998535110462220
                                                                                                                                                                                    SHA1:5CA79B7BD7E0E93271463FAEF3280F1644CBA073
                                                                                                                                                                                    SHA-256:9C552717E8D5079BBB226948641FF13532DF3D7BE434C6CE545F1692FA57D45A
                                                                                                                                                                                    SHA-512:812541836C8B6F356A4D530E5CCF1CFDCC4CA54AF048CAC19FE86707CE5EA0F41D73C501821AC627AD330291EF58C040DFC017923A7886CEEC308048DA2CE7C9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......-...."........................................&.....................U.....1T..S.R.Q.................................................R....Q.a............?..d.. ...............................................+A...Z+E...V+E...U..R.....}........Q..Ah....Ah..b.AX..b.PZ+A...V+E...V..J*....Q...b.Q..Ah....Ah..b.Ah..b.PZ*.(.@z.?.`;2.......................................................Q...b.Q..EZ*.(..Z>.G.....`Z+E......J*....F+D...F+E.......b.Q...h....PZ+E...V+E......J*....F+D...F+E..............[u#...a-...f<.9^[...l0..H..6.Kn.t...&..3a...GG...[u#..8.y6.q..%.R:8....6a.+.3..a-....l0..H..9^M..f..m..3a...GM.q..m..6.Kn.tq..%.R:l.W.lg...[u#...a-...f.r..c8.....f..m..0.....l0..H..6.Kn.t...&..3a...GG...[u#..8.y6.q..%.R:8....6a.+.3..a-....l0..H..9^M..f..m..3a...GM.q..m..6.Kn.tq..%.R:l.W.lg...[u#...a-...f.r..c8.....f..m.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{55EEBC69-80EA-45B4-BFCC-76272BBA1D50}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 728x77, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2695
                                                                                                                                                                                    Entropy (8bit):7.434963358385164
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:N9YMsguOZgKAz2vcaQU4R8r4BU0/Rc4nbIQdsohw13ZmFLY6KsVvMdBL2mr:/hsEgNz2v5T/rQC67SoWniHK4EdBH
                                                                                                                                                                                    MD5:B23DE98D5B4AFC269ED7EBFDDECE9716
                                                                                                                                                                                    SHA1:10AF507A8079293A9AE0E3B96CF63A949B4588AA
                                                                                                                                                                                    SHA-256:646586CB71742A2369A529876B41AF6A472C35CC508D1AE5D8395D55784814F2
                                                                                                                                                                                    SHA-512:BBACBE205EC0A4F4E3AB7E2B1DEE36FCF087DDF77C7D18B53AEA4B15984A47C64E19F9B8D8FA568620619CEA0361D94FE7ABEA6E502EC6ECAEFE957F42ED7EE8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......M....".......................................,.......................1....!ABQRq.2a."CbS.......................................................Qa1A............?....{............i........l..-D.q.~..|cS.S...R\..d.8,!.....]f$....Q..di.;~5......vj......MqCe..=.*.f^..=.}.Cm]qCd..s=..u.e..v..t'.,.....S.s..N...>.d4'.,..k...N...d..9....G...y....6J.Y.l.{Vf...^B..i.3.z....:5W#4@.S\fj.%..Mb.5.v.5......S.E..#.v.I.....I......m..H....D..|.Y|...W.Wf..o..U.0.E..@.T.....................................'.S../...Z......!J..1K..rI...T.f.>.+.N..o.....\..^u........e..q.qK.GXP..-...F8".;5J...]Y......j.a.,R.......J.N........z}<qu..J.)`.}X:..}.............B...[. ......,B.).b.......(Y.O....c\.o.e&.W.#Bo..N|..N8.#J.>1D.1..b.&....q.#..UT%,.d.....m&..^...VXA..b.nbTV~.....^........q..#./.I..=Q..=..Y.*.Ib...VZ+......Y.........'.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{5688239E-3D10-47CC-A60A-85FE575EEA58}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 50 x 600, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4410
                                                                                                                                                                                    Entropy (8bit):7.857636973514526
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:E/pQuIhKZ7u06dICH3AroiTe8DGTl55poBUmLNjpH7MvDHjfm:MpdZtPbknnRPpkLNVMvu
                                                                                                                                                                                    MD5:2494381A1ACDC83843B912CFCDE5643B
                                                                                                                                                                                    SHA1:98F9D1CC140076D1AE5A9EA19F47658FD5DF0D66
                                                                                                                                                                                    SHA-256:5EEBE803E434A845D19BC600DF3C75E98BB69BD0DE473CEEC410D1B3A9154E28
                                                                                                                                                                                    SHA-512:0E64CC3723DC41D94910F7ADFB6A0DFB5049350FD15A873695614E4A89ABD78B166BA4E9C8CB95E275FB56981539DECD2A7F28FBC25E80DD5E2DEA8077CC9489
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...2...X.......E.....PLTE...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................B..(....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.].\TU.?3"...(..L........q.Q...H.*j......W..Xd.ie.f..%.XT...em..m.m.vkik...>.}..}|..{'.U..~......}....s.............,CVu.x.:C..5...;.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{569E820D-0F30-4FC5-A39B-FA6FE5F726CC}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 171 x 552, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):10056
                                                                                                                                                                                    Entropy (8bit):7.956064700093514
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:edmu1fpj5DVHuooK4EpGLbAdT+dBXYBR8D1V2p6KwoPR6KUX9ojwRpgA:2Pp/B4LbAF+dBo/1E3S6JScpgA
                                                                                                                                                                                    MD5:E1B57A8851177DD25DC05B50B904656A
                                                                                                                                                                                    SHA1:96D2E31A325322F2720722973814D2CAED23D546
                                                                                                                                                                                    SHA-256:2035407A0540E1C4F7934DB08BA4ADD750FCB9A62863DDD9553E7871C81A99E3
                                                                                                                                                                                    SHA-512:BC7DC1201884E6DAFDC1F9D8E32656BFAEE0BB4905835E09B65299FE2D7C064B27EAA10B531F9BECF970C986E89A5FD8A0B83F508BBA34EB4E38B3F7F5FC623A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR.......(.....!..t....PLTE.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................4.....bKGD....H....cmPPJCmp0712....H.s...#.IDATx^.w`......$..B....... ....fz5..6`l\.8...Nsz{.//y./....{.7}g.....e.....~.......s...f.....%c...6....O.PJ...Y.oi...9..'j.2..6.-

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{5718BF1E-8805-46D4-BA67-385D0908D192}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 40 x 623, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1569
                                                                                                                                                                                    Entropy (8bit):7.583832946136897
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:KArPoy/sSfmBL0EGEsRgeTLLXFnViAAEslVorlP0i8OmO57EnGAkYelBKMN:9oQPTgeL5ViAe8rQs7HAkrlc+
                                                                                                                                                                                    MD5:07DB3F43DE7C1392C67802E74707DAA6
                                                                                                                                                                                    SHA1:C173ADB1999065C5E1E6DBEF934B4D4D7AF0CC23
                                                                                                                                                                                    SHA-256:51E05999A1C9F17DF28CB474E57DD8E64BDAB824874A532C20A23766A01F8967
                                                                                                                                                                                    SHA-512:E509255519D4E521E82332FF418DD5A6BBBC8476399A0D9C3D81542C1CABA535B2D79E5BC90F73F9EE8468643302137671934ABD600FC696F16161C91FEAC111
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...(...o.....>.c.....PLTE................................................................................................................................................................................................a.o.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.Y.. ..........}%.../].`<..y....V...m.....<....)..;Ki..'9...2.:.c...t..V..d.t;-y.Z.=K>B.."{Lj.~G..|..ENC.!Sw,....";.p..g....E.B..S.-...k..P."..E......l[./D.-.....Q+.G<>.+..b...#..y(...{a.M..J...<....v.W..F.qm.`.....(.mk.nX....l.Px8.0\Z....7G...$*.....&..Z.VJ.~......J.2|...2H..../...=.)q....ZT" .,%..h.p....Z$.!........r...Hh.f. ....P .d..1d....2.3h....;.A.... ....d..g4...A..^.....2.ew..."h...y/..j.h..B.......%.2.%..{r...+dG.=9h....P1...A...c...^h.]Q0.8x....q .!3....ZW"Z.!3...G.vC.GG..".&..X!3.|xB..V.P!.+zS..NX!3.....Nh.y(.Z.1.h..B...Z+....l8Xcu.B...K...@U..@Q...mB...x...&L C....mB.....@kC...Y.,.... ..e\F.B..........y..e\..:$(....Z.a...yn...f..z.~Q.{o...].ln.r....^.@.{..c.7..{...

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{5CBCB4E1-047B-4CF1-B9D3-DAFD910EBFC3}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:09:29], progressive, precision 8, 609x675, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):65998
                                                                                                                                                                                    Entropy (8bit):7.671031449942883
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:klZtmExaFrtWgpc+Sg+DKeplHClpHfRtPMbe:VEWWl+SNDKqlH8p/vse
                                                                                                                                                                                    MD5:B4F0A040890EE6F61EF8D9E094893C9C
                                                                                                                                                                                    SHA1:303BCBA1D777B03BFD99CC01A48E0BB493C93E04
                                                                                                                                                                                    SHA-256:1F81DDE3B42F23F0666D92EBF14D62893B31B39D72C07AEE070EAE28C2E6980E
                                                                                                                                                                                    SHA-512:8F07E4D519F2FD001006BB34F7F8274B9AF9EC55367B88D41D24E5824FCE4354FD1290CE4735E43930829702ED53F41DF02C673904A7091E9354C28E029AD4EF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:09:29.............................a.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..-O..s(...gO..@...[..+....+...H.'m........L.......@.......[k...S..O..p.'{X..3......]W..w.+.V....[.-.....2..i..i$.p.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{5E8B7600-0478-4E8B-98E2-FB9324DC44B9}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:08:07], baseline, precision 8, 595x450, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):59832
                                                                                                                                                                                    Entropy (8bit):7.308211468398169
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:HS9SYFtN0+CRa9mfJy4zBAiIJhzrkHDV2hJK:yAmta+Tyy4zBIJW5WK
                                                                                                                                                                                    MD5:DCDD543A4E0BA2C1909BA095D46FFBCB
                                                                                                                                                                                    SHA1:B86C89537138FE07255354202D3EAD0B53B3C54D
                                                                                                                                                                                    SHA-256:28F334B77068F71F5F92A95695433B950610204A0E5580CE567DB8FAD4993ECB
                                                                                                                                                                                    SHA-512:5408C3259B7F3288A4BEB04342799AD5FE3A6F0EC7E92353B29B7E7E538DFA9903B39637226919E0421BC422635D25F5F8069DC7441864DC03E1B909BF5C2C84
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....fExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:08:07.............................S.......................................................&.(.................................0.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................y...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?......;R~+'....xh..~.n-}.......Te................^B..IU_....._...S......h.......!....9...A}6V=J......C..c.....Ug.Wh......

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{60380367-B9ED-433B-B80D-B2185B8FD589}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 105x441, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2268
                                                                                                                                                                                    Entropy (8bit):7.384274251000273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:N9YMn9H5gXlM26vroVXWxyNnl1LmLR+rn4FOeewGhDbby:/h9SlMdgm09ll8R2/rby
                                                                                                                                                                                    MD5:09A7AE94AA8E517298A9618A13D6E0E2
                                                                                                                                                                                    SHA1:FA5181A7414BA32F816BF0C4278EC20C615E8B1A
                                                                                                                                                                                    SHA-256:3C68C7EE798E62A4A99C740153F3980D7DF029605C843410942C7F85E794823B
                                                                                                                                                                                    SHA-512:074E9A2BE2039D0AFEAD360157550B934FABD0CB86B5AF476C1FBC885EE60331F5A68EAF70BF76E23C8248A20FB900346839F4AA8892370B5889E64948DCC6E2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........i..".......................................3......................!.A..1Q."q.2BRa.b...#$................................... .......................!12AqQ.............?..D.z.4....;.....7...3.t<!..d.O.....+O+.;.z6.4cz7E.........U.Z)-..@..y...........}(W...<.xv/...5.ew......yN....n.Tk.Tm.Ty.vA=...T..U....h...e.8.5%....'......e^......L.g.$.~e..O.._...... .F`.....xnL.<.......]jfv...}..\G..c.......-%...#.C.|.].`..^..W..c..B..5D.QSTaZ.5A=....BU..z%.4.h.6..=..U...W.$..l...7.:...........IPQT_...~..i..x....~.l.|.n.J..TV.21.Tg.....................j.z!+.-............"j.j...)*..TT...."....T.Tc.**j..............j.z!*.h...&.&.&..e.%..TksTW%G.?".l+$..c._9..[x...TU..........i~X..#'.qm?ttO.....}*.i...q.....9..r..?..W..d.w...f;..q...tZh..0.....2.......OD%Q-.......$......56.K.O...y._..*_C.k..p9.p..O..vu...'........0v

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{62074E40-AEA2-431C-87B2-318C12CCC9AA}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):39010
                                                                                                                                                                                    Entropy (8bit):7.362726513389497
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:6tCjwO+E+KW0ZtOgepcoWW4pAWQ6/KWcR474HOAZaDfK:68j+E+KW0HOgep/72/NKWcRNefK
                                                                                                                                                                                    MD5:9700DE02720CDB5A45EDE51F1A4647EC
                                                                                                                                                                                    SHA1:CF72A73E1181719B1CC45C2FE0A6B619081E115E
                                                                                                                                                                                    SHA-256:7E6A7714A69688D9FFDF16AA942B66064A0C77FCD9B3E469F89730B4B9290C3E
                                                                                                                                                                                    SHA-512:5438921467D62376472007B9EBF3C35C9D9FE3EDE04D99A990129332D53EBC8EE2555C0319A4F7C0DF63516F29CEDF2171D8B6DC34C9FCD075C2CA41EB728660
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!1..A...Qaq..".......2BR#...b%&6..'w.r.3f7W8.s5EUeF.g....CS$4.Vv..Tdt..G..(c..u.Hhx.......................!1.AQa..2.q....".s...3.4BRr.#......b.$c............?........uf.....t...;..[...W.h.....-.k.f..i.u..KQ..b.F...rM%/.8n.S..=9.....G$O;.f.}L..N..U._i.[.X...3.~....S.~..+t$...c.5......{..X/..#.G...}s....6......^....o~.$.\WA?...^*w[O.~..6..~....a....~..:..0.......{O...|.s.u._w.........i...........{K...._.?.../{.....A..8....<g.iu..<..................X......|]v....D..9.k.w.|-IF.Tv.-.&.........."'.4.b....z.._.Z.....G...u.xyt./_.q..m>..S.V.Xdc.bw.T.W......g..........}s.._..?....U]_.......`......>.|'.~xH....,...?........?.q....o../..R..;...Y.G....A"?......?.<..1...w..o.M.........tco.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{6228D1A7-8BCD-455A-AD61-5E3683A526A9}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:18:09], progressive, precision 8, 164x641, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):27862
                                                                                                                                                                                    Entropy (8bit):7.238903610770013
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:LTawAZvhbrXzDc6LERLQ/b5vXOl6pXQ/wD5OUMrdRUUhCplQg0ESSz:6wm/vT/b4wxoqbdUhWnSs
                                                                                                                                                                                    MD5:E62F2908FA5F7189ED8EEBD413928DEE
                                                                                                                                                                                    SHA1:CA249B4A70924B73BDA52972E9C735AEC35A0C5D
                                                                                                                                                                                    SHA-256:20ABE389C885E42B6EBE9E902976229BB6FD63C8C34CB61AA70B8B746209F90A
                                                                                                                                                                                    SHA-512:EE8D1821A918BE8714F431895E7223D08036E88A4FDB9A5485EFF246640EE969A69A8AA4E2E9DDC35BA75FB6D4E95092A286E90B477BD6998C313639C2C31F25
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:18:09......................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................!.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..P.v..+..n(a..Q..S\6....Y....D......} w#.b..]l.5.RU..k...... ]$.$.........f........?.z@2uU...7....?..|.Q..I.&.. ......"T4)wdH.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{639B1873-CF22-4C26-97AC-BDB892773BAD}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):32656
                                                                                                                                                                                    Entropy (8bit):3.9517299510231485
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                                                                                                                                                                                    MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                                                                                                                                                                                    SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                                                                                                                                                                                    SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                                                                                                                                                                                    SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{65AD574E-A1B4-4BD5-96BD-5B5FE424ACD2}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):60924
                                                                                                                                                                                    Entropy (8bit):7.758472758205366
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:kU7O7+CFqO6DkxTgPzo2wqggrrX8QvN1I/ZLBttB9+dPFXbc:hVuqJDaTqo2wq1L84N1I/Z1tT9X
                                                                                                                                                                                    MD5:D58C51D2CF586A5E14A9EC8529C3B0A8
                                                                                                                                                                                    SHA1:F4811A353797C29B1E3F5A61B125C46E1534D587
                                                                                                                                                                                    SHA-256:F927C7825851974A2149868146970706523A49165133CEE6027A43E8C9ABDF27
                                                                                                                                                                                    SHA-512:34B963173AFBDF07432F4B983D29F10376E4771FE666E9D50B1A81DA0B9F6001FD86B4A08B9711386DE153BF6E03C8E932E2D181C8EAF94EFF34D20FCA7570E0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d................................................................................................!1AQ.aq....".....2B...Rbr#.s.4...3$.5u.6v..CSc...DT..f..t..&F........................!1..A.Qaq....."2....B.s....Rbr..#4...35...CSc.$...DTdt..%..............?....O<......X.O.Fg..{.W&u.u.T~.|r;g!.._X..N.p.4.........................................................yK..xd...6..|%....\j..e.=...Y..f..I.|-....e...$R.j.......~.W#....{.....V.k.|F..z^..:.~..f......"x.....L..K..r../.;..[..l...;.U...W...X.........8.....y?..B...m.......j..Q.g3..G.K....GL.o..n7a..Y..[.'.........x........\......~...f...0\Wc.n?k.|.....1.ww;..2..?...r4uF.MXdB6..W..mG2NJ.E........u...2.q...Z..=(l)jU.X...U.\X.......O<......X.O.Fg..{.W&u.u.T~.|r;g!.._X..N.p.4.......................................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{6D124A00-65BD-4943-B8E0-5B2C872BA979}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):86187
                                                                                                                                                                                    Entropy (8bit):7.951356272886186
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:AbmHwD7za0syWMetp3TdPFzoJamVdAQZCiUit9qbYN6LerhWMzIWgN1EeaYhJM:1QnzsyTeP3TPAdAQZCi5qbYEKrhWWMNO
                                                                                                                                                                                    MD5:FEE4785DF76E93A9DC2F4501CBAEAE12
                                                                                                                                                                                    SHA1:8FB4527BDE05EF208FCDB168098A07707C27501F
                                                                                                                                                                                    SHA-256:F091DED5E283AF6848670A3172E7C43C6099875D39B3FC69C2BDBA914F609602
                                                                                                                                                                                    SHA-512:7E99D33151A0D3873D6A819C98EA8E62D928C087B7BA2080F11C7BCF746AD60A44D4FF6EE3D2D2E8DFA4BF1FC6285ED56BB83F91C2FC6FC4FDFF2000105F10B1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................1.!Aq...Qa."...2..BR#...br......6v.7..3.CSc...$4.s..&dt%u.f.......................!1.AQ..aq........"2.B#....Rb3..t.5u.67.8.r..$....C4.cs.Sd%.DEUe&.............?............w.....c.....i.A.....3...7.......7..P......%.........?Th..l./?.;.....$}..=5Oa...F.c.A/...D.D..]..y..3e.5\%.fo2.X.*]q.5Ee.}..i..md.T....#...-...Mu...9...-+..~w5O.);..G..'.;..).....A_...M.vV..y.q......,<.3.(...._K:..XM.......w.......9..T.......?b..a-%.c;.}..>....|.,lZKCEB.t...fw|.Sw^..Y..:.J.................t._P..v..j.1.R8.R....G..W*H<(Xi........i..xcu...WM.dqM>'W..g....M.q.....+.....b'..~....>..T.~Jc....fj.X.x..9...N.w.6:..>.......&.(h..u...t._...)_k#7Za...cZ....P...Y..;.V.,..xo.....f........Y...\6...M'L._

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{70078E7E-7F0B-408E-9D11-13A44A737339}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):32656
                                                                                                                                                                                    Entropy (8bit):3.9517299510231485
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                                                                                                                                                                                    MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                                                                                                                                                                                    SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                                                                                                                                                                                    SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                                                                                                                                                                                    SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{73484774-C80F-4CE4-95FF-6AD83FB7A98D}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):55804
                                                                                                                                                                                    Entropy (8bit):7.433623355028275
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:gVvci05lhVbfBcWvBLeynluexaWqzww/u5:gVUZhHDljaHww/u5
                                                                                                                                                                                    MD5:4126992F65FE53D3E3E78F6B27FD49DC
                                                                                                                                                                                    SHA1:BC0D76B69310DA9B909D3EE4CECBFE5F386BFB45
                                                                                                                                                                                    SHA-256:3FBE3C1C238BD7DBC67F8CFF5F3BDDFD513C96A9851B9616477947D21DFF4B2E
                                                                                                                                                                                    SHA-512:624853F5E56D224C8188F122B2C4724F867D4099E7FAAFB9C945BE7E2907900ADCF4AE97AB08909CF94E96FB6F381E3B6396D560D93EB2731E4E69CBFE628F10
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d..............................................................................................!1...AQ.aq"2.....BR..8x..r#..9b....3....CS$.'.cs.......7Gw.(.4%5&..Wg.h......tEVfv..H..........................!1A..Qa.q...."2..u6....BRr.#...b..3s..d...7.Cc.$Tt..S4.5Ue..&..%.................?...,...8..{..S.y.N....%..q.8..H[5....o..xg........)c(.eO.YO..._D..x.U.....%.S.r.r._.^..Su.h.Q.t.:.#?....x..B.S...Q.....oqF..%..8'.qx....%.2JKjF..{y.w0.*a.RMb.c.Q{%....eW'..[IV..'ZW3...[...MN.....rO.:....$.i..7....Vrrr...I.r..M..Qo..j....q.^...N...J......%.J..)F...>$.....u........o...+......[...*..t....R}.I..R..S..GB..:......).6_[^Xft...F.1.....zP....,.#....MG.T..Q.F.....)Fi../.I...,%.voEb.b.Z..V3..FT.}..[Z{....wd.z.e.....QwW(.).t..\..'....:)<W.<..&k...caRT.X(..K.....:f...]...q..

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{75FA784A-F741-41CE-BD87-2CA4D3BD92D2}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:06:24], progressive, precision 8, 38x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):22203
                                                                                                                                                                                    Entropy (8bit):6.977175130747846
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:5q3R1VBvq3R1Flrk6Q0QPJJrR39joOVMJ25d1NkMhIwobbtAAAqYnLJZMJYZ2AC:xw6Q0WJR3FoOVMJIIlAAAqYnMJdD
                                                                                                                                                                                    MD5:2D3128554F6286809B2C8E99DE5FD3F6
                                                                                                                                                                                    SHA1:FC42CB04151D36F448093BDEFE33031A9B8D797D
                                                                                                                                                                                    SHA-256:14FA2D16310485AA1CE41F6D774A3D637E8CF8B03C4F72990155DF274FDB6BD9
                                                                                                                                                                                    SHA-512:D8531247A6E89ECABEA9C4A78F596CCE3493334EDF71AE4F7998FDDD0F80705948609C89756AB56FDFAB6D04DEC5F699A693801A772CA2EE2465BDD2CE5D2D5A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....XExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:06:24............................&.........................................................(.....................&...........*.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...H.....Go.Kxn.b..g...........%?_....O......q......7G......%%.V..8zm.].v?...jJ~._..>.......O;........o..rI.A.....n.a.........

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{764733F8-0B21-49C4-B261-7354294AD927}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):14177
                                                                                                                                                                                    Entropy (8bit):5.705782002886174
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:EbgGcV/hlvpfal7rgYa8S7auAxwfuSTmCSNoFQ6NO7L:EbgGcVnpwimnd38FdQL
                                                                                                                                                                                    MD5:7CDCE7EEBF795998DA6CAC11D363291C
                                                                                                                                                                                    SHA1:183B4CC25B50A80D3EC7CCE4BF445BCFBAA6F224
                                                                                                                                                                                    SHA-256:DE35AF949D4F83E97EE22F817AFE2531CC4B59FF9EE6026DCA7ECEBC5CF2737F
                                                                                                                                                                                    SHA-512:560FB15A9C12758D11BB40B742A6EAD755F15AD10D6C5DEBA67F7BC8A2AE67C860831914CBCBCDED9E6B2D1D5F26A636B9BCEF178151F70B4D027316F94F27E1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!.1..A....Qa".q..2.....&...B%6.'..R#3.$E.r457bS.DUFV.Wg(.......................1...3.Q..2Rr....s.4.!Aq.S.aC5B$%............?...n.Liq.}.{#....3/gg.1.M +..~3...q..+=..:.g.i1;P)7.....q..n.s"p...wx........v.t.f;..L/..~....y.r[.r.....n.n3..6i..g..}../........3..x.L.i?We..l.......~..<.;..6..o.....N.t.o6.l..~.......<...m.V...Q.7k.u./wq.t..;.I...}..{...>.L..3m..a....yd......6~.f..~Y..}+..<.[w..'-..?.v.7...v.u..4.......1];..u.MO.......s..p..ms.'.O-o...O......m.k.e....)t....i>..E|....,iOyD|.{......g.n...cu....=..........h.\.Q:?g/?.I.3._...t...d.n.0.%y....S.Q....S.&K.w..&wY<....%.g.v.....$y..#,i;.=...t...I6..yO..o.d..w\k...~......)..rK.......].u....N....e.s..kU.u..'}

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{76FC1BF0-15AF-4CDA-82A4-07FAA0C59EF2}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 39 x 579, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):515
                                                                                                                                                                                    Entropy (8bit):6.740133870626016
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:6v/7su2/c30mqkg9VgFHe7Ll8UmJX/N+1Zmkk8f3lbtI4:4mc38gFHe18lkk8f3lbth
                                                                                                                                                                                    MD5:E96BE30D892A5412CF262FEE652921CA
                                                                                                                                                                                    SHA1:8190A0BFE21D04BC6F3A406E91B87CA69C03A2DE
                                                                                                                                                                                    SHA-256:0E31DA4DFCFF4A36C64C1CE940362D2309769F36369E4C43C317D5F2FA15658E
                                                                                                                                                                                    SHA-512:D647F51ABBD013226A6ADD0D551D058C633F867F9AF5A9E099B85D6E291D220F7B85958B07381CD4C7C4F72356DBAFE2A86932AE398E28C56CDDF0744E92EE24
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...'...C........b...`PLTE..................................................................................................bKGD....H....cmPPJCmp0712....H.s....9IDATx^..I..@.C..<..?mo.#C((.J}...~..B...b.I.i.\<.e.....(p.I.EO...q.x.......dRz....K..b0.:.<c.o..0.x\:...F....I&..ap....."P@....DO...q)p*..@Y.CL2)=......1.........4....._.G..^`..lDO...q...X....SL..z....K..#.L#..I6..ap.Ls.,....7&..ap.p..lI...,GO...q.....k.n1..4......3=.f.x.$..4.....o....x.$+..0.x\.,&6...............IEND.B`.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{779ECD60-8D63-44D6-AA4F-A88299B014D0}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 70x626, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3428
                                                                                                                                                                                    Entropy (8bit):7.766473352510893
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:/hdu7isPwAp7zesusUyYAatNG87llTONQYS:5di5tfuQ9atNZlaC
                                                                                                                                                                                    MD5:EE9E2DF458733B61333E8A82F7A2613D
                                                                                                                                                                                    SHA1:A86704C969F51B86D6A05ED51C6C60214ED9FA89
                                                                                                                                                                                    SHA-256:BE4F0E6C89FCE91B9EBD2623567F7DFC259E0E3C77C9158742B8F64B724DF673
                                                                                                                                                                                    SHA-512:BFB5D6DD6B66EE21E946E90D1E482384CD10244308562DDA814189602681DADDE5752B80519E5B8515F115A71BD6BB4317A59BE65B8B5E3474AED119F8303569
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......r.F.."........................................H............................!Qaq.."12.....#3ARbr...$B...cd...&CSu.....................................+.......................12..aAQ.!#q.."................?...#...3.Za......rV.5&...../"..i.t...j..W........d.FL.V.2K....]t.f.d.NK..:.....f...... ......2.[...#..D...ZK....p.z.E.N..T..L.-....1....2.\.6FIr2..zS\U#..........fB\t..5J..~q...D....A.......!....MY..../.HY..../e.M.Y.n.~..,....'..Pc...l...d2..m.f.it$..qx-z*...._..].cOO....n..&.....FIA.....2J2..d:<qc..6.I.G.N....f.K..Dx.-.......`....2.FZ."K7.r}..<.P.Z.da.Y.....8..s....G.....b.e..g .S.......FL.Z,&..q.MG.J+..x\..m...qN=.....)..`...&Y...S....u6{.z.g.....@......FL.ZL&.Iv.w..8....U..v...*.q.B.v_./A..#.#.g.j........*J;...u...W.Ao...%....#$.....M..^\{W.SO...s,.N.....c).,.B.Gv...."k..z."..S]H.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{7DC890BD-9D12-4ADA-9A1B-AA84138280F3}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):39010
                                                                                                                                                                                    Entropy (8bit):7.362726513389497
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:6tCjwO+E+KW0ZtOgepcoWW4pAWQ6/KWcR474HOAZaDfK:68j+E+KW0HOgep/72/NKWcRNefK
                                                                                                                                                                                    MD5:9700DE02720CDB5A45EDE51F1A4647EC
                                                                                                                                                                                    SHA1:CF72A73E1181719B1CC45C2FE0A6B619081E115E
                                                                                                                                                                                    SHA-256:7E6A7714A69688D9FFDF16AA942B66064A0C77FCD9B3E469F89730B4B9290C3E
                                                                                                                                                                                    SHA-512:5438921467D62376472007B9EBF3C35C9D9FE3EDE04D99A990129332D53EBC8EE2555C0319A4F7C0DF63516F29CEDF2171D8B6DC34C9FCD075C2CA41EB728660
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!1..A...Qaq..".......2BR#...b%&6..'w.r.3f7W8.s5EUeF.g....CS$4.Vv..Tdt..G..(c..u.Hhx.......................!1.AQa..2.q....".s...3.4BRr.#......b.$c............?........uf.....t...;..[...W.h.....-.k.f..i.u..KQ..b.F...rM%/.8n.S..=9.....G$O;.f.}L..N..U._i.[.X...3.~....S.~..+t$...c.5......{..X/..#.G...}s....6......^....o~.$.\WA?...^*w[O.~..6..~....a....~..:..0.......{O...|.s.u._w.........i...........{K...._.?.../{.....A..8....<g.iu..<..................X......|]v....D..9.k.w.|-IF.Tv.-.&.........."'.4.b....z.._.Z.....G...u.xyt./_.q..m>..S.V.Xdc.bw.T.W......g..........}s.._..?....U]_.......`......>.|'.~xH....,...?........?.q....o../..R..;...Y.G....A"?......?.<..1...w..o.M.........tco.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{7F6EE03A-8596-461C-953E-094D698E25C1}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):40035
                                                                                                                                                                                    Entropy (8bit):7.360144465307449
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:MQhziQo1RKGlyyzYjlxuxwRUj/BN837xRmwH2uDTCn8qXFQziN:ThzrSzalg6O563l4uTC8q1Ig
                                                                                                                                                                                    MD5:B1DDD365D87605F96D72042CB56572F6
                                                                                                                                                                                    SHA1:ADF71DAD1A62B8A58A657C2EDBDD665A19EB846B
                                                                                                                                                                                    SHA-256:06E09DE80C3F32254DA4FE6B2CBAD7C05EF144DD54B8C65745E195BBF7317A2E
                                                                                                                                                                                    SHA-512:9C686092CC9524F34EA6CEC9AAE936A6225BCC54DE38DE1786EBA8F532959A80FF885E8664A09E4C318D7CA4B278E807D3D1F135BE55F30979B844FF5EC9699A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!1....AQ.aq.....".3.5...2B#s.$%..Rr.CS4&6...bE'7.c.DTtU...d.eu...VFfv.Gw.....Wg......................!...1AQaq........"2..4..Rbr#3$...B.s5Cc.S%.D............?..^.f....R*.N{.{f.....O.r.V.;U..~...U.(..>M._.yI.{8,..^.t...s`...j.O..U5t.&&..h.G.6Da.;.....J.......E..QD...C...}..N...tR.....~..].J:.V$.*.r......]...W......4.[.)6..Y_.....4...........m._'HR.a......]U=.....n...0.W..]..K..){.+...w...f...<|..1/.|.....b..-..y....]U#Ctn.7m.._.|..2I;|....tM....q.q.}.N)....'...9&...nR...R..}.........m._.LZ}u.../K....9.~..?.{....V.#..dx.Zk.:=..:.j].....E#....E~w%....J..[S..[......gr...vb.r]..<..ut..i...[P.w....:..Gkn>......#..m...9km`......t).up.....w....VOR.{&.nQI..}...wD.7Ey#n....MO.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{82A162DE-5DA1-429B-82A4-AC7B7AD89326}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 60 x 336, 4-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):347
                                                                                                                                                                                    Entropy (8bit):6.85024426015615
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:6v/lhPtnlx/QulkWNY2V18A6Akp7eee1VDjMHCyLezyKUX5Gp:6v/7RrIubiA6AkpNhiyKe+
                                                                                                                                                                                    MD5:78762C169F8B104CB57DFF5A1669D2DF
                                                                                                                                                                                    SHA1:9638B71B584CD636834016A635ABF8D9C0887711
                                                                                                                                                                                    SHA-256:E64FDCD0B108737D8B8F7B677029F924031D6BBAA50585D9C3DEF7C7E92ECAF2
                                                                                                                                                                                    SHA-512:5ED899AAF73B72DEC32E171FFA112382667D5BF3FBA98C92E313E66C0A6975EA97068F4CD32B62283F18DBD5345C11E3610F7EEAC2F2DE71FC44593180B9CEAC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...<...P.............PLTE......................=l......bKGD....H....cmPPJCmp0712....Om......IDATh......@..aI...B..C..l...^.%.`....>.]..|0.....a...hb...0......q.......p"....;...K..x=...p...y.yy~J....|...\.......y..X.......'...>1...Ky..f....&........N`..f0..b...3.......`Z.3..3.....o.......4.&........SV...4.....IEND.B`.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{83B3ACBC-952F-4F02-9941-7B35183408E4}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):33032
                                                                                                                                                                                    Entropy (8bit):2.941351060644542
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:ofmqvnCfmqsp1Ue5xzMq+Qh0dffUmS0w5xzMq+Qh0di:AGAp1rmSl
                                                                                                                                                                                    MD5:ACF4A9F470281F475EA45E113E9FB009
                                                                                                                                                                                    SHA1:B20698DDA5E5AFDD86BB359A6578C9860D5DF71F
                                                                                                                                                                                    SHA-256:5DC2367A80588A7518DB5014122510BF0FD784711015EF83A8718336584F82D0
                                                                                                                                                                                    SHA-512:998B7DB9DB08FD15A293267E2371052E436E024AF8D34F96D3C8FF04B1316678DFC1674C921CB404121FF381A4FC39DC759E6698F19D42A6261CBD39469B0A08
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:....l...........................Ac...... EMF........$...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC........................F...(.......GDIC............^...........F...........EMF+*@..$..........?...........?.........@..X...L........................."B...B...B...................?...........??.....n............;...<..@<...<...<...<...<...=...=.. =..0=..@=..P=..`=..p=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...>...>...>...>...>...>...>...>.. >..$>..(>..,>..0>..4>..8>..<>..@>..D>..H>..L>..P>..T>..X>..\>..`>..d>..h>..l>..p>..t>..x>..|>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...?...?...?...?...?...?

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{86FFD154-C689-4DE5-A037-53539FD3AEC4}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):67991
                                                                                                                                                                                    Entropy (8bit):7.870481231782746
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:3PC0XJjsmsKuZRG1pXuZ6z3wARnV9AEnieCc7cllJcHJ:qyMBzkUZ0gq25c7Z
                                                                                                                                                                                    MD5:1271B1905D18A40D79A5B9DB27EE97EA
                                                                                                                                                                                    SHA1:9618608FBD7342DE6C71220A36C3F4995BA9C13E
                                                                                                                                                                                    SHA-256:5B321A4D81BD499B289B1755F6450A42047C494DFBC112DBD56DA4CED2C15C1A
                                                                                                                                                                                    SHA-512:C32DD26047F6B8AA061085B38AC2B8335868E1BFD8731DB65544309223A955FA4BF45B06AC8D244408658F51A1775B6F19FF0FFC804989DE706DE8EB36F1436F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1..AQa..q..".........2...BR#b.r.3...$.'...)..C%7gw..(.S.W89.......................!1.A.Qa.q".....2...#....B.t......rc.$%67Rb3s&'CUu.v....S.d5.V4T.e.............?...?..Wj.e.e.......w/..E..eOw_.....6......u..C6h.,..;.g.D8Z..-)O..jy..e;.u.g..w..[.L""k'w.......'1'.[......=..P...S.9a.V./O....q=8xk]...........9......F...e9'....9.O.... .&.....p......c.4...mr...?.......L..'.....0....+..|_...POM=7.?.2.a....};.Z..y./....>./.C.<...;.....|.1>...........S.8.o.O...+..n2...k../.X..9...Y...:.....\...Dk......q.K..\.Wuh.!Z?.mu...R.5.A.S.h.0..[..v..+M.....aUi*.k..?#..._...X..R.&]..[..;../]L..f..V......*.e...ut&.#.J.5....c%..o.$..v.<K.6..T.IP.....6X.*.uf..t0^..-.)m$.!.q(.j.f;..WB6.b.B..R.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{876209B6-89D9-4DCA-AA60-D55619EB28C6}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12824
                                                                                                                                                                                    Entropy (8bit):7.974776104184905
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                                                                                                                                                                                    MD5:2628353534C5AD86CBFE57B6616D46DD
                                                                                                                                                                                    SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                                                                                                                                                                                    SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                                                                                                                                                                                    SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{8928FAEA-CF3E-4295-ACAA-EA195B972FF0}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:27:10], progressive, precision 8, 102x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):52912
                                                                                                                                                                                    Entropy (8bit):7.679147474806877
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:DB/nIviNJD9C8kfJj6TkVr4q24FsUpjPc021si:DdnIvi3D9C8Cl6Dq24ayPCz
                                                                                                                                                                                    MD5:1122BF4C2A42B4FA7F29D3C94954A7C9
                                                                                                                                                                                    SHA1:3750077A830FE21735A43ABD35C63BA9A4D4B0DE
                                                                                                                                                                                    SHA-256:423B0DD1A93B391D15B1DC8D8757C3BF5725FF2E7A59E6E3140033E2876B67F6
                                                                                                                                                                                    SHA-512:4626EFE2EDED2361D6296B57F994DC434CC9D02357A8A6A67D84A544FB8A1CFE0005EA98F846AB963BED7F2B6CE96BC9181182C9459843A52A98D3A731A4FE73
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:27:10............................f.........................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....]+\.9.9.P.d..Z.?~>.-...]6=....*.......S.9G...b<$..Z..........>.v.o:.o%.e...z.F`...[.wo..z.....k..E...5....G..7.......c2..

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{9510480B-0075-4E4F-820B-A74B8DFAFC48}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):79656
                                                                                                                                                                                    Entropy (8bit):7.966459570826366
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:2kuUliOeU4os8ii3nF3Hxro/qxXD9u/kjYgMZqoEs6ZUldm:3uUsOXYIAixR2k7WAZV
                                                                                                                                                                                    MD5:39FF3ACAE544EAC172B1269F825B9E9F
                                                                                                                                                                                    SHA1:2D40DE8D90BD21D56314D3F99CEF4FBAE3712C0F
                                                                                                                                                                                    SHA-256:70475431CCA3C91A4EFA3B8F04864371D2D3A45696674A1A0562FE9CD8DB287C
                                                                                                                                                                                    SHA-512:3B9F3B32696AB7779864E83DC0C45960114A130BEE0CF4D0643DE57FF952171E5D775AA49141EE31A28A9B5D052B26EB421F26EA736D7EF4B3A7EC812CA411CB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!.1A.Qa"..q.....2#..BRb..r3$.Cc..Ss.4...D%5&..T...'7....................!1.A..Q.aq..."2.....B3.r.#..R...bc$4..D.s%............?..Y..T.o.\......=.a..j..'^..s..[../........Y.......<...(..4.....7y..Ln.[9.cK.ilN...u@$.V.9.V?3..s.KL.z..w.jW.C.............@.~+.o?o8...k....,.m..9.".....q.....d....z.W...q...~...'..e..>..f#...S.....F....pU.......7..N.vfK......S..G.#.....}.c.........RXt.bq1.`.....[+8\.*.N..:......}.....r..........')......Na...&...m......c...a4_%d.............co..0.n.L.Q..E.Lt..y.|..F..4.i(>.._..\.eNL8..?z9I:hLgC.@.p....g.t......'.I!d..?1f..R..........|..4.wJ*..%g..~0bt.....*...v.......O...:.~.>~..o.x...9.@>...s.&.E.0/G.c..t.<..F.t.A.z. ......;.........Gp.P

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{97CECC6D-04BF-405B-8CBF-BCE9DD79B3CD}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 780x107, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2898
                                                                                                                                                                                    Entropy (8bit):7.551512280854713
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:N9YMTXc4gpw+EIWnqQ5G+NE9VTzRFvS4+Xh+AKrNx+JuCluc3Eeky8etajhDCFex:/hDc4rPIoNEzbS4+XhOrGJu1cUHeoVey
                                                                                                                                                                                    MD5:7C7D9922101488124D2E4666709198AC
                                                                                                                                                                                    SHA1:00CC44A1B84D4D94A0ACE8834491EB5F65D04619
                                                                                                                                                                                    SHA-256:20016E5FA1A32DCE5AF4E92872597E36432185A7BB2E61C91F362BD68484529B
                                                                                                                                                                                    SHA-512:882944B2CF040485899128E03B7499C540D481E45FE8017DBF4FE0330157B2D8ABB7334DDB31C112BA0EFE3722A554883917C54155A7F60044D2D7F3D848260F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......k....".......................................2...........................c.....TUb...Sa...QRqr..............................!.....................Q...R..!..............?...$.)m.1...%%bV.J..H....-.%a[...I"WJ..:.X.:TT.$.......N.-NR.E..-NR.E...9..E....$.k.....B.I,I)..J...kr..+)..I,Yj..YbI..+,J..e..Z..V.e.$V..TV.X..V.YQZ.EQ..U%PY[.[.R.EP............................| F.. ...j*...!m.!j.I%.j.$...YeEYYEEUE..eY[.hEEUeEil.....%..el...V..TUYA.U.UTTUT.Z..UQQUQE...V.,...UlE.U[.lEP.P.@......................................R1...AR1m.....#..$:.T.p..IJ.t.....A..AH.,5..]F!a.XJFaa. ..a.!*.aa. X.e.......bB.b..,HX[,!..,,.c0.,..U..X..(,,...B(.,..4..B.`..".a..-......"...........................>D..IKEb...t.....)u.....)K.%+L\.J]i)*b.JR.IIL\i)u....T............T.....qs.it.iJ...])ZJb.....X....U.A...V1..B.R1....X...,.c...,%X...,%#0...,H

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{9803D861-D7F9-4377-8EA9-6DB687AD5D8A}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:44:07], progressive, precision 8, 611x163, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):36740
                                                                                                                                                                                    Entropy (8bit):7.48266872907324
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:3nwDxjTvoE0Rjwit4rjucDILWg7/Da0JgGQ8e1S8SA/Khos0:SxjTmZw7nucDILj77a0JgGQvScb
                                                                                                                                                                                    MD5:9C205C8D770516C5AA70D31B2CA00AF3
                                                                                                                                                                                    SHA1:9A1002F0CF7F92F1BE2BB25BAD61CEBFAC282482
                                                                                                                                                                                    SHA-256:E111F96490755C7D71E87C88ACAEA38AFE55BB865B1A14A83C5BD239648D5E2C
                                                                                                                                                                                    SHA-512:A3E105208B32831265428572B0937DD3C17B793D8611B2DA8D4939F1BEC6050999D375E3F6B87D53AD49DFA0EAE737B0141D37597AA42116C310761973D4A134
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:44:07............................c.........................................................(.....................&...........n.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d................................................................................................................................................."...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..o...4.gP.~.c...K{...V.=...].<.........vS.........s....(.t......X......kk7....~-...yF}^c.Z.\.G./.?t...>....:.>......./.ib..).

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{9FCF8CDC-1127-444F-AA40-567152C4F909}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 700x114, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2266
                                                                                                                                                                                    Entropy (8bit):5.563021222358941
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:TuRCTP9rSTfIEe1HbcVY1YbDXq8eCI0bf2QQe0GVDQAzZw:aRCTN7HbcW1YbDXq+I07Ien0AVw
                                                                                                                                                                                    MD5:DB8A181E3F0EAD4A9472099E42ED6BE3
                                                                                                                                                                                    SHA1:92096AF05CC6167B1AA816811A1160B809393FA2
                                                                                                                                                                                    SHA-256:E9746B4E9AE9CE7B3B0068779DB3E113E2DFC9880F25373D745D0E700E69A906
                                                                                                                                                                                    SHA-512:A9E246E10E28D057090BA9F034ECE6131780D7F794C5C9421523388997C7EDFBB49BC32B863B6C6668911B359C304AA54969B48CB9234950D5CECD2A6F3EFFF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....C....................................... ! ..''**''555556666666666...C......................&.....&,$ $,(+&&&+(//,,//666666666666666......r...........................................5.......................!1AQ..2a...."Rq..#3BSr..C..................................................................?...X.....U...j...F.W.V]'KV.uWt.iT...{.......`.(.....V%..=.....z......V..ct+.U.B...@.............................................{.....5.........0...x4....c..;...........+......|.7E.%.9.1+}..d.........+.V#.P.HUL.E...g.li...8.>U.";0pi.]5.\..zo..."@.........................................y.6.mLN..S.....@...i..A..p.......~|V9.+.Xy.........+,L.....7Z7..p...-X...\.....:-...i....v.1...-..H....9.zk....l....^.......:.."^.t.Q.F...X..B..$............................................a.%f&3..1.5+.X..'b7bwr.).e.x....!...H...aa_..kD...b..g..p..K^.k..qX.[,.........Q...U..x...YMvj...w..:k.....j.W.8..4....c.u.}m.....o.=@.......j.S.t.|.....5h.y.%.~...G

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{A044CE9D-88F1-4766-83B6-15BE03A51D04}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:18:09], progressive, precision 8, 164x641, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):27862
                                                                                                                                                                                    Entropy (8bit):7.238903610770013
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:LTawAZvhbrXzDc6LERLQ/b5vXOl6pXQ/wD5OUMrdRUUhCplQg0ESSz:6wm/vT/b4wxoqbdUhWnSs
                                                                                                                                                                                    MD5:E62F2908FA5F7189ED8EEBD413928DEE
                                                                                                                                                                                    SHA1:CA249B4A70924B73BDA52972E9C735AEC35A0C5D
                                                                                                                                                                                    SHA-256:20ABE389C885E42B6EBE9E902976229BB6FD63C8C34CB61AA70B8B746209F90A
                                                                                                                                                                                    SHA-512:EE8D1821A918BE8714F431895E7223D08036E88A4FDB9A5485EFF246640EE969A69A8AA4E2E9DDC35BA75FB6D4E95092A286E90B477BD6998C313639C2C31F25
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:18:09......................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................!.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..P.v..+..n(a..Q..S\6....Y....D......} w#.b..]l.5.RU..k...... ]$.$.........f........?.z@2uU...7....?..|.Q..I.&.. ......"T4)wdH.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{A38768B9-B085-481B-B61F-117CDDF9B5E0}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 17x608, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1873
                                                                                                                                                                                    Entropy (8bit):7.534961703340853
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:N9YMw9kGzE4xTdow1C3kyIkyM66KeJY3fOxJ:/h8HzE4xTdoUCUyxyD6LCvSJ
                                                                                                                                                                                    MD5:4FC8500BD304AD127AF4B5E269DFF59B
                                                                                                                                                                                    SHA1:9A5E3432358A0FCDECE86AEB967319B93A65D14A
                                                                                                                                                                                    SHA-256:B4DAA90D5A53FCBC85119050B5B76962443C4DD18D7F42CDC6D4E0AD8EFAD872
                                                                                                                                                                                    SHA-512:E5E07054A522EB91EFD39722AFB3776389632B8F5F923C1D29796716D68CEC93BE5E44F79913804CEC7ED631FF520CBBBAAB841E01FB90AF8E8ADF84DCD47481
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......`...."........................................>.......................tu.....45.!#$%1s."fr...2Fq..AQe.Eav............................... .........................!AQR.............?..e4.bbu."m.G......u.S.-Qq.b.a..'#..E.......u.|:.f[O..jS.S.&....=.....[.....S...N.~~...'...q....N.T.Oyf..a.6..%.I.1j.e~.4..[5.WW.Y..Xp.gn...u.......Gb.O.W..k.!mJgfq....~.F.......m..}bn4.5........s,F...z.b)..O..*...5).-.-\....=`.fP....%...A..Q.&..9.....QQbD.%.:u.f...r$.10..W.F.T..MI...9...ZQH._..).....D..n.F].........*.:.j...!6Z..S....0...B.6..Ga..S.O.....U8S_.J.>...i..?..<.P..........M..F.T.C..7.E...`.4BKcMh1j....4y...+.|.^......2[.WG.W..+......E..r/V^".R...."..6..hht..f...........;E..Kx....)}Le.A.x.>..$/).._S.n.L......}..H^Sw...2. .v.io...../.........x.>..$/).._S.n.t^;O.....n...[.S...h.v.io...../....:/...[..7yK.c-

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{A80422F3-5A90-41F8-A254-4987883E8143}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:06:24], progressive, precision 8, 38x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):22203
                                                                                                                                                                                    Entropy (8bit):6.977175130747846
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:5q3R1VBvq3R1Flrk6Q0QPJJrR39joOVMJ25d1NkMhIwobbtAAAqYnLJZMJYZ2AC:xw6Q0WJR3FoOVMJIIlAAAqYnMJdD
                                                                                                                                                                                    MD5:2D3128554F6286809B2C8E99DE5FD3F6
                                                                                                                                                                                    SHA1:FC42CB04151D36F448093BDEFE33031A9B8D797D
                                                                                                                                                                                    SHA-256:14FA2D16310485AA1CE41F6D774A3D637E8CF8B03C4F72990155DF274FDB6BD9
                                                                                                                                                                                    SHA-512:D8531247A6E89ECABEA9C4A78F596CCE3493334EDF71AE4F7998FDDD0F80705948609C89756AB56FDFAB6D04DEC5F699A693801A772CA2EE2465BDD2CE5D2D5A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....XExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:06:24............................&.........................................................(.....................&...........*.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...H.....Go.Kxn.b..g...........%?_....O......q......7G......%%.V..8zm.].v?...jJ~._..>.......O;........o..rI.A.....n.a.........

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{AAC11472-B228-4598-9189-C5848BCAFF3D}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:19:29], progressive, precision 8, 221x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):24268
                                                                                                                                                                                    Entropy (8bit):6.946124661664625
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:d2wiieoHTRh5a1HAteZCWOZIM+L7WhNjYn:8wHFHJ+/OZIKhNO
                                                                                                                                                                                    MD5:3CD906D179F59DDFA112510C7E996351
                                                                                                                                                                                    SHA1:48CDB3685606EDD79D5BCDF0D7267B8B1CCBD5A8
                                                                                                                                                                                    SHA-256:1591FD26E7FFF5BE97431D0ED3D0ADE5CFC5FA74E3D7EC282FD242160CE68C1F
                                                                                                                                                                                    SHA-512:2048CBA13AF532FF2BCC7B8B40541993234BD1A8AB6DE47B889AF3F3E4571F9C5A22996D0B1C16DD6603233F6066A1A2A97C16A6020BEDD0826B83BAD0075512
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:19:29.....................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................$.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....)......[]t.\Z..g......A....&D.$LH._..X..Xl...`....cZ.X.........>......f.Z.X...]..~L.S..@..I$..I.IO.....x...s.g.[f.h{9..

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{AE6DF174-489F-45BC-9446-D3FB4A19785A}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):34299
                                                                                                                                                                                    Entropy (8bit):7.247541176493898
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:BrSX4V3P8AIc4KLkHeXRUer0zrhOmXfvG0yH82I:tSXuIc4K2eBtswKsHg
                                                                                                                                                                                    MD5:E9C52A7381075E4EBC59296F96C79399
                                                                                                                                                                                    SHA1:BE295AD24D46E2420D7163642B658BF3234A27EA
                                                                                                                                                                                    SHA-256:D56CEFE9EE2FAE72E31BDBA7DD2AA4426EA22E3CEB22EF68C8F63F9F24D5A8BC
                                                                                                                                                                                    SHA-512:95CC96DD4459EBAE623176033BA204CCDC50681A768F8CBAE94C16927D140224E49D5197CAE669C83C77010C5C04C1346CF126BEF49DB686F636C5480342A77F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.......................................................................................!.1..A..Qaq......".#4.2r3.$.%...B.5U&6....Rb.Cs.7..cDTEFVf'...S..dtevw.u.........Gg.....................!1..AQ.aq.2....."#3.4....r..BRb$CS.D............?..5..............#....v.q.m.}\..{....;...r....h.....J..q|..'.;\..6..v......e...../.k..|.8..i..|..]..3e.m....n..Z.GS..n".y..w.-...[a...7A.....i.4.)9\..~C...=.........s..\V]c.D1<./.g.l.&v..~.h..]....zb>G..y:vNS.\......LU....t.{*..Z#.?..v-...wn.rR...P.....y\=.v....../..9_...m4...V.|.+.o.#.......xj....}..>.s.>C...m.[;.>.p...=^.i.X.(..1...{.F#N.W...xi.z...4..u[{...yO.....8..}\..2...KlX.nbya...2.&.F...R.b.k.7.GV.x.h.y\.Q..O<\>......-...=...r......\......Z.Z...Jf.'....z..Y.q>.p....o..K....h..R..c.lg?......A.Z...Y.q3.L|.'5...

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{B3FB989A-31A2-4D51-9D51-CEB46B082FE4}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 85 x 470, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):11197
                                                                                                                                                                                    Entropy (8bit):7.975073010774664
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:p9wNdtRKcVHso6zsqm06xaqZdingVzLZ7/PGSIz/yycRTbChh/JzhbEx15RGb:mdtMcVHqgAqTinMzLZ7/uSIz/yTR/mhF
                                                                                                                                                                                    MD5:DDC3CC30794277500EFE4BC6667EC123
                                                                                                                                                                                    SHA1:EFC9642C1F95B5FC38764476AE481649C016FA0C
                                                                                                                                                                                    SHA-256:7F5B660A1A0BF46C75AAF19B4F77A0E086DE003EC03AFC1F58D871D55AA5BA9E
                                                                                                                                                                                    SHA-512:25232A84604C3959634D33090238FEC8D51E40AD84EB3A08BB8522A81BE1E83378649C014E98E1DFCDF46B7BFAC92D8D2429211CD11D7EE0334C9C3DF7C1B6A6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...U.........1x5.....PLTE....................................e........................................................s...............x..........................o..............................................................................................................................................................~.............................m...............................................j...............................................p.......z......................................................x..............|........................................v.......................y..........................................................h...........................................................................P..{....bKGD....H....cmPPJCmp0712....H.s...(SIDATx^.}i@S..N....h...!..)....AI%..p.L."a..)..`U..,h..:O.b.:.j+.Z).b..zN.s..{O...&|..N}...${....~.....k}.[k}{.o^.D_..W:35ly..7rL....6n0.A...b

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{B4F00A92-5A41-4816-8DA2-D48EB1D8CB4E}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 14x341, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3361
                                                                                                                                                                                    Entropy (8bit):7.619405839796034
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:zDqnxqMt6gGr/Nln5ANln5ANln5ANln5ANln5ANln5ANln5ANllHN6:CxqMQr/rn5Arn5Arn5Arn5Arn5Arn5AN
                                                                                                                                                                                    MD5:A994063FF2ABEB78917C5382B2F5FA8C
                                                                                                                                                                                    SHA1:BD5C4D816B04A2B6596DFE38DB01228F553FACCC
                                                                                                                                                                                    SHA-256:D72900E8DA72D1A7F3729971AA558E1E9B6E9CF9A0D51E83852E567256DBBFEF
                                                                                                                                                                                    SHA-512:CF2279033DD3EDFE6F6F9E5C517BEBD9A52863EEFD90F57F7A5AE0E0485E705254BE7ED6B50E6CA142669687727AE85E2E6035F69930B75F2E6D3EEFA961EF88
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....C....................................................................C.......................................................................U..........................................>...............................8H........59...$%&7F#'Ddf.....................................>.................................58EG........!#124$%&ACFbcde............?...n.p..v..a.~.._.>......#....8.....w.G...&.W...i...%6m..K;...4."...=..?.~......P..O...j.l..AW.jo..,..=d.h.ta..../.."...z|).J.......Ww._..<Wp.3+8...-5...G:..2.D..I>o..K.F;-.....#...`...6..T...M.....OOgV~..5...np...P..TYr...........b..{r.2.9..].DA.%C....=.v.z......CK."..R..l..y}.i..;.{....JzS.....~.?..Z....=c.h~*..p.@(@..G.....O.]...Hsd.xf".V]..S"..w...4e>....3*U.7..|M.x...|\......FD./.cIe.;.bId..+=...w.......[.k>....}.u...j.xZ.....Q4..+.....B....1O~\......I..h....LaXJ%&.w.<C...n/`.W..U.W.U.}~...}>..^.0.J.....@....LN.b.......5W...m].Eu...:....G..:4.=4ixx..@_0=.mab.T.U.....w..~.V.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{B8308F8D-1CC3-4767-A8DF-B87552C2FD72}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12824
                                                                                                                                                                                    Entropy (8bit):7.974776104184905
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                                                                                                                                                                                    MD5:2628353534C5AD86CBFE57B6616D46DD
                                                                                                                                                                                    SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                                                                                                                                                                                    SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                                                                                                                                                                                    SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{B982C438-1A39-4AD6-8CD4-07E70BC3B0FD}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 39 x 600, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2104
                                                                                                                                                                                    Entropy (8bit):7.252780160030615
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:2PPEOtz2P/LJtVRaqBG8qFOPvHlcEXgkuwf+j:2PZFSjJDjqFOPPlXgG+j
                                                                                                                                                                                    MD5:F6C596F505504044DF1E36BA5DA3F09B
                                                                                                                                                                                    SHA1:BCF17EC408899B822492B47E307DE638CC792447
                                                                                                                                                                                    SHA-256:EDBB86F160050FBF1F9860276802BAE292DBFD0BC98E3EA90D43D981E9F0C54A
                                                                                                                                                                                    SHA-512:E8D067A1932CED8746FE7D665EEC34EA92A98AFF3DF26FFA9DD02742DDEA3C5654124A88A649FA33DB596F96A5FC9CB2C693D03132F1C8B254ACB56DB4763BD8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...'...X.......:....PLTE.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................{.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^..c.%i.F...m.m.f.m.m.m{&....X...9.....M.WUW.d.N.O...E$...$...)H....n....N.k..v.....v1L[w)w.}..!...Y.X.V.D.......[....;..[..;....

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{C21D7C0F-D83E-4DBC-AD8B-62504519AF4B}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 50 x 500, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2033
                                                                                                                                                                                    Entropy (8bit):6.8741208714657
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:P37XYSDTz+UUl7DHt7Ah8l1+4ZfFclFUXwobKXlZr:v7j3z+UoDN0h8ugf2AwobMN
                                                                                                                                                                                    MD5:CA7D2BECCBC3741D73453DCF21D846E0
                                                                                                                                                                                    SHA1:E34B7788498E33FFF0CFB00125E6BA9E090F6CED
                                                                                                                                                                                    SHA-256:E9EAD0BFC09D32CB366010CDFEDE1C432A2D1D550CB7332BADAC1BEE9482BC86
                                                                                                                                                                                    SHA-512:7FE2C3654262B1EEBED4F6D83DA7D3450E1BE52500A3964185FC0092041506A237A2728E5D7EEA0A3814E413E822B803B789C49CF744D51816A2E4EDE5B4247B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...2.........H'......PLTE........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................[....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.\.W.G...=a.ewA..a.!r( ...%Dc..x.x....N.OO...3=...S...........~.z.D.0...g.2P.7.*M.#'....z.......3TPj.Z.[5....V..z'L3...a.j9..C>..9.z

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{C2FDC0F4-0713-4C3A-B528-E9D727EDC66E}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 613x144, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):29187
                                                                                                                                                                                    Entropy (8bit):7.971308326749753
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:RwjBOlCk+nYnGagKJWJhwMJiRO22ZIm4VXvXx1tA6BQs:i8snY3JW7uROlEfbtVL
                                                                                                                                                                                    MD5:DF99CAAAB9A7DE97B63343E60A699AB6
                                                                                                                                                                                    SHA1:B84334135CFB73BC6EF55F85926770D5AC6DFEA8
                                                                                                                                                                                    SHA-256:74C131777E7C437FD654427417097BC01B0813BA8E1E50E4B937BD50A1BEBCDB
                                                                                                                                                                                    SHA-512:5D15AAAA8B71DDFE01A7C0ADE16D9E1F5E9AAE484BCD711B38CCB103ED9564CAAC23A0031471167B660E15972D70179C2A387509B213C05D60261042A0456025
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....C....................................................................C.........................................................................e..............................................`.............................!1Qq...2ARa..."#.....3BSbr...$4C...Tcs......%&DUd...E....56Fe....................................H........................!1Qa..Aq..."b....2R...BSr..#...3..Cc....$%4...............?...b.d.8T1.;#.S.DO...~.R.......3.xe...z.6..."m..k...;*.'.f.5^.....m..<$....8.R.j.D.v..>...*dT..vGbt...I......sEWp.r3.. ..G...6.....w...l.S..q...b.....-R....^Zu5+u6...A..Z].:...5..Uzn.,l.L.....?%.*.S.+zVg7.=.s.Q.....8..:,c.......ZE...>'IF..W.0.d.......c.e.d.V.t..S$.DNR.[....g..#i.$. .U.SK2.....k...J5u u\R.....T.[4..A.O..,.T..................] .i...B.m.^f....._...{S.....<......:..|D...+...NA....Y.^f.1|..%K~1..B..^...S..v=.c..g.tX[..kTJ..t.gr....R..@.F....5j..2.K.9..g.1N.....*.U...^w......>+.l.v...@N....%Qd...t.Ni.....0;lggm...K".+!.,.....[J...>..?f.]._;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{C327E1AF-7D3D-45ED-8A5D-6EE124481FB9}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):52945
                                                                                                                                                                                    Entropy (8bit):7.6490972666456765
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:cjvqR0XvFaGCTJffi0tgybmWDoTw71kHUAnjvawrlp2+NUO8dWSNl3PF2PjK/q09:cyRffflgybmWoTw1UUADHUbU21MjpAD
                                                                                                                                                                                    MD5:AD003F032F32FAC4672D4CE237FA5C5B
                                                                                                                                                                                    SHA1:AE234931B452F0D649D91291763B919CF350EA49
                                                                                                                                                                                    SHA-256:ADB1EBBE18D6CD8FF08AA9BF5C83CDB83BF9AA179698E34E93DBCDDE12F04D32
                                                                                                                                                                                    SHA-512:ECA25FA657ECE3A66D3E650628E0F65D3BADD38864C028AB6553950A1A66D7D55482C85E9E565573E9E5AAFA91C2D53235971C644A266D41EB69F8E72E3A843B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQ..aq....".....2....BR#r.b3$...C.Sc%...s5E......................!1.A..Q.aq"...2...#...B...Rb3..$..CSr...6............?......y_N.e.H7?........W..w....k|...S..d.4.>.RW5z.$.i.)V.O....>o...c..*&1.D..O..".ufbb..1...t..u=..K...m...~.....F..-.fb:i..=f..C.w.[{..~.7k....;..:..3....4.....$..m]...}....~q...9T.#..7.~..8...q.N;c..ffo.w...W..d........../t_........lWJE..).>..v;:=....Rrw#.m.n.n...E...vm.J}2N*..|.4...80.#..e....t.J..ZQ.x|g/....F..e....k+vK...M..W.X.e.L..~...j.....kz....=...n:O.:..[.L,.+R...Y..zKNI....,..{e..U.'...}.......|..t.]...~...b4......_.i..../.......m...a..n...v.j.?..Rc.$G|.31..#..$?.........h.w....-... .a.%z..u......u.A....Fm..J.......G..[...w.....:....w/.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{C36928CA-F1C5-43EE-B0EA-629C15528DAB}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):41893
                                                                                                                                                                                    Entropy (8bit):7.52654558351485
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:pZvVQkUbOHxx3pvVmO5rsP5gUdXwFMuv53knzyncaXgRDqPU:pZkijV5wScXwFMYknzucaXgRyU
                                                                                                                                                                                    MD5:F25427EFECFEE786D5A9F630726DD140
                                                                                                                                                                                    SHA1:BC612A86FF985AB569ED1A1EA5FFC4FDB18FC605
                                                                                                                                                                                    SHA-256:5A36960DF32817E8426BD40A88F88B04FB55B84BAEF60F1E71E0872217FDB134
                                                                                                                                                                                    SHA-512:B102F34385196D630F198667E874F25ADBC737426FDAE0747EC799B33632E5DC92999C7C715DC84D904342738930267AB1709870BDAA842243E4C283FE5E1554
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................!.1AQ....aq......"......2...Xx..9BRr#.b3$..&..g.8....%F'G.(H.Ss..D5E..v..W..Cc.deu..7w.h.).....................!.1....A..Qaq...Ttu.6..."R..5...2B..S....bcs.Dd%&r3C...#$...Ue.............?..R...%.R...t.MQ*.l...v...V]..n...Zw....M....4..F.&&bb0.:]l......ay.r<..3.l.Q^.........I54.N2.8..2s...w..r6.......[1Zh....O...9..>...B......x]...r.\.\..v..~....y.QT.3.......=....r..}.l.....o;....M..C1....w)...+o1f.]...MoA.E..s5..i.\....miGsy..m\.Zj....I'YU.\tU6La5v.>.K..m.]1.......k..0....</5v.V7lY.e.vV.+./[....f..u{....s.}.Rb.Z.....Y.6]..m....V.\...Mr.=r...K...l..%..m^.......X.(..fG..[F*ly.jL.a4..vs..o.e..q.9km..w1.yg.....r_.*h.n..5i.-.{Y.l...<...'Or.s..Z....../JP.....\FV.S..............m

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{C848FFE2-560C-4DED-99B7-9B6FE450DF8A}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):32656
                                                                                                                                                                                    Entropy (8bit):3.9517299510231485
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                                                                                                                                                                                    MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                                                                                                                                                                                    SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                                                                                                                                                                                    SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                                                                                                                                                                                    SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{C9E29848-2861-420C-9918-5C9B24E9AD85}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 30 x 700, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1547
                                                                                                                                                                                    Entropy (8bit):6.4194805172468286
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:dZeDNYbS+238CTUFPA6SXG5qSacX9q73eXu0vC3dU+OB2gbwHRuZ:dykp9FzBBacXQ3uNC3n7xuZ
                                                                                                                                                                                    MD5:0BA36A74DFBF411FAB348404CCEC3348
                                                                                                                                                                                    SHA1:4C619790E517416E178161028987DF1CD3B871CC
                                                                                                                                                                                    SHA-256:2E7AAF26BEC32148B96442E8FFF1BD2CEF2D72630969F23B9A2ABEDB6CFEC93B
                                                                                                                                                                                    SHA-512:90AF53DB7C413E2ADB970AC345F73E4ED8AF626E179C929E6560118F7A9E98DC7C5FF02B2B3F6C98D397E0FE2D85F3427C6928C328872149E176FA8A99E91F54
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...............\....PLTE.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................D......bKGD....H....cmPPJCmp0712....H.s.....IDATx^.WSTA........b.0gPPP0..E.9b@L(.c.N.U>..@......;...}..B.(....$......5..XS...I....).!....D^.uE...\..5........F."o..-...m.n. .^.....q= .

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{CCE31545-ADE6-4F98-8678-CB834D871C8E}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:13:06], progressive, precision 8, 570x779, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):129887
                                                                                                                                                                                    Entropy (8bit):7.8877849553452695
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3072:QS1x1rXglsteJ79wHi4vNQR5yBlUdOSILe9hSj9jeWMPjdlOJ:vvglst1HiwWR5yBA2LeS9jd1
                                                                                                                                                                                    MD5:737E96E41D79D3BDACE7AB4F8CBF6274
                                                                                                                                                                                    SHA1:E6202A41A4F86B27D9EBCAEF7670B16C0ED67CF2
                                                                                                                                                                                    SHA-256:7966F3D8A2D61ECB49A35E163781858E052C0B122A18A1238AFE27B57E2850E8
                                                                                                                                                                                    SHA-512:D398C8521DB2FB3F8456FE792CF37472F3B851DD7298DB20E2DB79144F8E846D051878E77E5EF5D00E6840EDB90C6E2D97935BC1023A15FC45038CCE731E9895
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....iExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:13:06.............................:.......................................................&.(.................................3.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................u.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...W..I:..*....a....Aa ...w.T.M.v.........3x.......8Y....$.."-..m.I.0~sxB[@..=...:..\.Y?....@O.L;9i..U....?.5">+9.s\Z..vN

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{CFE87576-23E0-4D90-AF31-D14BC20AAA71}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 357x69, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):5465
                                                                                                                                                                                    Entropy (8bit):7.79401348966645
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:X0cZneDWlIKmXwxacOHHI6EhzNlSSDDgafbofgt7mGrw:XleDWlIJwQHihRdgu8imGk
                                                                                                                                                                                    MD5:8470F9A96B6C6CAD9EE60961E96D19B2
                                                                                                                                                                                    SHA1:AFE1F01FFA4E4CB06B1D770C9C59DA75B434D1AC
                                                                                                                                                                                    SHA-256:2DF453410796AEC7B9EFEC00059B6CE64BCF67313A95AE458BA600EA5DE14811
                                                                                                                                                                                    SHA-512:CAE5C2ED091BA49761F0348516D53491E578FB165F32F93AC7DAD927383E9A398B06229FAC6A8233777DF708E5001AE0037A1FA960293BDA49892C40B37F2240
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....C....................................................................C.......................................................................E.e.............................................8...............................!"1...2A#Qa.$34bBDSqt..........................................................?.....`0.....O...3Sd..@..5.0....Q.pw....;....!pN.DR....`0......N^...k.=.u.e.7{.b........?z....zV...M.....P:a.SPj.....WRK.=x.2.h..2..AS..s..A..|.Z/f$D.YX1pr......}G6._.~..)j...+.s.r".{..q..-.^@...#w|.H..*.K)....g...y..`0......2.w@.Ro.d....@...K....}...&... y..f.y.0.|DC..>p.[E.2......v..N.)Z..4.RF.D.8]..Z.|f/..+\ID.r/.o........0i..*.G.O..uj..RN. ....j...xnF...Q.Ls.U.c.D0m....z.k.P;f...b.=..L.hH.,./;.U..`sa.I...?*...I....M.0<.u....!..C..U.T.....s.Q......_..7K..*.....?....R\&=.<.u..oQ}WZ..Yu...{Fe3.h...@.s..mW.G..^....1.W.#[.q2.&u.c.G......`J./..X.C....M;.....3k$}.i.3...#/x.m.Oh.}FH]. ..5NNDIS.-.M~...6..w.d....P.;..k...........v*..T..L.P...s.!B.4..w

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{D2533651-149B-4680-8C68-9D9B0E401A7D}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 40 x 617, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):827
                                                                                                                                                                                    Entropy (8bit):7.23139555596658
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:6v/7Hs2NwBW1mtjeSfaTHHy05riYUtr8y8PQvPYzzg979Reip0QPqc:oOsotazy4rStr8y8PQIzWea0Qv
                                                                                                                                                                                    MD5:3E675D61F588462FB452342B14BCF9C0
                                                                                                                                                                                    SHA1:86B62019BC3C5BE48B654256B5D10293FC8C842A
                                                                                                                                                                                    SHA-256:639EADAD468B6B32B9124B1F4395A8DA3027FF7258D102173BA070AE2ED541AE
                                                                                                                                                                                    SHA-512:E6EA855B642ED36FA82F8E469A826DC57EB0C36E307045FF8D166F67AF9242C87840833BE31FBE4706DC54100E999D6A3D3A78D0633A3114735818874AD34758
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...(...i..........`PLTE...................................................................................................bKGD....H....cmPPJCmp0712....H.s....qIDATx^...0.Cg.;......@j..2c.=~KP.[H~..@..8...?U.g.n.a=.=.).....3..u^(.....L....5..........8.}..T.f.n.a=.=.).....3..u^(.....L..r....s..8.....W]....,..9..G?.a..`c.z...E.p...)Y.P.....#....@9.7].....,..9..G?.a..`c.z...E.p...)Y.P...`b....0.b.+~{.Pu...1..<..0._.l.@O.y.(...V3%..J....s... .(g.+.qyWu...1..<..0._.l.@O.y.(...V3%...%R.L.Q..x..R.<t.o......7.............:/.E..j.da@i..`b..Z......u.>.?...7.............:/.E..j.da@.Dj..9.W....s. .....:.......L...">w..7... .....:..."...L..."..a....D..Ya.l....E.{.@&.|.._...7..D..Ya.l.....{.@&.|....0.J.."z.0s..s....=g ..>........"z.0s..s....=g ..>..l..1...y..g......IEND.B`.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{D30E4AEB-15FA-4E76-8A99-CE8A89AAEDE3}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):15740
                                                                                                                                                                                    Entropy (8bit):6.0674556182683945
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:Elv3GG8/OOs+GouFdxMlxjoPyerzkpuOo2vPMc62PaJseZC+BJoS/:EtNiwdxMlZoPhzkpuOo2PMc6rX8+B6+
                                                                                                                                                                                    MD5:FFA5EC40DC9A0FD10EB9E6355142D6A6
                                                                                                                                                                                    SHA1:3D3D6A7E086B3C610C08F1F3E3F883604F06F2A4
                                                                                                                                                                                    SHA-256:D74C3973C8D1F7C77274691AFB1AA934940674341D7EEE563BE75E563281BDFD
                                                                                                                                                                                    SHA-512:6FAF2A24D06E6008F3579C7CEC90C2887462BDF83FAD7372FBB74B8DE90340B580E9836F309B68A9794597A598F7DCDA661C9A58DA6D8187C69083B7A17C9CD9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!.1.....AQ..aq.g..8...."r....2.FG..#.E..7.Rb..Cc..D.v.B..3s..$d.%5Uu..&6fW'w........................!....1Aa...d..5e.6.q...Q..."2b.c..r3DE..BRs4U.#C.S.T............?...u.&0...cV.T.I...1..=4....Ce_.g.q.=F.M:>)...k..pm..h..=........S....)Ja8x...b.).=5.q..0......k.M.....1?-.G.b&.5..Ep.8t...'...R)..ta.F$bXO]tW.b.6#.t.XWN..ZW......].....G....x&&f..'L.....7...\...'.8...~`.sa...............................................X........qo...SMk...'.V...i..hb.}&?/.k.:>l.^....>Y...<}...&.jY.Gn.MKejyV......D......gf.0....t.nw..XQ...H.B.....=8.UkR.....Hm..w..]...k...#Z...F../.gjWvf.....w.aZ].2..5..^...VZv..._.7..a.|...:.B...,f...............~....m.;_.....-.e.y.w.[m.].bu.b.f+.E++\.....Y..7

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{DB3418CC-AF44-43C8-8DDF-1CF300D07DAE}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:05:55], progressive, precision 8, 612x618, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):68633
                                                                                                                                                                                    Entropy (8bit):7.709776384921022
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:tapXpSTJDOkFGdJdBk/slsbfsw1imaapnbvD8:U2OjJr6b07m1bvD8
                                                                                                                                                                                    MD5:41241EE59AB7BC9EB34784E3BCE31CB4
                                                                                                                                                                                    SHA1:98680761A51E9199CF3C89F68B5309FBEC7EE3CB
                                                                                                                                                                                    SHA-256:035B26DF61855A3F36DBD30FDAB0C157C04C9E8AE2197EA4D4AEB3E82E6A4C2B
                                                                                                                                                                                    SHA-512:3EE331D5BCEE4AD5D3FC9661D4AB4053F7D351591A094334F963C33C9D0E32CCCABE9334AD7C308108CE99617E064FE848DCD469ACD8D83FBE5C4452DE523D8F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:05:55.............................d...........j...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?../$.W:SZ./...9.....-...u......r.....].c...@W_.7...+......v.+PD.I..-<1.pDn-\.....p.$....0.}V....\..>.~..XN.o..l(E....ik..o.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{DEAC60EE-6049-4A2C-A2F0-E8FB5D9D5805}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 814x105, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12654
                                                                                                                                                                                    Entropy (8bit):7.745439197485533
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:JheN2cq6MLu6MLGu54cHeNzhcmhcDu53eNE3UPkhrxvu:Ji2Wix7fzVsbE3Zm
                                                                                                                                                                                    MD5:4BCCCDBB4273ECEBE216C84930A8D0B2
                                                                                                                                                                                    SHA1:FFBF617787E27BC94D9BAF89F2FE34A2BD42794B
                                                                                                                                                                                    SHA-256:474F9A8C25D5E21192315397EA995B1E11E2C1608157C6E0277688091BFD136A
                                                                                                                                                                                    SHA-512:DAD73A8C0E293B88685C0C71EF15E0DC95EE39B7FC9F849DE5D634173FD9FA0AF0AA96742D9E94BE03556AA4A817D5001C95A6736EAD5D5DF03661876785EB74
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....C....................................................................C.......................................................................i..............................................E.....................U....V...f..ASTc.......de.1Qq...!Rb....Ca."r.................................B....................b....Ra.....!Qc.....AS.1U.."C...2Bq...$#3%&.............?......3.....~......:..g..s"......:..g..s"..ic..Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. ..0...Q_..X..V5E~..c..X...@u...cTW...0...Q_..;.m.....@w...Q.+....*.4W...lUFh....v..._..wn...dW....y._..v..E~...*...@wn...dW....y._...v..U..@wn...d..{`;.|U.2g...*.3...:.0?ViN.z.@w...4.M.:m..`~..i7...q...I....J.`l...W..n..PQTiB...6....+..sj.*."...6....+..WA...x..A........(.N6`..AD.q.....'S...t.Q:.l.......f.]..N..0.. .u8..A........_W..Y...}.C...~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~.v..?U..^.r..}..Bep

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{DF6177A6-5359-45F5-94A1-8A3AB36E8C83}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):15740
                                                                                                                                                                                    Entropy (8bit):6.0674556182683945
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:Elv3GG8/OOs+GouFdxMlxjoPyerzkpuOo2vPMc62PaJseZC+BJoS/:EtNiwdxMlZoPhzkpuOo2PMc6rX8+B6+
                                                                                                                                                                                    MD5:FFA5EC40DC9A0FD10EB9E6355142D6A6
                                                                                                                                                                                    SHA1:3D3D6A7E086B3C610C08F1F3E3F883604F06F2A4
                                                                                                                                                                                    SHA-256:D74C3973C8D1F7C77274691AFB1AA934940674341D7EEE563BE75E563281BDFD
                                                                                                                                                                                    SHA-512:6FAF2A24D06E6008F3579C7CEC90C2887462BDF83FAD7372FBB74B8DE90340B580E9836F309B68A9794597A598F7DCDA661C9A58DA6D8187C69083B7A17C9CD9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!.1.....AQ..aq.g..8...."r....2.FG..#.E..7.Rb..Cc..D.v.B..3s..$d.%5Uu..&6fW'w........................!....1Aa...d..5e.6.q...Q..."2b.c..r3DE..BRs4U.#C.S.T............?...u.&0...cV.T.I...1..=4....Ce_.g.q.=F.M:>)...k..pm..h..=........S....)Ja8x...b.).=5.q..0......k.M.....1?-.G.b&.5..Ep.8t...'...R)..ta.F$bXO]tW.b.6#.t.XWN..ZW......].....G....x&&f..'L.....7...\...'.8...~`.sa...............................................X........qo...SMk...'.V...i..hb.}&?/.k.:>l.^....>Y...<}...&.jY.Gn.MKejyV......D......gf.0....t.nw..XQ...H.B.....=8.UkR.....Hm..w..]...k...#Z...F../.gjWvf.....w.aZ].2..5..^...VZv..._.7..a.|...:.B...,f...............~....m.;_.....-.e.y.w.[m.].bu.b.f+.E++\.....Y..7

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{E177AA68-5EDA-437C-82D2-D58AA23010EB}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):84941
                                                                                                                                                                                    Entropy (8bit):7.966881945560921
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:X3sWfhTVd+xu6rA6SOONM0/YFXnviDwoPCaNSm+z/ze/fWNj7GfigeKyCGzw+QKW:nsOhdDJOwY1voPCaom+z/zeHAfGihCG8
                                                                                                                                                                                    MD5:CB84C108A76C2AFFCAC2551A3C1EAD56
                                                                                                                                                                                    SHA1:8BB7C2A12B056C1ED12EBBAE5BC9F60CCE880FFE
                                                                                                                                                                                    SHA-256:139BB0E79F89C3DDEF79B1716A5FBAB4C07DF5785FB3CDF6B4EEDDBF6C078452
                                                                                                                                                                                    SHA-512:6EF85144E9A7ACD0FF2E52A5FF42093153EFB69127B1C8549EEBC49B6CC196A46B65EE39A2CAD0206F6A41476D8B5B35D29EAC9942B8F84972B32E14CAFEED27
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d....................................................................................!.1A.Qa..q...........".2..BRbr#.T.3C....S$.cs.D..4%5......................!1A..Qaq."2..BR....3...b#.r.C4.............?.......m.q..'O.....r......_.1....8h....?.....O]~..k......GO...''._...!....o........''..g..H?k.......1...?.....z......>...+0..................GO...''._.........}.O.Z|.L?...........?.........[~t.......}......NO.....v.......J.......?..g..H?k......GO,m..r}o.z.....}......dC.9?..g..H_..........?.....O]~...m...C?.z..f....W.=u.B..m..C.-?.a.....3._.?.......o....np.M....g..H_............9?..g..H...../..kO...''._...!~...o.....0.M....g..H.........../......O]~.~...o.......7..+.... ..l?.}........&....3._./....?.........W.=u.C..m..C.+?..o.W.=u.A.^.O....:......_.........}..t

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{E4F613BA-B21D-4AE5-B3DF-14C684DE3D5D}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:PNG image data, 77 x 627, 8-bit colormap, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):5136
                                                                                                                                                                                    Entropy (8bit):7.622045262603241
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:djzuNKb3XHco17p2wolIxIx7lpskdsC/ddWNKeabJbMojpxLDTu1:VzuNKb397pwlIxKp7qs3bJb5FBTw
                                                                                                                                                                                    MD5:FA38AFA965141EA3F17863EE8DCCDE61
                                                                                                                                                                                    SHA1:2B4611E651AF7549C1AA73932B1136B561A7602F
                                                                                                                                                                                    SHA-256:E1CB1A0EC9BE62D5445C73AA84DF38234002A7E164EE830C9DF24997802CB5D2
                                                                                                                                                                                    SHA-512:A372674F5CA343321BA9C413D346070709F7685706C9C6C3DC7F61846B59253A5E6FE800DBA10AE870FD3887439B2AA106FBBB51751E92A163938A4393C43E28
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR...M...s.....}8nv....PLTE.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................z`.....tRNS...................................................................................................................................................................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{E5416AF3-CC3B-4ACA-9B74-5584EC764D70}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):40884
                                                                                                                                                                                    Entropy (8bit):7.545929039957292
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:MCBOA4d+ElOXJ/3pI7cRBiL7L6qERqGz65WXzZqJsKQSbIsTT6XB:hIAU+2cGdLX6qBG4WDZl4Ihx
                                                                                                                                                                                    MD5:7379775A1E2AB7FAB95CFFCE01AE05F3
                                                                                                                                                                                    SHA1:3D3DDFD8AC7E07203561BAE423D66F0806833AB3
                                                                                                                                                                                    SHA-256:9301DB6D2D87282FCEE450189AEACE16D85F64273BF62713A3044992B6B7A9E9
                                                                                                                                                                                    SHA-512:4B5006E620E80D3A146944649CF4CA619782CAD7E8C4CD0D1DE0EBCA0FA05EACB7378DAFCEED3E26F5698B07F19604614D906C8F51F898660E2F129D8DEC6F62
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1A.....Qaq....".....2....BR#S..br...3T...C$.7(Hx....4D.G..Xh.cs..'..t...%...8.....................1...!AQ..a...q"2.4Tt.......R3S....Br...#s...Uu.bc.de..$D..6..C%E..............?...z...;sB.yv...........]t.\...n...../....m....M.=.3G+..x+.....S).*&.J../..8..O/+..sG...p...<!....~.c..C.w..,[oHom.wc-.J.~.......L[..6...'..i_..S;...!Y.z.q].EK..M.x...i.x.+.;.+...}....#......f.)........e6V..p.;........s.)..Ml.J......IU.6...<9+9.^..l..Y...[._...2..^..j.ia...._..3.;...~..<3...;......z.^.......]..Qk.,...Yk...3.3Jy^p.}....q...I...&..t.......;..9.g.GH;..'...%...)..[..y..../...zCn..>...'...1e.Y..;....]..7...N>t..m-.j.............H^..T\.q.ru...}...eTn]I'r.^].#..wOY....v

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{E8618D10-7E55-454B-979F-72896CB4D431}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:12:29], progressive, precision 8, 598x766, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):70028
                                                                                                                                                                                    Entropy (8bit):7.742089280742944
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:ub4bgbB7g9cKCmSzaNF0jAdAzQKTEFBQqUp/i0yG1pidLHTVX:ub4bIB7Qg2OjbzjgWp/i0yGCZx
                                                                                                                                                                                    MD5:EC7811912ACA47F6AEB912469761D70D
                                                                                                                                                                                    SHA1:C759BC2D908705D599B03BDB366C951B11F99A4E
                                                                                                                                                                                    SHA-256:FBB4573E3BEE1B337077691BEBAE15D6FAC52432405D31396D526D7694A8283D
                                                                                                                                                                                    SHA-512:881828150993A8C56E36CDA2051D89C1F6E0322643902C9506392C163E8734A2933A46486F40E5BC8C8D0164E180605E52620EF22FE14540AEA787A38B22E98E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H.....7Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:12:29.............................V.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................}.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....H.yM..? .Z.. .^.x..p.8.A...K.... .\{..)..y....t..=.^y)..v.@.W>. .h.. ..p.:.\)(.$....$.I).....!....E..Z.....&.5.).

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{EBC1DCFB-1F0D-4BAC-8693-F6F8D6D02347}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 262x277, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3555
                                                                                                                                                                                    Entropy (8bit):7.686253071499049
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:/h3JeYCQV5Hn++9HBdAjU78S/mjLLwqnqahJD:53Je8b+EBdAjm8S/mjLLRnphJD
                                                                                                                                                                                    MD5:8A5444524F467A45A5A10245F89C855A
                                                                                                                                                                                    SHA1:ACE68D567B02B68275E0345C86DB1139C0EC1386
                                                                                                                                                                                    SHA-256:7D2B01F17354D9237A6AB99D5B9AFDF0E1CC43687125848B0C2DEDFB44CE3843
                                                                                                                                                                                    SHA-512:8151B447B60D110C32EC1EF286B941FFC09B99140F41BBACF5A1650A385FF4D13C0DDB2878E9A470FC7CFCC95A1AB6E44F6DE72562B0FFE093DC8A3C3C7FCC14
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222...........".......................................2........................!1AQ.a."2q.B..#R...3C................................ .......................!1.AQBq............?........)&vD.)3Hn*..X+....r...tmL.k..(.E...R. .Z..&...,fJ...!...6..S\t3.=...g&..Bqe.)_U.....1......-..fl.................J...u.i.mU..K..v.w.0O..E.h..D~K.(..9.,8..E.}.............i.\.....t."v..q..C............<..|3.........................*Q..../c.....f.}8....D..|k..Z......0..~..c..e..m(...|.c..'.5.5............==bx.5x.8...T;....=.--.pc...I;.V.m..,(....}...NH.ho....Q..U.E$.~...w.t>.S\....'f.{.+.g._.t....;>.....P...........-..G.h..2...J.% !.E97Ir.D..N....j...oE._...._...".?.......#".S.........Q.Tc.I..*I..k.......=$.........sk1Jp.\K.....F.3.Q..q..J....N..[l.&....OR4bB|..2ul....J...B.$&H..9#j.f.n./........?R~....B.I.@..........m

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{EF5FB40A-FA80-43E5-B623-683BAA6D5C83}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):59707
                                                                                                                                                                                    Entropy (8bit):7.858445368171059
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:k76rvGc8WKC2/UX1uEgVRY/jvv9CblyL/T:k77Z5C2/Ow1e9CblCT
                                                                                                                                                                                    MD5:47ADB0DF6FDA756920225A099B722322
                                                                                                                                                                                    SHA1:851946B8C2BD0BB351BAEECA9E5BB6648A87D7CA
                                                                                                                                                                                    SHA-256:EC8CD7250F3D82E900E99114869777EE859EC73EFFABED108815F65742078C3A
                                                                                                                                                                                    SHA-512:85A9920E1CE4A2FCCEBAFA425C925DF33580FA3C3C00178F058539B2FBC0163866DB8A41B320E2EF2CD217F00FFA06A1A831C728D3F9F910C9EAC58B5DA76E2D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..A..Qaq"....2........B#..R.b3$..8xrC4&'W.%e.(.c.d.5E6Ff..h..SsTt..u...Gg..H.....................!.1..AQ.aq.".......2..st.BR..56.r#3.b.S.4c%...$d.CT............?....3.7...G:../P....z..K.:6..w......6....... .z7...~.....{gdF60...9....{...'[N....m.........z...g{.......7...4..1..=.z...._..p...m..Icd.~.v..9.P..0Z(.<j.......R6zm.....v.z...>x..)=g........zo{..w..f..y.t.....%.D..#.}.I.>).H.QM..cLD..x.../.^y.{.............y.=^.......I.T.......U..0_?...u..og..3.ky..K....6w...Dc......~........ik.z....N...en......_.....x....._u...4.{..P...>.....}.......>.R.....m.....[mt.....}.........|.....m......~....B.F.]C.36..q....yg...{]...+.DZv.9<.o..;..N.n&im.,....w.3...V.s...Y..e#$.

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{F08AB56E-FA3A-4270-A848-E9E91F52563E}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:26:15], progressive, precision 8, 216x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):64118
                                                                                                                                                                                    Entropy (8bit):7.742974333356952
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:ORG4azGOKXzkEmR4bdRSbxONOoz0khbSb4J/5GZK5SWUlRwUYdv1M:ZXzGXzJdhRmgHfIb4J/5GZK5SWUldYdq
                                                                                                                                                                                    MD5:864EEA0336F8628AE4A1ED46D4406807
                                                                                                                                                                                    SHA1:CFCD7A751DFDBE52A20C03EE0C60FDFFA7A45B93
                                                                                                                                                                                    SHA-256:7CE10D1EA660D2F9CF8B704F3FAB2966A4CE2627D9858D32C75D857095012098
                                                                                                                                                                                    SHA-512:0CAA0C54C14571C279A75F0D5922F78A17803CF6EE1724D66819F7F5944C0F5B25CB586BB686A52808CDF2F8FEB3E4864052A914884054EF7DE44124A8CA951E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:26:15.....................................................................................(.....................&...........s.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................#.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....NC+n....<.=.7..&.8A56..@^.Q..\\...E.>..".&G.......J .'....$.I)........0.../..mv...D....<v0=..ugc+..l.o...=.c.......x.&D..{`8...v

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{F1B31AF3-0B52-4388-83EB-130E6B6061BE}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:19:29], progressive, precision 8, 221x792, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):24268
                                                                                                                                                                                    Entropy (8bit):6.946124661664625
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:d2wiieoHTRh5a1HAteZCWOZIM+L7WhNjYn:8wHFHJ+/OZIKhNO
                                                                                                                                                                                    MD5:3CD906D179F59DDFA112510C7E996351
                                                                                                                                                                                    SHA1:48CDB3685606EDD79D5BCDF0D7267B8B1CCBD5A8
                                                                                                                                                                                    SHA-256:1591FD26E7FFF5BE97431D0ED3D0ADE5CFC5FA74E3D7EC282FD242160CE68C1F
                                                                                                                                                                                    SHA-512:2048CBA13AF532FF2BCC7B8B40541993234BD1A8AB6DE47B889AF3F3E4571F9C5A22996D0B1C16DD6603233F6066A1A2A97C16A6020BEDD0826B83BAD0075512
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:19:29.....................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................$.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....)......[]t.\Z..g......A....&D.$LH._..X..Xl...`....cZ.X.........>......f.Z.X...]..~L.S..@..I$..I.IO.....x...s.g.[f.h{9..

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\{F76A1E9A-FBA1-41F1-926A-3A406638C3EA}

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:15:20], progressive, precision 8, 604x784, components 3
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):140755
                                                                                                                                                                                    Entropy (8bit):7.9013245181576695
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3072:i/aDiblRsFcOco8dofE5Zx1+NQI8Wh9aiOe5NTO:mnbM+TxaAi98W3aiOwTO
                                                                                                                                                                                    MD5:CC087700C07D674D69AFDFDA0FA9825C
                                                                                                                                                                                    SHA1:F11113DF69DACDB255C6CBCFB29C1D1CCE40B346
                                                                                                                                                                                    SHA-256:A7FA7F092EFF43030A56342C39A765F8D5CC48C7DB815DDFC8C1E5EC40117FAE
                                                                                                                                                                                    SHA-512:843202D975EFA91E73287052A893584B6E5AE601F91612B56539AA2F73D1AD3F997FCAD1E711E0F483A2E91D46D9643D0B026B43F4E94116A5D2FB6551536034
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:15:20.............................\.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................{.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.......J...\O.,......../$..........OE.m.o......T....Z..l.g.-....m.?...Y....3......"....].j.X.k.S.k.....4..R....{....?F.

                                                                                                                                                                                    C:\Users\user\AppData\Roaming\Microsoft\OneNote\16.0\Preferences.dat

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4456
                                                                                                                                                                                    Entropy (8bit):0.44145676805217604
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:zJGNft7pljYyfhcD1RRXUn/cX52o2RXfo/Gq+J+/KRujslll:zJit7LjYyfmJ/U/cX52hRvouFw/6/l
                                                                                                                                                                                    MD5:C75B81C9ABBDEDCA7347B23AB0343D47
                                                                                                                                                                                    SHA1:6494ABEDFC9010AC6110C029CCF618B433FD53BE
                                                                                                                                                                                    SHA-256:BFE0A1D56764DAE8D01468A389A7DDB940FC8709BED15F4F4CD90B3D9172F055
                                                                                                                                                                                    SHA-512:C742C6A1D6B85D6EDF22189506F006967F26B7758315F94E21A509B33D5DB0EF325CF13C9B23E3F204D553D04218A50270ECBD6D5F4853E04A37383CB7B529E2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.%c....L..=../\.z.po..H..{..e?.................?.....I.......*...*...*...*...........................................................................................h...........................h................*...I.#,.*.._.........\R.&.I.:j.px9............................... :.. :.. :.. :................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6221
                                                                                                                                                                                    Entropy (8bit):3.721437693365143
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:BlFlf33CxHEjkvhkvCCtem9LnH5m9LkH6:B1fyknemrm9
                                                                                                                                                                                    MD5:B708969EA714425128FC88FC3C2946F0
                                                                                                                                                                                    SHA1:F46B188917131AFD146A9219EB2FD0B6F502705A
                                                                                                                                                                                    SHA-256:27358A4AD2702EC6CB330535C0301B06E94C3E21B6CE57A48F6BC2C2C1C0ADC4
                                                                                                                                                                                    SHA-512:D646977095ED072AA44347E5152760D9C2C93C32F30EB07B80F1932BFFBE30508F5F9F9F37184D3F93042940CF69D3FE538EE7EFFF247B77FB083163910BEC77
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:...................................FL..................F.".. ...-/.v....uE.S/U..z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v....(w.O/U.."..S/U......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.\...........................%..A.p.p.D.a.t.a...B.V.1......Y.\..Roaming.@......CW.^.Y.\...........................3..R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^.Y.\..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWR`..Windows.@......CW.^DWR`..........................9...W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^.Y.\....Q...........

                                                                                                                                                                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LXBLY70HMGGVONEOM0XE.temp

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6221
                                                                                                                                                                                    Entropy (8bit):3.721437693365143
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:BlFlf33CxHEjkvhkvCCtem9LnH5m9LkH6:B1fyknemrm9
                                                                                                                                                                                    MD5:B708969EA714425128FC88FC3C2946F0
                                                                                                                                                                                    SHA1:F46B188917131AFD146A9219EB2FD0B6F502705A
                                                                                                                                                                                    SHA-256:27358A4AD2702EC6CB330535C0301B06E94C3E21B6CE57A48F6BC2C2C1C0ADC4
                                                                                                                                                                                    SHA-512:D646977095ED072AA44347E5152760D9C2C93C32F30EB07B80F1932BFFBE30508F5F9F9F37184D3F93042940CF69D3FE538EE7EFFF247B77FB083163910BEC77
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:...................................FL..................F.".. ...-/.v....uE.S/U..z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v....(w.O/U.."..S/U......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.\...........................%..A.p.p.D.a.t.a...B.V.1......Y.\..Roaming.@......CW.^.Y.\...........................3..R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^.Y.\..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWR`..Windows.@......CW.^DWR`..........................9...W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^.Y.\....Q...........

                                                                                                                                                                                    C:\Users\user\Contacts\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Desktop\CURQNKVOIX.jpg.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1273
                                                                                                                                                                                    Entropy (8bit):7.826879827584557
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:ZCn08LNhcki7iz09c+HGF1G0OwKjhRpCsNXxKjqsG7ZYQDGFpsgPAelpbuiO:ZCn0ENhcP9xGS0DKtvrNhKKtYqkpHA+M
                                                                                                                                                                                    MD5:72D805CE1086CB0949FD2F9C050EC3C0
                                                                                                                                                                                    SHA1:D50CDA99DA417271BDD4F389949DA57FE7CF7A8E
                                                                                                                                                                                    SHA-256:79B898880207EB2F74D29AAC7007FD7030ADA26F4DD3AFD64B722C71EF77F3E4
                                                                                                                                                                                    SHA-512:9FA5DE7CDF31B24AF1701C6AE7F87365D633C4E81E9E903EAAC85FE88BACE6332C6CAC575E7CA1C900594319C7EB8E6D23CD464DDEB8BFD90D33EEE7E5D8C4CD
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.y.1!.JN....cR...&m:.bVRK..a..\...-..~..]...I..".....F../.dz%....6Q.Y.1)U....=v.[..X.....gqh...z9.1...@..C8.`..2....vM({b2..H......\6HV..S...*=....(].Z7@.m.U....|Kq..J.x.i...M.......c[)-....\.O....!+,...+.5%b..i..l.............D..6..)t.R.xY..y.(:.TP....cM... l8.dEE[..b..Y..."..}..Q...^..2.....Q).$.|i;....*V.M.;%A....?l.G..G.....pm}...s .;...J..[).r..+....l\({.Dt(zx.G.+..."......x.. (...lj.....w.s.s...s..Vb.y...y.9..v..!.^..|.K.\<.hHl.....VWNi)........2.Y..G...'..[.r..L5...^.........S....v@.J...N...lw4....t..BvR."ru....J.y..S.N?....,t:Rx.U...v2..u..V.m...G.Z...L5..V.._e~e..,..1&...|...3. .....X..t.Hl+f|.H.&...'......{.. >....i.....w.i.{...f..Wt.{...h.7..j..&.L..p.F.C&.wHk.....CVVj/........).I..G...9..G.r..Q!...[.....V..t..f.qhe,.z..t..?C.L.....Jm...4...\m...g.f. .<.V.....T^ub-v..dU...o..a...r...t.$wD.)h.x..\.........Xh*.. .v^.B..}..U...W.......+..S..82......J.yM..7.\.w.......+...ZT........6..C..o....#b.Z..W.}E....a...?...v?..&}.[...

                                                                                                                                                                                    C:\Users\user\Desktop\CURQNKVOIX\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Desktop\DVWHKMNFNN.docx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1273
                                                                                                                                                                                    Entropy (8bit):7.839982244504733
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:R2EVU5/EM0wHoE+UYyUyWGbaOZ0wUjgMpjp49DQg2DDDqK2uiO:RjK5VIIPRr70p49MBDKuV
                                                                                                                                                                                    MD5:5F1D75BA59EBE5468B6FC3A0E34DACA6
                                                                                                                                                                                    SHA1:BEBA3C5954341BD0D0069CE4AE796C50D22E5995
                                                                                                                                                                                    SHA-256:78E81C36359024239EEA5480E276C0817599D54F48B72262113A1739D6B31BB5
                                                                                                                                                                                    SHA-512:66E80434AC8C448A1653339E765432A11AD50F22A6215C8303D36172B465A8745E92F4F66A183AA10C841A1B02D4F69A3774EA783D100AE2741E858EADD751F5
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:Qm6...3...0..CN...;.^..T"M.0E./..kC..F....=....b.).g{YiE...[..(.A........|...9.O.u9.}.T.....o.z.M1......(......& ......\......V..aQ..`@..&..LPD.j-..{..Eb..Lx.1...C.ZV.i...@.L..D...)...j....W0;[h!U...7.UTNd..USu..01z.Gf....-{yc.T.3I0...".x.1.H.Sy9...'...,..FZ...<.Q..F#O...(N.#..wJ..E....9....y.1.mlOeU..T..8.A........p...5.U.`5.v.U.....v.o.W3......)......=<......DA.^7.....y...cS..x.a\}....<lB._..we.yi..wu[n.7.ZS$.?.x.!.,p"...n<g....0i..r.9..............?q ..T..!......].,.U~F.u....'R.A.,e.C..qS4.r6..7..D.x...7.cQ. .S.1CN..h...*....Y.Z.......?._..{....:..\......8............]..^..(... T...=t&..+.{.EU..DP.B<.....q...nM..~.hPn....;pW.X..|c.{p~.slLj.;.][ .=.b.+.5f,.#.s%s....,a..c.!.............,~4..@..2.,....^.-.EdA.r....&U.....\t.......w.....{.(....b. ,h}1*......./.J.ek...........].....(.^2.W-.I..j./w0..4.<....'J.5,=A.i....+....w$........&.......F...E.....w.C..7.........j.....Z_hy..B.x,.gYon.......+;..Ke.H$..c.$.......?..m..|_..,.g.B...:.N{

                                                                                                                                                                                    C:\Users\user\Desktop\DVWHKMNFNN.jpg.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1271
                                                                                                                                                                                    Entropy (8bit):7.8334415757388705
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:LDgh5QeN8GxSXIkwV6B1OMY7IjrN4xuX4GcJ8bHU0YgM/ewPauuiO:LDgDQY/VWYEjrSG4000vZIuV
                                                                                                                                                                                    MD5:45B2B5A91C1652637188487F8EE792D2
                                                                                                                                                                                    SHA1:CB054FD9CA56A639650028D4C4FDE190A902D170
                                                                                                                                                                                    SHA-256:1F95F32FBFFFC9C00BEA6BD28C4150D66811D8BCE0AC6EBB65A776EB498D5081
                                                                                                                                                                                    SHA-512:A270F55C23AC59C55989FC8AE765DC17A9609E6B08598EEB4C092915819D14568399663E871CF5CF7FFB0A2AC0CABC5E3489329D53BA8837DEB6479DC0DFD393
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:..Z.l_.NP..38......'...7:l............Vw|.z[....m.N.]...):.U.M..oLH:...V..|..q^o|S...wO...N...c.}...m..{.-Q..BL.L......7"u.'z<o..M.D....+Nq'.Fn........1..6.<..........]..Q....(`1..0~.(i\.MZ..GUa.>...Pk...0su..R."R,... .N#..c.^......U...[}.n...U.e^.@X..(=......!...5<g............]`j.xB....i.Y.Q...5=.@.W...CQ3..>_..{..gDqi_...vT...[...a.y...n..z.(P..YP.O.......Rm.....ElbB......?bw..*A.8......XX...n.u.|n.84..~.. .[.>.v.z..........+....K....`cm..H>.......o..u.`V.q..=..%Z....m.}.X..F/$.Y.N@M.k;.Zr..d~..#.....>..O.=..aF.P...;.\.S....S-....y.hN..Qr.;.....?nj..;1\...:...>......j~.&..z..v.W...........C..Nf.....MfiU......6nd..:F.(....yQZ...j.b.ib.?<..c..*.B.0.{.g..........+....A....~iq..K4.......|..h.eU.r....."O....l......7Sd.....5..r.ks..&.E.r.<1...>......P.}.L&Rp...p..4P.......e@j.hVV...N..".....m..&.v[...C~F.p?... ..Y.J.....xJ~Y..;.P0$El..O......d........4.......Z.3..0.%5D...^_}..B.j.....s....w.....f.5....F.S#.7.....~..o.......v.v!.L

                                                                                                                                                                                    C:\Users\user\Desktop\DVWHKMNFNN.xlsx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1271
                                                                                                                                                                                    Entropy (8bit):7.8487302492769775
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:Dz8DD8zzpu3wS5qZCTpiCq6Pn73UNQfQJltmeNvWxmaGiXuuiO:Dz6wLSMZ8xbTBfgltTvQma9+uV
                                                                                                                                                                                    MD5:8BE2EFCB15010564E8D79FA345977A62
                                                                                                                                                                                    SHA1:6DA519B396D3A42A618C23CE8EDF48FEF7056815
                                                                                                                                                                                    SHA-256:882894336FF7B20DE577D03604540C5549AE8B29122E63EA797DA4A3A08675FA
                                                                                                                                                                                    SHA-512:D71A7B0B8CA142207C8FF0E64D0E3A9AABBCFC56468506F9FD6C3834A09274C231B50BB965334026439BFDCAC3A6AE639D5511D6D678E7E9E4E2BE5A42373D8D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:<.[l_.J.e...W..&.)n.X.....S.'....J.H..lA..........j....Ox@f...>...u{_.U..:.......P)x..x...?C.z.....E-s.9.....uU...:-....#}.A..c....x.h...V.....m...+......../..n[.r..G*.)=.#.....f...2q z..H..`..B.DP....G..?.6.F..........hn........LDRV...P..h..+n.>.TgV.D.c...R..,..n.^.....X.?....Z.T..jB..........r....ChPf...+...r{O.L.. .......F3f..}....$I.r....N)x.>.....pT...5....;P:...>..[.~a..x.....Q..1.5|..U..5..}|.YO/8...v.K.x...Q..]......'b.........Ok5..q.7....G...tb.......nb"_>..b.EAu.%...5....x......|:.m+....H.....|/......{.8n*6.E....PI.TX.j....*....jAL..nM.5....i.D....W]...C:....VC.a....8......).....+.....W..A0.%. ..C.tj..f.....B..!.)i.._..>...e.OK6/...q.O.z...[..K......3c.........Os-..o.=....Y...oa.....xe1^<..g.FBt.6... ....y...S..?...!j..ZI0...v.....Q.dc.....B..9..8.?..{..j.......A..p.m...uWI.4Pv....S...7q...bd...k.~\......6.sZ|...k...R_...?ZSJ.E.p..eT...f..$.S..a.[.[t....[Ou^...T..X.o..F.LTI..d..ntsh]E......-)....|....q....h...<....a?..+@:.0c..

                                                                                                                                                                                    C:\Users\user\Desktop\DVWHKMNFNN\CURQNKVOIX.jpg.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1273
                                                                                                                                                                                    Entropy (8bit):7.839557774399663
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:zxrthJXF22SjGD0DzVJV/Ofm49LX/UL4wKjd8fugTMOIEFGXC4l2/mKAe7sVluiO:zNthlFpSUSkfm4R/ULpUGTBdFGXC5XAe
                                                                                                                                                                                    MD5:ACD1AEBEBC9E417574754A4EFF174B84
                                                                                                                                                                                    SHA1:6AEE0D8C0192F988E92B3F5D9F5EA094199A6BBA
                                                                                                                                                                                    SHA-256:9E7ED060414E915ED498B688EA31AF4EFB5205D947799484CD7DE9A17500BA00
                                                                                                                                                                                    SHA-512:84A18960058479FC48DDE4A627A7EE2D0E39F0AAC6A6804CC904CA66A61A75375EEB490E9F92ECECD2CBDF34C42C9624776A898DB8EF80539919612118ED0CA1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PK..?o..m^I....M.B....r9.Zc.!...s..6....P...$nq5..?....^..6.'.A.i.J9@8..N..b..y.*...........D.JM......L.I-dA....\..9...r.._..a(..y.<.g..L.......]....."i...e..:D5..........!........;.t.E..7..Q).M.R...$.. U<u..J.l.).E....................SR..!~..t^V....K.@....b!.Yc.$...y..:....N...?~v...5...P..(.(.I.u.Q-C2..Z..`..e.0...........M.CT......S.Q<fS....Sw.#...o).....W........L...k..i.IP..a......<,.4..yF c.6j.a...i...U=C.V..C..Q{..%,3.E28_.b5jp.H/J.N......Q.cR.....s....."....5t........y..0....e.K...K`.O5..y..D^q.f.!...o-..".+[.J.....[..L..o.?..IH|5.ry.W...C.N&...%.47.....^.%3D......e.%...s.d..%.....X........N...b....\C..}....*..4'.3..xP>a.6c.c...e...R<Q.A..N...Fr../ <.]/-^.a3js.L?@.V......Q.kO......{.....!..+.&d...1&K.g.I......k......*P._,..*.p...OGYvu..NLd..`...}.v..?..wJk).^.....qQ..p....AA..3.r..&...`..+..G.<....64.-}....t.......~o.2..q..`N.R4{..:...D!.jL.{I..n-a...\.....I,%?..V..7.{~#D..9;.6......<.xh... k...F...Y*-.G.....g.G.J3

                                                                                                                                                                                    C:\Users\user\Desktop\DVWHKMNFNN\DVWHKMNFNN.docx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1273
                                                                                                                                                                                    Entropy (8bit):7.866610552615186
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:Nq+LZqOlOmHbDM8+9zJ8d7uuq52d3VHN4EAns2T+ATTmQNDgeVuiO:zqubDM8QCd7mSOEAnsl8mQWsuV
                                                                                                                                                                                    MD5:CEBA5D1C88CD9DC93B4286B9ED0DB08F
                                                                                                                                                                                    SHA1:9EC026FACAAC1ACCC824BB1B5B8EF4A2D6337518
                                                                                                                                                                                    SHA-256:F692AB7EC459DDA9F2116EA0AE4135FF867146945E0B1E35ACB8AFDC02A82F2A
                                                                                                                                                                                    SHA-512:52580A611BF07A0A3152B49E8887194E13582F98D40EC8B9198FB3EA3102C4DB4513CD9DC929E225BD05202B3152FCBF61AA5753800ADA34EBB85FDC6199C145
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:..$....+!j.].6...c...|...6..../..@..Y&...+..L&......D...2M...|.........2.D0......t....q.}-.1.<K.2....Q...........g2C.@V..,."&.k}k..0)}.I.&..1k..x..eB2.......E.2A.^...si..0[........W_.F..f.e\...B.c7....KHX..&.7O.....a...v.d.>.KF..?......{.......+....%)l.K.3...z...z...4.....6..P..P3...(..Z"......B..$%[...|.......+.K*....x....}.v>.*.3C.'....Z.....v....)_.C]..:.i......A>..DkO..:RJ9}.%5.........w..W. .p.i1j.."....~A..^.s.....ka..VI.....vt......Y..?....UL.#NJ4..Q..6p.p....#....W..+.....X...g.:.dK..P.f`.~......o.o...^.=.2'-..(...T..h......E;..m......y......|].$*p...Mh]..-W:....x...W...m..M........T....Tx.....Y6..SfQ..<_C5n.<%........q..N.6.i.m$f..*....dY..G.}......`..LU.....nl......Z..!.....__.7FD ..B..+x.s...0....P..5.....m.[..ww.....d.YQ...?c[...P...3>R.R._.n..+.e".o{$....w..<SLai.....C..c...Y./..`.. ..j..a...7]h.....i.v.}Gwl..q..+.*......t..Uc.w.kM..tq..#...j.O,.o...!:.T.n.i}.0...d..:.6..^....m..xR...).F.w83k.^l..}...H.a.{.2.g.d..i.....:I.

                                                                                                                                                                                    C:\Users\user\Desktop\DVWHKMNFNN\IPKGELNTQY.mp3.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1273
                                                                                                                                                                                    Entropy (8bit):7.852279235098348
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:1FuzCE30XWhehnicXAZi0TdP+c7laGTuR+lBm5lLUiNQT2jGQ6rspAuiO:3oT3QhnXX0TdPAtusbPNQi7646uV
                                                                                                                                                                                    MD5:5B8F57DCB60BDBDEDBC30C435633F047
                                                                                                                                                                                    SHA1:D5B5D92D8767D45E2CC555229AC3358C545FF454
                                                                                                                                                                                    SHA-256:7DA44BAA74146A1393BFC557132D14DA34F896D44F066F4B27A7B4DF8D9AF122
                                                                                                                                                                                    SHA-512:8DD8A298045865BA78EC4DEAE0FC104657FC1A1B3637FBECB3AB635C79C80CA67A12A2B32923F5618AF9C30208439286612F9B4F8FDD487C58E7A24075050A2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:x.2.l.^e...ic......,.....J.....{.i`....Xe..42.A..<...u..U...x.s.p.Oo...L?t.P..O...$2....]..iC.J...{.....z..t.W%.A.%...<.*Q...$......vn......R.V...>..`.E.K.^...].]..V......h...G.3....3..$4.'.`.....C..e.k....g."Q.n.....$$.....3.s.....`v.N..A.b.-.x.Ys...yx......".....H....w..yu....En../8.].."...u..G...j.r.o.Fs...W(a.P..D...6+....Z...k_.Q...~.....|..c.S0..[.)...2.?U..m....Wr......I.L.#.G.....(.4..~...4./....#.a....[|.*....b......I..y.).$G..!.#.....!.(Jy&`..O.$....Qt.`..C.C...........~...<....'.z>..=P....:Lq.P&1u:_X..B....iu....<o...c.......@.]...~..8W.~."d.0....-..`+e.........:.4........6g.,..p\.v.q.........|....Nb......_.S.=.P.....5....}...5.&......k....Xl.*....i......B..~.*.9E..1.).....9.+Yi>...].$.....Fb.`..T.W...........~.-.2.[.8..}....:......3.d=..<.=...66r......'.n...".-.U....A.!K.........%.5u.}..........a.s.v.l..%...J...l.h.h..K]o7..2y..[....L...j......8..$|!v........>[.....0t......;_....................[..Z.w....@......H.).7.6....P.

                                                                                                                                                                                    C:\Users\user\Desktop\DVWHKMNFNN\NIKHQAIQAU.pdf.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1269
                                                                                                                                                                                    Entropy (8bit):7.868381770001095
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:rq8Zc7SbhOd7sXSj7Rk5LZBua+1MN80tZ1AA/E/atuiO:r9oSMJG5LZYaCW80lA+E/atuV
                                                                                                                                                                                    MD5:10EDCF9D87A9BD8EB472435425425B5C
                                                                                                                                                                                    SHA1:6D833E0C8C8ECD2719C066D4AEB4FF7ABEA8480E
                                                                                                                                                                                    SHA-256:1A1EBE5D138E732EC05F6D66CB5AB7CAEFB380B258C293F249095325A7D74C71
                                                                                                                                                                                    SHA-512:2FD6A18AE3A604FDF10E0004230D217FC71C519ACF1C7DDF89DD06516D077940B9491E50A9A3596AD4ACEF49329A7212CF1173A149CD014809D29DEDCE1E42BA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.....TOiK......7.0.k.[.....|.L...l...4......>_u4>..."....Y%.i. ..Y.vA.~....j3 U..Z8[......rSZ.mY4-...,.x.`....,.....S]...c8?.H.=....{{....Q........b..z.....M..]..Fh.e.....D{...lOM.r..ZK";]YN..&k'.Rx.#...].%g.J..e..y..$rN....y._+<.-.....................KGcW........:.h.H.....`.C...k...9.....1S~06...)....[/.c.5..O.xA.x....|34M..X!Z.....wZY.}E17...&.i......3......BF....v/$.o..)..T.M.T.7.d..<..,j.@.+pXC..Hi.H.CU..3....h.U....LO5.f.3.P..tK......v.\.ce... y|..W.......s=..s....*RP.^;9m=.LbI....e.B...sE.......t...q..IO.....|oq5...4=..........:.A..'..U..4.G]Z..hQ.1.1.i.`.`..&....<.Y..[....Y!...~..%.......U......6...)..3.k..9..T.I.C. .p..?..+r.U.."aIG..Xf.\.L@..7....w.H....XQ$.o.#.U..jT......o.M.q|...:zv..@.n......f(..q....%XQ.\4'o1.IpU....k.F.'.<,.}.0/... +#"....[......-.|Kf..%,.....8.%a....V...LD...........\t.;....^. ..wj....B!.S. Nl.-.{.k~i..........E..m(jb?I.^RJw3...T...t*..K.....pt..0.X?%P)3m.]_.{N..SZ^UyA...u0~B.\.5iY.>.1.N........_.??..m...M`.#.......

                                                                                                                                                                                    C:\Users\user\Desktop\DVWHKMNFNN\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Desktop\DVWHKMNFNN\SQRKHNBNYN.png.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1269
                                                                                                                                                                                    Entropy (8bit):7.823627162240983
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:Y9U7/a5Qyc5TKDjURRIYtk4OgrRYW/3MUfg7N9LhMGGkSlyGnuTuiO:Y90/amyc9KvUDDCUZ/8ig7WGGdlhuTuV
                                                                                                                                                                                    MD5:6A8B0F12F864E8117F161F902C7AC202
                                                                                                                                                                                    SHA1:DD3739D71C52A773C28A2D23B4AC85B1CB776CC4
                                                                                                                                                                                    SHA-256:4C0290452FEE10C6384F21D86507CE6C1F72A6881A6976B6D77156F9D707D92D
                                                                                                                                                                                    SHA-512:CEE96E7A549FD2A4DC493C6B4FBC3982105F7CE47553CA986488D9A6D64949B78DE9D1B58DA0DA667B8F2D88B3D0424C446CFA420EDD7C2945A26BB467AF449F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......#J.Y...Z3.b......kd..Ya.b'."...:... .(m;.Kq.:...x........^.h.Uy!.V..0.Q..P..H...x....y..S...)..4....J.s....Dl.....U.4C....\.%......}......O.g..;.PN.#)m.....7+?3p....'/...*yM.]'.?...1....7. .Y.i^.J..}.z0b.*.8|.....b%...:.....oU.z.......2H...C...W1.d......pz..K}.c/.;...;...".4l6.Jg.&...{........}N.f.Aa8.Z..4.I..V.._...i....r..V...)..'....I.u....Wd....'-.D...o..oyp......h*..@.)....<..L-[....e..:.eH.....7.z`.{;g...G...X.1...\......I]b....3..c.D.4.s..O[..5G..]2...n39.F....'H.~..0q.D.. ...0U..J...\.&2...G....i...".Lf5.d....0ZqQ.a^.......K.&.n^.759Z...e...s.D6J.....Pf_.../S.'t.+....6&I.5.T:=.\......ple......i5..N.,....5..E4_....z.. .wP....=.yw.o-g..H...H.4....[......FYl....<..h.^.;.g..L_..=O..^$...a54.Y.....95.-...-.c..^..NGQ..pHf\.j.<.Q)..B...f.}..lA1.../.e..C.........%e.h.^.).. ....y......Rp...CX.b..a..@.J...oK.S..E..C...^.].O..'....z....=^...b.|.$.d......g...s..B.1bl.r...F.`..5Lf*.....n.p...$....H..Y'..s}.*4HV.c.8.....

                                                                                                                                                                                    C:\Users\user\Desktop\DVWHKMNFNN\YPSIACHYXW.xlsx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1273
                                                                                                                                                                                    Entropy (8bit):7.833366328575499
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:sfxu1DzQj6t4cfElhI60o5J3ib6uIHRJhwW831VaauSgiilPu6u5J8oW3wuiO:sfeA6tVeb0F+pxJhbUnESLi5w8wuV
                                                                                                                                                                                    MD5:F7E713653C8DC0F533A0D7BC475B6FB6
                                                                                                                                                                                    SHA1:79BF1F5BBB8C04F076B680F84582CBD45B020AE4
                                                                                                                                                                                    SHA-256:B72D4420765BD16ABFCFACEAB3624665C3191468693C5909D159F812AA6930E0
                                                                                                                                                                                    SHA-512:12CB9E380AFE656F3AC933AEE064D7F5B75B3808AC9799D4B469F5A82A429CB616B4AB73B32194E8424E48689512A8AC94E619B8EA272C5FFD117854C7733188
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:u..E..9su....oC".%.X.=..!....e8X.N..3....U}#.,A.....Z..{.fF....i....7E!..U.D.@.>*......t.../...cZJ.U..9z..P.%o.G.j...Im`....&..tqF:....i.Y..x...u....fM)..%.\.9...K..se.....g...._... ..v..~6...zV.".r...Q...\.gQ.K-.~.._..2"..u....+.`U..p.T.h...y...E..%na....`H .;.X.'..2...e;Y..U..."....N~+. Y.....S....dW....r..~.-P%..J.P.I.0>......t...+...h\J.K../r..P.>{.D.qa..B.0.^O.o.8".qM...../_^.K.m..A1..C.s..Ax.........D..{7u..k..64'..oh.|y.c..ol.Q....*.PNT.$V.....D....7.h.t\.y..~..3Omy>.......).J.X...P.h.m..WM..<.....9!*Q....Q|.nD.)....&77..............~....{.N..5.Z.'P.....y8.N..H.'.suD.T.....O.r ...t.....:.>.SV.}.:+.dK.....8][.W.m..L=..S.c..^h.........P..a*s..e..6 1.~j.ts.p..}t.B....3.[UW.=M....Y......r.mK.d..{..9Baj>.......~..9..&w.|.E.i.....J. ......R..{P.h......~-...9[..y....f^S.-.......0q.L.U.....a.....4...O......[.5Bv......B[G<.{j5..^i..>5...3({....z.q........_.0.>r.Q....y....v.@3<.d..GN....L.I..(z.g&5......|.d.t.....g...xqX.+....+...

                                                                                                                                                                                    C:\Users\user\Desktop\FENIVHOIKN.png.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1270
                                                                                                                                                                                    Entropy (8bit):7.83837332406528
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:fg3LpezGo4XAlS6VCm/3KO1ziS1RgUzNqFGcxZn95xXsTvS3n+lwqYCuiO:fWLprGCuPJiSIUZq8cxZDL+lFuV
                                                                                                                                                                                    MD5:CA9DEE9DA5CD8B44C06271B6218548A7
                                                                                                                                                                                    SHA1:147D988F441442161B56C6B5ED71886032871A62
                                                                                                                                                                                    SHA-256:F10FDD2112DD57A0E43E1E241F137E2E2C1A28B707ED35AF02105817BA761D75
                                                                                                                                                                                    SHA-512:591EA44558CE4367F38B2D0D028A0E7F0C3934F85788D485238F85DE17A1C810ECC21FC0751069B053870F65D0B6D382BE0CCAFFB034723FFC9BF06F612B0085
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:#..+....L....)..s.C.....>!.%..L'."=.C...7.*c./\(Z..P...7#`./.D?.....O.I,D....o.'S.`y....b.:.V.....a......x........5n.7..d.....?.).+>.1n6u...\.!>.o..\.g.'...!.....4K.W..3...~nyW............JvO.x%.r....C.....Gn3.....Y..<K...6.l.^..%.Ae^i5.T;.!..8....W....4..w.Q.....;;.*..Y,.4-.@......`.2^:Z..T...'<q.!.Z .....W.^'D....q.;O.by....`.(.F.....d......h........<a.>.........L=.+.`..... ].8G../...!.....{.qyF.S.P.F. ...^.0B.h.[.. .'k......k..|..fG....,8p..Th..A."z..P...]1.E.......`m... 1.}{|h.....q.|s[.....9....c...g1..n.T.....x..~...R.&......G...k.".`.....(.`...}.2.%........f.@..p0..x.J..:@.~..b.{.1D.>.........J6.2.......=M.6R..>...>.....h.nsF.[.M.Y.*...C.=_.k.E..9."h...s..n..`..{O....9"r..Sg.._.-e..K...P(.W......lb...73.nB..+..L....{"~Y...&..f|..'.H@.1.....k..L...M......n/...<.8r...\.FNG*fw...r/...J`....5..V.Y>C^.......Y.K1k.S.b(........j.R-..>7.....g.y....,.5.....I....6.5;F?8>.O..]..D....gX.n K.8..j...y|.z..>..........*j.j:..B.K5..^...ML.

                                                                                                                                                                                    C:\Users\user\Desktop\GAOBCVIQIJ\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Desktop\HTAGVDFUIE.docx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1275
                                                                                                                                                                                    Entropy (8bit):7.850700767400107
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:Rw7JZOs8LdVhe8qyePgve9wgPEPxkT+TFEq0F3dQHgbw2qhXI/DKuiO:Rw7uLdVhWonuexOXF3qTI7KuV
                                                                                                                                                                                    MD5:B41A91C73F05BFBB20241A63B7374D12
                                                                                                                                                                                    SHA1:D554AF13A850E279A4C74CF3FBB9778074F6B08A
                                                                                                                                                                                    SHA-256:33DDAB3488DC7399B258EDD495D31A821F9C917B53B2E15EBBD4BCDBD6E6119B
                                                                                                                                                                                    SHA-512:A98C473EB6DEFD93CC61BFF84136C99408BB442F718717AFCA92ECBCE0649C53E985B04C8964D8A671A1C7F03069D5AEF336039366D4CD92CF0C2DCA2D46F032
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:..U.....u+.#...#..P~..Z.6.d*...6.tZ.....?}........0...:B*.{....]..W.Bq..[.d...,.9@...y........*..B.G{<}.FqU..a............$A.'....8...,..PF~.p...Q...I.......O..$.V..E)g..l..<J.KIlj...........Rw..}|..H.h..-.8.....0{X......Yv.|..o.UG.C..&.5.T\...C.....o'./....(..I`..@.?.|-...%.|R..... p.........!...'J0.{...G..U.Dk..[.n.../.#C............1..M.Rh6}.DpW..i...........Bw.l..iz3b....5V.u.x.R.....2.IQ..4H.'....."h........&8|Y...(.C/!..yU..f.lC{2.E....z...I....1Q_..[....Xm.....7..T.E$.m...^B.. ..9..}..K.}...=.l..\.;..z...; ...A.T.2d.o...t...0B.E.1..a.....|'.......%.....<...D.m..=.o`.a..c.hL@..Q....Q.K.t.m^}@Ky.d..j| a....>].|.j.A.....6.JR..)Y.3.....3e..........59zH...6.X2=..m@..x.lWb;._....w...H....?\M..J...._`.....8..T.@7.z..%.(j.f"....#.V.-_%.../..2.........1.^D.um/.cfoBE..~gu.D=.......3.,.K.`f]..>....T8...G.N..v5.U.<G...c..t.)AV,......+.OnF.~+..<.8..j.,..p.e./.h....q...K..d....!.F...~a.....H...h.4J...Dj.7.Fv..;..;.3.R.M..i.@;..5..

                                                                                                                                                                                    C:\Users\user\Desktop\HTAGVDFUIE.pdf.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1273
                                                                                                                                                                                    Entropy (8bit):7.8181071557467385
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:sdhWaYWBFFLL/h4bMQIjfC7GZUAtg4Iln7JtENoo+UVQmQp6EYpuMGSz7ImuuiO:IPBFBbhcID4Gg4I3tESo+UVQ67lI3uV
                                                                                                                                                                                    MD5:477A60D5A17FE71700625C04C9B48771
                                                                                                                                                                                    SHA1:88A002C13C5415D3583EAE5DDB695079B2D22B2F
                                                                                                                                                                                    SHA-256:06F49FFA44439396675FD06846C971E8EAA9079531CAF70FBC0F3A4786311C9D
                                                                                                                                                                                    SHA-512:A0891CCCA11D871A5FFCF2D0F79057E1563E3B7ACB270DC2EEED9CCF6E5E32A85299BFAB6BD8E77CA097D016C57226660B4579184A88D6E5EB7412073F51C354
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.$..KS....@!....#..X-..DE.....T3..T2..v...O.............bL?.7;+...{[..h..R...b.....k.nO!.7\?.s+=Z..o./...'.b..]H....b..4.=o6a.....&....E..H...o0.......9.9.....=.Yd..g=_."...i...?..Y.7...Z......j...8...7..Kz?L...2.&...u].....[zrn..>...S.!|.....s.s..?..SF....V-....(..^4..@B.....S*..G=..a{..]..........h..sR".-8+...gA..j..H...y.s...h.tL;.0Z%.k/8Z..t.%...4.b..\J....r..8."r!b..../.6...<kw....r..[6.. o..v4R.{x.%...HKM....}.}C6.u.%.H..h.Pa...g.............\.?.H+"-x.1.8..L.."...@.xLo. e.V...kZ{P.H.......jR.V.^.{.~...&.z&..<..C.s.!...=..c....zOXJ^S...J."r'.u.....V.%..\].X..A". ....S.nhBt.\.'eT..e...2..L5;._j....e.,!....w.9....'.-...?xk...y..I$...d...0P.x..8...FXU....l.._7.}.1.A..i.Ap...d.............E.*.P+*/t.5.!..\..#...\.iKs.3y.[...yCh_.N.............T.....6. $..~...#Ev..\p.R...5..G).(!.=.U.%&S.o.......3K.>.y.X...C.b..-.<.'M0..6(..(..s.9....B.^..........Mj)......-.'.......b.........o5q.c...<#...4..D..."....y..{...K#X..H^..xd@..n.U..F_.Y..@x.4J%.E.y.3...,..?........

                                                                                                                                                                                    C:\Users\user\Desktop\HTAGVDFUIE\FENIVHOIKN.png.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1270
                                                                                                                                                                                    Entropy (8bit):7.8556123595811815
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:N2m7XhaREVvr3ag3hqOfQ9Ic0JmZkmW5cMwlwbMUgnVxuiO:cIXhaRYvjJsOfbc0J6bldUgnXuV
                                                                                                                                                                                    MD5:02037147D3108B7B49121A0919CED6CC
                                                                                                                                                                                    SHA1:ABD0B46957E22095F86DC2CE8F5DE61774269CB4
                                                                                                                                                                                    SHA-256:542F823053F55EF759175DAFC457A74C3A9BB0E29CC453BFCF4BF9E70365DEEE
                                                                                                                                                                                    SHA-512:8B05113AE20DCC91A0F5B7E1310E7A4A65AF364994E7DDAD42888F1F59738F06958D21753851379B53F7815E502F19AC03C161F7109FDEB0F725E1512B6B2D46
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:...$8x.`1........$.T..`P..h.?.....'....r...^......a.p`M.&.....wp...O,...y....U.,..e%..A.C..%.8.0......V.....T+nC'.&.l.2..n<b.e....$..]E.....A......`..1t......"|......>{y.'..r.......l.......Nf...!6=.]...?AU..n.f.......V....n..sb..._.~l..F...k.#.c.4.#u.....*+d.`>........9.[..rE....:.....2....e...W......c.piU.%..o..a~.._6...a....T."..|9..C.O..&.+.+......J.....E!~K"...|.?j.a,k.e[.d&.qs.mT..<..J...s.3.v..k.)..&zT.t......m..^(......|mK..H......s..7~.`$.!.V.p.V.e.u.."&....k.s..c.d..0.....e.s#.X{Bg...f.*l.(....)..O.......|....A..oD....@.5.7..2j|s.<.....h.....7..2.2oj.N.Z.o.jiASK..u*-...U8~.......N....C;.j...K...Y.Ns. .R..F..G.n*.cy.fF..#..B...n...c..z.$..:m@.u......o..A<......qp]..V......v..;i.e=.=.T.x.B.p.w.."!....i.l..x..e..!...r.x .WtN}...u.......x..#.=Pl.iIt.U=e...d...y..@..P...c.fX...bN..E..e....t.-..@m^ac....|l.YY.....C..xI.G.:.2?v.B.ulT]L.....$..>..o.......H'.CQwR.b...a.....Q.g:`....;......../..hCQ.7....$.s."....IM..[.8. ......'..*..x%.u.t..H-W._.....

                                                                                                                                                                                    C:\Users\user\Desktop\HTAGVDFUIE\HTAGVDFUIE.docx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1275
                                                                                                                                                                                    Entropy (8bit):7.845227430125802
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:ZP3WfePJEvFCqWgyWjvQcU5dP3Jz0dy5IZtIoDNUqUdyJhX8BY09KuiO:ZefgEIq0C4cU1adyaaoDGdkkY09KuV
                                                                                                                                                                                    MD5:6233F638EFCC44868475419D1CABF0FD
                                                                                                                                                                                    SHA1:2182BFBE2B2F7AB6955F3B649006A5DA71551FA4
                                                                                                                                                                                    SHA-256:821F7C587DC7299EC7B10C256E8B109D7754DF21BB500DE48EF957A47ED9C332
                                                                                                                                                                                    SHA-512:1FB9E3EC753A0887EF12C6207E13A848999B5CC8A9711F61DA6BF176A9EEE335E1234B92CBB52FB226E6EBBD51314A2E628CD89892EA2C1F43A5B3FF1321FF55
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:g...Z....-......A......(......-.....)....:F...4/ .....>..9..v$..#.7g....&~2....r....<.=.....Se.fH)....s...J.+.(<I....^.o.O1.......h.H:.:.V..#.!*T..:vmvz.+..._...TgK...q..8R......l.... ........n6.n.v......;Y.2....>...3. -8..w....=..86...e1q.qd...B....!.....J........2......".....>....7Y...8 ....../..1..v*..?.4`....0a2....y....&.:.....Ve.{S-.....y...K.7. ?S....O.r.L".$.7<.......U.a(g.O..m...(.l..#....[.r<..#~mU*.&8.?p!..dt.x..g.u.9.....{6=.Am|..a.\.B..G...]...8...:j%.....$..x.ME..vF{".D|!e...q h8..%./..$.w3U...+.!..=.m0...p.r...Q..N...q.h.MgU..@@..EZ.c.a..ZI.\. .H...[.4..w.....DG*.sl.&a.3..f![D..4...*./'.......H.j/n.]..c...,.o..>....N.u ..!blT".2/.7c ..up.f......a.9.....o/4..Ymt..l.Z.Z..H...S...)...*y9....m=..~.^@......\2La3..6^=..lB....^..y...y#.8.Y.%.......1.r..f]4.....Of.6."..F.Q.#Z1......o...W......B1.tW=....]....H.n.....".p%.b....|.EO;.....d.-5.B....f.........."...HE.Q....}....40p).=...m...\n...+...QfP....K...&...Kbtml..9..N9...

                                                                                                                                                                                    C:\Users\user\Desktop\HTAGVDFUIE\KZWFNRXYKI.pdf.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1272
                                                                                                                                                                                    Entropy (8bit):7.846831504047909
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:b0gDZi4nEd0P1wSzPC+7mQ/I1LpbXiNMv+JK5Ts5vll5uiO:YG41e1wSbCqm0I1LpXyMvkK50uV
                                                                                                                                                                                    MD5:66BB40F415284E3BB1D1850C5D7B63A1
                                                                                                                                                                                    SHA1:D475FB0EDCEC1EB13E6D50740D868165E1E02287
                                                                                                                                                                                    SHA-256:33BEEC0B2FB31E33F1E2B133328B846D06C08BD278B35AD2AD772F7BE6224266
                                                                                                                                                                                    SHA-512:2223D9D20A9CFA0839A42CD13613D559D702F05FE9E4BDA5A16C8461EA09EF570168A9D18B3ED46A6282D18E24289E98609D5FF69BCD532C88E14CC62F1EC1BD
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:d..G.. ...6.3@...*.p..e.f..f.y.Q.v. .9.~.}...;&.U1.u...u....[....=t.|..s...:.K.."..zPoW...Y..J....)O..De.O....X.9;..Z.;.....].....J.dqi.^M}=.y..*`67.X._.{.P.....q....I>....7.Z..j.D6:5.lIh...6#.)V...d..=..y.G39.........Im_Q..[...P;............}..P..,...#.;M...;.b..t.}..c.l.C.y.8. .o.`...33.T5.j....h....U....&w.a..|...8.C.-*..xNzV...^...H....:D..A{.W....P.=6..T.5....l9....}.2f..].....2.2.U.b..j....-N...^.....&.F:.np.^....R...O?..w.......}.#FamCl...!.......x].......|B.....V.@.`..|IW.\.M...pW..yO.%R.....9......l..i..v.....>...)n.....{...T...z.+..{.y.w......#[S.m.n.V...A...;...Cg.i.n.Y..{K ....W.o.J....6.Bp.{1....w.,b..C.....2.<.J.i......*G...K.....(.W+.}l..S....S...U#..b.......w.3D|oWl...&.......eX.......oM.1...G.T.t..d_G.Q..[.qK..*E....0.K0n.../~^....H........$...oF.......8.F../17.e.!v...?......F.7......x..A/mV%.8...SrS{$.....y.E.........V@N...i......./+ o..B=.L.=....8.... ../.......p..~.{].;J.s..G.a.s.+=:K..B..v.0.......q......(.k'..m..r

                                                                                                                                                                                    C:\Users\user\Desktop\HTAGVDFUIE\NIKHQAIQAU.jpg.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1269
                                                                                                                                                                                    Entropy (8bit):7.854468683307422
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:oYLFURM0du42zZTAV79Vpgx50AOMxZ9DC4Lfvt15uiO:oYLFURMku4gCV79Yx6A9/9fFHuV
                                                                                                                                                                                    MD5:D8F998B922500F6DB77EA7BEFD9D896B
                                                                                                                                                                                    SHA1:F53160879A2E2101A8934A45B175D30587E44145
                                                                                                                                                                                    SHA-256:6754E3B54554FC92FAE40379E4C287D943B3AC4A75F1D2671BF0CE63638A05F3
                                                                                                                                                                                    SHA-512:BE7EC6631DD3D1EB89FBDAA11F1EAC6F9612805932D306B8BAEC33E090A5CD68DC1EF3E92FF0284AB92DBD45C07E09D2B896BAC74008C51FC2DD25B985944E50
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:..t.S...m.N.$.M.......{+..>....u....._.&.Sn..h.7..e...T.,...s.jzB3w.lM..:i....'.9.@...5..8oVZK5.I..@.f..!...i...|.+_..o..m..~.).....}(.b!.f1.1...qs.z.>.o..SE..Z.$.].q..z....3.3l.rY.....9...]..0..Rl...3.q...)=.k..B.../..pk...p.,O...s.-..9.$....o.M...g.C. .B.......z(..=....g...p.R.$.Pz..d.3..u...H.....s.ldT"y.fK..$~.....%.8.N...!..;oFFN/..J..Q.n.......vr..g. F:.x.#.....#..}..pfe...o..wQ.......1o..9..D..(h...........k....B....BL..T..Z..r....^..g.%Gi?Q..=...l..L;...1.#.g^p'..2L....<.O.%...uV.....4...y).e...*mxz..e..N. '..xU.:...f......`.B..D,..@........[......zj._.z.....2.....y.`\.ih..[.1ea.C?.?..+.......a..gzr.v..zV......5s..6..Q...j............u.....D....]O..F..C..k.....]..u./Vy.Q..(...n.B*...3.=}kHu5..-^.....4.P.I9s3...r.X.....6.0.zR\.1....K......7.....( ?...3W..f.YD.5...Me+7f...f...Uo....1...!..A......PhJ.k..g<. 4a....;..?.I.8...+.....y.n@.....^Q.....r.ql....N..,.)..c.....K..N..`F.O..-.a.TZ.d.e....Y......}J..F...ZE.......M

                                                                                                                                                                                    C:\Users\user\Desktop\HTAGVDFUIE\NWTVCDUMOB.xlsx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1274
                                                                                                                                                                                    Entropy (8bit):7.856440787254564
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:l6FxOCaa3EjWjpilkEwKVIgYKN//7T14pGeblfPGtZM0tIj43ruiO:sbSa3ECjUlkdKVIg9N/DT1MGebRGI0+7
                                                                                                                                                                                    MD5:AE027F8A166F81BCF49BF7E93EA1F45F
                                                                                                                                                                                    SHA1:D958B0F64FDD0A2751B1681919E6045E7352B4B8
                                                                                                                                                                                    SHA-256:82A77CF171222625A3DCDC520C10025938C60F8B73FBE5D16B69BAE714AE97C7
                                                                                                                                                                                    SHA-512:9CD17D143AAB735653917689DE0BBC0F699C8A304630918888530F7C73682630915F4FF99486BCB7D4FB1B03ED37016D40ED80AEAE0C33AB2D94526DBE82555E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:Z.*t.6{Y....'...FR...{[.....#.....5...K.k...bu.s|.T....vP....... e..iq...W.K..m.2..q..e*...v..,0...r....@..l.[.{.`F.N.@N;.s./j..xC....." ..9.......sa.\.__5...E..............W.E.b.%.F5N..#./.'...-......Q]s......g.........PmMV.3..=.\.~w..@.)z.4~U%...=...IA...dR.....*.....4...E.g...~..ez.R....eH.......1c..el...G._..r.0..w..h1.....i..?%...o....A..l.V.q.bD.]\.......Ej.Q.-....Ux..(~zgG..4"..':yQ.....(..H.....g^.O...eI.B.'Q....Z..^..}m.O.z,.{....M...b...Nj!-..B._;........X..#0.X.....!.e.r....5I` ...X.u.d.`_...s5.[..<......~......g..+...E....X'..}.B..r.C?......>`./..S.s....Gc...r.5 ...po9....1..:...B.......Od.S.%....Im..3yz|T.. $..+<wR....."..B.....s_.F...zC.J.?L....Y..G..{l.X.o+.m....O..v...Yl/4..L.X9.`......L...) .... L...~J8.X.9..v.r..$...A....bt#.......?."...L..0.N.d...hlE..W.'..G.>....1h...........t.;k.....]......C.t. .@D1..a...O]^..2...>3v..g.l.],b..b...._T.4..]6HN....<.T;........^.[&."<l.tO..+.KU.j..B..}./...\I.Q-....jf. .......D.d

                                                                                                                                                                                    C:\Users\user\Desktop\HTAGVDFUIE\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Desktop\HTAGVDFUIE\ZTGJILHXQB.mp3.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1273
                                                                                                                                                                                    Entropy (8bit):7.842025161196196
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:rEMZL9y5oEQXgTI3z0mhjs5loDNj6jwktVl8T6DXjIhmNyGuiO:rzZ1EQx0mhjs5qx68k/mT6DXMkNyGuV
                                                                                                                                                                                    MD5:D84F41F20F540F964A380BC31EFCFEB1
                                                                                                                                                                                    SHA1:777C03646CEF249CF5EEDD398A672581CCD2B863
                                                                                                                                                                                    SHA-256:E8E7E42E961CC1DA5F315D4C9EEB823280C545346DF3768C30FE0E439AFE1010
                                                                                                                                                                                    SHA-512:C73175662E67FF69B3B0FEDFA1E351D1605F773D265A4A0DFB47BCEFEF502D97B690AE1A47A9A20AA34CC0B45AEA81C865DD608833780E310674B0397537F6BF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:...X.w.....:...R.^..5g..x.B.....#3.F(W`,.+]...Y.+6Sah...|.9VN..=...]...t.Z..#..R.....R.J...)..0...H.K.Z.......~D?.5....j.1;~.........: ].(....7.w.V..h..!.i..F..Z6h.....U{.4.7;e.N<v.....f...;.~..sp...%.%....H....S.%g.W~.a.>.Qqj....]..?.*9.1.[M.;.....T.z.....6...I.F..8|..y.L.....-5.C!Xe:.9T...Q.(7Apz...p.(F@..!...B...}.^..5..]....].M...*..7...O.W.S.......iB,.>....b.6+|..O.A.........+.6./(f.]]..U..m.J0......|.%.w...8.H.b;&...U..Z.go+..UD.)...|...d...gG....F..C..n1...)[..4B.........._...N....n."..%.........*.[..A...^..).d..?..~....i...u.f..Kru5.dZ...)|>A@..!.:U...|H......o.J@...h......M%.1W.@..|W.YHA.p.;..qc..E.^.........0./.+9z.GX..A..n.U2......i.$.yi..+.^.a5%...C..Q.`l?..GR."...y..9{...tH....I..A..j1...<P...>J..........L...W...SZY.v%.2U..x..)}.$.%j...AMpV..e...a...a..p.-4..'.... &...UI~.J..QA....B.=F8.j...7.V:..!q.......e8....n..<g....].*T.J..}.r..H........#...c......P....r.A..)....Y.....h.Y..o+..t...Z...{..W^Yf.......a.D.+.t.[...an.\.*....

                                                                                                                                                                                    C:\Users\user\Desktop\IPKGELNTQY.mp3.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1273
                                                                                                                                                                                    Entropy (8bit):7.87476343794062
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:ajDylj+OIPbC5eXm9Z+fMkPZDyC7Ep3wUVxhLqOvveUfxI2jvWkdUAauuiO:Z+pT0eXmDcMkR1MAUVxhlvvdXjW8UA7+
                                                                                                                                                                                    MD5:3E7767C25250523F1B76002AB7EEC98E
                                                                                                                                                                                    SHA1:9AEEDE5110106DFF21E887EB40418320DEC19D48
                                                                                                                                                                                    SHA-256:82902B18AFD56F4ACE9B5AD1DB2DA97418CBD590CF1B1440A4A695529DCCAC7D
                                                                                                                                                                                    SHA-512:8505FBC188A91EE4D60B10A132FF5AC5B64EBD4A5479157D974F9E27E9EFF5C27DB7809AE83A22B8877B83F67FF127E5F67E8277EEF3C1AB247663CA71B03289
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:..8..U.8..A....Y...d...D..1i=.._k.S..|vN...i...\....K.\g.u,......O....%-u[>.t.9uq..yL..........>.>V..)}Q\..}.g......Y.@#.P..F.e=T../..%l....h.:.....g.%.Ml.z.i..Y.6.!.Y6z..:......q.P..-ZwqEC..OK..PL.H.Gu*.w,...>.Q.m..YRu7.............;... ..L...'..^....L....W..j...O..$i1..O~.X..a}S...d...B...._.No.k>......S....28y[!...:jc..g]..........!.0U..?{]H..y.o......^.N?.T..."..\x.....H..~.G..n..^.....'..g,..!E<..c..u....%..]...j......K.r.'.Ap..w.N......[...,2.$l...r..}...m.=....&.kB.,y.....fe...9.;@..> ...S......V..w..c.Tpn6..C.4.{?.`P...^.7t......^K.L.....v3....&...v...x..2].4C.K.1,.o.8..d..;?..?.g.z0Z.G.........3..Yr......O..a.Y..z.._.....$..q-..7V2..k.......$..D..fv......I.i.0.Xm..e.U.o....[...?".;u...r..d...{.=....2.~U.>}.....fvI..........$'..=f..p|~^.O!]../..Iv..uS{.w.&]R..L.Y..../.NF.H...X.J;=6C..,U..%..M..v .....}....oze..P.!.e..m..P-h..q&....k....8.._!..Tz.U...v/...ZK...9...5..YT}.E.~../..ozsR.b....zf.o.<y.AM...\.O.=l..e.W,4.>.u.I'.I.j

                                                                                                                                                                                    C:\Users\user\Desktop\IPKGELNTQY\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Desktop\IUccGQLWI0.ps1

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\ProgramData\339E.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:modified
                                                                                                                                                                                    Size (bytes):477819
                                                                                                                                                                                    Entropy (8bit):7.997131646745169
                                                                                                                                                                                    Encrypted:true
                                                                                                                                                                                    SSDEEP:6144:akrfnRHNZkrfnRHNZkrfnRHNZkrfnRHNZkrfnRHNZkrfnRHNZkrfnRHNZk9:nnRt4nRt4nRt4nRt4nRt4nRt4nRt2
                                                                                                                                                                                    MD5:3F9812EE93EB5C65B2FBCC2F328A9A73
                                                                                                                                                                                    SHA1:C6783E17E08CB1A1C2F1456D35D303A9F6A3B8B5
                                                                                                                                                                                    SHA-256:CFB7F6241214914B33522454B0AC0FA4F9353AECF65BF0176F7BB4A0C487A749
                                                                                                                                                                                    SHA-512:4925AD3D992C972FAE5C541B408E38FA3310DA224494315E098819F84F516414C2FED6AC7ABE3144FDFD295C6BFAED7E573FCFF1EB9460E223C79DD4310D1A98
                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                    Preview:..f.O....8.9r..,...\.ZPFi.r.1e.?t0.z.*?. ...zu.[{YwL.......z.C..O.S.<....!.;-ckT#@..58....=8....AM.'.h.....~.......Lr/...K4...y9...........G....\..\\.0..CfL@.......{.M.;...5$..X..G.....t.............m_..2..._<....Q...._NB.x.d..n........k.{A..G...L&.-....!....{.a%........!.J.....e3{.:.....w..%<.H..%j.<Dz....f..`u...?u...M0......`O.....x.Q....A.t......X.i...G..ZY....9/6...u....\gP 91M&..l....1,...\...8...o.l..lJZ..l.D..G...)3+X;.S]MK....H.tH]..+3..y!.RvI.T.5..a.O.N..2..d>....V....r.lIU...;.Y.3..O..%..6........8HY.0.......f....a.9.9...l...A..y.'...jGPI.Wc.'....;-TCV.>.u.{..O_p.3<f/++}!..Wz3.......t..........|+Wi.n.,..c...:.......z..n8.. ..J.`...\.^<...w.......y...DQ3zp|..2.H..(.&....G..Q.n..D.....w..u.2ms..z.V|*.E...(.*?.S.y.t.YW. ..A.kK.[..X...q=..;).n.5.].E.-."tHX.} rG..-}..O..=.L~ ] ...6...U.....cdC./..+...."4zs.Y...)6..........1.C..ADm.p...Z......C..*w@..(..].....+1R..5.q.....U...T..O.A..,..I.f.R...lo..R.....OrB.....)...k....P.I..u.^

                                                                                                                                                                                    C:\Users\user\Desktop\JSDNGYCOWY.png.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1272
                                                                                                                                                                                    Entropy (8bit):7.843989007697117
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:DKD2fmddKkK+y1CSpxoRSTOR/Rl0QWvHzWTp0wuiVbHHuiO:eDXfQfvoYK/r0DqTuw7VTuV
                                                                                                                                                                                    MD5:8C7D7DD29562EAC44AFCEE0947DB85C2
                                                                                                                                                                                    SHA1:E4D564C903959D1F19902641FB64A47F482E0848
                                                                                                                                                                                    SHA-256:CAED184B830D1EDECE48AE8672C0C20B480815D1148706CC300F256A9D328F35
                                                                                                                                                                                    SHA-512:524B773BDA8AE2BD00C56DDAA19DB3D524CA95CE9C222B8A2753AF6978CFE77614D088460A0145D298BDC959656457893F4295C94D1285663D379E1EDC0F938A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:*..4^....?]|....1.`..............7.........x[......N..C...U...e....M.....#..Z....%}..E...z..n..V..#.......Av{A.,.Bv.7.k......i.L..ZFt'...Snu.A...VF.K.8..6T...u.M.......gS.R/*.!W..9.3......_S....,..>...&...y..l..............Fc.,l<.A.#p...*..8_....0]o.... ................)........bX........P..X...[.p.....@...6..L....&t...M...r..r..K..*.......CrvA.'.Ke.).a..#v..J...........T..W.L.g.7'5....DY...........) .1*r.0.C3./t.T.j:.X......Wr..l.e..t.[q..m5.[.k..7e.G...V.....WN8...C.~.Q...&...~X@l.F.b7........R...&).4}B.....2..7.0b...2m.3......j_g\...4.d.Y...q.O.....v...8J...u.T.'..../Dd.a...A.@.Y..L.A.].}AK.7..*e..P...........D..].S.y.00#....X]...........%5. $t.%.Y!.;`.K.h+.S......Bg..h.r..h.Ft..n5.G.`../m.Y...J....PI(...T.w.C.1."."H....Xr._--.T..D9%Z..dI?4~.l.h...b'...qk.J2a. ..6%...^.....[..x....n2.\.(.........z5..{.1w(`......O.{.......':~.l.B'R..jx4(...y.v(..|.1....y....y5."]...#..A..|.c.t.tb......W...d...1...g.$....x..H.h.2`.A[.?...F:N~}..".....

                                                                                                                                                                                    C:\Users\user\Desktop\KATAXZVCPS.docx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1274
                                                                                                                                                                                    Entropy (8bit):7.836796458592347
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:8vqoyKtQDyYvk3ATB8nZU28zXYyrvg/lZbpJv51FZOnY6HccjaiquiO:8vqoOO3W8ZUDrYAvsZJ1DCYIcceiquV
                                                                                                                                                                                    MD5:8E6C034CAFEBEA193ABB676C0F82C22B
                                                                                                                                                                                    SHA1:92CF6977AE3F22F583CBE9E85CAD42E0BC18585A
                                                                                                                                                                                    SHA-256:76184E476698166C33AEC0C574436B94EE14BC1140E292921A41AB16F8F4C215
                                                                                                                                                                                    SHA-512:27A2A5F9AEA024ED2D132F30CC17F02D53D0B3F20E5CD640F1BB4ACB3BFC070C9CA8920ECAB69717565299895EC95CAEDFE2E8E9B2D8A82284242DA8D2AC8CB6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:O........I.\.U.R.R.Z.{.3...Vq...\....'.G..k..R h.6...U........O...,Z.#[.8.B..."..L.nPm`.&...zd.^.....A~2...c..!..=S.$..E(%n...9.....A.'.[.X^.a..c?u......FGl;..M[.]...r.....'..pB.....%EdR..\dX*.H..b..w.E-.L.Q...m....q..}.=n.T..GU<.)>.x.U.........{b..R........I.Y.S.S}B._..p.7...Ax...W....(.D...e..M5z.,...[........M...=W.,J.3.^...0..O.~Srip%...js.\.....Mp+...c..=..%M.-..N!5w.Md!.3.-]]c.......lw..#[...K...qu.QX.}z.T...=..{.].t..$~....T..O.8.N....k.m:C..9.....t.........~..@.:..%... ...x.N~.be>.{T....c)....ck....$N..U.Q.k.My..h.$8n..[5.....ee^o.<..Q.GB.0..!d..Z:..]o65.s...\g..G y.o....*....Z.V.#$x.sB.7[.KK..9.....|.Sv1.3.7GEr.....jo..(K...^...tu.[P.yl..S...8..|.Q.x..>b..U..._.$.\....a..n=O.3....`...........m..H."..;...8...{._t..s...]N.se..9.."./5..2..........[.g..D....a.{B......Q.........7].4...$Oj..c#..W..k......y.@.].....%.).......Cx.<..&..3.0.ZQ..!.@.|.........Oi.x.{,...R.T.=......>.M.|_..2..u.,.mdq.....ci..l....CY..1.mR...m.......{.;Kz.q-.:

                                                                                                                                                                                    C:\Users\user\Desktop\KATAXZVCPS.xlsx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1272
                                                                                                                                                                                    Entropy (8bit):7.847878654974694
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:q2GMZItvUC1lcytoq0yzw8DCHTmLtZD32aTy976hjpXWAkTuiO:phWtsCLcYoq0HCCzmZZj24kS9GhTuV
                                                                                                                                                                                    MD5:E94CB5702AC1AEABC797B6CCC39321B9
                                                                                                                                                                                    SHA1:F779CBB2B2B518B3712BFEF79F77A52E789A7C5C
                                                                                                                                                                                    SHA-256:BFC969168867B538765A569B1DD9EF3C03CCB405B2B86F8ECEC3EE372A7566EE
                                                                                                                                                                                    SHA-512:AF0426906453C429BC1868CDAD7CAD52A4C74ACAAFF8E863B3DB0EF8F11A69E699BF708EF9B44A0797151DF5C8D0BA4355CC32A1EE92086A7BFFC2BBB95915F9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.N`.h.:.}.=j...9.n...A....d.P...2G....#@V.l88...+.....9..).....#.......e(3.c|...)......(|......B...6q.2.w..cP(...#X..5.?.!.M$....u.."..kF....}..\..Q..x..G.4..2[$....I.:m..ci.....M..>..7..s.I..._.L.9......*.uJ..m..].M..*4"..#.Z.}.{.3!ay....Hd.s.,.{..o...8.~...F....h.G...9Z....)C_.n6(...9.....7..$....!.........p4=.bn...7.......4l......A.../t.'.w...M/...)N..%...2..T...?2V....^...!..X.;..8...>|l&c...U...V.aX...... ZA..7.......Y..{..;z^....~..A...1..@[w.&.=.d.....}.....I;.....!/..?{&.3.5.....O.x.&1<g.Q.......:^F..N..h:X..#.q..Q....|....i}C.../...$.........}.$.G..../....,..k.b.:.....P...OC.d....-........?y... ..T#..'#H....Q...'..F.+..-...;|i<i...C..U.dC......1B[..%......E..j..#pN....a..S..$5..^Bb.5.&.f...........W5..."3..(f0...j.m..k.p..x,-,.....U..9..Z.......a.}.G.|.xS..P/Z.&zFb..f2...\.5.,k....]Y.A,...8E1.E..1.8l.......<F,5!..Gc.i.O-.+zMZS..'.7._.].e,c.{*.G:.....SF..b..v|..|.3.(.>,.~.mt.....>....+vq....$ ...5....R.0....A...\..T..;.m"h.s..2.72.

                                                                                                                                                                                    C:\Users\user\Desktop\KATAXZVCPS\DVWHKMNFNN.xlsx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1271
                                                                                                                                                                                    Entropy (8bit):7.866845071235124
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:0iO3elzHV/HxT1q5PEha5bGed8rTEOgXFIF9Sr2PFgnYIxuiO:0rK9HxToPEU5bf8rTlWFIFMr2PFgnY4+
                                                                                                                                                                                    MD5:E59DC99F47E194687B15CEB8DF6F71DC
                                                                                                                                                                                    SHA1:461E7DC9188FB912DEC0A2C8597058DDC3E80DA1
                                                                                                                                                                                    SHA-256:3DF33B60EEFCF5506F4B244BDC5915C792C64F3F143F516A141A886F5493D79A
                                                                                                                                                                                    SHA-512:FA522DF410890B20FEBEDE89AFE8606BD9986D33CA4835051B3E705555869D081D98A38E98955F820BDC52F2DEEA18DAE84D460C1D97E60251A8E584E1A15BC1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.e...KR*..{%.8.].T..`....{xHg.c:-...J...H..Nq!4.U../_..-.N../pn.fB..J.............G.^..B.)....`O<.^.f.E....k..,L..`.7@..K..S.#0o......6..3goR...A.P.{Ua.+>....."...F......5.=c.......j$$...2./.2....&...R0/..|){Y..\.Z..u.'.X..*....2..G..]1...r....v.~.q...JF$..g3.=.J.M..o.....}sK..z0!...C.C..Yg%6.\..4Y..'.B../li.sO..M.............K.D..N."....j@4.K.k.G....a..%I..x.+O..L...(.#.z.,y....k$......*.1...z.P_*A(W.9...X......3...g^.^..X.............xC.2mI...u...e^.u..=W.......ke....{z.......~q'.x...8...A...Y+..%.......).:,..9d.5W2V9..R...t.jO......6!.....>b.....`..+..T8.d..-.../.........I....Y.....l.8..|.8....#\G7..a.9.?.v.,s....f:......9.(...f.@X A2\.0...N......1...b\.D..M............tY.#mQ..{k...fP.k..$L.......}b....~y......yd .l...?..*da...AvOv.r...Z.O....`...v...f.N...d....>M.IC3..M.oS|tH....$.........a..-......j....{..1.."...?N...u..(.d..$Y..:..........q]..uK .".v...T.K.3.]..U.(.;....#U.I...y......0..9.x..)....`...y....@.;z...2.|.3a.&./...O..sl...

                                                                                                                                                                                    C:\Users\user\Desktop\KATAXZVCPS\JSDNGYCOWY.png.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1272
                                                                                                                                                                                    Entropy (8bit):7.858927198012337
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:P35RxvDB7WuZefLIGHuRtuveCfceMrZT5BbjIypvLFYCZVbYnHUuiO:v5LvDB7WuZejIGORtuveecjT5BHlvLFs
                                                                                                                                                                                    MD5:C40CC25AC8DC76DFF470A8A7077B96AB
                                                                                                                                                                                    SHA1:1DAC47FDD5CD6684BCA55663FCF36A27909EA508
                                                                                                                                                                                    SHA-256:166E81F4046499F62040297D1FE601552C4990D70377535CC5DF41E7FBCA5541
                                                                                                                                                                                    SHA-512:29185C44242D0C1C318FC9BBF764B85CB3A5B6DC7DC8201EC75312252AFBF6DE2020414CDF5A0D544AFC32A29279665A7E5CEA49F7D893BF1597A4A532DC05CE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GO..o........o....[<......H.f#.Y0Pq ...F.}./...A..".G=..gP...4.ox....5.{_;..?J.. . .X......S^./L....,.B.O.)..e.......}..FV...=.B.......9.Y5..OrHT_).TjQ....c....7..\(Z.*'......}...2^....Y<.....4R.....x....N..."7+.yFZ....&...&I8-Dw..D..Y.e.=..T..$GD..n........h....D1......B.r&.N7Qb#...I.g.<...[..?.]"..}[...+.ky....1.jR?..7D..1.;.W......[P.>D....$.G.F.$..f.......v..YH.....7t....gx.@...A.KgU.v...&...dI.C{.G....MO'./...`..b.U#...2f..xE....8#...r..Q.#2..m.*=..:.+z..r"..........;.,.[....X.;.Ml*............b..2...y2......s.t~..._*.!.k...g|Cv...H.n.0].d..<..o..)...b...q.i.00G.-.r5..."[..0j{q...S.5$-.q.2..z..G.2.......;w....gt.E...Q.^m[.u...1...fU.P|.I....\R1.:...f..u.G)...-c..iN....2"...z..F.%...h.+>..&. }..z%...........>.+.H3...M.*.Ri.....U..Y.].Q..c.<.0V^.-.D...UH.$e.9.,..P.l~.....9./.,..P..l.+.....X2d..X.,..6yf..i...K4.,...U[..........{..R.7Jc...0.8.wQ.V..q;.....Z#.....c.......!<u.0f...f..].[.....jp..#....N....d.4.......O........dK..v.d..l....VtH.bt|

                                                                                                                                                                                    C:\Users\user\Desktop\KATAXZVCPS\KATAXZVCPS.docx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1274
                                                                                                                                                                                    Entropy (8bit):7.862879120506131
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:Vhy4v0toGxZIVSRN0Iq4NttEWJVFmRagbO5/w4XUeMVPLWoDyHLuj1P3oxuiO:zyqLGxmVSNq6lk7bO5VX3WZaLuJP3ox+
                                                                                                                                                                                    MD5:3451E788BC8299211D189A5D477A4C2F
                                                                                                                                                                                    SHA1:106AE0439804B0FA0215EB586045B363AF641475
                                                                                                                                                                                    SHA-256:49FC4F685B1B6119270BD854F76FC83F183C26AD89C8B6F506BC3B1C65DFB30B
                                                                                                                                                                                    SHA-512:11557B7FA6A2124FDFBDDB57F5BE7CF2034441EB498F3663ECEFC377EAC533412C6A0BA7698FB01566DA22567A60C4B6970D5BCFBBE15FAF7150B894B05AA0C0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:k...6%..`6.)._....D...V.uUt..{'..0.PK.1..1....|...[........._......6.h5...$.x....l.v".+./~..h*..{.. ..G%...".N.AF..2.N....|.O...m....^n-.X?.....bZ.\....n (.56.....-..ba............}.....r2d..|.Z. ..:R.dc...W-...@.y.v..".v}...i.<.....Q].J...v....-"..f6.,.K....A...K.xYg..c...-.NE.;.."....n...I.........Z......*.y(...*.y....r.u=.$.+a... ..m..>..I<...6.^.\A..;.E...J4..2..`.X..>..y.....bB.U...d.`.,..WF....O0...~.@`.zp.t.;..z;.t.P...v.).~..p...a..j.Eg...^.!.l.&...+cS..z...*b.).......(...XM/{H....!],...W.su..7..@...C.r|x.z.2.....X..@..t....WlH...&.{r,R.."/^.m.a..G.Og........9j(..e.../.ID......;._...G....>..e.O*..!..z.@..?..w.....zB.^..q.o.3..R\....Y&...}.[h.d|.x.#..c)...U...j.;.l..z...f..~.W|...J.?.y.5...#cR..x...>j.'.......4...E[cD_G.._....(......"[.......-..<8i.7.......D{......N..l.%r...0F.......D...u...=.S`..7o.@..u}xu..{.....m.EL....#...b.....2aj..;?.m[..H1...W.V@m.G..d".J..c....<......21...i..El..Y.*..5..3d.*.'..na'......sV.KQ.....[.b......

                                                                                                                                                                                    C:\Users\user\Desktop\KATAXZVCPS\NIKHQAIQAU.mp3.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1269
                                                                                                                                                                                    Entropy (8bit):7.834362577009082
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:/PJHW030Oz4sg3mu26vMSQ9IstCEY/+Ci7zQMyPjYLyDauiO:3JbEb3dvMSQ9RoEe+Ci7zFyPjLGuV
                                                                                                                                                                                    MD5:FF0689CF23882A0DDC36135A738C2D87
                                                                                                                                                                                    SHA1:5C3E34EE7F8FA62908348061DEC04620DA28B930
                                                                                                                                                                                    SHA-256:A5E65CE7A9EFC465C32B2EC7D94EC4F0CCB48D589FDE45751A6CB37CA7BBA196
                                                                                                                                                                                    SHA-512:097D5EAB963BD04BE961CAD9C334F01904AEABA50B5BD3D2B44E614D7B9E1F51D703C2DC5DAADCB7D0EB7EE82DCF38106DB8F85F5ADEFFC5C08DE953E2F0EEB0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.)...b...H.#....u.9.$X.a....."Zw.Y..6..R.m.....2.>. .V.VF+..t..:.8.ex..G..m.."....#rs.y...$..i.0..}G.#.z..I.. .O.".....P.5...ul<.$.L3. ...EBh....Jv.bZ7... Y.q.h..B...j..)R.}..N_7...u;.mks6...e.-.....<. e.G.y.....[....F..X...n3...w..(FR|.>...i..Z.7...w...T. ....l.3.'].`.....-Pe.^..6..P.y.....:.#.+.B.QD!..~..$.).er..O..{..:...."w}.|...-..y.5.g|D.2.e..O..?.R.=.....I. .y...9..........i..P..."v.*.6z\..q...C.>2..!J.%?-.d....w.?.......'.".K~W..vlF.V..mF.2}..>........+.}fZ.dM... .)l..*.....b.......F.D.Q4.D..p...2.V.....e'..|..-....5...2..L.N..9..F.D)WOD.$.H..-d..X.p.).|.....q.n...(.M.......M..C...]Q....H`..v.~..jmn...5.........t..I...%n.?.=sM..m...W.1'..%U."*2.y...i.!.....%.=.@~E..omW.D..b@.1w..)........-..rG.uB..t".7n../.....k.......X.V._..X...;.D.e.+...~..(..t.;.1.......wb.s.4.;l4J.r.Q.+.......O.w...a...N..]2...xY~...~..r...O^.\6...*y54..$._.......j..h.....Z...Q.T#Sx8A1.x1t..[<.N.Q23x#.E....J}C.!.=.G.U........../Rx..dnt$.+..Q....H.xn"1.;

                                                                                                                                                                                    C:\Users\user\Desktop\KATAXZVCPS\NWTVCDUMOB.pdf.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1273
                                                                                                                                                                                    Entropy (8bit):7.8466651020062415
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4vAqzPx2qA/pAAPDb1uMEUo3UeNlqK+tL4MJBTZBjrTy6ua3slqPHuiO:4vAsP7AGAPDZD1o3UeNkKGL4M3TrHy6q
                                                                                                                                                                                    MD5:3E108F65D4C6F376931BB300C96C7203
                                                                                                                                                                                    SHA1:E5966E58BA4A708452E890F0093B3C1C641A137D
                                                                                                                                                                                    SHA-256:33005EBC9EEA6C1118FC889E490BAE3C0CD6112DD6456615F951F11E5192F21C
                                                                                                                                                                                    SHA-512:51FD95C0995C640F0107114B6570490BE5425373A507D89505904A4EE9DAFB31B3F650CDB92DAF1515C045DD93E603B316EBA232CD5828AA92D792D1938BB6D0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:%...'.F...(.=A.F.....N..|.....".{."=..K...k...@.w$No.i78..(4L.g..(C..md.De...V....(Yt...oy....p._.{:.[.7..x.4..X.K.....+./J..s..c;.t......b..1#....m+...usQ..}e..].(.%T.....>.-......'.....].K.....j..p...I......#.../........".O#......]3*?...1.C....1.([.T.....O..u.....%.r.12..Y...o...P.k.By.e10..='T.h..+W..xf.Yk...B....6Rr...mt....b.J.{0..S.8..t.4..C._....%..{.....[......n...KQ4. ...g...-................+...O|...=....ok}..N.E.&.b..^.S.v.&..x..(.,..;$\.?..T.OqY.T.....KG.)C#.]..S.......Gzb.......0_SI.Ua...!....d0...W..*.Q.J........3Q.7..y..1;..l..Y:.."^x+.b..n!....W..'2.A.../..jJC.....0.....e....5;..~.....@......r...PV4.3...a...+................*..Vn...5....dc..^.N. .f..K.Y.h../..d..<....=*E.:..S.JnJ.D.....YQ.#S!...l.S....>C...._5..#y....k.....S..].M7I.....!......l.....D..M.."}..(.+.....j.S..b..Z...)...g.-.RZUNT...#.!........R....f"PJ....L.C.-],...."........!H>...H(..a...[....u.S...$.Y8.A.><pbm...8....1.C.z.....Nl._....o.

                                                                                                                                                                                    C:\Users\user\Desktop\KATAXZVCPS\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Desktop\KATAXZVCPS\YPSIACHYXW.jpg.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1272
                                                                                                                                                                                    Entropy (8bit):7.854707301447186
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:roDa4KO8R2bUJdM0wihaFspPX9N1BML2hZ990TKLbe0gLJwniu6s+Q1uiO:Ee4KOjQJjhYGPXP1SL8OK+3LJwnmQ1uV
                                                                                                                                                                                    MD5:B2A6BC291F2EEDB4CB1792FE83C93054
                                                                                                                                                                                    SHA1:41BDBA65AE8BF4EA4AC4FE0CADC18E0E65A5C88E
                                                                                                                                                                                    SHA-256:EDAD863A1FBA646F6440186F13B07F7BCE2A1DAF079BFB8049B4183966084957
                                                                                                                                                                                    SHA-512:2382A93800634A973B97C1B9F8D5ACB1D61AAB92624D2DC02C0FAD290B7BE9C9380B4E500DC72E64828560F0AC137AAC0F0E8E974D0A5197FC3F308EFA302D4B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.?R......pq..g.}..]..2]9.Z..Z-....}.W..;p9.Q/2..............!,z,.}.. }fN.=D*..._...tEq..K.q...o.8.+T..~.....aB:@.ha...YF0...W..KK....m"R>....XpG.q..~.:.?M.=C{...z.<..g.t......h....FP.....ocA.bQ.0]B.A.x.b.....u,.v....*..*...x`...8Q.2..l...Ca.Q.&Z....y..h.{....G..!D5.F..Y,....d.F..?m:.J,:..............%?p7.w..:hbF./["...Q...`Lc..K.l..>o.3.+\..t.....a_!T.ke...SM...a.w.l....s.g.36.o. .~....X.t.a.u...%.`..9...0I.L....7....w.#I.......u.H......!MJ.j...V V.L(..G.y...(......YYf.Y"......lZU:=..Y...\KY...[a..x...4G#g.t..Ji8 ....AESe.....Q./.-...}:..1l*... .4./3H..oT..GC...7..............j.Zx.^'...e...........l.a.~o.v.f.d.:/.x.%.b.....T.e.q.l...6.|..)...$C.Z....&....a..X.......w.P......0TT.q...M6V.M$..V.`...1...u..HCl.U1....;..(gL..i......i|...t.2.......P.)wi(N....G.o_.>k....OQ`.)y....wT.....FB:..:m......#..../......3(7.....mF.e;..=.'..4.....dS......9...7....s0........<..R.w...g..I.t.}=..#.....f.;.U.I2.C@Iy..,6..d....Np..)........;jY&\k...A.....

                                                                                                                                                                                    C:\Users\user\Desktop\KZWFNRXYKI.pdf.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1272
                                                                                                                                                                                    Entropy (8bit):7.850025009237046
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:LwrgzVebKgxGJbIxNmh8TekJP30mFoFqTn5w23WTyYNWvlVdpxUwuiO:MgBeWgxGJ8SgRP30mFoz2DrduV
                                                                                                                                                                                    MD5:99578B823D7B491AD239CF1B89181CD1
                                                                                                                                                                                    SHA1:F305936704C02068E745B2EA6212AB1963E06A6E
                                                                                                                                                                                    SHA-256:E83DFDF6F365CBA00587846C8EAA527012D3FCD426BE086C0C2C1969A29D5856
                                                                                                                                                                                    SHA-512:0F68E5567EE2A1DA56FC89146EAF9485E75E3886CCA00454ABE632446617DC62C6710BBE2261F8403A5CDF9465044B12BDC6C3DEF971CE2C751E53177AD7E114
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:,]5...'[..(...K.k.I...s.q.%.%....vU.??.J.$=1..t.R........../?o.t.m...O+..E..........u.i;Cr$...\n..[.+_+r...&.i.^%...$qJ..}P.t$$Y...bg.sP.i.3.6....2...(..8'3M..R.E.f....d.X....=.[y.b@.....N.Z=.......y..Z`..t...c...:(..S)i>V.>..-/.+...Z..>..hm...u5V-...+I../...F.~.X..{.}.:.,....nI. ..W."79...u.C.........&.h.w.p...G'..T.........a.j<_m6...@k..Q..A<j...5.u.J(...=zU...Bxy...Y..T5.o......."'.FS.....E.R.2.2.J.8.f........D.P.q...!*....QSe...q?.G../..Yd..C.I\..,2.U...X...........Fp.RL_..r.......R..C.....#..B.\..j.5..c....fN.s/|w...r..t.).].01........F.L..x._R..CK..J...'..s...h.>Q...KtFb.....Y..W..F`.{.}.V...Gds...\..Z .t........-:.PG.....K.F.?.*.D.).f.........Q.O.k...46....H^g...s".S..9.._t..G.GC..5:.V...E..........R`.JZO.....@...J..}.r.N.G!..k...u..Ct.....z.Hk..e..o..L...........l.!...V.Q......+......$Wg.l..'...3...!.'.l..gUpSv......o...\7..F.3.6...Kt..p.>..L.PV;.&.1+'....<.n...[1...).k..;^X6.....(..0.YF.'aY..h...j..,>.7...A/.n..r.L

                                                                                                                                                                                    C:\Users\user\Desktop\LTKMYBSEYZ.png.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1272
                                                                                                                                                                                    Entropy (8bit):7.854817624711214
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:Rrhg1mo13C/A0GXcyl4eB1Nsyto8vejWyJ+Ac2z0BQMlTbO/uiO:5OdW5GXLl4eVsMoge6y+A3zsQMlTi/uV
                                                                                                                                                                                    MD5:094A359BB85DC3762BEFB5A62677397C
                                                                                                                                                                                    SHA1:9C22E263D6052FF3C2BF25511348B1D7A65073CC
                                                                                                                                                                                    SHA-256:C30D03F290694391716236B2A91E29CA3C852B12A542BC82D3C93C166D8A766D
                                                                                                                                                                                    SHA-512:EC118F96749366874B24D64F7F96B364F2AFBE5BBD37C2ED87F3713C17A49A8794E59DA8A53EB5CA3CDA4A0AD79CF3B33306FBC0C819AF165BC5F31EC6317C24
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:E..w.7.(...Q...Z6. U.3O}.|...{rO......].......L....$.].Y.........h...1P-j727.(.F.;E...#(.:...jx..X.....9i....z.!~..0.k..=..H.}......Z......A.........!.......|.d..,...u.`..BM|.W..A...Q...2....=VF$.e._.[(......4twZ..q|.St..E.E...V...yQo...I/...C..F.\..j.=.:..._...S;.1P.>C..z..6g~F......U.......L....$.L._.........r... V/y ??.3.Z.>G...#%.#...ev..D......f.)..s.'`..&.y..$..c.....[.6.OW%Y.=..;..a....l.<.1...kTrA.QgD.32U...H..I..Y..P.3w..`..Q.8tw^0.......z.q...7.....l1..fix.r.O..R.L.mj..c./B.@*r*.......4..Ur##...8`.R.....B.I..a...z.......}..y:E..../v!.!.F.w....n...`....f.`..mj.IK.G.!S,....;JKw.)....]iV......r#"u.....N.'.TY<X.<..!.k....t./.3....~ZjL.ScB..:@.s.X..Y..N...A.9l..h..S.0~f\0.......p.q...%......m...nfa.y.K..K.F.iz..h.,I.T>s.....:h.i...Sf9.....5..z'.U<S...;Er..........Ua.&C...aHy.5......n$;MF.'.6.=.+w.'..1."M..R%.. ...Q|..*..\Xc.|n........{....7...QL...............n.....8...-d-....u.Dv..........yD.6Ua...Cgb*j......)....@..n1..0..:...=....9,..F.

                                                                                                                                                                                    C:\Users\user\Desktop\NIKHQAIQAU.jpg.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1269
                                                                                                                                                                                    Entropy (8bit):7.859615140103597
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:UncLA0NUH0o0OKgvA2Av8zRARdMgNoX2IUdfrDptrrUSOo5vtSQnuiO:vLA0JOQF8z3sIMJtrrr5FZnuV
                                                                                                                                                                                    MD5:E8E9043100378FA6C41753DA11BCD92D
                                                                                                                                                                                    SHA1:6E8392EB234AE5D77083C08D63247F4F53CEC75C
                                                                                                                                                                                    SHA-256:0CA8CF193D95AF1585814670812600B153A0B742031DEF053E15F2B998596E9F
                                                                                                                                                                                    SHA-512:8B988A878AAB4282A6B045A911FF586064EB87715D910DF9D7E5F2DFDC2F01DB1661405F9992D421658251BF5E10362BDB35358071B3432B56A1B079E145B840
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:....051..VW..e..t...[.#...V..6...X;.g-.=....T;.7d.l.{.\..4$..n.<.$%.+...0.9.......co..EZ..X.L7.C........FDb.....Q..d....Q.]Jb.M..%Q$u...+.f...t.!.......$...2.......mF*|X/]..0h.9.^...nWQ..MM.%uY..i{U..E.fkK$.O..V..`...f..q(.BPn.,..N....0G4.3..b19Vp..... ...JZ..q.'m...X.0...\..9...^<.h-.'....Q4.<`.n.k.X..3&..yu<.";8:...6.1......av..KR..L.E4.S........W_}.....D..{....Z.I_u....?...8.Dq:.. r.6...g..m=R...N#.'wj5......(.....P9.K.....,.52o.r..S.#...F.....;..k..Uf.;@.'....b.C...E........x..."..<P...n....x._....d.}Y;......k..1.?...=S......V>..#.k......7.;..Bv.z...w......w..V.gf..r..Y.N,....6........y,G.%..*{=77.$S...j@..../...8.@a-..=f./...`..x)Y..J?.7xs!;.....7.....M'.N.....%.37t.l..X.1"..G.....4..h..Gq.*P.'....w.W...T........}..%=..2R..!.Pb....>.K..?.Dr..A...............xC.{OQ..2lU[..!.....V#a.0A,.Dm..H.>.D.mgs..?`A..u.+.k._.{..h..o.8..\..]..(.=..CD4.z.6._...p...HP)..g.x.a...~......S.."=.o;...-....#T..ztTV...2.?..]d._..j...=}rz..<l..v...7...C"_.1.

                                                                                                                                                                                    C:\Users\user\Desktop\NIKHQAIQAU.mp3.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1269
                                                                                                                                                                                    Entropy (8bit):7.863217974326131
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:0JbLBLvpUEpyyVvNae+RG7LlXt/esS451W7mKC8piyMvnuiO:0JbLBLKEUy/aFR0PS4LW7mKC8cyunuV
                                                                                                                                                                                    MD5:43BCF8AAA51A4765A742B87A809786FC
                                                                                                                                                                                    SHA1:3CA5457034D2128354916BC0C471DB119293EF38
                                                                                                                                                                                    SHA-256:14166B495DCD8FAD39F28509170B37C792FFBC7545F4291F49025C5BE1501207
                                                                                                                                                                                    SHA-512:228F8AC58CED38C9E18E2F5E80985C955F8770A6022EB899D5C175D6C68E156638C4F95B8AC006AB299AAFE51C25FE2412BBE50A52BED3E02878D3A0D85B5B7C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:."=eJ/.... Um.Ii../. .u..._..O.\+x9...=.|..n...h.Y1.A[}..+.....'.M.F..|p#.(.o......D..'..l051m.0Sf...$.gP|/...........i....&.).HNFv...;..tz....&..i...[.I..0.....g......pBX ..Z#QM..x2.6....u..%I.3c.Kp"..9.&f.CI...O.d.e.a..8M...{h.L....2OL`ED..3.@}%=.<&bT:....-Vi.F`..%.#.f...U..@.V9~>...'.w..k...j.I:.UGz..(......6.M.@..bg5.<.|......A.."..l )4w.1Pl...;wdVs0........dd.p.....)U1.{.....4.....7I..X;..PK..[.m.'Q_=..i.j..."....$....@9G.b....K....d.]!..^.{..<m..5y..x....<.....Y..o.dI..7.@`.>W..#.].A1..Q..M./2....r.C..`......5:).H.N.....9N..e.q.`P*.bJ.....5].t...).l(ln..........,...\.v8..K..:.......1...k..W.......*;.+Y!.v.....#.....2D..R...YZ..G.}.2^J;}.v.m...?.....0...R)A.`....Y....u.O8..X.x...z..%h..r....(.....V..d.kW..!.R|.!E..!...g....>...,...A.j.....S%b.>l..A4CS6.{F..........(..t...5.d..R(.A..;x~.s..0..d.URK....4....h#T:..1..B1|....}.H..X....zn.....Bfv-..V<@..CB..]\.o<k.>h......T...I#..!O....{|z_X.o..zo.........?B..6..L(..S.,....d...'"..D.~K..

                                                                                                                                                                                    C:\Users\user\Desktop\NIKHQAIQAU.pdf.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1269
                                                                                                                                                                                    Entropy (8bit):7.843082650010961
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:Kf9ynP3UnxOlCVvOd8DSwStnjr1G7Sz6d+N0CeOIxK8A/z1NluiO:Kf9ynPEnjvO2Mf07CCJoIA8+zduV
                                                                                                                                                                                    MD5:8908722CAEB9F948EA4B9BA4FA44F9C8
                                                                                                                                                                                    SHA1:20307673161D35E4D01B7FBFF929A1D9D60DC7FF
                                                                                                                                                                                    SHA-256:ADA4DC925408C0483FF8AA228084D5C826D18FFDBF7A49B290FE0EF859055E19
                                                                                                                                                                                    SHA-512:975BAE9FF5864F9427A6BBF02ED53CF900967FB0CE699B3956284703151B62F0DEAC54FA5046E59D5A2B67E9762CB32A3E38D8B16BC595BE274AF56B61D5AE0E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:..?2GdD:...?..%.........d~SP>.8...9....~}..*....\sa..v'....>.p......'....._.E.[].....Pr.....".....K.*.2UE.q.....&'..)c...%.).+.E ..%.......5.K1...,...&....x#....)..@.0.p....0@>.g$uD.vgv....<D....LuC.r..H..'.....Pd.3...>.....U..~..B+.;.....6...$5Yq[2$..<...,.........itPL1.2...0....u~..!....Lxe..q%....+.n....../....G.J.B\.....U{...c.8....Z.5.1SJ.n.....&6.."z....D).r.lv...v.n.......p.^5...[`QKM......lVE7..D..d..Q.s..PX.{z`k.q......>.p:.T.q.....^..f....n....L.....!o....hu...;mi|.*.a....k..y..........).(.........+W..E}..h|&&k..|.....@q.....964.t..@,...a......t....O..)..@..1.%....p.c.t.;t.m.(y....].n0I....L-.~.t{...r.y.......u.Y-...Pi@ZI......yYP1..[..q..L.k..NL.jwiy.w......,.}#.E.c.....T..q.....f..;.J.....0`....gk...>.uw.8.o....[...........R\.../..&.a/.h 1...6........W...a==.w2P.w..i..N...[.(J......Be..EjD.L1.`.)m.........4..m..&Q.7o..M'.d...y......2...`..&.....^#.9..~/...k.-vB...Z%...~S.1i.c..YO.n..q.'....i.y-._&.d.T...XLP|f.&.......q.%.K..'..)

                                                                                                                                                                                    C:\Users\user\Desktop\NWTVCDUMOB.mp3.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1273
                                                                                                                                                                                    Entropy (8bit):7.860868081042663
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:vyKItNu38F89id3zC8YEpRv3U3Tv/tgiZCLI2jmQUTuiO:g6W89mu8YOvkrmiAI2CHuV
                                                                                                                                                                                    MD5:A5AADDE843860BEC72D837AAD09F7322
                                                                                                                                                                                    SHA1:75B93D8246B46458588DE7CB3398AB3B4A26E2B7
                                                                                                                                                                                    SHA-256:68A3A7CBABD210EBC7004921082606C4F7EA7D5006F9ACDBA0BF6FE489090F9E
                                                                                                                                                                                    SHA-512:68F37FD6AB58758E51731DE7F393EB37447CA0056E7C12A3EC5169965CBA26A38DCF7F32F464E8BEA646E17E638B381231247CB415A82C96AA7A7049463C3548
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:fo..a...L .c.$;.{.8...+....?.....U$C.[C./.N.hhh;a.EYA.3. .W.../.......<.x..?L{n..X..!..G,......gc....EE....nt..*d.#F..... .....~.0.Xn.0G}.p...>F..D}".O.0..L.}?.......U.T.....]H.....-....<N~.(.\..nx.f.../...z...z.|........XF.......e.n.6.!.-S.cq{y.O|r..w...G5.z.1!.i.1...*....?...._7L.QQ.1.T.tdx1x..IOG.5.=.B... .......>.e..&Nki..Y.#..A:......j||...IE....g{..&n.4K.....2..Y.......a`r-.......{.w^............6..G..4..;.{1.`z..7b.X...k...8...SG...[7.p37.g9%..%t[.L...?.$.....:s...4;..f....~.j.....'....O.m.....R....%.C.l..T...E.N........w>5.U.......xp.]G....]....Hp.]......>....2..D@<^...8..I?.Q....NC.#.Y.1....E.......zbl%.......b.p^.............&..^..>..1.s=..s..?k.A...y...%...MD....H1.t$$.`330.#}].P...=.3....4r...+(..n....l.g.....G`..w.s....[9....*.....7._............W?..Xw...P...G ..........).....4.HB....O.<..31....<.h..2..1...OF.X..>.Q|.3NH....Z.J.4..=...a../S..Nk.B.JVc....VB..F..6.....r\/...-.%...pP8.....R....C...#O.6[.[..N.....gG..m..@g

                                                                                                                                                                                    C:\Users\user\Desktop\NWTVCDUMOB.pdf.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1273
                                                                                                                                                                                    Entropy (8bit):7.821611761472437
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:JJ4qhbK1TGhlkq3gFkEmiR+lgaZ+96Mbc8NGMLgWH5dLKbP9m44SHQXq346huiO:JKGhlk8gSERRqgaAUgNGc3ZdLKbP9CS0
                                                                                                                                                                                    MD5:55BC93E3F8F1CC1F21E5DA7C0525C791
                                                                                                                                                                                    SHA1:2BEC3C072AAF97D302990425F30E4A749C2C58B0
                                                                                                                                                                                    SHA-256:C5E59C9DC4314B75C644AC80F7E93242C0829C8FEEB817F2A79902F7223D6438
                                                                                                                                                                                    SHA-512:929AA274C9D99D8B1AD41C0C957D3CF0E0CF31B3F43ECC0F9FF70FDBA0F45B23D2175F6A20B845EA570558DA6CBBC8A71C93D6069D2B15C67330878919E78882
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........$@Y...j.9.....{......6.*1?.+~....:..... ..........:.m....u.....(......SA.)...&!.\y.....(...C]...Dq._K..ESz..?9X..NV.{2-,.$....lK.Z.y...A..)..h.g..'.4.L.e.w.o.......R.......-.D..9C9_S.........&...b)..N.;.......^.N....6P..9..f.....E.........1M@...{.0.....{...... .<85.${...$...0............).e....a.....5......GB.6..0-'.Nt.....7...VQ...Ey.^G..EDw..+;Z....(.Z........1Q.?...F.q.\.b5..Y.-q1|....Y.PZ".PaS.....W.t...~...!..bP....8;u..<....V.....P...wD.}...'"..B~_5q......x.....l.<+Hl..y.]...^%.a.SH.%[...$..N..8.....l.).,iOmq.i..Dv....B..5...K..5+F.D.Ov....SG%.L<.rv=.O.Q...........*=......$.^.S/...-.D........5D.?..._.v.G.b4..O. }7r....@.[P".Zj["....V.}...l.....1..aE....>:q..)....P.....@...aS.s....&%..]mV%y......n...........r,...+.t.t.'..."a..=.S....9.p|.."}.....;C....q.X.$3#..0.O..3.<....N...H..a.M.#...Go...u..=...`W.e.q.n..I)...].4"4[.....#. .cs.q..V.a.H.....O'_So..T...H..p!..dU.....AM^....t9..*. ].W=x..V}.....<.s2A5.t*.*;.EQ[P

                                                                                                                                                                                    C:\Users\user\Desktop\NWTVCDUMOB.xlsx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1274
                                                                                                                                                                                    Entropy (8bit):7.843247014191668
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:PEhDBYTDu5mXM/0/+z+/w2EXp0dhvGZAMKjM4Q3pA4ZfonUQHCnoKpguiO:PgG/uaOwwj6hvGEjOr9HQHzGguV
                                                                                                                                                                                    MD5:F35AFBB0FD6084005BC0D3DB031022DA
                                                                                                                                                                                    SHA1:AB01A6DA6036D58205DEC1E9AAE735515BFC656B
                                                                                                                                                                                    SHA-256:A9B96AAC3C43E6B8853614FA34848EA8974BE63B9C86B41F1C73327A1D9E6DA7
                                                                                                                                                                                    SHA-512:BB2FD1D3294B0EA5653BADD01907B42E63B3870C1E0C95BCEC267F70FF2D54A475D6C05B65FF8ED466AE8A4D3DC5D59D8D48597E0DBA07C44E888678E3FA021C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:...'TT+RI.f ....U%.......K.....PO..X..Y@.._.P. ...c......=...;{....4..-..".y..O<L.x./.../..^b..G.]...hx.....=..bi9c$.M.x.O{..5q.IL..[._...k.........%N.....N...Mx2.zy=R..d?<.`.....o.\t'.q_..g...n.A...b.J;H....|@.].Se..r.LK...H..4.......aX.....)BV.^B.k9....G,.......B.....FF..W..KJ..[.L.0.....u......(...4l.....2....#.. .~..N#J.s.9...8..No..U.H...ip.....7..or3w&._.S0..._.... .-ce-.l.Y...I..fO%.%...".....^.`..mIw]......h...V.g.W...[.p....g&g4...#.....dV%.=r$..66...2.Nlm.A..N...K......<.3e#m.5.X...D.&.tb....,..{2..U&P.y..1i..e.R.h....F.>L ....|..*n...r...5.,.pC:u.;X.R...r..l3...b.l0...........z...jq...Cz0EM,...V....>.)vb-.y.@...R..g[#.&...!....U.`..eEfB......q...D.a.J.o.E.e....a'c#...).....fJ=.<p2..8/...3.Lir.H..I..._......1#..z...{.v...L...Q[.........%.I/!/c.e+..-....r..-...;Y..c.]...lJ-x-2....I/.............K..a.n".....l.....\.....t.3.a.jM.P...)..^.........y.i.....<.W..L^x...Z..._.Xx@......p.'P...*.......]<.....b....v.....K....%....M....R

                                                                                                                                                                                    C:\Users\user\Desktop\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Desktop\RAYHIWGKDI\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Desktop\SQRKHNBNYN.png.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1269
                                                                                                                                                                                    Entropy (8bit):7.832841105542978
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:hbKLPscCbtPlaKSBlnbzIs3KJQK/3MzRwGQxvCBoxPGY9ZWbuiO:tKLPdW7a3lnbzIsaSoAPQgBMOYTmuV
                                                                                                                                                                                    MD5:B572F361DD94A727E6C70E91936D3F6E
                                                                                                                                                                                    SHA1:1465F2D9934E4AB4D6652FDBA79AC498201D6637
                                                                                                                                                                                    SHA-256:C1980555046545E65BF6DE623E5D460AE5682F56944C641CDDCA2633343AB30D
                                                                                                                                                                                    SHA-512:AB91C117E6E409325056368D3D04BC3381AEA70983B3DE317839E1EB4594E7CF73AB667B3220A89FE1F91FB045DEE92131AE2475FFD1C8DE603C922348C535FA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:4.......T...0..v.B.{A?......q..r.W....C%..-~G.l..ii..&........8KiK....gq......v.T$.i......P.....gZ ..L.s.B....=....3bG.....I..l.v..V..T..I...24..h{...'.(xie.. .8,......9.Q...e.......A.2...Y.....Y......k.s;..g..w...'?sm..f.37..~.c=ZZ..`..xw&"X.3.......S...'..t.D.aE!...0..c..s.Q...B*../v[.a...b..*......$_uI....we......r.L9...u......G......bX(..M.a.Q...>.....6qO....b.S...'.. ..D...T1.....X#*Vpv...c....h....&..r..F...;..Vs.A.i.K.T..er..C..O.8....p.....q<yi.00....}.......a......gW...k.-.LL.5...'.bt0.L.\B../.0...U.~..+.mA....y z*.,.@E8,....M%z.2........UYo.W.{..R.R.}=.&u'..OJ.K$.....gjy..;P."...y...w..0Vr`P...A...:..*..Q...V+.....V+/Vlp.n0...l...9..h..^...:..Ud.U.i.O.@..di..]..A.,....f.....b=vs.;=....i.......z......aZ...s......R.u%h=.../o..........Iy..t&.a.W.1..V0P.....~-X}.8.%85c.4..2..'..sT./..1.Y..2..|..K`.....hTsbXJ.&.^....X...].N+....n.r>.A$J..$.Ja}w{.u.4..........8...FkKJ.......[...?.M.X,...q6.^...[`#a..,bu8...R. 2....Mo?.|.y=.Z.d@..

                                                                                                                                                                                    C:\Users\user\Desktop\SUAVTZKNFL\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Desktop\UMMBDNEQBN.docx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1271
                                                                                                                                                                                    Entropy (8bit):7.801138662979447
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:3zUQRWmYvK4XaG4Gi/pbcIZMDn8kODkEPsiOc5zbJdApw6uTOnxMOcsA75vfIjuV:3TRWg4KGhkpbBCUNsbcdbJWuTOPcsAVx
                                                                                                                                                                                    MD5:9FC5464F0000C445784A822EF0D5887B
                                                                                                                                                                                    SHA1:D1EE53437F684608339675882A8688A820F7F89F
                                                                                                                                                                                    SHA-256:F074FB07A5074B081B60BADAE868682C0DBFD8B42F19BAC29509129411D37175
                                                                                                                                                                                    SHA-512:6A8C0EDE1693B4890E54496AE36735695700A554A47B88D26F5416500F5D5496FE368B35C3A318296ED0C6FD5C3F00BE438929FB685D992C7983D9FAE1A00E6B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.uw.H\....v.Y..\...8.Xr..n.f......>....L.+;..U.......I!12..pz.3.....:^.(.O.0J]...{v.....2.u@.q#g).G.x.{....8.]q.............2....S.............i..$.K..W-.....v.K......\o7.X).P...(a....\...J.Q@F@..16;@..E........0t.S.@..,.2b.R].:. ".......a|.YV....e.R..I...?.Wp..b.i......5....E.=?..W.......K!+2..od.6.....2C...O."CE...or.a...1.mD.f4x(.C.c.`....".@n..........K"<.N.Y.Ge...?.5Qu..u&........>K.w. 2X.....d3...c.p....@...0...^..;.:...v..Z.S1k6f..r...1.KI'..G..[.a...}........&..V....V].DZ6.w.|....Hk..v......[$)......H..1.......y+...%,\Z........v..8.HU.+*.\H..H..o...Q.....=2`..K.g>G.VN.DG..re3.A...K.\90.X.O.On...=.9K{..f'........5^.j.")Z.....d4...o.g....Y...%...K..).=...d..D.I4z4y..gm..?.]Z<..L..O.k...l........5..K....W[..U.>)9...{.....O{.!Y.@n..a..Y.......}p....`{Z.W..3....Y..ov.x.I..........!r.*.~.....x......p..5.z.7Z5Zh"t....TD.)...O.....J=.0...q.......c).}sHv..ft..xJg.e......i.}....2..Pc..xU@.jy....hP..u... .kl....i..s.\.v.>_6.4

                                                                                                                                                                                    C:\Users\user\Desktop\UMMBDNEQBN\DVWHKMNFNN.jpg.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1271
                                                                                                                                                                                    Entropy (8bit):7.853294314571542
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:WnAvwQ8yFjAsT0QpbfliSaYRa9NSg3v+xcuEbYkA0uH19uiO:WnmwFyRAIlliSk9NSfxc/ckA0uHHuV
                                                                                                                                                                                    MD5:79F58DBA2B819562DA9DEE681E829FF4
                                                                                                                                                                                    SHA1:AE516FC141A74D173BE29A39B42285B7D13B73DA
                                                                                                                                                                                    SHA-256:907794B3943DCA6511DBD4F5E57423CE49F724D36EA4BCDAF45F1087D280FE5C
                                                                                                                                                                                    SHA-512:85DB123A910AAA08FEDB1A0BEA5110D98262EB2412DEEE5F747407E7B4AE0140DBBF445E11A7D7A945EF112C7757F4F361E05FE33BB73C519B92427EA0959F6E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.k?...2.*.G.P....N.9..di.e7{....~....#......>..J..m..K.e.@..\.AD$.e.YLKUL.. 2Je.*QvCg..\.)..l?.HX|.b...j.q%X......^{(>.h;z.....qj...j.'.T2..2..4....$I.'`.`.A,v.....Q..1U.0.[...w.R.6..mt:.....c....~~ps3 ..g..J.z@&..\.w..\...c7....l.........q-...,.....0...<.,.Q.U....I.6..vh.c<x...r....6......:..E..u..\.i.P..[.TI>.b.ICR\C..)>Cb.&Gl]r..W.(..f0.]Mq.`...x.r/Y......Bt+5.{-b.E...w..%..".7.q|.Pn..............5..D..]|]..u..a.y.M_..u.7.x...<...l.......XL'.."}....:9tW.G..........L...TU.P.#$..8.znH...S.;....pX..n.e...~.v.a..p..O.....d..A.kf..c....U.......|..)3..v0.J...t9S......m.b ....enp.L.mSm...........d.V...,.Te......O...w..-..5.).jz.Yb..............4..]..Hp_..q..|.a.XF..`.6.a....&...v.......DF:..3c....93gX.O.........O...NF.J.6#..&.{iIb..C.}....QN.2..r....Z.~.Y.O.............A...,...*1.5........0...2......./...7`<.e ......*.t.Ci...]a?r..0......Bli......B....g.O........^.I.d..WgW.o.3......A......<....3@..:.... ..:.h..X...u%m..9......2...4.a..._k..\..

                                                                                                                                                                                    C:\Users\user\Desktop\UMMBDNEQBN\HTAGVDFUIE.pdf.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1273
                                                                                                                                                                                    Entropy (8bit):7.846280657889801
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:YKv6wAKLyj89I/kPcL+W10Xp8IblE6BmvfUotd2+cWiuruiO:nv6pKY8ukPpWyZ8I5D7ov2+viuruV
                                                                                                                                                                                    MD5:BF677DD6FFEB6E1B7B73B5E637274DF3
                                                                                                                                                                                    SHA1:D4FC77FD31B78AFFB1457F0C6142FE4822ECDA4D
                                                                                                                                                                                    SHA-256:16634EF0834C3692C99AF891D3E50EDA862998C50FD07D4B5451DF043CB405C0
                                                                                                                                                                                    SHA-512:F306FD0B960C112EE0D7F43216B8B7C3566A8E923FE151D09B9BB99DDDBF54074D84AD62C87E5CDD6ABD892ED582F725EDACB4355940A0B7EAF56D68B2591248
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:g8.....~)~A...N..c..G..p|mW#.^Z.P...E.<zp\.:>z.u.>...4vdm.<..K0...X).u....F..%..B....i......W.....6_.H..\....r.ZN}4..fNu\#.ph.h..(j......V..}u^.j..'..=%i.'..;.H<.'.c.b..=.u.0..m...cO{3.Jf^2.......\X........(.:Nm.._V.5y........^.....t......<...0..d#.....d%hM...U..e..I..jdd^;.GU._...A.'h}C.=-v.{.5...%gzp.&..E$...[..z..8.F..)..I...s....3.S.....2U.]..\....t.YTm2..wQhK ..#tN...j..O..@).6p...?..Y.....'.:0..K.......,.I$.y...HoT.../..}*Q(c.s..i$...g..K.....;.ac......%fjR.:Q=..Br{B...Z....G.E.z.........;J...Bw......E...C...|.@#......T"g..1....sU;.G..+..@.._....Ox...3..c..w.q*...~..m....+.._A.....n.......:.>@,j....+lU...i..^..K".?b...1..[......2.+-..X.......-.A!.n...IiE...1..`6I$w.s.zw/...n..S.....".`s......7z{C.&A...Ou}L...U....B.[....q../.6.lP.r..w...).........;.;.2(...O.jH...^...I...G.u....p.........;V;$.d..3.d..P.+..(wU.[...[E.M.%M%...{..j.!Nu`D..X..0O;..+.._Kr..{fi.B..J....1.L....6.E?.4..:-..]..K.S.y.~.....e;.@....[R...U,..z.J....4.....J..p.

                                                                                                                                                                                    C:\Users\user\Desktop\UMMBDNEQBN\KATAXZVCPS.xlsx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1272
                                                                                                                                                                                    Entropy (8bit):7.837413924536257
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:0V77QgjYOO9sAgv7NCflgrrKYHDxzOcj4xH8tUjpXkXzTeuiO:SVkOO9Owlg9Oc8xJ9OKuV
                                                                                                                                                                                    MD5:6B7BDBEF8886BC48A656E06BAF49EA0F
                                                                                                                                                                                    SHA1:42EEECA7085EC01A24787D878E28F88BDFB3CF00
                                                                                                                                                                                    SHA-256:480DFF72B402FB4BE4833C9DED7BE37B17F926D56B0A32C0AC7C292459DA2379
                                                                                                                                                                                    SHA-512:D6370CFB45E221F4171B229A6E13CF56F023EF2CFC4D6688232A28EAEC955087F62DE3BDD9A38E01D092BF9D731530CDB1DCEDAD809499352B3AEDE1B46B99BF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.7...W../....6 ..h.i...h%.M..a...;[.?.r.I...B^l..b.....IYj...lqr.P....z.....>.zd3.m..a.r...CoH.1.......EH.....+.5F..1.)...<|q...U........G..t..3.{.F.#..f..T....#v..7.~ix.S......"...D.|..^h..RJi.......5....8.\)....Y..O....~.^..l=..e;...9D.Z8.....3...L..7....,&..j.p...u!.A..h...0F.!.}.J.....EAy.gx.....CTg...isa.A....q.....,.vg-.n..n.v...TeJ.'.......[].....6.-X..;.".....L../.q0.{-.R2..P......n.j..!|..icqg.1...>^K...A:......)3.....7.c-...&.. ......d..0.."...+.j3>.7..v)y..a.3c..2...s$.=>...JU..B.M.Z._r.B.%..Yd.a..r.'..P..;9.\Z............%U.h5../%.'....;....M.^..2.E)..O`XT.?.n.....~y...>......A..RyW.........^../.k(.e,.Z<..H......b...."c..ly{o..'...$]P..._6......0!...z.).q1...4..0......v..:..?...3..(/.?..e.{..y.;}..!...p8.7)...r,....585....2.Ar.6..M_....-....r...q.5.9+......+.L.6v."{i%(3.]...`.b..5.....5.h.8Z.0d.......%..|V..*~..!pH....V.}./....>.v...[+.....je.....j.....o..v(E.....s....JQ.^.(gc.*.I7..ge.z.......h.`c.C.*(..5..u6....7..P._U...

                                                                                                                                                                                    C:\Users\user\Desktop\UMMBDNEQBN\LTKMYBSEYZ.png.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1272
                                                                                                                                                                                    Entropy (8bit):7.849359110050598
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:84DijgPnB2uR8/IdsFZgUjKsdi8QuvbCYTZuiO:84DijcB5W/tgpUruV
                                                                                                                                                                                    MD5:31A1980DC59468D7EFBD507CCEA165AD
                                                                                                                                                                                    SHA1:742CA6BC4BBC9CF52E96717BA04C3562DB1879E3
                                                                                                                                                                                    SHA-256:4A7C2615D497F47A786F92D356348AE6D30C4401811DB3CD4D59519E7BDEB1CC
                                                                                                                                                                                    SHA-512:5D10BAAEC115AE8DB4DF0ACC158B46217334EC3A7956CAA7650F48EF99FBD14CEA5C0A2E341F9078CEE721ECB05EB4E8273F87934C39C81A15E459BDBCA8E9A1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.ICb&I...d....<.}..={..}.xI...C.k....I....-...[BN..egg.3B....v).S.GJ......M^...C=Tz.,vH.1.A}J.............^'.N]O.=t."..d.v.62......N.A.)..#.......O.,..t1.X.Fk4.mD<o&...e:.1..o...y.j>.p......6/F..a...2zD..S.h.C..s.!.R..l......7......c.z..0x..\L..C...IA|;_...o....4.t..>j.hp.z\...[.g....J....+....NBQ...bg."N..x8.[.[P......^I...X#Hi+.uU.1.NdT............Q5.\_F.;j.<..v.v.+ .&..Njf...p.5...%....9.W.8......1S#f.'........z9..G..P.fH.Vl.._D.P.=<'4V..jlnOR.D~3.j.pi.A.].E...-.S..y......pW..cB6.!m.~=.b....H..[.....9E.g..W..50..........CH.[!V..|..Z......{...k..]jO...[.D..a...m..m`...RUp.w...[8...w....Y....d...........8.t.."..]os...k.,...)....=.C. ......(M6h.*.........v3..C..Z.{G.T}..DD.X..> <\..ja}BA.Xf9.g.c{.J.[.B...*.\..r......tG...I9."f.j).v..kar..|...yN{N.ln".7b..Q........8@._4....5....;oc....l}.$.jB$..Mb.y.zde%;./..S.#...y.O......4...r...c.;.f......j}...8..b.......l} ...Ly..i...|.../.....B..._...'...u.s....F;.....I...p...Qg..]....J..j.3..;.`...P.5.$. ..S...H.

                                                                                                                                                                                    C:\Users\user\Desktop\UMMBDNEQBN\NWTVCDUMOB.mp3.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1273
                                                                                                                                                                                    Entropy (8bit):7.829354652398361
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:4BFYpnlHgZX5qicIJ4wNNmDUT1iPMHgDWqu4l2/WXY32ji+hwxuiO:Qen9mXQicI2wNNmARiPKgKqu41Y32vK+
                                                                                                                                                                                    MD5:D42A1748028F625760F10526229E22B1
                                                                                                                                                                                    SHA1:AFE72288556EF5140E46D233322D486D18F5ABEA
                                                                                                                                                                                    SHA-256:218E16DC71C68DDF1CF2DCC241C13F65946F3CF10562DDC51C73DD83CDE9136C
                                                                                                                                                                                    SHA-512:4AC935FF532B1641467F10832C97AD2BDF655E1F29EDFC02297382BB197FE692CCAD3CD6CA26E79943B011C0B381F6863CF2DDCA9AA0C6FD13CBBEE5AA625C5C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:...w.o :....y.T..z...c...2.z...>.lg.U.$]....g......U.SH.Pu..k$.Q...=Y...%.K.:>a.S/...n.X.0.*6+.yg[...Ee. Z7"..c8...7S.V...5..w.....N...rn.gg...X(.^....=..2.<......v..u........4J@;.5..,j?...?Uw/Fr.{,... =|.c.....X.9.D$g.1.t?N................y.m%6....~.N..s...|...;.~...(.ft.P.6W....{...c..C._N.Ml..s,.F...&H...8.O.8.f.P....p.^.".1!).txX...Ie.=[?+..o4...:H.B...&L..?...g{..y..=..g.d.3...........Ssr.v3b..b......:....F..V..o%..n...2....=&%d.4.y7.;+.G...<d...Sj.?|.N0..a.c.-.:c..>.%..+[+..uT=g3L......4.!.Z..?.|G.r^....;_...l+F.g..q6...k$.R^`...0M*....f......>"....R........7..h.}!.{.s.....zHs..9....O.hM..R..:...iq..{..9..g.q.*...........]pb.{*b..b......%....O..D.}-..s...,....65#e.#.l0.-5.N...$t...E}.1e.K>..c.|.$.2d..;.7..!K).{...'.HO...:...J ..i......Zh.<.../K.E!.A...Bb.6......[....-o^.....S.......I..f,$En.o|63.y.Y.T.-?b.u3.Rd-..d......Q.C.q..^.$,..*5..X..ls4.S......h.R........Gd|.}.}..y.+.k.v.[>M....lxSxTZ.W"..68x.9X.x.U...0I...h1..|.M..<bXK..

                                                                                                                                                                                    C:\Users\user\Desktop\UMMBDNEQBN\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Desktop\UMMBDNEQBN\UMMBDNEQBN.docx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1271
                                                                                                                                                                                    Entropy (8bit):7.8607430297464616
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:hwEbaqbwr5sETAB7FjLltA9YH0pUBlitPudpRPcWJ+s/8LHlWrLAuiO:hwEf5oAB7FjwMWUBlitP+Px/GHwrLAuV
                                                                                                                                                                                    MD5:4B886F62E9684EE6E28E43FA8AB7831D
                                                                                                                                                                                    SHA1:AD97C3B88A1BE43C49554DF48E0AD171370A5FA5
                                                                                                                                                                                    SHA-256:13E499FDF3D8B306A96EEBCDE81B1A7ED2EC436938CD224A60CB53EDDF3312B7
                                                                                                                                                                                    SHA-512:50C9CF156C090BEC80E3740F6C642356C1129ACB89711CDF457BBC393840C5147A623C0EF057C80AE35FDD06CCECDBAE801627107DB46FB1CC0E61BD85EA03AA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:C.......#..%sY......W.....D..Hx...f.7....0$7*JM.C.]....0}...K.z..e....w4..s..~..n...z...7...}.X.N.Y....-y[|..........Z.....W.......l.....cR|..p....0a|....q.YL.IP.&....Y....=...4.....=L....=....&.f.6.a...5qa7.>..&%..+.....0e...0.y.k2.T.7...5J^......./..%xX......O.....H..Gh...m.)......-:50NI.N.[...../c...O.`..m....w-..z.....j...l...6...j.G.[.J....=}Xf........._..."..3.,..T....?.s{.k.q..t.'....2.&.3.G..N.`.j.v....?e.._.7Dsn.p........nH...T..@|.p....Xf..R.+Q..Hr.yb(........N.....>....?z"..*.R.lK.M.u/.lQ.(.V...)....^...@...3>...]R..%...;.a7.8....L8J..a..0.q...@.jv.I..Q&...F..H.i...+2..)..36.L...d.0.9..%.:.._....&.ff.j.u..i.)..../.$.-.I..N.o.j.f....+r..O.6Rn{.l........pM...V..\i.l....Cp..D.;[..Yy.ck'........S.....8....z..M`......@.S....."X.:j..'....w...|.VK.z..n...}.a...mFl..I5...!J..(.z.dr.v....Q.S....6.W.P??|.V...A.....v..1!...r.y_+.....P.."=.j.vM.~tw..b............E.`.#2v]b-*....<.c..@......Q.(.N.C....1R.C~..8.!.7f.v/...P...

                                                                                                                                                                                    C:\Users\user\Desktop\UOOJJOZIRH\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Desktop\WUTJSCBCFX\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Desktop\YPSIACHYXW.jpg.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1272
                                                                                                                                                                                    Entropy (8bit):7.83099253183884
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:LGNfE6+lxJukF3zIWn276deTPe2by7xY3vabEE+xxiKZbE1LEu6KBK4wMuiO:qnEKcu6dev7/abEEA0Kl+BKJMuV
                                                                                                                                                                                    MD5:12BB9CFE77E01123EE9BE1D9318F26F6
                                                                                                                                                                                    SHA1:FE93A62BB0A355FCC354002BE30AE7FFF994521E
                                                                                                                                                                                    SHA-256:354AFC224DF07A923D4C700DE0F39D0B308722295A7FC3D637AC88BE6146FBC0
                                                                                                                                                                                    SHA-512:56B83094505BA9FBB83666AF2E6DCABADBB128EAA9D1085D842C95DA118FFFD974CF53C23944A1AAEEEF16FD62F3BB7607176FEEF685DEE3BEC724684A8B3DF7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.x6a..Gu(..A..o.R."......i.%1...t. .......d.35.....M.;R@...jd.e...s.T..._......v.,........q....1\..W....T.fY...>.....a2j..dy5..M-...f.....@j...M..#S c.D9!.@..S.H.........%Vp@x7.'En...n.V..W...q...e....V..%@&.`...3...;.f>D.-%.U...?....8U..w*..`/i..Ki5..H..j.Y.$......i.<=...t.!.......g.7(.....U.#\G...ch.a...w.^...^......i.8........c....,\..W....\.iS...%.....e)t..o)..D.g..t..k.h*...5.X...X...uYeW.....|<....[}.'[?k..s.2..%.P..4.A..GE....PU..I..\+=J..(....7.b.......WOn..~!Mo.k..pqlx.8G/..1..v.....Np.r7..T..p...by..yPu.wp.s8..(m.....B...I..|.........n..h;.5.........3...-&_...ra3cZ....d.....7=f.l..+.<...t.M*..I.q..d..kjn)...'.Z...X...xUeF.....u#....[}.*S3...e./..4.G.. .I..EF....ZW..^..\:$T..+..7.c.......MVw..c+^j.z..|blc.3]:....i...^.h8.5..}.>........@g.W.?..O..5..'P^f.C.*B.!SD..2......c.R....Z...2=....V.....H-.=/.H.s..1.h.0.....T..L..v}...U...}qI...=E..............s.l.....*..a..Q.V.t.'f... ,Z..GMJ....V^..i..). ..}.:""uK....c..l.....k..z....

                                                                                                                                                                                    C:\Users\user\Desktop\YPSIACHYXW.xlsx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1273
                                                                                                                                                                                    Entropy (8bit):7.855126073794886
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:pmDBfdGuUdW3/D/SltjGI93yNaqg3gvtEUKu5JSXNjMuiO:wDB1G63Lql5rVyoq7nFUNIuV
                                                                                                                                                                                    MD5:9C361415D7C46BC8ABC7E56E4896E2CF
                                                                                                                                                                                    SHA1:F0CBC724B69432AA7643D04E671CC736551877FF
                                                                                                                                                                                    SHA-256:E219000C54D665AAB7787FFF34E15B1FAF30CBC0A34B76052517F703019DA352
                                                                                                                                                                                    SHA-512:077B20E0AF2C160568ED3C29ACF3F8E20F33C7D6948C73E0749EE5DBB2D02704BBBEFA29C2741BC9B0E18938676C1F5CBEDD4388043680D87401350128FAADE9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:>..C.jZH..5.7.5~........}..R.%n..{.m;...p....U.v.q.Ar.....,..lGMEc.9..j.V|......Z....wk.e.+5.V............2.=1.m..u.F..ag...ld.W}........e.J..;.u/y.....)y.a~.hd....."......yk..Z.D.=.C..jd.7.Q.$...G..........;Z......pP.w.....!.jk.=..H....2...C.fFU..<.=.:u....r...d..N.%m..h.b"...|....V.n.i.F}.....(..}OIVi.3..t.Cx......Y....~m.l<,+.K..............5*.m..a.E..zm...S.D... .R.#Q.....J..R.w.o....z....Y.,.oZ..=h...k ..tL...^..9H.9.X.sR.*...L`...@...J.x.e..A.L.D0.-F.......4...v.7T3.Ae...9A(.Asz.x..`...UM.$A..XC....................U6.#\.~......C..M...;.p.iC.lJ.0..(...}TB..K.e..Q..~2...W?{.....M...X...*.....U.]...0.[.6W.....]..S.w.g....j....F.?.sZ..5d...}:..a]...^..1E.;.P.jT. ...Ss..@...A.{.|..R.@..A!.4P..7.....1...|.;G3.Gn...2`..Vr@...*....N*.L..?..O.......0.f.....}23......)...Qv.......c..@`..T...Z..Q.WR..M..FVX.o.B.m.b..? ..,)m...]...I.[..F...&[I6...(.|....\.D..KMN..x..#{)"....{TG..Q.........S../...|.9..73z........Y..o...&.8F...d...r..D

                                                                                                                                                                                    C:\Users\user\Desktop\YPSIACHYXW\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Desktop\ZTGJILHXQB.mp3.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1273
                                                                                                                                                                                    Entropy (8bit):7.827767252611318
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:FbyD2sLJjpCXIuQ/q1bNznqPzzOTIhZmwcXJp3Sb7HYcR5j2uiO:FeqoKhpbNznqPzyUhS5p3SnYcR5KuV
                                                                                                                                                                                    MD5:FE4B39A6683400604CF501AF3D5B3BF8
                                                                                                                                                                                    SHA1:54D7E20D1F565193478725E21F6CFD48DCB3191E
                                                                                                                                                                                    SHA-256:47A839E594DE871E55579153E30A01BA75AE3C4BDF9FE5FC7143A2E77794771D
                                                                                                                                                                                    SHA-512:8A479A1FB24847EB46F6669716408430EA7B652B18164865510BD90B698BB26D13BDD3299ABF20025AF2011D668A681A6100CE7D5198C9E9EE2D5DC58E153896
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.&........E,me....c.t..$..PG..VU7c.f1...l$a3...w..IQ..>..L...X.y&mH^.....BC...% ..Nh[t.O0uM.>I...KS`.....u,.N....TU.0.....O._...O..}z......%..R.\>"PL}? ..Y1..]....yX3.Y..'..a.tB'P.m7c..C..K.....8..gBO..\.B).k.A......~,zwH;...I.H..gG.R..9 .gy.......t.+.......N oz....i.y..7..^U..]Z9e.c8...h6h#...c..[@..*..Qn..G.e5rPA.....FP...??..XnTk.[6rU.%Q...LVz.....|4.[....CS./.....G...].;..M.p...~.^.......F!..... ....<~..?.E$...u...]>...J.....TU+!...6.......".W.K]S.B.."A.l.u...6..-.[n..hV.*.I./...-...w...-{.s}.j...A9.&D...o....fc.c.....7..kr..~C..A..G.<X.C..zt.+P...tc..,R..{3...m...;|=.r....#.;.k.lieQ.>.....b.2....BP+..."..M.d...td[.......W=.....?....-|..!.P!...c...F(...B.....^^9&........b../.G.TDS.Q..>R.c.h...2..,.Ne..x\.4.H.3...7...h...9}.....wV^.....14..........ib4"..O....\.!.O2.'n...{.LP....f.... \4bh.e....'e......=....3.S.....|Pd7..M.L0O.../m.F..]^..L)..g..............nRH.d.b.._..8..c.....>..k.Dl)oA.9..M........s...........(`Q..!%...;+.^k.K2..n...

                                                                                                                                                                                    C:\Users\user\Documents\CURQNKVOIX.jpg.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1273
                                                                                                                                                                                    Entropy (8bit):7.836045532265443
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:DrgVYWdl8HvK0ld7LQmLTYP9UfoK1pK006c+QudLgvpAeCs6ZTuiO:PkYLi0ldgmnY2fnjL06BexAp/uV
                                                                                                                                                                                    MD5:5D504414A36AFD0E639D699B8BC27B35
                                                                                                                                                                                    SHA1:2AB9C298C99E91A8E869DE8D3372DB4831D30251
                                                                                                                                                                                    SHA-256:DC06CC105A9C6345C39D68AB52A371D128866AE7245FB3433CDF5FD1B54416BB
                                                                                                                                                                                    SHA-512:6C1A0E7072B5AB8167E5C564136BCB0F53ED27978184FCE393BE30E2EED1FA55C5EC4E39E142BF36E50C761C1AE30B201959B3782F0CEE60063ED5F82279F160
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.Q ..>z......m...=...n./.Y.6E0.=..S.O..wn...._.f}...Gv2.$Eq..t..}.c...m....T'.....(..+...1/.6Wb..F... ..s&......}KlZ...F|.1S..&.c...-.......X...&'..]....Le.~EX.^.6+d.!.)/....>.....(.r.L'7.-.(.Y.6L0P.......L].o...O...?.....V......>(Zx....]=..3t......f...<....t.;.[.'[..-..G._..tw...M..kq..]}!.2Qi..v..z.....{....N=..x..;..#...)&.=^p..R...7..`(......nVyT.....kB{.-4...'.R.%..o..j._-..?.....W......}....N^..^j......9=3P0.t.....i[.C..-m.y1.]L..:...)6$..\.._w..6..64...7....b..M&...<.....y.j.....e7...AA.....v....Zm<:...K).f.@.(f...U,.XDX._zPfn8.>\T..a..,|........E..H./.....M.].B.{..,O.{=....p......?......dIz.*/...?.V.(..n..i.K4..%....M......g....OR..Sg....i.71=S/.h.....~Y.O..7~.`4.BG..>...;5...L..Lj..?..#+...4....d..H*...^...QY.....>}._-~TYY.X.^(..47.....U:..T/.f24..q.#.)`.fy.%o..F....:.k.K.....Tl!0.B.".t..A......K.5,)R..P.......5A^..X...W.)Y._Ln.|.V.j\..r.-.../f..~...Ar.q:k..}.@.0wC.#=(s.'..6..R...E...|~.h..<...E..Gv.........N.....

                                                                                                                                                                                    C:\Users\user\Documents\CURQNKVOIX\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Documents\DVWHKMNFNN.docx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1273
                                                                                                                                                                                    Entropy (8bit):7.84490544615627
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:PlMbO7kIV/XI3hW99n8yHGDmXNb8aE46b4vxuiO:6bOAKIxWuDmXaaEDEJuV
                                                                                                                                                                                    MD5:42D0B79EF23DDBE7AB39A1DD589CE3ED
                                                                                                                                                                                    SHA1:09111EEB0A08704A41F8AD62BBCE8573EBF40CF7
                                                                                                                                                                                    SHA-256:8BEF1D23BCB648138A33E99CF709F388C056551E66B960B7F670F3E7CE130EAF
                                                                                                                                                                                    SHA-512:AE913A80955C4A384C253C978CFF69A6543A5DB8F12DAD15009E2E36A47FD7B32713E6EF70368CA0BE16B13E7113011C8ABB1848BF02D54842DDBCDE1CE41F4D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.f.A._?3$.4..(.?.!~.o.=QIx......x),..u....6.P......F..P{.......;8.8i.G.id.=...h.Y..).k.2..>.4..W:7...CI.x.(..62.,..`y...E).j...mU..vU..[!.B.B......o~.....XJ.r..]...?.!...d-......b.*..'.^.."a...Ji...]*....t...=l..z.7. ..~9.....6m..B.......r.H.K1;"."...?.&.!q.~.?WB{......}5%..v.... .R......^..Gm.......6".?i.H.`k.4...d.C..%.x.3...6.!..U13...@C.y.-...).#...so...9......"9J....<....D....&....;.*$aw..........i>Yxq..i.y..i..1...ed...p......b.=d.[8.]....ci...@7..Y...".K..Ejc.-qE........]Z+.........&.......j.Ed-Dr ....+.-.k..{#xPW..V..6+!qC.YD...qe&.......#....y2..k..R.'.'/.../...V....>E.]E..&n>=W......2......(2]....:....T....:....;.!"hu.....,.a:\zl..c.`..|..,...zp...|....6.{.#x.F;.C....`c.....T!..X...'.H.._ys.*dB.......P>..U".:.|r.>.p..1..=.r....8.0..X..;..a..!....!>.fK..../.B...1......z~.P.DQ..M-/...:,+.#...w.......2e.ce .}.X....A.W...d.aP.6vZ......'...'..V...F....\.j.|.)....;..h.3./...Kr.RL.G...Q..S.@..uH.A.S. ?.S......:.uA.....a.

                                                                                                                                                                                    C:\Users\user\Documents\DVWHKMNFNN.jpg.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1271
                                                                                                                                                                                    Entropy (8bit):7.852386911574008
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:wcBD3j6xBb22RId13BBWp188746B/RiGZjA3eiq4D7fYcWHkqdfcbfKy1/pEEuiO:NB7evbVipopq8zB/DZ0FJ7fYjHkwfqZ0
                                                                                                                                                                                    MD5:303E533AFF064406AE5247AAC2527321
                                                                                                                                                                                    SHA1:5CF40FDA483AED0C6C1C634D16FAA1463D046F8F
                                                                                                                                                                                    SHA-256:0BB29BBA1E261DD74D1D8DBACB8492C8B1F19E174255D6D99E05035F887A60F6
                                                                                                                                                                                    SHA-512:EC1010B02A49A08D8582D15A630F5FB644E1A16415ED548B9E60256D3C4835347CC2AD7FCBC5BABAE33A27540E1B5CAC6E058A743C2C72DB79717E33DDC56020
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:|..a..a..5x74...yx.q.R....=P.(#......e.X..'......+.3..3.Yp$4.T.............b.C.{m.We}.,..I.9.%.[.?v..C.C&(..F.#.].A.U_M.L.....!k....r..;...X.T..w....89......$..~.vp........{D.~./t.fw.......}r=...'.....K.....]..4z8..3....+..G..|9..$.....v..8~..j..o..)n,1....yw.`.S}...%[."/......f.[..%......!.%..3.^.19.D............t.].wh.Dd|.&..P.,.?.P.4d..I.B/-..^.?.^.F.CG=W5......t....)..yB.'....[.2..s..k.....L+g..,..s...*"T3Z{....e.A..W\...S].Q..._S..7.4."v.....o.3...L.JU.......h.D#..Q."....o.nd..f.s....A.J..&..I...JJ...<x.V.#.[sT.Z..2.pGA].}....2u#F<........J}.1.(.P}.0UTP....7aT.&t0..&2.....nk.aV>....u.`J[.,])............2..uQ.>....N.5..i..b.....U<c..+..v...2(A*Lu...|.@..M@...B].I...CY..9.*.>o.....g.'...M.W].......r.Q$..O.#.-v%6...@..%...9....E..LS..Az,g...Sd...1.t..%Gm."..u.........Ej....Ok'dO...^..$J.......(.S.3,....i.p...D......yd..Y.&...L...r.B.ZY.2..).#...+.([.A......z.|f.....!."....8{....v.R.....Q]9}....&8...5....Q....V..Gf.\..vz..*.

                                                                                                                                                                                    C:\Users\user\Documents\DVWHKMNFNN.xlsx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1271
                                                                                                                                                                                    Entropy (8bit):7.839557193015557
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:oGePpQoO2DTqj7e0DSsGQ1/RHCbjXvIlEhPCCfi+OLIzUTQjOuiO:oGytO2/EreQoXHCCazIzUTQjOuV
                                                                                                                                                                                    MD5:11F0DE4E33D9A86C8543C50510EFB7E6
                                                                                                                                                                                    SHA1:803A86EED40DD8FD88DA8C9F0CA3841965BF17FC
                                                                                                                                                                                    SHA-256:418D6B6C5432DD47FEAFD881FEE33BA507165D55681771B810876695C887A507
                                                                                                                                                                                    SHA-512:8407BA522C7382FE4E6C797D0813C4746120F38C10D64BF50D34880B540542761EAABFA9F3A5D642D3540B077EA5DB51611175F3116B612508B84D8E5F8EB0FA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.j....*........'.2.L.Pg......r..5.j..5..)........AZ.mT...]....0.E..5...-C..[.B.)A....X..aA0...U@..L..Z.8.....hC.3.TRRD.t.h'..?y..k..L`......\Y9....qX:si....B..m.5.3A.....!0bj....v#_.}.\R.BbX.......G.).D.8.AfB-|uu....QtYD.n^...;..fQ.$...z...h.~....$.......-.5.C.Au......x..0.c..6..?........KM.aD...Z....7.U..<.4.!J..W.W.,J....R..xT%...^D..K..[.1.....tL.8.GDJ.;.R.......k.T..L.h.T.........`..6W......"L..&.y..pfg<..u.....=cF. .l.:...0...$.|...w(U.S..F.}8...}.*.GU...q.....@c..N.\.W.G.8...g.....n.....|^..$.,.Ri........e....]]I6..M.k.C5.oP.!.iA.'.!...g...#.....?.....`E.X>*v.g[.)....].B.J:.Y.t.:.E.j.CB..1.Y.......`.Y..W.a.G.........j..=Q.....;[...$.q..r{}$..l.... zR.?.v.2..!....:.v...i"I.H..I.u6...|.7.DV...b.....T}..OO.0..$.........!..R...c+0.2..z..x....k..#..4n%-_289.......-.3......:..r%Ys..$./X.VO[...*,....E..oe.d.&...Ajt(.:......@6CsoP...Fw..U..:H....,H......o.w.}Y........8..oW..0..._...a.u........?7....{...Hz4..ON..p.V.:N.%...A.^..`.

                                                                                                                                                                                    C:\Users\user\Documents\FENIVHOIKN.png.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1270
                                                                                                                                                                                    Entropy (8bit):7.856176699863514
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:LnzTc2sF/U8518hupnDhDGq5qS/atRV8s8ljldBtlwXImjAuiO:D3c2PiXnDRG0qSitXrWlJmjAuV
                                                                                                                                                                                    MD5:86246955E35EEF85A762E4CE8379FA02
                                                                                                                                                                                    SHA1:3DD7F03939D077B38815DE0CBDAA3DEB9A0C13C5
                                                                                                                                                                                    SHA-256:23F302B1D1257D63D09F6C2CD0915C5F3FD8DA57A9F4D4AC80C25DA097501E4A
                                                                                                                                                                                    SHA-512:760CF2B61E15F824C7B7F016E7E30736EEAAAF5A12C69DFF54438D332703DE1DD810B2E17A351965A9B8067A4EB3F3F2DDE2ED4375F8BB7C4DE6D53965D84D19
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:m."v.E.%.o<+.............|Vx+~..N.......OHwe...Km,.EZ#Vk.\.6..M"3.....k.o.hH....P.F.r'....{.N..97'..=...Y)y......A}X./.#....m....5.dj..-Y..:...W.O.jxL.X.J....Esr...#eb.G??0...<..a..hH.7.../M..%..P{.....TKI..8}L..._..F.5.{.c....5..fX....>.i.7......o.!x.Y.%.r'&...........kG}1m..G.......KAnz...Vo>.LB'Ut.L.'.._<,.....s.x.hI....I.Z.p'....y.\..:=9..>....W3h......NmS.:.,......>)f.K..K.f\.....V..6k_.H..nq.y.~.....T..5|,.B^.w.^.......B..q.v.Am.......L...A.&.!U.(.uu..2p.\...~.TH.4^..g..).2./?.]..+t._..C.z.j...!.$.g9...N!.{.8...r..zO.9..n......mw.t.m..K..N.Q-=.UD.v.o....^.9"6.k.L......@.:..[....P.....Ugv)Nh......4@...w..4%f.A..Y.rC.....[..+eJ.N..co.e.j.....^..=~1.]J.z.V.....O..p.o.Dn.......U....I.'.4O.5.ur..(n.S...e.^I.-O..x..>.9.#0.Q..)i..Y......\...53...m@.4v.....n...........w..!....@.27...q[...............3..N.....9p.Ch.l.'l..g/...g.........p...JP.`.....xT..e....t29.....r...(*..5...{7....r...w.(..Nt.....f.<.~....,.n....8NoDs.~;^..C..._.@+[........:#.

                                                                                                                                                                                    C:\Users\user\Documents\HTAGVDFUIE.docx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1275
                                                                                                                                                                                    Entropy (8bit):7.881100101625915
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:QxhpX7n25If3uTMLUdSr0FYpqMUBk0Vmf51Z7hMohXrNKuiO:Y2mu4LUQIMn4VmRj7PxKuV
                                                                                                                                                                                    MD5:0F5653C12508CCF309D8DB83AC15C9A0
                                                                                                                                                                                    SHA1:1B8D27A5F43D7D19135DC2A310489A39D55AE5A5
                                                                                                                                                                                    SHA-256:37408CE48206E39EDBE7EF90D7BC92CA073A0422E743AC178012BAA327AA6966
                                                                                                                                                                                    SHA-512:AA8DCBB80D10734127334FBB0D62F2C7B41629A529FB50666C0B4AFCD54DA077595ABFE252C6033ABB9C5C2A2CE1CFB6AAE4B1AC52F047CB26DE3ACD55126F5E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.xa.G,......x>.......... V....... G.....3.D(.{m.C.....YZ..49.E..........4~.app.M..,/..K....s}...oi(Xg".V6bf..v.u0x...a.E.....6..i.G.......!?Z..d...$......S(>..D../F.:. ..9..P.q.j.l...h...P......i..a}+.#..K:G.]w+6\...?'J.#.aG1..x.......Rnon&...X.cw._9......d%..........)N.......(P.....,.C;.tc.H.....GG..79.Q..........4e.mud.N../5..Q....u`...`n=Km".T7`z..u.e6u...|.F...xau.$h...%F$..bQR.J.....k.??..W.b..iv....j......{..`.....z.......b..9.rk23lT.O......>.|#...c.b.-.....Al..n.nWC.p.?g..%.0..&,.Ym]..w,.-...y....~..4.4L._.. .?PR-t.Z.J\\........,.C.......g.4*E....U"`ME...%.b..Xm..kt.|....?8.>.A0}....Df.(..i'.nim...7k...+[/..kC@.Y.....o.<<....J.q..fq.....k....'.h..q.....a.......|..-.{~(+l\.B......1.v".....s.1.....Fj..w.a[E.c.,y...9.E.y.'...0..P..a.....:5^......S..B...E.~MU|...O..v..ri.NTRz/..,....R.+..z...>.l...u.se.......r....-...c.g.......r..B..sn.f.?Cm....HD..U.S.A.L#.q.l.x=9.&ZC..xgu..F^...4x..i.....1U...d..`.X\..G;..h.7x..5j.."...,.R.Y3.....

                                                                                                                                                                                    C:\Users\user\Documents\HTAGVDFUIE.pdf.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1273
                                                                                                                                                                                    Entropy (8bit):7.868065330429569
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:6uDedoC0m5bIJ9hYpsbtAVzFTC+bIsAncDTmAuiO:6uDcAmOzhYObWC8IsDuV
                                                                                                                                                                                    MD5:CD9ABB44166D92AFB5A82E12ADFCC608
                                                                                                                                                                                    SHA1:3D2244F528F5B0B72644504453097E875E330DC1
                                                                                                                                                                                    SHA-256:BE2920FC6EDFF1D86BDADD595C87732108EE0D433B1734156B1916E7F1486808
                                                                                                                                                                                    SHA-512:3B5CCE73A59C9CE11768C6569D2F89C03309435C3C62472A7BB7D65856D831F162DD66DA93F89F9FEFA1C9368FFA85CFD1DAFCD4866769EF90C71D476527BBE1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:u.B...o.n.J.......}x...@...xX.T4..`j.bv......F.............e\...`...K.W.#q.h..P..^JQ....j...E.6..?.t....o.....gP..f;.'B..3..N.......'.!.0rN...+..Of.g.\...Q....6.U......d..Vn.@.0G`....&:...o.yy....vz.....XelC..Bb....0.s..{.&.CHtm|.1.. ..}.<v.T...b.t.\.......w~....G...q@.M;..ob.ur......A...q.........w.f\...z...D.M.<q.b..[..DIK.....r...C.-..0.a....m.....wV..w$.0A.z.!9.:.<L..P...,..M.N.....EG.$..G.u.Lm..:....)..x.koV5&.....YY_.4..wg...{.k*...x.7...Cg....C.u:A.5..4...'.w3..d. 2........&.9.....Z.w..=..1...$ml.._......-.t....]...|2..O.oG0..".t.r'.....O..:.j...b6t5.....W..$.ue.....P.L..B...$..<ny!zs...4.Q.s.71.!.:_..L...'..D.\.....GN.&..R.h.B~..5....+..p..x_=5.....GZD.(..bg...p..3...`.?}..Ga....M.t4L.)..(... .p5..}./>..........T....!3.ME.....m.^.<....^.?.Q..l....g.d>>..0Q...LX......*j.......{...a.-;5_..t.F....q.....nz.{/..s....M.U.t.~X3u.0...f<.R.V..}..A.....%....r..!6...U..8..X.<~Yp..T....c..)<g.....?P.i.}.e .30.o.R.......f............j.c.

                                                                                                                                                                                    C:\Users\user\Documents\HTAGVDFUIE\FENIVHOIKN.png.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1270
                                                                                                                                                                                    Entropy (8bit):7.850251347845703
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:96OKou6YOANCr7d+CIYwmJHa6Iwm9P5fQKyhYtKHJUV0HPdZmm5iFidlwDuiO:9MO5/oCIYw0Ha1wm96V0KHOOP+m5iFKV
                                                                                                                                                                                    MD5:931FE9D40A44E20C2AEFFEA6337CA30C
                                                                                                                                                                                    SHA1:746C9FD1BC435FC31F5A75342F5700796D29D550
                                                                                                                                                                                    SHA-256:C94C3D64F4FAB60615A93CAE9CE220FECD6A8C112D28FA5A6E539E33051DEAF4
                                                                                                                                                                                    SHA-512:FA5815A2146EB86A8409AB8A880F7FF99121BD7A0091693AD6828E6120888A64A961E8FD2DBE8FF343E1F812D0038AF3A26C53E3C7C327677ABE571CA4A9AB83
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:4Z.6.....^..Q..sqW.?h....".c$?E..Y..U...X...&.OT(@....p....c,!....6.....u........i@...d........Jx..;.....d..uO..4..._J:I.....(,.2.*.Sh.2.h.F.bAX,^.*..T.U\..A....w...s..SP.......t|....t..SB.L<V.1....e...;....vy...T.g.....S..6.2.-....64..i6J.8.....H..R..r~S.-}...8.l96P..O..V.*.A...;.]T!X....`....}31......!.....u........vC............Vg..5.....v..eD...;..._i$.....R.Z..F.1....lLx.q..V....[.Y?..&%......./..1!..X.!....3.pz.1....>,:C....R...~..]G=-m....b..Z......8]..(...\M.%[(.+5].......MU8.J.+)..2..._vI.U.I)....9X...T".O.}..>.B..T10...2,..~.....KtAL1R.o..l....[41U.7...^z0y...X...mB..;V8^Ic.C.z..L.u$.....B..H..Y.?....q\e.d..G....G.M3../:.........%..%<..E."....*.uy.&....;50_....F...d..MG:"c....t..P...n..'^...#....PW.'F;.Q...k0T.n.g....^.En...44XC..8N...w...Hx*.6...!.....4o$P.*..........R.<..VW.;.......z89.[..zk.f>*.{.W/VN.........|pf..H..SK.O.=....g..s.......{.u.#.. ....8......-.G*.'......2+...uF....@.zs...;.03Z.0.ae;.h.=.+...t.."E.

                                                                                                                                                                                    C:\Users\user\Documents\HTAGVDFUIE\HTAGVDFUIE.docx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1275
                                                                                                                                                                                    Entropy (8bit):7.863326082331267
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:e0m4BuXOwim7RV0YfDPFJdQCmWtiK21rzpkTXxAWO5ghXjA1g9sd+jKuiO:eGumm7RVTDPFnoWtIvS7xAWOkDi+jKuV
                                                                                                                                                                                    MD5:48EA159B8500B1CE77F6FA0C1360B6CE
                                                                                                                                                                                    SHA1:DE8A55CB14D90D81B3768F1FAB0B3A6029E505BB
                                                                                                                                                                                    SHA-256:305A5AC39F626908734BF1921B3D935DB79047284AF71FCA959F4296CFC34530
                                                                                                                                                                                    SHA-512:76CF62E0DE16897FCB8C00A2D57005E2A759B7A085CFEB5F87280F9029BC3643F28C7CAB22F7454661BBC140215093CD0A7479A29CA7C7CB8F0640A23E2CE8E4
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.$L.0g.$N6...6(H./..[.zI.........@#.q.P.......Bb.{&.d....s..&.V2....&....$.n.C.do..^..^54..p{pZz.J....b.8.B4....e.. A~J.n,x.Aq..$..8o.....va..em..]j.;V..Y,s.....E[.U(...W.t6... ....Vtl.....|.zh[^..9.0...*r_#.?KS...H..rB.".........v."q..|?Z.(r.;T:...-3C.%..E.~N.........O+.f.U......Nm.w-.x......i..(..J(.... ....?.b.W..ou.._..D(,..p}mA~.E....y.9.^2....c..1^c].}..$.a.:.M.j.._.-...r..|.BV...rZ.'....~.V*.&#..!N\.6.........bn.....Z.W......O...u..X-p..TMC...FZ..|.mS%.\H...T...".._1.`.....n.1..6.....U ...).M..s{..-..7]EqE.RX%0.{3..w...8+.._.......m^....N....?.P.Ck..A...#......S...Bz..hB$}m.I...)H#5.g..,..b..9.Q.d..T.$...a..~.FT...gG.:....q.J;.$?..)KH.>..........r....._.\....W...q..@,`..UCN.W]..o.j^".RZ...X...'..H~\!...u.9..F...G.,.j......]X.....S(.dL......l...\./ b.....xp(..y#..X../.V.h...b5....m....!......3..V2^K.,....di.<........k.Qe...k..dE.v....._...u6dc..7..fl/.$Q..2.N.s..:x.>.%.@.Ul?..g..._.p+..c>...o.Z...{@i.Z..|k...6.l..

                                                                                                                                                                                    C:\Users\user\Documents\HTAGVDFUIE\KZWFNRXYKI.pdf.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1272
                                                                                                                                                                                    Entropy (8bit):7.843199609908597
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:Vyz4BF9C4ZUGfWWymXDewO8Omw/5vo5oBTxuqsx3OvlK5bMuiO:YzkM7Gf8mT/O8ObhMoBFwx3GuV
                                                                                                                                                                                    MD5:98C4F4FC3736E5389ED57CC2B3706E75
                                                                                                                                                                                    SHA1:B635DB88DEC20626F86D710A43067BC9C2F3D63D
                                                                                                                                                                                    SHA-256:3813CE4FB4FBC6638EA97061C51E5EB383B9AE42F0428D79985B0259992918F4
                                                                                                                                                                                    SHA-512:9DFAA2B1E439BDA35D5E1DC7BBC24E542191E01E31184A6C6399F48765F8CFB3C94589B772334758CA1EAC4B9186E22F774A1507D4756049CC3032958EA0CA04
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:..g..x.x......ws..&...L..}..^........$f..W........a....;;5o.r..t.._.....w..]m.Q...6.V|i...\.~$...a..6.Hh.Y.#...8."..C.z.$9@|&xf.`v......G.*...1 #...~7.e.......cV.L ..............8H4.....mF._}g3..s.V.-...$0M.>..sZ.fb....N.<..HH..*..>*pD..b.P.....n..w......|f.."...]...b..K........5u..]........i....*;;a.{..w..F.....u..Nn.Z...7.A.n...^.|8...k..!.Yz.J.?...5.0..H.....zTaEG..80OfiU..;...}$...d.sb..3.8_.q)..S...4.Vh...H*/~]..Nrx'..x,..2J.....F.F.. O......1.k..J..K%.Yn.o...e..i....K.......s..gE..n0.`\F..5..\../....V.T.KJ..0.x...(..t\$.u./...tP.fxL....=..m...G...D.X.8#..............G....F.x.Il.%C&K..sc.=}....HkFY.=.Kh|_..;...b/...q.go....3. K.w1..]...'.S}...B+:dB...Prm;).u-..0@...}.O.P..&_........n..L..[&.Ja.p...}..}....[.....We....j.=.....(..$%.g..X.(l.,..:.....Cm.n.f...yL.G..C....Y........O4...{....F.n...=C'.!...~....aC.J...Y..<7.b.......#&U&..M./....q.;O.\..28.....`...w.Qw.]....c.....E.|};...(....S.....RSg........A..a...<./q..j.#.

                                                                                                                                                                                    C:\Users\user\Documents\HTAGVDFUIE\NIKHQAIQAU.jpg.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1269
                                                                                                                                                                                    Entropy (8bit):7.866496055902505
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:ptaMJTs2Njzo+8lgpbSiIsmzAhbjHs5DZidB1TWCrdVUAZXpvt7HlCmMuiO:pMuTs2Nj8rcwpybjJdBzBuEXpF7F9MuV
                                                                                                                                                                                    MD5:7ABF119FDC604242C2D758088EA4E9FB
                                                                                                                                                                                    SHA1:C2BDF3D2F5710714B756FA98CA875EB52F7610AE
                                                                                                                                                                                    SHA-256:210029D6D7165D6C94FD550900915723E812E9BCA4736AAF0A287626ACD013C7
                                                                                                                                                                                    SHA-512:745EF0C9DEA09931C4188E325FEE562FBCF55C2A68135FDD2F0E61BC8C8853A537564DD2EE591A5AE0D281A32DB677F7018A8A6E92F67FB6BCF2175777D8AEA2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:#|.....q.T..!....8.p.'....zO~a..,.9...g..a.].L."...m.R?g.NuE.....}...r....]...#.5....>C.QNiK.c.cR..|yF{.M{...W..-u.....kb=<.>.q..u|[..T.OSG..../UZa....pS8M........b...&....e...._.s.&S.RZ..j..f.~.{>.<.P..|..m.~..?..'....R8...m....G....4..hg.>C8b.....y.H..5..a.%.u.&...f@qk..+.6...l..d.V..N.2...q.P5d.DuP.....}...z....N...".;....;J.Q^uN.{.`X..cqE}.Rn...W..&l......uVDx.#|.........guN..k.%tI...)...v.......E..r..]....i3./:........l.....V..x.......$?..e".....j..Y~?O'..ZG.X..M..,0i..>S..wL.....U...9B.:.E......i..Y.?d.W.....}......{...J..K...&.6.s.o..%...ybn..*..2j........KL..^...!.\.J|[....LY..P ...a.........wZT`.#|.........~vK..s.0`B...5...o......Z..g..@....w'.>7........l..#..G..a.......6(..u3........[j"A6..[L.W..A..>,b..7]...Z....:...91.o....}..11...@....q./z(.5F..Q..4v..S......U.c.q.....I.S].....@F.....z..)I.p..R./Q......'......t..>F...{.Z...Z<gT......._In5.?A...}...o....'.".....3<.Ps.4.t4..F..G.....q/.~...2y...d>W.=.?.]af......e...:kYT.D

                                                                                                                                                                                    C:\Users\user\Documents\HTAGVDFUIE\NWTVCDUMOB.xlsx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1274
                                                                                                                                                                                    Entropy (8bit):7.819202117213581
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:C6xy9NNut3w7LLBLCAFPCmSBnNg+lAdMe5uiO:C59fuy7LLBLdRCzrur5uV
                                                                                                                                                                                    MD5:1F8D85117C9E1FE68F59B31A8251C687
                                                                                                                                                                                    SHA1:59F9EC2F39B91ECA1E52AF8AAE57DE660753F7C4
                                                                                                                                                                                    SHA-256:379476D5BC48234170302D07BF61A425C13FB174BF014908DCBAE8CFF2A32AC7
                                                                                                                                                                                    SHA-512:008421B8B7963E3BF3F70A834BEA76BD6AB472B26C6DDDB8587B84718633956A7730E359724C412C1FCF8C80A65DA47FB97519E841C2938AD57709E23D2DDEDD
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:..E...;.........4..$..*......~..j.z..#(,s.3.........r4..../...<.."...f-.X.L......D..ox..}/<...u.l,U..f...d..|3r.%M.V..`9..f."..E.....]N..<...T..s..........8R4xt..>z.....U5...Vx.</<..R.W?..:..P9L@2..'................../....Q3..M.q._.]9f|..K...0.........;.%../......t..o.h..=,6}.?..........o-....8...'..7...b4.H.O.....B..bc..p?1...f.`,_.n...h..q(x.'O.E....DKa.....M"..0N)n\Kp.....9Y..^L..>..7..(.....M..h*..G.i.%.e.vT.b8...9...)...{c ..P.uY....... .Q..[K.(;.m...C..%...hN....J@o.......n-Ra.....>.....?. .uh..h`..#}X.Ef....r...w..X..E.H.]..U>..).0...#Z.S....-.6.GK..!.z.....}P..........-..0.J....._......\Uh.....E&..,[7wGLp....?O..RJ.....7..(.....\...i"..^.v.7.c.kT.m&... ...(...nd*..W.|_........&.H..UJ.*>.~...D.. ..ieD......0..7...c;&.,...{./7./...iU.6,k.bD..t...o1[.r2.]%p.)....]k....._....d.V>....9....!PW&&2.p...A..o..KD....L&'.$..F..9. L.P[.b$s@=.....L(.......ZNs.Q..J.....H...4....1M.@;..i"..q......T.v_.W.'...j.5.K........5?g/g.i..av

                                                                                                                                                                                    C:\Users\user\Documents\HTAGVDFUIE\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Documents\HTAGVDFUIE\ZTGJILHXQB.mp3.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1273
                                                                                                                                                                                    Entropy (8bit):7.85789024907081
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:SmSDkk+0NqSLtwOMb7pyTBI3eIBCbk8kua6jmHUuiO:S5DkkZqSLtwTaI3pCbHi64UuV
                                                                                                                                                                                    MD5:9CEA099C5849B6B1C8493311A5AB5C89
                                                                                                                                                                                    SHA1:F8D3FC5474EF3757D831E1E753DF54B728104BAD
                                                                                                                                                                                    SHA-256:66E68A9A089B53C5A89283AEEA910F70041D475E2F7E88DE8048491B640C6B48
                                                                                                                                                                                    SHA-512:102760566F8EE2FA9BD8E4312208C0DA76E5680C0050FEE26CC0BF948BAA21FD173184AD7359E56001C8932926038ED24DB3ABDB803F9B06292D5877073FAAB5
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:[a.M.G....'\S#$.eW...A....[N../v.K...W.....Y.P..7....,1...e.x^.S..FGT.p...qX.....,....(B..:.!o.Z..V..Z..w.a0.%Dg4..8..z.lI...l..6.a.X.Q.7wR.<.AkQ.~qQ.DS.kRQ..cG.l..)H.m...D%......K..gt^N...G..;../.r..4.:. ....}'.hm..P..}b..[.2.p.B; ....F....5....Rl.A.J....,PQ<%.kO...Z....U\..$y.M...X....I.K..4....2%.".u.g^.@..P\N.....hN.....*..../Z..".#h._..Q..S..b.~2.2Bt+..3.r.kY..2.uv...O..jm"...n....o.D.....VX..'f..f.<....0..[.H.....k./'.5....].1v...'l<{d...........9=.m.X...K.....Q%.*%/.....\.T....03...Q.`..z ;].f.L....G .\K..BM..m*e...4.8.K.....g..{d......@....b...1.$l...l9xjy....O...!.....u...EdL...6;5..MS.|..q=..8+..v...J..qh(...w...x.A....UY..6dg.x.)....&..H.^....e.94.>....E.#`...)l9vc...........-2.p.B...J.....A/.<;......O.D....$.....O...X.O..F..{......z......d.........fQ...........aK......Kp....Kx.R|F.h..e.2.....;y.........qMr.}t..{-..B.........Rg..M.J...G#.>(...g.#..3.Z...~..AO..0Q._^.E&.#iA.'N5...z..u.E..s9..1c..6".".E..Z+T.%K....h._aK4l.Y.

                                                                                                                                                                                    C:\Users\user\Documents\IPKGELNTQY\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Documents\JSDNGYCOWY.png.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1272
                                                                                                                                                                                    Entropy (8bit):7.8456881216093715
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:tJ9LAt67QUYxM5lMLRBgTrze9g6xOOesOMuua2WVbKbSuiO:tJhAt679eMXIRBgTvYg7psO/D2WVemuV
                                                                                                                                                                                    MD5:B165776516263C45A02986A25C38205B
                                                                                                                                                                                    SHA1:184844183ED10D12CB12DE88617E8F4AE3FFC55C
                                                                                                                                                                                    SHA-256:BB94BD64A3A1184824981C2EDDD6FD6C1F797AD5876ED86382044A03F0C0FE35
                                                                                                                                                                                    SHA-512:75D3ECE3C5C2D99B10D0D9BE19ED30D62D750988AAAF4DEAC5B9E15B77F7C5D69864D69E972DCEC9C4D1B45372BB54CC545A8854B3A1D8A0CC34D0A1902C8A4D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.5.yj./..a.B.g....v.bt.s..."x.|x.q.}.L)CXY.......J;S>m-t.[...e.[...de...\f....i..T.Kq....o.+U>..b......T.JVnS....bW.YJZX._B|c)8k....9d......6..H.....fbm~.`'...S.....]2..5....%#....L%^.B...!.....=V5s..........Jd.%S;..B!y(..j.ij........mp..>.uk.%..n.H.z....{.fo.v...'`.{y.r.{.O&RBC.....W7I!.3n.@...a.X.....`p...Is....z..I.Ay....a."]#..k......U.HRcS....qH.I@[..PI.......L...^........b.Y.....y....DhF..4KD.Q._.F...)Q4.Bn......Ap.M..D.4...-}..T.v....C..!+.rb...h..F...."(.A...........o.xx.{;.ik.Y...~q....!a&,.ek././..=..r....(I.\.f.fy..'9V.Q..).3}......x...g.B..$..N........W.S.9i..9.@lxAh.P.e.r...&......i..CE.......@...Ao.......l.N...=}e....J~S..%VR.H.Q.Q....#E .]k..n...El.L..T.0...+a..Q.w.....H..9#.y|...m.._....%8.\...........4..fTU=.@..u.A..m!/76.h..Y2JhjSk.i5..z...,A.G..m~..^3......f.t....m..=...7,.3...UZ.g".k...gJfo.I.I..yG...).@z.]..S*...kQR.....*..:.f*%.n...j.....m...A..>.-.#ed.2}qH.|.....oA..45W}.b.F ..{.'@vI(J...\.......+G.9..C...4sapP

                                                                                                                                                                                    C:\Users\user\Documents\KATAXZVCPS.docx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1274
                                                                                                                                                                                    Entropy (8bit):7.824692342990708
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:bCThZrIY8FhmLUMKKTugpsXBJZXBq9R6/uJfFunjEmuiO:bCN6Yk/MXslXc9RIuJknomuV
                                                                                                                                                                                    MD5:5ECD85C1B38B3C39068A4D57F13057F1
                                                                                                                                                                                    SHA1:9643286EA77EEA5614B9562D8B1C22A607401349
                                                                                                                                                                                    SHA-256:F25C4758C76E59F85987A7DA1F2890A3489405ECC483AC94894AF7F03F316579
                                                                                                                                                                                    SHA-512:1AFDD4598CB3CEB3CDD3787F6B7F8B9C074A4F17643B0B100F847BBA37B978989BE9ED561F528A47EB8960A4AFC089EB19313628EE878221B9093917D8F1BA19
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:..}.:.H..k0P<...R^.8.V.V2...X...^..Uj.$..j.+.%..g.H...Et<sfS.YFa.....|T.klU.j.fpP...2."......W.#tH...L}..7..2....~.O!........G..R8.l....LY...J>........L.....P..a.a/.(.>..N.k.F.P.-R...).,.@.bv..(-S}.Iw`....[..........d..yL.|...[...1...wz.U....$.w..{.6..^..k#U&...PN.=.Q.K6...O...C..Ht.+..c.%."`.u.R...Kq6~kO.SCc.....`[.vg@.d.gb]...".=.....o@.!u^...@s..)..2....y.Q;'....kE.....Vw..;.-4".......>3.A..9...........:~.".......Z..V^q/..."2...x'B.......i..;.X.......=-.T....#"L.......S.u.9.... \.L\..E.....F.NT..W..R..=..z..#Y...&....SGk$...vf.Ts.L.c..2._..6L.:.d:*.......c3...2jz.[l.;!z.......:.....c=D..S.g.....a.uW.....Lo..3.#;"........?.Tj.:............=d.9.......K..OLj$...<"...j6P.......c..'.\.......(6.V....$ D.......@.t.$....=J%./.....|..G....*...YY.....II.AS....Z.......Xt.fv$....C.R...."c....'!..F.P..&...l.R.)...k..!'%.f=.....w...S.9i[..........0.....zj....4t....*x...5....:.p"e.e....'5p+....?D....k>....a.k.......l.+.QEmmd.!li....:..x..Kq.;...

                                                                                                                                                                                    C:\Users\user\Documents\KATAXZVCPS.xlsx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1272
                                                                                                                                                                                    Entropy (8bit):7.843341677495363
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:R0cFGZnV+GKEltAT9QtuotPCI31HGlMSa7QOQqf39HbS0GEYGIQjpX4VLP6xuiO:7FGZnFlPQGml/a7v+0xuQ9opPauV
                                                                                                                                                                                    MD5:BD505793308F457B621A61A6447EB5DA
                                                                                                                                                                                    SHA1:9C3D5EF1F0EC5D62AE3A3C496C38D922BADC9920
                                                                                                                                                                                    SHA-256:EEB8A7594838DB2406D2573FD1F0AAB7F1A275CBF9472CE1508479690186DDA6
                                                                                                                                                                                    SHA-512:18374EFB85585298E047E173BC044978DE268CAF48F5F402DD005B5C8DD7E62D88ECB9F426523EA43383A043A5DD3E487C326EF9B9D2559D802A199BB97D47AD
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:~.1........Q`.Tx.[j..X=.b..!...Gi.jP...J.. .f,...VC&|HI..!0p..[L...6.c....V....@...H[..|......n.7....O...x.'yU.c......x..5..N..N..rg..eFM..&.........uB........0..IZXo......*..{eOx..V..!..e..S.{.0.%..ot./P.....@.."..:H.k.n.q...!d]D...YC1.O....c.7........Tz.@y.Ks.._6.f..2..Nt.wM...@..3.h<...D[<aZI..+=}..QI.../.n...]....R...VK..u......d.6....C...f.3yE......r...%.I.uV[...,....#!.F.ff.%D.9......Eh....2..~.[i........d}."..p.....yj.5.H.......E.....v...c`~A..J.'..M0.........l.II{..s.!.....>......*..W.h.b...be.te...42.\....cQ9..D....._.gU....zv...lno.kd.j..".R.&h.k.sa.c...n.......c...E..I....O.r.....zL.gFH...6....+/.F..`~..T.0......Em....6..y.Xr....."..ue.>.mk.....ix.0..Z.......Z.....|..b}ykY..Q.%..L#..........m.TJg..n.vah..!...E..E..H.!.F.F..Z....}.+.Q.6..'..,D.K.....gO^.T...p!y.`#...[..8.j..e./.{H..../...|..[...z,.......U"._....k.......l..r...]..$....:J=z.C.9.~a..3R...........rtL.u.D-6.R..E..DOS.*.g..W.........-.`\......x#..[..?..V.QoD

                                                                                                                                                                                    C:\Users\user\Documents\KATAXZVCPS\DVWHKMNFNN.xlsx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1271
                                                                                                                                                                                    Entropy (8bit):7.852333391775396
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:DybBtWDFnP7oLQ75yQ7Q0FHMdG3A9pQy+NhdUezQIIH9LfvzS9xuiO:sBtGPOQdl7zHIG3A9pYNhXzQIybvzux+
                                                                                                                                                                                    MD5:7E9FD2C0C1BBFE86CBDE70C09E583BC5
                                                                                                                                                                                    SHA1:C3B152D602CEA915E3212F06D3EF83444835A71F
                                                                                                                                                                                    SHA-256:DE2EBD765E029ED5F2D6150A827D25C759E03830CDEE11B66558CA49DDCC236F
                                                                                                                                                                                    SHA-512:D537C751ADAACB10EBCAB2CC57E55E0ACBE5E439A975319FF7AB530E367CCA0F36E96F92C01DA5CEAC3AF52D0DC3056D848C82FC41FF0D2D2D4F351A57167D66
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.P;..h..U.:sd".x].L........:V..w.*...A.P@.K6...q%....p..~0b.....u.V......7..X.%\....Z.q....Y.......G......._.Te.....E.#.Q.Dom.\;.m(..D..g.qv.t...vFu....G.yX2;~[............jf3Y...yj~...s..5..5<@De....X....?#4..;...:"Sv.6nK.........R..1.,@..Z.D4..i..].&e.'.oW.K........1U..}s:...T.SK.@!...x,.....z..r r.....x.F......8..Q.,[....D.}...X.......].......U.Ul.....Y. .V.Rw.P.....E.[.v.e..yL.N.Z......n.}.l.I..........W..1...S....kc|)Rv.c.........0-.5sO.....~..6..l.C..-...DX.n.&....T.I...{.J.9p........%..`..2...X...H....=.`}....0...tz...$.&.K@..v.4;.ph....kY.w...9.s.-.#m...Hdr`D{....G5nc.......9..v7P...K1j..)E.^w.Z.....O.S.}.h..bJ.G.I......{.z.l.B.........[..9..N....rur<_w.z.........!-.-jK.....o...7-....W..9...EZ.f.%....D.N..o.Q.>q9..g..D...v........-]..I..S....3....i.~.!.T..U1EJ......n...%&..;.?WV.t.._..i_.iqs.5..?.0.'....u........:./.....5.."0...f..6Z.,........L.Z.d...J..{:...6.....\.._.y..@E...,J.....h.....j.........c..M...L-...B.@...)3......D.m.

                                                                                                                                                                                    C:\Users\user\Documents\KATAXZVCPS\JSDNGYCOWY.png.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1272
                                                                                                                                                                                    Entropy (8bit):7.8489733245379565
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:BTlAmXg7AfQoT5LNFIODymxcarIPQ5wBXAE4jbIGCVbviTGuiO:BTCmBfpTnFrDxcarX5wBbGCVfuV
                                                                                                                                                                                    MD5:64D892B17D01200ABA56CA948D0E7AD9
                                                                                                                                                                                    SHA1:0817B8B1244D51DFB545F26F883DABE87815FFBF
                                                                                                                                                                                    SHA-256:023263E13C6E730EE2D8D6BC2B5A145F25DF0A118070D1C8898B92F84F63408E
                                                                                                                                                                                    SHA-512:B2602690B3C2BA40B2F8EF5E16F1D4398B72C8F508A44ACA6A6E30AD29B5C9809F517FAC6E305E589024DC31EDDA69959074445F6A6AE96FB61A0F7D95C16DDC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.\..J.ZYx...`<..W.v.@.M......z..w.z.fjh.m..j....[K.d....'>3..F&.8.....<.T.:......?...'1..~|.~P..4I...a![.L..P....?.L.\...7..3g.e..O....-k...q.v......i..3V.........F......S..k{m..w.!w....1... ...c.Y.eu.A+\.K.8i.....(...k...R.G0..J.-.P.:..q;.03.BG..W..K.PFg..j;..F.i.D.F......b..v.y.`yk.|..y....EW.h....=5(..Y(.9.....-.P.$......$.....,..vr.oXq.(@...a(X.W..V....?.G.U...'..+}....`.N....c[...z.G@.F@,.[....U.7.=.(LH..]..K-.'....)...[.......$V..g....<.A....\...;u..|....n.U..t+..$../..h..E.\g6sp.](S.J..H..6..t'..s]....,m..k.|...c..y~gyL..dR.dc...~dR....d.Y.F.....,.....!..9;.XZ5.3)P.[.p... 9...{.=A.......V.l.....+.hR2..0t....b.N....fZ...d.MN.E^".L....F.7.+.%YY..Q..Z#.0....#....^.......8\..r....+.G....K...!i..{.....p.J.2e2..#>.2..`..W.Dx3ws .......E5..&...<"......E........9.k~..V.~y..yi:...].~+n.,6..M......'...)Q3n.3'.p>m..).J..4.. p.R.]Wf.....P..~.a7.n..V.C..(.O,.r. ...t..3g.<.L|.....H......c...j..-.X.E.'4.I.[..#.*.c.......-.{..E~..g....UJ=.q..`i...-...

                                                                                                                                                                                    C:\Users\user\Documents\KATAXZVCPS\KATAXZVCPS.docx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1274
                                                                                                                                                                                    Entropy (8bit):7.848044313062745
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:07XMt6j8wtMrfbRMXEP7grZzXrus4dcYhnnmSN0w0YgiapjWByHzuiO:07X86TtMTVMXEDg5XrFYh/NiYOcAuV
                                                                                                                                                                                    MD5:CC28683D28F44728D95AF648DCAF51D2
                                                                                                                                                                                    SHA1:2928A6ED658A1A6D9C8584B8E239C5582E92C520
                                                                                                                                                                                    SHA-256:1AC75B5CBCDC6CEAB214CA4DE9C8AC31DC772287DCA8876B0E0CE877FCD58DFE
                                                                                                                                                                                    SHA-512:6010F539AF0D63527316A812347C8EBD5A31AAB18AD3A3AB068E74D75A2512C7C4788736CC6A4345E93271DE8E09530125B3485A3A62EF49DB32809DD7A460EC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.qz..Nu....=Ve..........V;..d.*.s..m..v...<.D.;..}.Z.K..v<Rsi.{8}..."...!.u. ....Y...j.....j....l..).H.u....Q.Wc...*u......l..2...=x.Bv.....L..;..M....>LT#.....Ej.H\].[[...F..."z../.e/......z.e..n1..AZ..u+Y.7.hD..? ..:.UKB..(..A.2......%..u|..Ur....8Lc..........R6..s.2.n..p..y...>.T....g.H.E..{1Nuc.o!l..3...=.l.2....I...e.......ki...y..0.].u....V.Iy...!|...*X.<%..&B.}.M@.?s......xZ..f.9.....b..r....\.i..9p.w].}..]65.$.'V...I............m_E..S..oj..B....L\..iRnCz.z.;.,.....y...3....h...S7..F.`........AI.u.;cK>.I...e.v...Ea.e.Z.I.2.......R91p..\..&.L.%.i<k... :..a+.n..3a.......G.l....;.q.h.H.OA@...4J./%..<Z.c.EH.?k......hV..s.:......j..d....G.r..'|.fE.a..F=4.".7D...X............qUA..M..wy..S...._[..qFf]t.i.:.1.....d.,dQ....s..V?......^..B.!`Z..U-2.....6.e.o|..L....:.N3.......9.$m.\=w7...l....![.^.&.c.`...R...k[..o....D."...of..xbM..#z...I.qQ..I.#...Q..V..<..\...\.A.......Cbf.p...&.g.k...F..7.su'\.f6.z.'....=.!...b...Ak...cX.g...

                                                                                                                                                                                    C:\Users\user\Documents\KATAXZVCPS\NIKHQAIQAU.mp3.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1269
                                                                                                                                                                                    Entropy (8bit):7.853804619868082
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:sa75TO1R3OM+aY2oOAARkxrd/VYBwV0wU1Wygr+r8yD5RjWLTuiO:saFC1K2oOAqkxRVCwLUE5r+4yD5R4TuV
                                                                                                                                                                                    MD5:E85BF3C7F1ECCDA1EFFAC405A6B8210B
                                                                                                                                                                                    SHA1:C5D857C2B923CCD78601995FD66E2F64F5DEB06E
                                                                                                                                                                                    SHA-256:123D96F8285B23FCDA6837C0796403C1B0941BD5B962FAC27F282B58468D3A7A
                                                                                                                                                                                    SHA-512:0BBDD12282EB0EF9B176920B2600AC480692EF904928639B949065942BB0B5D9E35EC46821152A31502754BAA8101D0FEF6DF724EC707B972066B2E400FE0CE9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.(3..y......0....ck7....X2..e8 EE.+.....2:..nlP.H...;..D..K...C..#..7....dq.`0~..E.....ef66...I.!..V....U.+.&.r.HWoG8.u.B{...LZ....,?v.m'nU.}|...+.i.......Wu{...Rk...a.?+..}.vP t..;.M.O.......;"h...E.....7......_.O.x'..4..7J.G..}K..z....z.'e..6(..l......4....}a*....[?..y7/OW.,......1..bgT.J...?.C..H...V..-..1....rq.x#q..D.....le6&...Q."..G....S.4.;...YLtL!.`.&/x.yS.....Xy.|...W..C...w.`..-IDRD.5s..+.......~}....I.|.bGH?..y.7a.).Spl.N.=M7....HlRr.F...bx.#.B1.TS.epj|.....a.?.]....-..~...X.8.Q...;.+0...*.+".3.....l....T".a[......>.......i0.W...;.A...$....5...-.r>....<..(.'..\..s...z..:.s..L.....l...1'|.uC.....Hn.k...N..N....c.i..1CT]]. |../.......`e....X.u.rAM$..f.<a.%.Jq}.\.'B1.|..Z{Xc.W...cm.%.@%.E\.d{hs.....s.4.O.....nF......)`...l.....f..;..%.V..^1._`D...;=.>..,.S.>.h..i.I..d.[.T..].g..8X....W...%d.gx......d.....[..;.S*...x..).3...D`.=9#......b..y..T-7E.![.}..tX..@a2.r*..G..o.....e5.k._....XP.C...1h...Wi.......r..*.4.;-Zim[.

                                                                                                                                                                                    C:\Users\user\Documents\KATAXZVCPS\NWTVCDUMOB.pdf.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1273
                                                                                                                                                                                    Entropy (8bit):7.84305994065353
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:OKFMW2YcPsnLdJ+VaCePnF0LkZMYBxRbseCtUaZrtrPgsakpvtq3dgSMuiO:VM+suRnC+FIqMI3s9frV/akpvt+dgSM+
                                                                                                                                                                                    MD5:D1DE6A5ECC2C6B623A0D6BC8D49840F9
                                                                                                                                                                                    SHA1:F8BCCADFC9C03B99C8C75173397C2E36AC67A05D
                                                                                                                                                                                    SHA-256:C36E42BAF9BA74D2F5290CEEE356E2D4B7B61FA8C3874F5C51B3491231E32EC5
                                                                                                                                                                                    SHA-512:9272A84C5A6CCDCB34DB6434DAC5F2375522B9B9EAAAFE85F3C533DA041B739E8131C66515A922BDD7112701F9BD3A8AA33417BEC742AA93E01920DCB366418B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:..d...i.+'..3sR-.....;|...I Js..E..-....o..Om.v.......9.>.1.<1......S...J.OJ.fn.:...VUjp,..DA...$......,..JjN...h.I.oCN.".\.0....5.R...Mb..Q. ^...6...;o<..n..D'I......&..q~...\...o^...v.B.......}u.....s..l...d.......Y..0r...d.;..`...W.@!.../.8#...g...l. 2..&iC?.....:|...M He..L.."....q..Aq.|.......?.#.$.$9......B...F.AN.d~.....PWt{*..._V...;......1..EkB.....C.mA\...f`*..A.C,_....%.g...G.k-.......W=l........5.l...L...S.#........2.....e\..F.3.{.z.2M.i......4tR4.#A.04W.......8l..A4_..*...:...*....$.0V..h.w./!..V:.(.....G.......K...........5....v..'...V&.v.Q]M1..P...X.!.).nA.`3k...e|....7-..4.tF.{J........ne2....O.A2W....0.~...T.j9........G1a........=.}...M...J..)........'......aK..A.%.|.s.0Q.y......:mO1."F.5+D.......,~..K$]...|......g&"..]U.&:...."D_...3..W....@5@$..e..x.'...u..C....P.o&p[.....'.".shL...JoD0..AO.a.O.nm..........q...U(...9.{....._B........l.xv/..qj..........K....HN$#R..\.....4.1.%8..F..V.......>..R..wBJ..`"..'.z..a....).G.x.(4E

                                                                                                                                                                                    C:\Users\user\Documents\KATAXZVCPS\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Documents\KATAXZVCPS\YPSIACHYXW.jpg.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1272
                                                                                                                                                                                    Entropy (8bit):7.821327451015452
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:RXjN0HQe3e0J8Bq9uCiSTiUaLzMN6J368gSbU4+/I7qkhIu6kuiO:tyHh3e48UF1G68gT4L77FuV
                                                                                                                                                                                    MD5:52B4007693EA90449DE1DBC753710E23
                                                                                                                                                                                    SHA1:6FB33C1E33E54E915356E7D17971D92574470E76
                                                                                                                                                                                    SHA-256:73B6E6989F48226C14EB577CE5AD2F1A70CE10DC228765C28DFD0CF4A18916B6
                                                                                                                                                                                    SHA-512:7006EFB142A90E26F741328F526AA61AE22C07C96B8FF0633B76E145EBB87DE6F4B0B9643E0457BF094AC394D06EDDBD42E259C9DC41F41D896D1A31EF6DA485
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:mMaD..TD..j.\...uQ)g{v/.9...Zo.l0.d..X.c.c.DOP.`J..}..La..p*.T..-.9...M."v..O........K............hH.... .S.v..*O.~.......QE!...MQ.".+}...;..<.....a]..;=..wO..c...&........aE..z3..O.RTg.G."..(l....U.B.K,.bpX$.@NE)...tMG...m~.$C...d.|.7l.i..f9)..aUxL..XX..y.R...~S/ylv".&...Vh.v0.e..C.z.r.HKM.eQ..e..Bf..f#.M../.1...G.#h..K........E.......a...lX.... .M.|.."T.~.......O^+..E....1.Y6.l.[.F..:l.)LD,...:%.Zy.V.=^.um.OA..,..<....'z......(=.c.&..&.[..{..i) .19.f.(.......|.-...r..9."&....A.RT...NA..p ...f.K@..y.z%..a..Ci..?U&.....X.p.?...:./..OK+..DJ%..2.s6+.F.....M..\...y.y.Q.<.kH......o....:.E....ZT*2.....y(.1.b.K.....#.P6.j.R.T.}?m.)LL"...:4.J..O."N=.q.OQ.. ...*....6t......%,.`.,..,.I..h..f)1./2.e.1.......y.+...k..3.'+.....A.T_....<..#.k........_4..e...Q"S'.G.RALFz....h4.pj.%5z....e....W...&...b.A..6........52|.r.f.'...9......1.h..M.....a.....a.....V..K*%._.(0m..[Y.BQ....n.i.~:CO..............q.!.-...A'W~S.:...4.pN.@..S.....p....}.I.v..b.u..ym{......o..

                                                                                                                                                                                    C:\Users\user\Documents\KZWFNRXYKI.pdf.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1272
                                                                                                                                                                                    Entropy (8bit):7.845502557984598
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:c5SOcROlnBn9I4Sd9kQNzTYB92FQF7kdXtFgqsvl3rMuKguiO:+sIHS4SXke2iQVk58qirMuKguV
                                                                                                                                                                                    MD5:70C86C23B13C3A644877080BD5E5D78B
                                                                                                                                                                                    SHA1:A0A04D0090377787681776366D671C2A757A44D3
                                                                                                                                                                                    SHA-256:D81DC68B893F4ABA4DE5177C44A5E9DD06937AA91D58F535AFB55A46562E45AE
                                                                                                                                                                                    SHA-512:320AB8463B4A23629DFE3E4FDB65381BD22DD703403BAE2D6AED233E95F85B2791B33D1FEA7D3DFEBA7DFDC2576301AA306A1AC365CB96C2E8F51953FC695C7F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.[.c>?..*T1.$q......c.....&..Sq............Q.g..Q..`.k.K.C.....I...L=....2;0f&.r...|..V.{.Yru..3..'.4.t..o.@}..5.n..Y..U0fg5.......T.....N..A...[..b}.;.>..w........i .[K......K..E.m{.U.....H.0X.x.k.j.^..6..=...S.O1o.xW@.F*b;-...5.6...bu.C.e(3..1S$.,|......t......./..Ap.............Y.s..@..|.f.W...M.....T...@#....:1;d8.s...{..D.~.Ewf..&..0.%.u..s.Mi..'.w..\.5i&...e/..1'..*.m...j.t.A....B.sh.<.{.E.....L;.,Hk.u..-g}^..TZ&...a....?..Y[.....DZ.k5.....:..'iP'....8.5....Z.......2... .........W.l/yz/*^p..b..h..{..~?wTJn........V..p...j^.'....'..W.Q..Ktj.L.Zv...s.J..a....w.c.H..-/..d?.60..B...;..,..=~7...f1..49..?.v...r...N....T.zv.2.o.H.....B*.,[w.`..#ew_..K^<...t....2..JK.....EL.m%.....4.."pX!....+.0....K.......".....CSF...\..P!....w.x....|.X..t...}..Ey...o.;(z.....2.....C3}.,..o?...!.5.Mb|.pi..c..n...q.A..&...._.)1]_cjd-......O...h........h...i;..p.aN.......;.....g....$t..[.....E..M..RQB..U..LR1...d.G.....\9c.e........>L...

                                                                                                                                                                                    C:\Users\user\Documents\LTKMYBSEYZ.png.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1272
                                                                                                                                                                                    Entropy (8bit):7.848968675780994
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:+ByFkTTpgfUcIQhFORmbEO5BCh8+uwX+HjTFiI1nCRQ4bTn0hmuiO:+Qkfacc3lXzw1X+HjpHQRQ4TuV
                                                                                                                                                                                    MD5:2A3F2E78198D08B4127A00C976A8EEB6
                                                                                                                                                                                    SHA1:DF8F5565C0CD2860F4F1364BF74E5D4858581B3A
                                                                                                                                                                                    SHA-256:48F9FD75E90D4C550D04D75DB0442F7C497DE48D0EDA7420DA15C804604063B5
                                                                                                                                                                                    SHA-512:80BC567086C6BAEDD597CBF206B2007C9A427E977B49A1C545D82533D63D02410AEADC800F1EF3B7A79AFF6C8E4C29283AF33F0A1D18B51451EAD2E985D208E2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:G`;.a...5AK..6......NA...E>o.........k..A.WyDC..E`S_.*.B.1.G..........oW.5.!..4|h.m.QC.K.{...rV....O&.:R".|.R..HT@Kn...Qz....`e.....9.....,/j.[...f.....`...0.....RQ\..+i}.U..9..<........T/O{..@....Y.^..#S.p....J...g,.........0...*<.G.w8E...W..?n^`9.|...'JJ..1......KV...P8l........h..I.QoPU..E.WA./.I.=.W..........vF.7.6..=gv.~.S@.W.v...lY...T-.?V5.n.@..KR^Up...Qc..)...B..O......R.nlLL.#.X............&+V.....A9{6+YL.Bd....u=.o.GIx)m...!.. ..Facv.kQ.";.....Y..2.G...D.............../.....3........y....-.JU]..4.N.!g..OE..r..m<.o....@q.c{.w.8..J.9...=....xn...{x...G....h'.....8.....(.....E..-?%.J.X.4..a.WHl?...Q.V......S.|v__.'.L.......j...;)R.....M3k'/IP.Uy.....&.d.SZz.e...!...3..^kdv..B.>0.....]..=.W...Z.................;.....T]..s.ArCJ...{aX..9..u...@...z0.31......S#..w@...?.m.......W.....'[gD...r*...G=r..n@.<k2a.d.L.=.z...g...FR.....W.....t.:2.l.}4...)...=...Eg.-4xk ..b...@.Y$M [...7.g.fa...cF.'M..Y/.Z.#.;+.0.-......s...A;.x........N.

                                                                                                                                                                                    C:\Users\user\Documents\LTKMYBSEYZ\BPMLNOBVSB.pdf.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1271
                                                                                                                                                                                    Entropy (8bit):7.867767874688771
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:jS/MSHwxo3Uk67s9KyLcP6LZM1aNa9jXtUPBe01pF76CYJkvUHYkrcuiO:j+MSHwxaUKjLP3NatXtUP0wpF76evyY+
                                                                                                                                                                                    MD5:7950CCFE1D78AB373AB08097E1261695
                                                                                                                                                                                    SHA1:5CA0DCAA56BD5CFC2FD5BE9983863C60848229D5
                                                                                                                                                                                    SHA-256:BA54859919D36C8A7EB491524D9B69220647870F2F1852D937CF0F8F5E6AEC8E
                                                                                                                                                                                    SHA-512:605C889C284E3168F9A8AE46A1297BEA2E7AECCF8F90B916E0225A39D6B7C15CA66B989E39398A6221FF16E193C1323D0828AE38A19644A6319F17D1CEA9AA5B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.....c...g......:u.3#.....G....w.'(d...;U.m...".6...).......,a.l......^#.....9|.5.%.......W...<k..j..........<.w.2..w.G..ZsB..=;..G.........T.{x.0.a.z.f.Z...3...3...8UTB.....M@{.x.j...V.F...w.E..F.D>..2?.W...c..:.!R.,..8..=.*.@.....\.vMl......h...x......%w.,$.....D....t.'7o...(Z.d.../.>u..+...&...#n.`......T/....=q.'.8.......Y...!r..|.........,..n.#..z.V..Hq.).F...'...xX.... ..p/V.'...q.c"..)...!.]..f.y/.\O..F...g:&..U...k.!:...$..Z'....=..~..4OX..e.j.D.z..N.!.s*.j..(../(Vm>.U\.v..+.v.f|W...Q#.u......{.e.B....z\...].Y+!.U.......b...R.....c.z.G!.Jc..'.{....5zIq.q..n9}.....P......N\...v%..y.LT.0.k...n.8.Q... ....D.... ..{>_.&...}.|:..2...(.V..k.{'.]O..@...x35..A...i.- ...(.tC8.......c3.?@J..e.y.X.p..R.*.s5.j..(..6$Ju%.NV.h\K.i..9.M.....b.....I<0hU.d.......k...$RL...a....t.t...Y......\..Y0.Xd^$.#\-.9s.......L......61...3..WC.0.(.'&...kC&..[.VO...O3X.h@X#g...7".. .@.AI..HK[.f.......a..6..h&....)...T.r.5uz..=U.$....k..{|s.........{.p~.U.....q

                                                                                                                                                                                    C:\Users\user\Documents\LTKMYBSEYZ\KZWFNRXYKI.xlsx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1273
                                                                                                                                                                                    Entropy (8bit):7.855200622389234
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:aQH+EAieoECOuhhV5biV+irg+k7Wt1TRyUiGzmlp5E4R0J3IXC5Jjloe68uiO:aQVeowM5uV+b7WtSGKn5E4RU3x3oejuV
                                                                                                                                                                                    MD5:313D57AA57D19282520514C1384A8253
                                                                                                                                                                                    SHA1:1EDE9F09BEF66F1CB72637C3B1C5CD25E27D9242
                                                                                                                                                                                    SHA-256:9875382F7AF4046F0E46B2106D229035C6A661327CB2A2ECDE869FB2F759A34D
                                                                                                                                                                                    SHA-512:697150FEFA365F0346AA98BE694EF4B2C373299140DA8C26D20308AB2957E079BC1310914490603695BD442DA70265E596D6FAA8E5010234CA22146D9F528900
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:..G#^:..p.Q.C.}#.......!...ja.jD..Bb h.#.g..5#.......K..t4.....Bl.NX....7.;..qJ.....8.Y.;....h..n...x..1..bs.:...&vS.{u...D.p`.x..0..%.A.Z...E.....X....4..s^'e.`o.../.......w]..l4....G....!,z.a.Jd`.....(......TC.#.?|]..s...8.u.p<).\.U..3...y..._4X,....V.P.p(.......0...ud..B..Mc8t.<.t...?+.......C..y).......Yo.SA....).*..rB.....,.Z.'....t..e...f.. ..q{.>...(d].pj...M.5.....NP.H..Sg...DE.;3........p@..]....l.I.......[f+~)+q......d.~%.G.i....J8.................im.y7..on..9_n%..S...[f"Ff...s'aN.......y.OD.|..c..%A36.)z.e.3..V..i.,]..k...]B.k..m.i4..Ep..,.m...o.j.X...|.r..a}uS....(f...z.....P'.?.camB.zI..\.).....PT.]..Vg...[N.4.........pN.H....b.X......._h)t(>k......c.s$.J.c....H,.................pe.z4..r}..&Qr9..M...Mv'K.Cu(..4.^.v...hR....o\/...[..x/.[.Z.2ol....B.f.|..C.R2X{=.z..O. .....:.X......~....s._..'>p....;.i.w|...;3y.........z...BZ'sU.0...W..|g.[...M4..G......6-.d....Y....<.qK.Q...Rq..H.s....Q.6......Z'..G.A... H..M..h.i....C

                                                                                                                                                                                    C:\Users\user\Documents\LTKMYBSEYZ\LTKMYBSEYZ.docx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1274
                                                                                                                                                                                    Entropy (8bit):7.841982865355415
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:MVibzC509qADS3BNvrmbEFBJGd3+4tP5wvZE2HX05iYIvrU4uiO:MUK50gAO3BprmbEFK3+4tPe3304YIQ4+
                                                                                                                                                                                    MD5:DEF5D2FC0C50531F4429822AB653D9D2
                                                                                                                                                                                    SHA1:B14A287E8E2AD38600DF262C69F9220D175D26D4
                                                                                                                                                                                    SHA-256:20B2638EEADF4B4830D8D35294D578723A7AD13F7D91597C6E4C86A133996982
                                                                                                                                                                                    SHA-512:EE4BA2245C2678D412858D571F125B6A3AFD72F38EFB6F49C23649E402FC04ED589101B12A7DD3641786B36A3E9415FA13CE3436B642588E071CA6A59A3DFCA1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:...r..:<`..y..c...l..#z3RR....cJ.r...G.3.{...... .=V..0%/z.................[.y/.s*?.J....@...Y....+P....=.);L..)A...$.a...(..j}*...rB...G.8_.l[....].....98.J.......}......0T.....}.or...Xz5.h...1....E........$.(..V.i...=T...2x.{p...R.DmG......l..0 r..w..}v..o..4w?PG.....F.h`..D.3.h...... .9H...;4#|...............V.p4.o9:.I.2..O...G....7K....2..)N../_....$.x...E..i..v..........c..$1<.0{.qA.4L}......i8..........s.l...oH.P.f..7...3u...x...2......@..e..D9./\8.6e~.NP..%.Jg._...v_65.N.Xj>s..]...B+..7.mY..,|.p'.Y..w;m..gf..p.....k^.6.....I.U..P.aR...g.2.....(...P5...Ce...%.8......m.7.F.F...U.<..ouR9...<...A..z..g.........p..4%+.4h.s@.*Ys......k%..........y.q...~C.K.m..$...9d...k...8.......T..b..@>. E(.7a`.WW..!.@d.T...}J"!...Q0.7...d.W..u"6ZL.n..CW_|...6~......sX#..A...0.../..{..UM ...Y...d..)..7l..q.1+..4....j.Z...0Y[E..h..u.2...F@*c..J..).?..*......Bj..0..X+....8.K......~.x.t..i..I..h.&..w.C.Fm.&._.,...@..j7.S.r.X....|.p*........%...P2z.+.?V...

                                                                                                                                                                                    C:\Users\user\Documents\LTKMYBSEYZ\NEBFQQYWPS.mp3.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1272
                                                                                                                                                                                    Entropy (8bit):7.843305868273347
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:JVdf5gALpVvag4Frz6VLX8EEGr3XPD1cqgl5L9z+NHAB72rBobBMVMuiO:zdRfjvagezuXFEGrPDKqgLNAoarBoSVJ
                                                                                                                                                                                    MD5:332127A7B617A20BFAA24183B12F8458
                                                                                                                                                                                    SHA1:6EE7B536027BF50E7DEC0CB809A3D0BD1C60544E
                                                                                                                                                                                    SHA-256:D2849B09A172FBE7CEDD2BB0A92DB220E7180CFEB87B2EE72BF9E8BCC13661C0
                                                                                                                                                                                    SHA-512:5D81F319BEE93F0025C9ABA2E24DC95585F433CDE45E96A52484B9C37E3969E50AFD904D917A1B2990A33485AEE2F9A12A0DC37759DCC1A549D422B27BA0C5C1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:6..zz5.....@..".Ao.;..........X....".......M%6\..y....4.?.6Nt....\...9H....9..X..~6W...1.'.$......Q...]......K..B..l:....c~.V .. ...V..?N$GD ..........z......e.(@A.B......z.L....._.(r..\...(...5........*...*}...w........Z.q..O..1..m]\...>6..~q6.....K..).Ps.?.........C....*.......K)=Y..k....$.>.;^h....G...%A....'..O..c1E...0.;.:......B...]......U.X..n#71X.........V.1X...5.`.g.FN..<}.`..<!..m..t.h..S.o...g...XD..w..S...t..=..W.W)G.n..t.../O..,...O..N.QM.9.[.j...@.P...Oc.{...4%b..(...Y...qT. .@.I..*.K.2..~........u...G. n.kFw.c{Qj..S+]j..).. b.....h..0...G.e./tX..6.+...&.g.:.{I..JC..n......%:F........._..Z...;.j.g.PO..:c.x...'...i..|.f..T.i...h...YX..q..G...i..=..\.U;Q.w..`...+L..!...\..U.^U.>..^.c...C.M...B..|#b....(.%4....k......t=Z.^.f.....E..9D..al._...[..<..(.u.Y>....O.>.0..[*+x~.....,}{...o....T........L.^g.......8..Xc.?.dj1w+.I.....n...^Y=.;.e~.J..H...Yw.G......eS.gC..VV.sfR.]s..Y....i..E^e.....w}.q.+.....~xD.2Y

                                                                                                                                                                                    C:\Users\user\Documents\LTKMYBSEYZ\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Documents\LTKMYBSEYZ\UOOJJOZIRH.png.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1269
                                                                                                                                                                                    Entropy (8bit):7.830197568173104
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:T2Hbu3E/qBsW7Qk3i+xvYxE92wifOBYS0uwHIZZAYN5ZhoNPeuiO:AFqBsWck1vtQ0wHu7NPKNPeuV
                                                                                                                                                                                    MD5:473845A6AA53F146050797759B9BECD7
                                                                                                                                                                                    SHA1:E6DC8E30DCE1025A6A831729F39C748C4E94658C
                                                                                                                                                                                    SHA-256:5A94A4F41DE54AB9D3CD6F66E53C5C481D79F6B2879B1889451721B1B0E329B8
                                                                                                                                                                                    SHA-512:77C9808C9F87C4448254B32626153470BE3ADC03B614DE9C2E0750CD287C0E41CE91B5DE07FBD00DD0252054C5FA34A849045D58749F22086819CFF3745BBB0B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.!.4....z.......:...."..Y...X..S-a......>.1..$.*-...$.C.....<.pl.z..j"x....&0.d..._...|.iV..R-....=....'*$...J....w.m..T...U@v_...o..:Rm........m[,.......W.U.D..m%.......s@_...Yb........ ^W6l .C:F....<..;.."....?-...#.8...?....`....u....D.Y.7?. .:....v.......=....&..B...X..@%e...... <!z.-.5....&._.......1.si.y..m+k....+8.h...L...k.zB..S7.... ...=2'...E...t.w....RrD......-F.........v...}.U..._.i.a1.5.bU|U.Z#....,.iSAL.zy...|..l_.V.]!.3<..X.P.r)_Q.....84.2..a0.u.=.'...........RR..S....F.t|..7g.$.u]o..<*_]...J6n.....%x.....&...g.$4..D....\....F.7..*.q.u...e.... %R.. u.<Q.#......X..rW...`n"A\....l..0.....HlD......)Y...........i...d.\...O.p..*.(..lUkA.A6....).iRVZ.f}...`.`J.^.D1.4:..K.X.l,HM.....!;.9..p".k.#.;.........DC......s....S#.........3..A..s..E.....}.3.^...?....q...1CQ......u.-)zu.%....^^x....5..Q*=.P..F.1.r...&h.....`M. ..b.H8..`E........I....+....:,.C.__..H@.:......H...,]<.BKT..bz.n..t...$..M/..c..q.r.....O...l.o.....SKz..1..

                                                                                                                                                                                    C:\Users\user\Documents\LTKMYBSEYZ\WKXEWIOTXI.jpg.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1270
                                                                                                                                                                                    Entropy (8bit):7.876534407308007
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:hB2cE+F8xVCi7TqFZuzQQste7GJg/oZyD4D71mcBVAgbN8U0coRgIuiO:hgRf/lfMw8Qqe7sFZ7wc3AASV/6IuV
                                                                                                                                                                                    MD5:797A47E09A3935350A454929DE034E6E
                                                                                                                                                                                    SHA1:D476773AD7E4F463783B90F40AD6922D4B1CCE70
                                                                                                                                                                                    SHA-256:72F75B342AF0313989EEF6B9233A33E946F836F7581504B0494A070C62C3ED78
                                                                                                                                                                                    SHA-512:FF6BC6DFE465E53CBA9350A841218567C40B5459C9ECB77960D23E404322A201650477083B5896446557769E43DBBC4F14D411DB6D15D815E75C8A07ECFDAF53
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:4._.....l>.).#^.Q....T.}"...d.XL).}A=.6.&.\.w..'H..E.?.....$.fqhN......{..8........\....P. .is.59...-4(.uy.yW..&..w%U!..#...^;..h..yf:.V.J...wVF...3.=?_ ..._.........zN....h....@.I.d.M.N..B...S...a~..YB(._.....k...dlb.?|U.Y.DgMf.+L....!..W..m.!.B.....o-.6.'\.Z....C.g%...f.IR7.mM$.".6._.h..1Z..H./.....,.rikJ......f..9........G....G.0.`d.<+...%;/.er.w\..1..d8@/....%.`%h...x......I.x..n.e..>...!....x.6...K..{<..3.hcpR..h.29@.:...../....IH....2..I...O#...T:.s..;MX...ur....1....y....VN..&)".l..\.S..{k.`.e.I...v....;Sf.........A{..f.u./$....Q..ac....9.."C.p...2........T3.cm+......9.7a....F..a*.w[Q.:<3..*.a,o...y..!...^.y..m.q../.../....w.....Q..f3..!.eayW..{.>7C.. .....9....E@....+..V...K:...W0..p..(PC...og..".#....q...J.|4...........}.w.>.d...-.e._~.'..........!..M.i/,..j.I.S.}......i...8J..n.v..".~.&ZS...S.<E..].k.0AFng8...36..a.b.>..F..}._.j .yS.Dj....w~.|..R..t[._..!.*....3.b....9.k...Rw...:h.~.BX..........dn).`.'s:..I...'.[..O..

                                                                                                                                                                                    C:\Users\user\Documents\NEBFQQYWPS.mp3.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1272
                                                                                                                                                                                    Entropy (8bit):7.836633124102967
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:7dxgwx0vWVUjCSPuQ70tyzDnE6BAQXUobfaH+1uiO:7dVVUmguQwtyzItQXUoL4WuV
                                                                                                                                                                                    MD5:983D71C11B757618B26455542E8F88FE
                                                                                                                                                                                    SHA1:04697FAAD63FAB3C388DAEE11D32A699DDA1F059
                                                                                                                                                                                    SHA-256:B7578840466CBC5EE876990681B15AE04EB917A1555CEAA18D652679E9E26530
                                                                                                                                                                                    SHA-512:EB39FD26356A22B5E6473BAAB7480A6648DE3BBB311265E754308884CD495A9847916ABD7970530C31CA0BC7E3A81C68B00436E8697395A5472B66F4686D61F6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:Wi..jL....@.`.~.X....(w...7{....!.5~b...#..B.....0..2)F..7,.....W.?Am....g....).E...:6....);...~p,.{;G.b_5C..MQ.j(h\.>i*.w....}....Yt....4.J#.......x:...?O......qQ.....h[.z.Y.<......./..$`..|.r4...NrWc&F.W..|do\.$..J(.........'o...Z...0,.v....m.Wb..aO...}F.k.c.S....*a...,r....6.;wt...(..A....."..03Z..65....X.7Zi....e.....+.F...=$2..-'...cd .~9Z.}J+C..YV.y8vO.$q7.n...x..mJ8.I...8^.4+o.......k.}a..a.........=.Of..N'r...|...P4v.W...N.:..{....e..|.K.p9P&...9._.(w..^.:p.(.0.K.MF..t...f..B............OPI.{..}..j'.rdR.v..k^D.h...S...c..x........sC.......,{.6M..{'..xi.N...f#.....w.t..Ef>."...v.....r.|..Y..!...).3...z..d^9.I...1U.6*........ki|~.y..........9.@n..M5u...q...Z-w.G...H.=..f....k..~<].i/M2...=.X.3z..M.=l.3.?g\.^Y..}...h.._.......G/..! ...~%. .N.x.T..U-..5.[...K.-..E.Q.MO...KY.K..1..X.H8~..d..cv=:........5.8%9....:.\XGX......D.........Tf$..7....p.Z....= ....Z;.<f....0...)....c.....G.A^....y8,K.......8.F.k;......|..s...wT\.~..k.G.Z.>....y..,..M

                                                                                                                                                                                    C:\Users\user\Documents\NIKHQAIQAU.jpg.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1269
                                                                                                                                                                                    Entropy (8bit):7.854291327111935
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:xVzWDMlhUSyAvWhl5X6E4TvTulm7Pqa6SsMXyREv5M3CQYYG9GxaRv4FQQ6vt7sQ:xVqDtA+hll6Pcm7CaJd5CC3FGahqQZFz
                                                                                                                                                                                    MD5:8917A45E54C7C22F64788378C9978D3F
                                                                                                                                                                                    SHA1:899E66C6F6DF7962C075B701C1A76D7EFD41A765
                                                                                                                                                                                    SHA-256:5C9A998C9D1610C498D96D9F2B4BD87FE8C184D3FB7747E2941CA3AE474D571C
                                                                                                                                                                                    SHA-512:E063CF759F80AE2A37A352EA2CF5CBAFC38CA631DFC7AA423CFC5B983DFE9A1EB84DBA3E9A556B6F12234D930B40FFD532615769C15DCFA1782EA305AE2B236E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.!-.4..O..L..*0.l..q1h.......-...9..u\o.O..H{..g....L9.f.b.;o.~N-:....[...n.7Ky^W0.e......=3u..dQx@.....&&n.[...!`..Y.3.B.. .b....R.....|XE&Ab.._....iq.qu.<z..TV..p{h.6"I...j...S.9....q....._>..L...E._P*.\.......<.d..I.h.T..d..q{..*..L~.Z_..._.?6.*..G..A..>?.u.l2m......."...?..z\b.M..\~..c...H-.a.h.;z.`X<4....E...z.$D{GV5.m......-/p..eRrM..... )q.F...!q..R.'.U..a8,...f=...R......U.`e..v..H.U$sO....X.#P.....8UM........=.......Ol\U4J..6L.q@y...w..oJ/.{H.^.. h2..n.#.p.;33.......Z..~.|.....a).'.......M .[.OXe.f...]>.Lo..@.6V.g.......*~.P.t.X..I9.a.9../...z....B".wngw...#.W..t.P=....O7k..&......,.....{..e: ...f!...N......P.g}..b..Y.I.c@.....Z.<F..... PM........&........Bu]D-X..9J.rJ~...f>.oB%.n]..\...y=..e.,.r.-6!.......^Gd.WI".S.^.....[..c.Z.-..Gbo.b.x.q.....>..W..d...>4..`P.OE.pt..j..J_.P..fN.u..s.;.(.vG....d.......X..>.........3.:Z.....o.?...........H.O.........I.<.S&....A.[...J.e......>vx..."....J.;..g....sl.x.?..{..I..O..vX$..

                                                                                                                                                                                    C:\Users\user\Documents\NIKHQAIQAU.mp3.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1269
                                                                                                                                                                                    Entropy (8bit):7.843402342657385
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:IeRxBPlOqWMDzHYU35B2zrxhkeI4D/YsF9tSYkA95p9JIyply7mAuiO:VnPdzHRgVCXFsFHSgXp9fry7DuV
                                                                                                                                                                                    MD5:7337BF16868685FCA431CB852462A672
                                                                                                                                                                                    SHA1:10EF3FFF3F56E281377CFCB44ED33007233148F7
                                                                                                                                                                                    SHA-256:233F9D0550C02CCE2968F4FFA01A4474C8BA68AEA2A0CECEAAD4AEE2134C03EE
                                                                                                                                                                                    SHA-512:3541DFA0A94817FF2223AEDD978928E89559F7021E2DE504EDB06BB880C87C3C4718E0B1ED84F3EB6CD744A965A218B4642A959E64A7787A58AFB3A60F27085B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:f7P......Rd.8.Fz*P..ADr..t.KT.V..z..htg{...s...R...J...k..M...Ta...p>.N.W._'.t...t.`.R..+.E..v....=.S..,.w..ze..-.0.[.d<..}.|..4,..;....d....7...NE..G.#..*&?.,N.q..x.._k...w.......Q...%.........]..a....yf@.a<..........,.MmC!n.Mc......m..a.v})K....Ni.<.Is3N..DWs..h.D^.P..u..rvlx...x{..O...^...a..M..0Bpq..v(.Y.W.G4.v...|.v.W..+.Y..n....,.L..*.h..g{.-.+.P.p)..B_..d.{.y...#.s..zI.zo...j.Ex..b....3+0.....}...|.=dG.6*w...H...].k..nS=^.M{]....G...|.z.}.....S9A.2...?.z..2I...?....z...py..9q.......(YV../.......s.......& .g...G...\l.k......5k.;.....o.o.-....,..+Eh..|.<.-.L....lL*c.B.-y...x[.C.....0..!m.6z.9n?A...J[..t.v.y...4.db.rP..b...~.Li..~....'>?.....k...i.#|B.(>i...Z.F.u..eS/R.TzL....H...v.h.w.....Y8T.4...".k..3B...=....f...~{.N..n<...J..C..Oz.Qo.....z4..1F.....>>Me..(....7..nC.+..8..X... ."....n.=B.../O...........M*....r........./....T.c......D..6.U%.(..V8FL..|=.w.......v..;&.A;>.5{.....o.O..X1J...]M..|.k.%.^....;;)S.......o..c\F..7....Q........

                                                                                                                                                                                    C:\Users\user\Documents\NIKHQAIQAU.pdf.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1269
                                                                                                                                                                                    Entropy (8bit):7.834059902439369
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:J5aeDZRUN6ZxsovmZwb7BqLIcDX1tfJ5wIZn8wAqA/RluuiO:JYeLH0ovmA7MI0X1txhZn86+RluuV
                                                                                                                                                                                    MD5:C5D0CF2873C48822BB6690C96B39901B
                                                                                                                                                                                    SHA1:0AEABBEEF6704B8B4DF2D7CFC1A322649A1D8EE0
                                                                                                                                                                                    SHA-256:2B9F61DB75B3A96F57E7F02EE4E990957233C300E7D9F5534AEC76155C6BE467
                                                                                                                                                                                    SHA-512:10E220D1C9F49582D939B1F6EDD5F41B3059C40DCC3BCDCC1820F965B98A6137A8FA2D5D0A483C78729286A3AF411BB2BAD2552CEB9036B163287C90E624D911
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:..8.......X.t..wq.8.{ K.&....g.)..q.....m.9..?g....xw..58.4.J.g....]....S,t=+........,?H..[..s...J.....oj...}q....q....%w%hZ>..*..@T...S..].s.....p.J..._.?..gO(.dO.......'.wS..........w.u.iK].).....A...z+.+..z;...j..QI.~.l..`...m..........y...#.......\.{..i{.;.h!H.,....m./..~.....n.<..4c....|c..72.>.L.v....K....S8l.$........8:A..K..i...G.....ie...`o...j.....k{..c...7....-....@..`I@..Q...rU..........K.E.#.|#.|}f...9..T..&U;.....2P.&S&...6..D4...M....}..S...8.w....2..@I...ws...........]P..n...h/*.U......F.T..,%......VNh...)....n.......QC.G.M...T7,...FL.#.`.Fq..z....E..c..A4....ax..y.&u..n2B...a...c...s...+....:....C..gQJ..Z...vI..........O.S.6.i>.dxf...(..F..#N9..... \.?R7...,..^7...Z...}..R...,.c.q..3..OW...eo...... ;.R....:..~l...8K...Z1o.{x........'..F.l.V.<.<....F,.f..<_.<...<J....... ..\..m.>w..U....q.+6rA..1m.%J...0....T]..V9..n.~..P..q.4..n.JqB.S. .4/\#.\w.P.\..q..F}.k`........a..;iU.sR.>...y.X.........T.A..6*'\...2..B.:..

                                                                                                                                                                                    C:\Users\user\Documents\NWTVCDUMOB.mp3.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1273
                                                                                                                                                                                    Entropy (8bit):7.861197842501391
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:ZT293WDz9WsgKiGAv6rH6pT2aWZJASmvLJC1wprK2CKt2jTpJ0uiO:E2BWzKVAv6rH6RBsrQ9C122npKuV
                                                                                                                                                                                    MD5:1FC934F8864DE4070C4B2A88CCF230AB
                                                                                                                                                                                    SHA1:9AF1AB3FF599D492E85CB7DB90A51F5D0A40FE65
                                                                                                                                                                                    SHA-256:E4773BF3C1DD4F2663A2265894AF1BAA124464343547C40E200277A3F3A9B320
                                                                                                                                                                                    SHA-512:444A9EA1B9EB6774F0087750EF3749D76010291341DF2E5401EFC729F68681F007D69FEF8DC525EC56C4804C0958AD8C485D9CD2DB7ABD39D3714082651E04D6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:...zb{......le. z).|...0=.............].Sa(K..h..M{......TC.>.p...y.7..^....=..Xng@JFXf.|.M.....,....3N.f\>...&,..q......./......;..cZ.Y.Y~... )...h..T....dY.....&1gafS.-..{B..0.i..e......_`...k...p.....:&.."...0=..H..|.............d..Z......$...tty......y..2s .o.../4..........p..O.R.,Q..d..Tg......MV.&.....m.&..\....$.._zdAU@Zx.z._.....!....&B.lA?...' ..q.......+....|......>....n.t../.u.8...G^.8....\...z..q.W^...bzm*p....7w....h6.a..........Q..+......HPv.O.[....K...n.\9.....O..e .{..FC.A....."_v.|Y.....>...L?..*M..S..;.#N.d.t.;..XRU...g...n.....}...<.+kCm..Xm..!.......w.j....)....cH.;...A.A.o./5....b......:....{.m../.f.,...JR.6....W..q..`.^J...bc.5z....*w....q=.g..........X..3......N^o.J.Z.....B...b.Y-.......sV.._~....Bjg.G..>.n..E..e.8H^...3fl.F{..........p.6..........N.H..........r.[.YHt%...w..\`.5.._.....i.{).{..:...~........".!..HVO.>1:O..&h->.e.....N..i,...%7..WUJN.|......b6_hu..((D6..C....H<y.m.a.......E..e...>.+.._,1

                                                                                                                                                                                    C:\Users\user\Documents\NWTVCDUMOB.pdf.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1273
                                                                                                                                                                                    Entropy (8bit):7.848158310642277
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:Uo8lZ13f3rCz0ORoBh13nycJIb4NDLzqIXuP2i7wFkmqvmeuiO:a71DU5q/tDJIcxqEuP1wWmGVuV
                                                                                                                                                                                    MD5:84072EA0F7A7610FA704E158B998F031
                                                                                                                                                                                    SHA1:5FB2B0F3CCE9EDEC356332AF06D1F914672F7A49
                                                                                                                                                                                    SHA-256:A1822D7221C1C5F7EEE965874156DF92DED9BF7A19A786EC7CA8CBFA717715C2
                                                                                                                                                                                    SHA-512:8D7D197E5431406C02827DB4B3835D61A14002237452EF8C84E26812F8CCE9B2634CC4A05524D952930F7BDA3D2AB9C232CE7C09004DA3D84641066DA6981A1C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:S.D...j.......s....\...*.X...0..&...ps..MuK.]...B0.O$...Y.:.w.b}......5...,.*.....T..R...5.!vz......<.7......m.{.<...|.ht.G.""..x....,.l..'...l....>i.d..kw..(.....^..i.a.B-.1u....U...[&|0U?ma0..9.gk..S(tP..I.......}~2C_...+.1.z.MVj....vz..../Z.I.G...o........b....O...5.]...&..,...za..IoE.Q...^:.Y"...@.2.`.vf......;...<.>./..._..@...7.1{e......6.6......g.l.'...~.{..nw4wYL.B.<i^..r...#.Bz.${..R..e[%1..../....@....-.g>.........F1.WKI...>.0...M..}..Z.L.T...8/.I......m.......Qf[jl..d./3V]...F....fLm..y"BKsc...........&.i>A.5....V.......~....]..?..~.@.....tac......=...i..t[.N..6!..t.1.*..+b!S"b..i.eY...u..fr,iPB.L.>wV..u...=.Y}.?h..F..fV)7...."....I....<.n*.......[1.XUJ...5.6...^..w..].E(V...9-.^......l.......YaWhi..r.%#TP..2...........j0]..Y..n.O.$....A..N....V@..S'..."..a0....S6..(z.W'/.^..g1.........(..)..%..6..9I..-.,oa-..........=..R.\.F...g+bw.vR...j...............N.."..(..@'.f......g..It../j..|:.........O.|..9.....f.9.UG0A.GN.D...Uhf

                                                                                                                                                                                    C:\Users\user\Documents\NWTVCDUMOB.xlsx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1274
                                                                                                                                                                                    Entropy (8bit):7.871979659620525
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:LrJHIQh9lEpOMJSur5lavtmQ5KOfSs+sISqMbW5d/6//31XBctXeuiO:LrJJh6ZSur5ytmA5/6//U1XBc9euV
                                                                                                                                                                                    MD5:5002538139518C026E58C38CADC6DB5D
                                                                                                                                                                                    SHA1:BDDE6EB3CE77F1C3A65393CFEBAC0FD343AE00B6
                                                                                                                                                                                    SHA-256:95ECFC232DC62C8F5E84B5F16B1C9934CE2E925537E7A3FF1EE80CF9DD92C49D
                                                                                                                                                                                    SHA-512:C8C790C08EC03D6A9F1E88D491A3F3AA41600AEAD444882DE015C031E8F9CAEBD88D7F7CF0F69571DC0C4B8F7B29B919ECD92C8C7E73741DA36E0A2B5CE4876C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.....Z?jV%..oT.....U.3..V.....E..T._wA...kgE..h...i.ppvc..<.....:.U..t{|.1\..q...O.......z.s..=|.yq)4 .V8.....Z..E/B./.+...k.0h#...0.....%.g.. n.....%...r..-.[..Oos.....<>a.......p:%.[?.......n..i.T....i...a..G...W.J....H,......`.<...:...w.x..!.....X:f]0..hA.......J.3..S.....L..[.UeK...e{I..q...o.vxkz..4.....+.@..iux.3L..r..M.......m.~.."..l})>=.^1....Z..^%V.-..Y.k`k.We*?....Fr.|.p.o.../.[".~....... ..h.H..%.FD"M".B.....|.k..$v...5......Py.0T8J...^.W 2....b.<.&P.>.2t.0).p.b.I.~ZH@O-q.3V.w....}..{...t..>\?.......e..}S.>.@...).........~.!Lf...@npD.....3.;..%0....d....}..~. ..5A..^.....k...4........_.E.nxu.Yo$$....Su.`.n.t...<.Z6.h.......-..c.H....JU=D6.J.....v.m..$f... >.....Tn.%S2\...W.U<*....t.2.;U.?.0q.# .x.n.].hWBPM .I......:~n./...X..4.F..p.....iSb....s....zf..6..R..O.g..._.YiZ$....P.'.B.}.*..r.O.n..% .M.Ed"07.g..9..7..C..K.@....X.x...P.._..{V...c.).7o.%.w.!N~.B.H......H....!a..X'@.dP..:.X/S.2Q.l..R.........8....J.o/...s...[....f.|

                                                                                                                                                                                    C:\Users\user\Documents\PIVFAGEAAV\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Documents\QNCYCDFIJJ\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Documents\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Documents\RAYHIWGKDI\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Documents\UMMBDNEQBN.docx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1271
                                                                                                                                                                                    Entropy (8bit):7.84509501899005
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:VuVmUkBHKaTbg7BpxQO6AcvDl6WhyKcJinzfDL2XOETuiO:VQksHfn6JWG/L2XNuV
                                                                                                                                                                                    MD5:D4B581927CDC794BB343CEE9A45EFD0B
                                                                                                                                                                                    SHA1:0D5B178B313D94B79CD3B7A7142251E687D2C557
                                                                                                                                                                                    SHA-256:D5EB5A29261F18C8E6CE210DA6947BD9B254FEB3FD2E2B8317632764B9EA91E5
                                                                                                                                                                                    SHA-512:4020E2A35BFDA5056EE2E2C7A2630A0DD60B73A888F1CE50A7A1DF615CD7F57F8970FE0EF1C5647A51135F6683B778AADD32AD4A587B7804909B1DD2217DFC71
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.c.>...).C.9..[7..........".W.+}.....N.P.w.I.0r.t..<.......&....ZH.j.J...j.2As...pn/.../..\w.ua.*..[..k..)C.+......1....VwLAzb....lP.].C.*.W.....V.q.UT..zl..g..L..s]5........+....4...~#+....!`}.#o...hS.[.F.zR.j<...;.j+.....)..uO....zfI...{...p[o._u..w.4...%.P.2..N:..........-.G.;d......G.F.i.S.4g.a..<.......#....@I.b.N...s. Hk...dj4...*..]o..v.5.._..z..9G.1......0....Ys...."..X...P..l.q*..|"z.'$.S.?.'-..a..T..O....*\r...aW"l.6..t.2Fj/..2N..|".yt.M...^.j..:w!...aF........C..t..#D0..5H.f...&/x..2s....X.\UD-e..e.CwH..pj.t/Y.D~1..V..;_.!...;.....B.. q6.0O.?%%T._.g..@ts..[....M......E;..j(.WD..H%...k.yZ.L.y/Wp.........4..O...Q..u..?..}>~..:9.^.*.:...c..Z..O....&Le...xM'|.7..a..T`(..)\..b'.|e.R...L.g..,d:...wZ........J..r..0E#..<C.x.....*<|.d.wQ/)......}..$<|.k..H.V..5...+.03..IF..tu..r.THq.\..r*{Q.....d..\.?.3.>`.g..^.`TJ.$..$.4....z..cMj..NK.)z.L..P..l..e.p....qf5.M..;.....^r.Q..$.0?l......C......s-..q....:.tvP..u0g@.p...g......'.Q..7...HY.V...u

                                                                                                                                                                                    C:\Users\user\Documents\UMMBDNEQBN\DVWHKMNFNN.jpg.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1271
                                                                                                                                                                                    Entropy (8bit):7.858124377234667
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:sKMd5Y1atU4OkHeHOr0ejeIUSHibnia78Pa+Sd4luiO:sKPR4OfOrNeKWtAPtSd4luV
                                                                                                                                                                                    MD5:FBBDB3C2D2ECAC3D4313C78F042D622F
                                                                                                                                                                                    SHA1:8225BA215A7372D598F2B9B89773C9052B72CA7D
                                                                                                                                                                                    SHA-256:2ABFBF49CBDEF51BBD29104DBE273E5DE4DFFAFDE1629A547E5F8E34A9FA8481
                                                                                                                                                                                    SHA-512:87DE00BDDA2003ECAC628BCFD76BA2204A9E4682B4C16A7DC2B1410A24CFB77537606E85FC48C676BADD30BB793C759B74288D2F470ED13C9656781F411C6D85
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.Bx..:@3F.{_..T.$jM?<....S.M./U.~...A,.!...!......k.h..oL.$..+...$,Q.,%.i.......&a..>W....X_*.^..>.;.t:w./v..(.:.U.[.v..W.f...}.T..f.......Q.U../^..i+...U.G:....w.y(.i7.M.@.....y.8...........f..V.i..E.a$.au9...B...}b.N..v.$.m.i..t.}..3.r.$...Vw..;T=N.gI....^.#jB9-....X.U.6_.{...G/."...%......m.l..y@.4..,...><V.<*.`........*w..2R...dRP".K....5.0.s9}.....0.&.V.H.n....J.a.^..g....z+.......c.>Z.d]e.#X'a.x....?/_s.].>..W.U...xx..R...iI:...z|..xf.T..U..S.Y.L..R....K.l.\W../...$...sD..3.ypwiN.}.!.s..^....8.X6.K.`......1ru....1.G[..L..6.........+.........8p*.Y.m.DQ*;.@....P......aWw.j...f..b....>'.h.!.%........F.a.F..l....s'.......v..4Z..bTg."N#x.|....7+Zq.G.4...Y.X..ly..N...iX:...~b..ee.E..I..P.J.X..F....V.i._T..<...#...hE...um8..>..f)...................4.>..._$...Q9.J....qz....M.K..;. .ai.#*.Z=..j....}PQ.r...K.B.W.k..'.....2n..6....l....=.]...+M.z.5.P.9..>...+.c..&..l..x.do.M..E.H.es.....5.1.v..Fu..x.T....dj...2F..V..0..&._q6....k..H)....

                                                                                                                                                                                    C:\Users\user\Documents\UMMBDNEQBN\HTAGVDFUIE.pdf.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1273
                                                                                                                                                                                    Entropy (8bit):7.856145864528526
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:oIp4xxgv5KgOGRC+U/66itUD/gZMV24ZmTT0KBHieuiO:oY4Qwlkz+66dYh4Y0sieuV
                                                                                                                                                                                    MD5:DDD6F0DF27CF851830957655C2A934B5
                                                                                                                                                                                    SHA1:E06E300CB5D883DE41F5BB00681A7FAAEB30DC85
                                                                                                                                                                                    SHA-256:0E333082B7E949A819540505A6D90FE4F4E38ABC8A73D5BE2E72E2DA54D46C7F
                                                                                                                                                                                    SHA-512:CFD0AB3EDDE652E3F4EA8549AD1B6B90AC0FA197775974FD980DB125E52E28C772B447F0E6A66E07E5EF6D3373563EBF2751FA314B92198C548BBD70736692E0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:,j.,.f.b..9{...D.....B..S...$M...H....i11u..9.Gnr.M...B....z^gI...<... ..T....b..{u..(F...L...6Zn..D.qs.//_.w.....nr.u...*.wB.d...)T....w38].u.js|'&"-\hZjG......P...j#O. g?4.i...k^L.....Ob!r......d..Xj...(|..$..7,n6.DX......T.[...*.qt.....Ti7Es./q...9.y.n..-g...I.....X..Z...+X...@....d.<r..6.Kee.\..._....tJkU...3... ..X....i..at..45^...J...<Ui..N.jq.3)W.m....qo.v......:rX~...<..U...{.Q..2........\Cq....Qe.............7HC.o5..Z...O+Wg.O&R+'Q....$.t..yBO..L...I..a.....M......*..a.J..>./[.(.....-qd'...t....'.g.E...'J..*5.}V............-.....4K........|.\{..;<.-9.m.`.yU.5....x..D.....K./.....F......}.M......!q^m...-..^...i.A..9........ARl....Dj............?[B.~$..D...C?Bg.J8Y+3H....,.x...[W..C...D...p.....J......9..g.Y.. .....R....v.....n.9.XGW..K.{6..H..:..r.)6j...<...._.#.....R..c.|......9..ZW....G.CC..y.......[...&...P..#_zg;..z.bl. ID.R....T..G..d~....X..&A..v.N..>..:..w..!..|.0.\..0W....8;..Pl=.......$.L..M.~....b..b....':.QU.}..[..+.

                                                                                                                                                                                    C:\Users\user\Documents\UMMBDNEQBN\KATAXZVCPS.xlsx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:OpenPGP Public Key
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1272
                                                                                                                                                                                    Entropy (8bit):7.824679262794895
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:O90Rw+ilsLRsWFm9/m4FDgdC+lD+aGOl0ADj91jpXvxAouiO:qow+ilsqqm9/pl+/lKpOT919fx7uV
                                                                                                                                                                                    MD5:737CF503A194862B320A35D9C1952BAD
                                                                                                                                                                                    SHA1:8D06199A333A61748219C0768BB5E65562C776DC
                                                                                                                                                                                    SHA-256:4EC7B6C17A8510185E37AD2E48EF6DF10C7C956C9521DEA98B9BAC87595C7E46
                                                                                                                                                                                    SHA-512:4619C69DAC897773E4A6EEE33722405C9EA9EC578D17A2566E10111E5380A3C857F5A92AEAB0B8D438B73A1E7342991201BBCD436AD2B2683AB36C27708A8465
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:..so..U*iT...|p...`..i..r.......z...e.z.+....x.....L\..,*.Jbq..]@....}.0.^i..".hM.M..*^..K...vC..?.......h\?..w........k.(qwJk..V.........tPO(.......DO,..$....@..*.\?.W..A..ia.E.s..j..i.O[r.Q.."....e..>...}....y|;..(...k....?.....cv.5.GDH.j..v.o.....uk..R<qR...fv...y..n..v.......g...{.u.(....h.....VA.."/.Gom..XB....p.!.U|..;.z@.N..)A..H...fT..).......vI+..n........}.!anXn...'...q.+..U. ..E.^..M.b7.....&.E.....s%T!i.Va.nw4....Hn..'w4.}5..]H.7.@..3fl.....F..!*....x....8y...+>).8..V.<.;V*.i E|....l..'.'H.....;....~.<.ZO............^.IXsl.`./W..........y.?u\>..V.L7~a|.t+.3H<.T...@.?...U.n*.F..w/...h.-...f]p....*...`.*..[. ..C.^...D.w8.....,.V.....h O)n.Zs..o.....Co..9g&.x'..OP.,.G..'l~.....X..99....p.../a...%5:.9..U.-.,K<..,..[..)>..B1.hE.j.z.t.Z2.o....y.b$DpPYl....l....{.^`.8..0.....?..Rr..>..@.+\.v..E...!x.y.w..M..D.33..... I....u.h....h.$..M.n.b...)..c.]....w......*..l T....q.y..T.@.`..;...A....x.6.:u.{...T..t1...7.!.[.W.D.c..........

                                                                                                                                                                                    C:\Users\user\Documents\UMMBDNEQBN\LTKMYBSEYZ.png.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1272
                                                                                                                                                                                    Entropy (8bit):7.837407029916011
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:cRUZAHppEQAvuL9St6OEDTmv0CCvMvXLhi3mCm3BwN5sq5UjBN4b3TtRquiO:c2Za7EQAgYwOED6hCWXLhi3JmxaLUjBO
                                                                                                                                                                                    MD5:B36F726914E51DB8093D2A76BF22831D
                                                                                                                                                                                    SHA1:EB0DD0050B563573F8F10857092CA678988DDC57
                                                                                                                                                                                    SHA-256:9311C8D06C40E464B5E8390DE605CC23435D9EAE0DC17D788A797387B352D040
                                                                                                                                                                                    SHA-512:B04875D25CF6A4C83EA35893AC015315E56D4DF7C2EC467886236B704884DE0F2B481AFBDED24A4306E4D6C88787414D9D442D6B72F9268CBE8FAEE0A809B2DB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:`y_i.k.de*d......d.4\8...'....|....40:x....v.......M.X.NY......9T......T..PU..eY+]..Cyss]t$..i...!..6%I\..|.\F6..ST^..bY....;=U0..p.lB...L....F2.)...Q..Z./>,.....@.......'.%... Q.r..._...E..S..]..*..g....5.._.>......`.......d.......2.s.2..r@..yy]w.}.xw!e......i.7M=...%....p....:3;x....b.......W.X._U......4H......V..]]..{E8X..^es~Rm:...g...:..3!^S..n.UE0..MB]..b@..]..Q.H.Au .hA.O.......A.....'c.........^.)#Y............|m..11....rW0#...._.zJP.&...E.x..C].o%.&5.JX.:s?.S..C^z.......QT.h..`~.Z.....190..4.<.2..9.G...m.........T........+..yH.~..1...>.N..;........"3VX#..((j.#wN.'.w.,..'X\7....y....5[./v..|g....Y..B.].Pk;.q@.N.......U..{..%b.......Z.+>Q..............mf..1:....u_:2...=R.dVH.!...V.d..EV.n:.!=.SH.;w!.J..PZj......ZA.|...[..Z.r+x.....k..p...ZJ}.........A.y.>...V..y.'..MS.D.!...N-.9U..-.f...#..!?Z..R8......O...>P.x.;e.Cz...<a...-X.)z..........n....D ........N.KI...Y.PR5;.`......R.a.6..-..1...R!....q...\....Q.c80EU.U.1q.lI.Q....8...B

                                                                                                                                                                                    C:\Users\user\Documents\UMMBDNEQBN\NWTVCDUMOB.mp3.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1273
                                                                                                                                                                                    Entropy (8bit):7.810748851078334
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:RTYmNA/boDwxepHGKP656UXz2GkH86a7eInX+sfzICUCUL2jS/Hq6AuuiO:9VYQpS56UwcnbzVUCg2GK6AuuV
                                                                                                                                                                                    MD5:856C413C98170F0941D84EBFC13FD3CE
                                                                                                                                                                                    SHA1:B9044D20C9DCB3FCB04EE66CB1539CDCDD3EFA80
                                                                                                                                                                                    SHA-256:06FC18A939FDB55E13D16BB6A8E8F77ABF0E42A7A4A8FAAE978EF15D87124136
                                                                                                                                                                                    SHA-512:48A374B319D8079BA2650AAAF5675BDDD23A5EAC03822BBCCD146D22BE9D4A412793003B11940DAC8C955C893D9B816B7E722C757112B04DA752D1185DBF9848
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:c[Lv>..6..dc.$sV.Bo..P....~..Q.."...7.}#..9....o..;)li.. ......f.H,h>.`v...P4.^.....(...ob..dP.m.knn$....e.7e...Ji..Xk]..0sSi,.:.Pnx..l7mc..*...W&....z....]......p..5M.........9w..k*H.Z"%.YX...CA...Nf~{...X np.x.J.r...$.8n.==..........k..l....S..?..yFOx(..:..iz.1iG.Kf..Q..+z..G.8+...2.o)..=.......'#`...&......n._<k*.qp...M:.G...)...qi..v].z.f~c;....i.*d...Ke..X|P..$qQ{?e.ET..yr;.e.)._Z.u).LV....}.`..\.LF...JCF..%..\9.`....pN.C7{..c.oy'.;.v.P........q`...7.E.j..$...5...B.RI.y'v.|..T...W>.<.!..tg...h.4....;....}.<0.w*.......a...t...O.I.z...~~=8...8..X#.-..v.18.~t.I..B..sOx...RQ.X....-.2.).Jn..8..]....7...N%...'...L{.MQ..p|1.~.7.[O.u5.RO.....}.t.._.@@...GZF..,..T5...k..yN.Q(q..e.ry7.%.c.I........vj...1.C.v..0..."..._.\H.{"i.u..S...C,.1.1....]......... ..cQ.pa.Bj......{JO...*....>....~hd.a.P.O.....?..#......5.Y....I.M..WL..@o\..1k....ia.......\m}+....."..14..>...'....88.5..pvk.[.....S. )...K.p........._.; ...,..v%...1.$.....&..O8d....kX..F.x.".K.].GD...jT.h.

                                                                                                                                                                                    C:\Users\user\Documents\UMMBDNEQBN\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Documents\UMMBDNEQBN\UMMBDNEQBN.docx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1271
                                                                                                                                                                                    Entropy (8bit):7.850415947474829
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:TmVpcKSAwDjBfkMedv+bMakMZo1K9B5yalljoqBy0UHVfD8gHqMuiO:TmA3DVfkZ+oaklKP5yalljoqByLygHqJ
                                                                                                                                                                                    MD5:458F53540D92BFFB068387C6F151E768
                                                                                                                                                                                    SHA1:82D05B505020390B4097C0614D6928998626ED9F
                                                                                                                                                                                    SHA-256:E74A09CE6127BCFED37DE3D0CE3F1650AF9DAE28213B5AC4FD5F9E6C204B5621
                                                                                                                                                                                    SHA-512:39A85B8F88A2CAA5A8AC4DD2E35F8D2DE7E9940C2F0F398A882BFF06D4011391EAA5AF4F56E671ABA49F29CCDDAA5C1C50CDB8252EBFC7F9F9777FB2446CC3BA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:M..v...n..U]..x.......-.A../....J...f:./..D.%.........-..k.<.<...t...'......,.?MTkA....f.\..?Y..H*,.O/.\F.v....CtnY*.....4UN.JjM... .....2....W+.]..|$qp4l.M....H....F...q."..G....I...@.=.&!2U.J.....[..s...&......>...mY.....+.|.../.,.......@_...P..|...h..F]..`....../.E.. ....S...x2.&..@.;........./..k.".9...q.../.......>.>LN.E....k.D..(N..].?.^4.LB.l....EnoR-......&Azs.bR3.V.U.#S.*..>.].Od.1h.].[.o.#..?W..;.=k......XqF.Bmp.j_.*....y.X.J......T._.-tU..H.5..8.qQ..+....}.h......U....]...,1L5.....E.h.G.:.L.S.....B...7O].h^..k7..._.....U.M.S.......J......}...;.s.eV.F.)....s.AGC.U}.....Su...W..-..<.%yMH.......=M|e.tE;.S.R.:_.$..-.A.^v.,f.V.K.l.8.."Y..;.2`......SeQ.Xh`.|B.2....g.C.B......K.C.?hX..^....3.mE..?....g.g.y....F....P...=..Y..h.@g..r2Q.H...p....PO..>e......7....{6|...4,..'pe...2...)#6...u..F.7.....>.5.x...h/..bI.$V..tw1{......(..-clX4.....5&w..jl^.=.W.p....'._'c5S..X...j..\....RB...|r...i.my{{+...'..8....JT]..{rT!...l.z....>jyu....

                                                                                                                                                                                    C:\Users\user\Documents\UOOJJOZIRH.png.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1269
                                                                                                                                                                                    Entropy (8bit):7.81042989963648
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:+iy5zyRbHVMBD2ME/o8cCzOp9Kx8kTjsQ501AQ3G+bopm5Ztmjl9uiO:+iy5z0c1E/tJypk8vSZQW6FPsTuV
                                                                                                                                                                                    MD5:415744F385AB60D80726C8C324803BCE
                                                                                                                                                                                    SHA1:B2439C9D6668DEE627812F7C7F9C28420219EA23
                                                                                                                                                                                    SHA-256:E19C09F6A4FB59468FF0FE149FE877D55B99AA8250079DA90ED2C50F4F679217
                                                                                                                                                                                    SHA-512:627E017D809DF624D6DA86C81BB6DC810ED93D791BDC2D4DFC6DFC0518AACFB9C377F61681211BF0A16D702F778DA8136EBCEDF3F46004415AB51945EBB9B58E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:..).x...JZP.d..e!I.XA...}$.|.5..99.~ .rr|?..._CDR..B(o..&....T/;X...oZ..P.1..T4%:.g..$.WD2...d...*.9v........Dh...o..e..b.GWq1.......j1T._.H.Dw..:...]...T.E"M._u.........l....s{..@I...d.)$..m..A.d]..{l!}:.r`......1.#.q^.42.8m.t1.[....g..z<.{;I)..... .z..@VJ.s.y*Z.IL...y(.g.>..<*.z).imk-...OFYLd.D7l..6....K4>J...jW..U.2..S=6).f..,.[N9...a...5.-|........U|...w......}.DTk..Ta#.V...q.. .R-.I1......Be.i"...&B.].c...y...7..:1. c ;.W...,#.c.|.H......g.?..!9.5B......e1.8.ZZ..@..-EX....k..<..y....D>.tn...Q.ef:./T....L..|=q...c........t.e&.....I-.q-qu..P!.1.~....W...S..\..6.R..S....z... .RIK...NE......Z.k..t.2....L{=.V...h..?.F!.P2......_`.p ...+R.D.}...m.. ..!$.*`,..D...:6....m.^.h....x.9..26.4\......o-.7.WQ..Q..3_F....~...:.....2..e.....F$^t.)..... ...&.....iU..3..DcO.Gv..u)...8..2....A.Q.~J.O.Y8- ..'..|./<...e....5M....>cpO..B...c...45xT......|&.!......^...svyXi._T...6n*.*tL!..f....jy.?..+..x.<...D&.J.....[/lB...c..q........*.^uDE.]t......*B.

                                                                                                                                                                                    C:\Users\user\Documents\UOOJJOZIRH\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Documents\WUTJSCBCFX\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Documents\YPSIACHYXW.jpg.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1272
                                                                                                                                                                                    Entropy (8bit):7.850509643576628
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:Gz+OtcSqAio/eakTD5wpWXQ5tAmSa7Q+tNxqXTk39iT0fRVZxpKu6XBuiO:GzN0zot2XitvScBqDkNiTyZx2BuV
                                                                                                                                                                                    MD5:74CCB005FD18A8CD2C5F66A7897A4475
                                                                                                                                                                                    SHA1:9F869D2173BCFEB27D3D969C62F0DF94323FA7CC
                                                                                                                                                                                    SHA-256:C4DC29BEB576D41C2ED944CDBF92C35FCAD2B13DDFE85247E0D447935DFB81AF
                                                                                                                                                                                    SHA-512:F1F348513C932F7C9927731FAA35B62A1AEED0BFAF5E96509609AEA7FFA26BF412770857E30AC96948FE199589DD04CB96497992DA75CCEE309398220FA1B162
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:..%.b..'...lL......!.._.Wp....v6..[MwH...*..=x....m.....7.M.\.....JJ..g*q....|(.33"...j;...P+49G.V..i.. .b..5`..L.9.jK....O.T~L.K...aE..#.+.{1.F....6..3..v...7x.Z..9Q.....^...9.$.. F...,...r..D.6..!.N^x....X...L'A.x.(..$P'.......K....3...u6..q..<.b..;...eB......6..E.Wc....v5..HVxQ......&{wg..c.......K.M.....@@..}?u....t<.:,,...~2...P6)9C.V..o..>.h....n..W.8.nP.....3.....j...g.6}.%.2g..WT.....o.VN.K......q..]I......?\...m.?KkP.....1..=\.+8.V..'j^...,D.|'{..q.xp.D>.,.VV...G...r...s7..K.m..x_.v.E....uuEXUt..dx.O.......#W..s...Fj.5I.v....Sa..~".]-...uw.[.~......w.D...O..P.......ts..[..U.I...4...}......I.1l.#...5...z...r.5b.<.%e..WT.....o.P^.R.....q..PA.....4"Z...z.?_}X.....;...V.9 .E..(jO.../Q.g1{..}.}a.](.5.AL...B...x...s,..Q.X.`.'X......N....................T...N..>..D\..I.lQ....[{...ir.......\.......BC...."... k.......'.B............t..Am..S..L.^.t..g?3z.....J.[...;....O.~.<....Q.=....en.........=.......Hb...#....;o.P..@.d......V.@....I.

                                                                                                                                                                                    C:\Users\user\Documents\YPSIACHYXW.xlsx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1273
                                                                                                                                                                                    Entropy (8bit):7.8525028185743775
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:9itYCl2AG/UlHMmrMDLZIaspUD23CDr8TVtlRAJ6Eiru5J7RosmuuiO:9itBBGsFCLZepUKG8BtA6CJ+smuuV
                                                                                                                                                                                    MD5:946EB2CA5AE6404A197C46F27E4181D1
                                                                                                                                                                                    SHA1:64972FBE534463DD66DAF50F12292CBE07FE4455
                                                                                                                                                                                    SHA-256:9DECD6FC8CF901C24186492C7AB70B69E383CDFE938AB78A39D8B7ED370BA091
                                                                                                                                                                                    SHA-512:89539E2ECD8314B4DEE2A1C1DAB37A7186B099A0C4CDF153530E715CC6872946F6B1633E6BD11395052451BFD779CC9C9336035B2152E5AAF4AE875C7114272B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:2...A..<W~.q.yp.?...(..G)\mw{.,.M[s.Li..FI....J...+..W.Y...sU...-.1...E.v...K...v..|..~..w..F.Z%.....M9...x..y.\Eb.}.!@..q.V.......9.s.n....q.\o..,.+...c...8td...56.....I=v.e<.........0..:....@.n(&0&...Sl.;5R..t.A.F...F...q.e.T..*....).....U1.>...A.. Jj...|..=...(..X)Ot{|.6.NZl.Wf..WJ....O...3..Y.V....L...<&5.$.O.w...O...i......j..c..F.G%.....K9...r..b.\Xy..~.:^..z....}.....F..ihJ.g..H.3..4.....xc..g'o.i.....0c..S.......v.P...0w...p.,....I...".\....^..\U.f...v....:^.!.."(h.x*.....}.|~...Z...).U.;3.>W.u......&..E.3y_a/..C.. `D.k..j.~..)z...1.z.mW/.......a.c..O.8.*Q.V..T.0...).=<.2..~w..1k...[..h9L..uuU....d.......@..`qX.e..T.3..2.....he..n8..cc....8o..L.......a.P...=f...i.?....V..-.E....K..JU.g....p.....-Db+../9r.u&.....h."U.ViI.).D...7.....lQ...3A$..ra..0.z.q.5%..,..FB@.6...q..~...p.18*h..]....Z.~..2..U...7Q.@.]......(......2N..}..b..-U..|>.{.]..../.=U.sXhe5.......>5.........\.l.;-?...|r4N.Z....B......p......,.\eB.s.\P.NSPu..@.@....9.i.6i3O..

                                                                                                                                                                                    C:\Users\user\Documents\YPSIACHYXW\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Documents\ZTGJILHXQB.mp3.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1273
                                                                                                                                                                                    Entropy (8bit):7.859394677351555
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:C/VzBKqN6o8wbYyKYnrwUE0thL6iFAN+f2wwJw62/qZzfC9A5q3OjN50TuiO:CygGSYZYr2qw+Ea/czCGwOh50TuV
                                                                                                                                                                                    MD5:6F64A7C0D0CE6805473DABFCF562BEB3
                                                                                                                                                                                    SHA1:8B7CF201BEB937C444DCA87B5D331AA0F789FE35
                                                                                                                                                                                    SHA-256:BB32AEFCC322D631A83BDA503B66AE0FB29BA2C4FD7F35DEE552EE7650AB4835
                                                                                                                                                                                    SHA-512:A752E49670B7FEDDB5CC93CA5F78DD029DA89FBC47738D9406F6DA5FF4E3270FD35AB6C9824BABC2D7287ABA8DA2A2FF18799F52F700425B25C8C68BCB0556AB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:a.E..I.hV..4..#.p..SelP..r..lP.A=H*'....q4.......'....go7X..|...(..(..%......2.F.V.o.....1.`. ...%.U.9c.q/......H6.#.YL.X.^j.5.W..fp.^...}R.....j.iLW.....?.F...Q.....%b...5.{,#.N......@..A.6&..E. u...]y.*.} ....|.U..o.g...{......?.......t..h.J..D.z@..6..;.i..XvmX.c..c^.O8A%"....s/........3....wa(X..c...3..'..<......=.I.P.w....6.e.'...,.U./|.w8......V,.?.IN..[.nv.E.q.b.HO..8....D.<.....Zrj.>.zn...;..C P.><S....../..Ue....%.UDT~..+..oxZy../).N.:....V...!w...@.$..BTv......g..(...9h...L..\b]....9k.?.b..V...l..q'.$.....m4{.oiy&...:g...(......_..nr.t.oA...s.w....,_c+.....8.....a./!>..FT..[-B..4.....R....[.ni.K.s.y.BV..!....S.9.....[mh.<.{p...:..U6J.%*T......<.._n....=.GRSu..+..hhMf../:.A.)..T...!v...K.'..H\h......s..,.?r..e.....kg.T.h7...1...N...t...j...a..f.7..\>...'.k..q..9.@..i...06..._..eidL..9G.!..sM?......IB...B..,.p.o..rv.X.QvLO~....sV.K.(......."..F..\...c=%4......f..,?.......NX.)^..:....).!..)....n..& .e.....Q`.^....6....&.

                                                                                                                                                                                    C:\Users\user\Downloads\BPMLNOBVSB.pdf.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1271
                                                                                                                                                                                    Entropy (8bit):7.818224949181721
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:80+cSvgFvysgom1GW7qdVtbfwf9qRSNgIHng8NJy2N6UHCcZmuiO:QqKj17qGqRgVNU2oyLmuV
                                                                                                                                                                                    MD5:B19245D522679635C0A6A1B4EA5C876F
                                                                                                                                                                                    SHA1:30F0EFA20950CB1C6371BD754C498D3D9E47CB91
                                                                                                                                                                                    SHA-256:2B7E741E9DE105FA6DE983F74B2064E667FF3E010868EED5E157A67FA99FE253
                                                                                                                                                                                    SHA-512:3C866D8FEF4981EBDF64767A29DFDEEF1CAB40CD5DF58045A6EFEC26AEF76C1AA97525FD303A4A1E6C8C7F644C91315E37EF422A95FA3266F14CF01AD43E874E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:;9,.+&3...i.Z....k...'.2.5...........Q.R4...'....b.....#...C..-..K.O...F*.`y6.._...U.%.MM...c.F^....!.J.?..PyM.SYH.*.eZ\..Pm..K..n...Z...j.x....p.....WO..c.V~W>..e...?Db&{E.V.P..O.SY.....).......M..R..Va.....&..4.-.C.`......".!Qrrf....../.Ur.".r}..=/.3-9...v.F....t... ...:...........M.U'........j.....#...R..&..D.F...L&.hz&..[...U.&.OP...u.TC....:.F.%..NdM.M@Q.;.lWU..A.C.rY@.....B.`....*b+2t.].e....]...O.Q..n.ATaZ..J....;..0....?w.D..a..m..A.D...?i.....;.....)..q.^...`.............K.Q......`.a5 ./..aJ....sr$...2...8e........,+..(Z.?5...3.|sO..._......0O].K...a..g5..........zH.Bw..V..S...i.'......P.D.O]a.\.cWW..#..C.g....=b:-..T.p....Q.`.K.F..g.JTjW..C....+..9....'h.F..{..f..J.[...!h.....*.....2..b.B...l.j...........S.H....z..r...qB.....w.."s..6....T....\L.6x.d....V.>C{..'.....D>.W ..;9...j....Vu..S.Z,..g.......5.'....k...p..0.r....,.T/.~...;P.m..a..)..)..5..s...D`....}p..a..Zx.|..@.q.x...;...Q......U.|K....X c...)...sI..T...(...R.w.O0

                                                                                                                                                                                    C:\Users\user\Downloads\DVWHKMNFNN.jpg.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1271
                                                                                                                                                                                    Entropy (8bit):7.834640625157209
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:TGY2ZPx6rjuBoClj2ksCA3PdE34zU596OZLpJnW7Oe/zAr6JyuiO:TGYKx6rjuaCl65jzU5fZLpxm2uV
                                                                                                                                                                                    MD5:09D04DCDE1453ABF89DC3E8A162A62AC
                                                                                                                                                                                    SHA1:5ADC5A6064FEE25B27FFAB6B9E5311C9EC9C81CA
                                                                                                                                                                                    SHA-256:43D9FA685F9883EA13470166B304D03D4BB8CDA09917D408B508E860FF209ADA
                                                                                                                                                                                    SHA-512:0FD70E071FB1EA76198E7BB59EE2BA845BED97C4A432AEF9BFBD4FA0B5ED18DB999917320BA64439C2A9965FF73171AE21D04BB26F80177B903A89016BAC539E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.X..d.yQ*!...%....r\.h..`K....%.'s..5:_. tIbo..'..x......h"..~.....$+.Y..<1..7....;L....it..[.;)#....... .PU..A...)ka..,.sp..........PU..r....&..gI=..N..J........2Blz.V.Q......_L;..Z.....?m.8...Aa..W..N.._.5@..X&.".7q.4..TO:8.Z2..a..+...X.L..m.m_"'... ..u\.n..aI....<.+c..</Y.#.^tk.....~......x2..y.....$;.@..&!..>....%Y....hu..T..<........!.YP..Y...*`f...a....Y...M.=..V..:.tn........Z.J.|...>."....0...^..0-a...X@*.H....!L=.k|z.h+.A[E..C`.Rq.....%....?...c.|....8...iv.....R._....$...B...."./.G.F...9...../.z"...b..h._..h#..Dk!Wh......RD..X..........Yl4..9.#&.m.W.M.[g.ho.."&)0...^^.R.sC..v.ps.TG...k....Y...G.*..U..7.x}o........P.P.z...?.&....2...[..*5k...MM+.Q....;P5.q|k.p3.EEY..@n.L{....*....8...~.y..-."...nc...U..>o..&*...X$o.4)/M[...,......V8..tz,<.)... ......%^.H.pv........dx..;@..m.......0.Z#.n&.1..........M._+.........(.i?.CT...w..]ZF .K._n.Q".Nc*..M.D..=........7V..XR_'..W..UmG......"...j.?_..{..q_....S..H.....A..0......(

                                                                                                                                                                                    C:\Users\user\Downloads\DVWHKMNFNN.xlsx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1271
                                                                                                                                                                                    Entropy (8bit):7.832353811566738
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:Yl91tSv6zFjH5GHOUzACy0eIt86Et4VmoH34IT5+kLDq9fWbDzP3NvKuiO:Yl9HeKH5GHOUz13ee89ENTD8+bDz/Ny+
                                                                                                                                                                                    MD5:4E9F15DBE6DBB27FBFD92F3E335DFA71
                                                                                                                                                                                    SHA1:E32F85F74A851CDCCDF42B97A95069AE114E38FD
                                                                                                                                                                                    SHA-256:2D0FD29041F2654F16BB4B7009050161CBF17DA9764BD715CD79FCECAE05858B
                                                                                                                                                                                    SHA-512:BB63B7466F8E7351B62DFAF743EC61FFA28A521E287DBAB0BC6F1AA44C485CD0ABA44E654EF174A6C100D4AB38408F93B687067597E12885E192E37722654462
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.6...).....KO6.u....;|..9.{...7.~7.e*N...].n.jd......G...Chg.m.Dnta...1X]'.<...*.}.........{D.V..).:.l.*..../.q..H.m%T.O4......VS.h..J8.V.Y.D."..9.v.i...S....a.x..X....L...0'.....[4-...)T...E...y..=...l.K3..<~y.D P.(N.#.r.cI..F)y.)&,............."...(....]T3.b....4z..8.}...<.t;.`6G...V-e.|`.....gC...Sxg.j.Qcnq..o>AT(.,...-.q.........`N.^..<. .g.!......x..P.q*W.H'..V.. z....h=R..K...5D...K..)!...G.D..h..Z.....#LR.2..}x...k.Y.......J.;O....^.,]9-.|.W.07.b.."Q...{~s../}nN.L......A..qx..y...<.I..1....V].'.#.1.]...../h.......g..%.O..WtZ..p..M.....t..l6.....h...O.S+../.z....CQ.[.fO...>......I...E@'.. .{...\..,d....b6E..H...<H.[..54...G.O..j..L...../NU.6..`b...r.W......U.!S....^.4D=3.a.Y..=.{..(B....my`..'xmM.M......_..vyu...8...y........|..hC.p.#F.bEF+........BNb.k...cY.mS.p.#..Q.m n....,?.$nao.....q........9.......G%.Y.....Gz..%.vs...K..dlP8^.Ei...T.s.I.."..es.7.!m!.|..n....... .$...y.n..9>...BK<\.It0a."......Z#...^...qM"8Z.U..

                                                                                                                                                                                    C:\Users\user\Downloads\FENIVHOIKN.png.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1270
                                                                                                                                                                                    Entropy (8bit):7.8630579655872035
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:h6iQQmYEcyAEMGv3+9FoXOG8z56D0rHa/JPdAaPRvarq43JyIhlw4MuiO:hcqEcyAELCeXOGOXHaB6IRvqZMwliuV
                                                                                                                                                                                    MD5:4671FB47AB0AC1C0D5F8C42B2293E54E
                                                                                                                                                                                    SHA1:C9DE3DA84897542F4F688A6182BF77B867F8D145
                                                                                                                                                                                    SHA-256:7D7D4D51D4B7B206B42284B3FA6663914E9CDA81C584E9A4AFF7FE4E85C8D99F
                                                                                                                                                                                    SHA-512:72971FF2FE62A8F440AC56733BF860A8D81DD988306003A555A1374A14FCFED463FD464AD8F5DA41DC2E8D23B45DE193862875B4036AA72AA19D3A16031D9B05
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:^..J....[G.^."...Z.(Y~......38.......G3$..Z..d].EI7y....g.)5I...7.O...t"zmS.[....5[..+.3.d..b.......+.I)0.6Ij.Q)&.W.&..Y-@.b.Pn...m...J'.A.V....g..5(';.X...s93t.0...L......m........>mJ..O9k...^c.4U.. Te$.......G}..ny(9.tV.\..dK...lN../b.....T0..\..D....F\.H.?...[.,Ol......)+.......W$'..S..`^.XK%y...v.8#G...'.A.(.h5qmR.U.....*Y..4.1.v..a.......4.Q'*.<Yb.C!).\./..P.@^..:x..7..u..n.. .:....tB...............p2..S.2..i9{.C.zS.`..~gW..xe.Cl...*#..Pt..oX.J..[.....R....$...gE_T..b..e.......F.Z.UG[....8....jp.`9...z....OG.r. _....gQB.!.V;2...3.{......,..1....-...:.e.{.g..w......d.m...%..5..c...z.........A.B~.xB..6x..'..l..h..7.7....aS......c........`:..L.8..a-f.N.lP.~..i~J..}r.O{... ?..M|..nO.P..K.....M........vWJK..u..f.......[.*...4...Fd.....w...Pv....2g.]..x.~.)..-.|....N.6..;...hj.z..!.:....<..\.....`...[..L/.q..|..5..^..\.....b#.Y.f............... ......df.#...&.d..!5....D.a...@.D...t.!.T.G.%].<...t...}^H..K0P7.T5.eK2....._.}.l..,..K.p.E

                                                                                                                                                                                    C:\Users\user\Downloads\HTAGVDFUIE.docx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1275
                                                                                                                                                                                    Entropy (8bit):7.857897298449578
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:m1gtz+oHJjo0H0jsZr3yKP+YF982vLg3NBrnEccZnYHwSNhhXp1hKuiO:mXgoaOsoKP+wLuE1YQMThKuV
                                                                                                                                                                                    MD5:2D9F74ACB191E849ABB11E1DA4A481C8
                                                                                                                                                                                    SHA1:0F034042D618DA46281AD2925A18620EA51A8478
                                                                                                                                                                                    SHA-256:35A977161FB0340E40258DCF00D9B9F968623D8034F940BFF306DA474BA8B93D
                                                                                                                                                                                    SHA-512:B0F75B7CCDC93F071962CEC5AE5DB78B791FD66019EA4E4FF39AA12E1ABD36F6D91E5D72221DCF7F41A2BEBC53C0668A77CE7C4C591136BD2D1A7C4A3180FFDC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:w,....EQ.X...+..W.........`..q.,r..k...#.z..k.L.^.R.....?......y.{.&|.O....J...+.k.c...5../......N...I@.........}B...[..7p).....V....#N3..C....<.o5X1.....R...V..X!.&W}-...g"^L..uc.+.....[. .J....'..%...K.EW.@...i..w.p..Smv}5.vaZ5.H...Q.L1H....At7....HN.T...7..\.........i..v.#g..c...&.h.`f._.Q.^.....!....u.a.!~.I....Q...?.h.y...2..2......U...NU.........uA...V..(m>....X<..j../G7..E..).?T.%..Cv`.....|..VT..2>..Ou8..{;...'....sq.l#...~9.1.0..\g"R.!+|...Tn^S:V_j.i.P_....p.~.....M...r.YV.....ec..I.......9.+...i...5.rX.E.@.=5...|..2...9.'...<.D......[.x..R..Is.[%.}.4.B...ML../..!... n...9.......s~b.p..`..]..A..N4..i..,T+..X....-F.6..Tti.....a..BZ..'1..^x:..z3.....4....}o.w>.....~=./.0..Ur8J.))p...LoN\4\^d.{cAN....w.y.....B...a.JH.jv........._[p...Xd..&....D8../.....n(..].xKff.l....h >....r.i......>.=;..i.1.~.H..x..s..r..G..l`T.2&t.........d=.W..o.....U<.....+.f...p.6j;P.?b...a$w?6....A.!=...b.b.2..0.K..r4......N.*O..S..Cq.A..XNz.j.....=Y.E'2...#;..

                                                                                                                                                                                    C:\Users\user\Downloads\HTAGVDFUIE.pdf.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1273
                                                                                                                                                                                    Entropy (8bit):7.838138758606338
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:gPDc/jLInVjvAuZ4Je2oxfKxQh97Xthou3U4AqjQYniku+fdbFHWuiO:gPDijLIVLAOT2oxXhJXt/3jQUix652uV
                                                                                                                                                                                    MD5:86E2AD5D52648CAB8C8EAD24A56D3758
                                                                                                                                                                                    SHA1:CA763A88FDB764A97DEAFD54E56700E917AB05A0
                                                                                                                                                                                    SHA-256:A25398265DE61CB4E1D85A59197BFC9F862A1F95FF9C9FAC34077BDD5AE528E4
                                                                                                                                                                                    SHA-512:DA843CF085F0FC638167570CCC185FBEE75C42B1C9257399F9D08CC8FDDB22F4C13B962EBFF9A3FE3031F2F54F71E13AAC6D39F6A141DAAABBA1927022D35DBC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:...uV.1.x.36.e..E...EM...O.6...q..z..!$.g...G._.]..H.j0........A...]..*.;.......dD.U..._..P#.m.|..I.."./....k.vu..v.kS.w.....g$.'...*..m.f...v.O..#.O......T..[K@..F.}Q.._.....~13....$.....#d...W....a..x.T.K{..;....0X87..E5..9.G.&...e2DKq.u...W......cN.<.b.%:.y...H...[C...W.?...~..u..6 .|...J.S.S.._.{!.......U...^..%.!.......pO.^...^..J>.i.|..R..%.<....j.p}.f.f_.h.....Y.o{.m.K../.tz......+...]*.N..L0.g..]%.sP.UFw.Y5.=[S -.b2...>dD{. C..j.!b,....q$..|.....t.CED..=`.6....3,q..h..F.E....._x|y.T..l......7I....SF.....'...e.>Q l..Ylp...HU.F..Dl....{...c..;..-.....Ck..O...2).o..y....W.b.{. ..;%.8.&.a..?..W.gc.n.X..3.zg......;...J(.J..O7.z..I+.f_.IWz.E4.5^G7$.q3...:jZx.=_..~.%g2....x1..|.....r.[DT..0r.'......4!v..q...@.V....e..R~*;..........=...4...L...vd!d..2#..].. ...j.a.....G....G...3F..Luz.K.RF.....z....D.U...Hs.Y.A.x.'9>W.AIv<Vb..J......1..........cg..%=4...d.../..H5..(.}.W.#.d.4.m...7C<F.a.;.sa..*..j1.i. .......q...*Lh.K~y[}<d.*.b..

                                                                                                                                                                                    C:\Users\user\Downloads\JSDNGYCOWY.png.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1272
                                                                                                                                                                                    Entropy (8bit):7.870852206318602
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:QcnN7WzbYOXAcShqY+C1ActcQHYQXm23/BD/Qo45Vb6HsFDnuiO:LNKzdXnShJAacQHYQXPPtooWVUaDnuV
                                                                                                                                                                                    MD5:BCACDB95E3839F7F92CF6D832BCEB45E
                                                                                                                                                                                    SHA1:921D21554B09DDE74F449F42BA4DC803DD19C601
                                                                                                                                                                                    SHA-256:580AAC4C62CCDA95A7B7D2143BC08E861EBBAE48958AEC606D2F5D5BDC52D8B9
                                                                                                                                                                                    SHA-512:A8D566E581AF0CC22A3F9CE293FE1CD592EA2F6630FCFE1A0FCA910CD03124471432F4C02A88A3198C3DE8BFAB5A8DD060156D7889C6020F5A58D5CCE8DAB16C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:Z..`....J......A...T)k.1.U".Yj.....XN....l........G=.......o.4...f.c.....7u. .MY8..68...u.!.<.P.D...%..k.t..oA8.g55<.......Y.O...S...... w1...21.o...?..7.#.L...7.ic..=..].S..1.*..ex|%..@.'..nF.2.....}./.a...m... X;*......(:a....wP..r.C.L.]...Z..l...U......O...M-p.1._).\r.)...FH....v........Z1.....n.+...e.{....."k...XH...9+...w.).*..^.X... ..p.w..mE5.p>>5.....f.../F`..v.i..R.....)....7I9..@=A.@.%w.Q...-...^]..J.x..W.wO..J.....w...Q...3(......7........_Y%.[......Z`K...qi.,..?..&..^...'....m.<..Zn..=.j.:.....k..q...N....J..Vi...r..i.q..d.6t.&.B_..U.s.F........f.Ud~..x..>x.....G..+$........h$2..u...-F`..z.l..M.....6.... _3..S:A.V.(b.L...<...KJ..@.l..R.f^..W.....g...Q...6?......<........@\9.B......I}F...d{.4..;.n._...A...q.C!.4Z......=.`nMr....Uh.[..j..p..R..7Ot..#....NZ....Q.h.h{...=...z3,iB0..P4.....W0....{....eDF/; ...Z./.F.....Eu.....I..Y.B...I.....ar.Qa..|T.*.......,.......Y.s....L#.`w..j..y)R4.vzi......'....^p..6y.mB.p1.y.b\.a

                                                                                                                                                                                    C:\Users\user\Downloads\KATAXZVCPS.docx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1274
                                                                                                                                                                                    Entropy (8bit):7.844856128106687
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:85RolOxHAnA14zr3N+QJjt9Fb6c1kLBqOeWwz9xtEUjsCXx9uiO:8nol+gnAezr3zJjHFr12cWwzrtJwC9uV
                                                                                                                                                                                    MD5:198C5D37247DB251AB9D50A920DA54DD
                                                                                                                                                                                    SHA1:3EAAA868A2236A5F0499AD7CD48981B76E6A40A6
                                                                                                                                                                                    SHA-256:3E237C6F9CE9579DEBA7F964542065EB8772FC948C9AD058E18ECE04F4E48697
                                                                                                                                                                                    SHA-512:183ADC722D5C74E1D5BD85CBC55ED7DD3849525B8255382AE17F91B645E628E6D37F13926B2A45EA3BEAA16E329B25BFBF62DF186EE64DC894D66B806C03DABA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:J....S*.p..OM...|.'..A..~..x..$..g..!.>m.8a.j.i..)_..:h.o..s..._.v..3....K..C..6"I5..:=..r..^. .9...W..f..Y7..U.!....S<......5..UY.&.+...I..lf'........[...F.....fA.{.*...........[.........*..../...Ut...Wy..+az.t$W......Bc..g.o.pr....U*.|o.t......Y.W....H-.h..\H...}.7..Y..c..t..-..z..<.0b.;h.h.y..<M..'z.a..~...U.e..>....@..M..$/E6..9"'.q..B.7.;...T..j..\)..U.8...M&....,...v....hI...k^P]A...5..t..g..1R..^..>W..9.....'l..pq<.7u.z...:..D.uV.n......T{.<..-.o3;..^\g....>..C.. |A.i.....;.....N...h....LR.l....2e.;.......[@.Y@..T...\..!KM.Bq..9...E..f.AVu. .XfL..p..V......O.,\.....N.?...v4....R.=.. ..&8Z./.P.*8.>).nV.R.....f....rQ..cV^RA...-.....n..>Q.^..4_../...<i..wo0.;d.`...!..A.kF.r.......D`.;..9.}('.JAy....+...K..3{C.~.....(.....R...~4j..L...l[....#9+.!_<.H?.......__6>..$...1...2..8.l....!V....~.d.#.....bQJv.*.Vi.j-. .....BB.......U}.K.ppr2M...E..v.....X4W..E....J..'GC;dZ.Qf.Pz.g...$Ey#.A...K..=F....y..BmY..K...8.Rl.vKw.SLr.....Y..I.......3a...e..H

                                                                                                                                                                                    C:\Users\user\Downloads\KATAXZVCPS.xlsx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1272
                                                                                                                                                                                    Entropy (8bit):7.851553008248741
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:FMangn9dCSVtIvHnJ4EQhNgOKYpieQEcKO6+dEs2JbIhUjpXyz/uiO:FMangn9dCgAHihaOKYpDzO6DVJ8hU9CC
                                                                                                                                                                                    MD5:649E4D3729F43DF5040970001AE9E621
                                                                                                                                                                                    SHA1:A5881518C81B519300234F65F0A79173BC583F27
                                                                                                                                                                                    SHA-256:7F1C20D09C627B7CA7029228B5BEDB6121114262B3186E4690D946D1933E6659
                                                                                                                                                                                    SHA-512:41856A936EC0BF6E0B9DCB1DD550B5B9C867A27E7DFBC8920C9A2AE9864478C396A733C740789F6DB3D5D87221DFDF2C8614333F129CF78A262458EF25E1252E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:...x..:.w..8....|.M...G....SRp.t...Tc..-....$......WS....+.vB..up.OA/]SsW........K.;...Yp.X]...7..Xc#....lEhb$...$$V....C..R..n.......o.C...2....bAyQ{u[..Z......e..)O....J....4(.A.X...u.c#pK.t.z..P..)...}y:3....).>..b.[qa.. ,J?+..i.....]..m.......t..,.q..=....l.H...Z....D[hvi...Zl..$....;......W]....7.|G..la.SN>@XfK........[.$...]o.HJ...!..Fv/....yQhr=...<:L....J....OmC&.i.+]Y..o.7U.....J."A.Z..."...m......+.\*}..bAe..F..O&.7...4..rM'.h.`..}..D-.5.mjn0.Tv.}./............h.O..../...[...{.).....A@Cql.M.._.s...s.... ...9.f&.O.#....F..V..a.f.....=."..o..E.3.............`....+.S.A3.<0.:.z...Ns....h.Z'`MQI....._~C+.s.:CX..`./N.....Z.+T.U..."...~......0.G"z..pMt..Z..T-.2...&..`\5.p.p..z..P'...gnz-.Mc.n.4.............f.\....3...F.hf...`......\w.X..0X....m;...50.l.k.......5.s.]....:o.....Ea.l.$x.,...`..d?).....^.]....q~......(.4S.....!..@..#.' .......M......C(.......a.....|hA...)M.1....i...k$.c.S.h.....>.Snk0..7...q;cd....B!....1qkW.>..K.Hl.....P

                                                                                                                                                                                    C:\Users\user\Downloads\KZWFNRXYKI.pdf.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1272
                                                                                                                                                                                    Entropy (8bit):7.845437883606364
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:DEUBRgIRmb53iIlU3pmxg8Cr18c+B3JFXN+z9enDAS5fvl93auiO:DEUBbmb9i1ZmxgrT+B3pO9hS5z3auV
                                                                                                                                                                                    MD5:B958FCC926E0B212157313EBAE801F2E
                                                                                                                                                                                    SHA1:175C4DE525A235D59E7543898CB42546B6ED8704
                                                                                                                                                                                    SHA-256:5669E78BF0A56AE61D1E86F2856AB49926B6A23A9C3B5518E77123E64E1F7040
                                                                                                                                                                                    SHA-512:5337DA40EC1525FB513A3824CE0B883E58D27B9E07197C831DAC3AFBB094E61414AB6F32FA4B09C2C82DBFABEC4194016D43BA3F6DEF5AC723A3A7258223E209
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:...7nm....hI...=]............>.O...5)..y.N.U@..mx.h2...y....S.ZPTb..x.J..<.5<}.Z...(4q...G}.n..%..0.R..^.....X....l..%.C.......B7.....uz.^...S.....C..t..I.^s.3.>..l....~...y...(..b.f.....k..#./......FMV}b...&..E...I..L..7.I..C...-..w}...9K".... h{....o\...6H............+.]...-5..h.S.SJ..xl.y-...t....].GYEe..t.Y..0.7-u.Y...**d...@a.|..'..;.G..I.....P....a..+.H...nZ...2...Hr..+.T....[i.._9D......4..MpGp.........ti.2!.....{i"...z8.{$..X.....Z.W.........'..+w..nh....u.*.*-..N....k..'......L.p....W...{.[....%....MYm.....`..rB.Wr..@..#...9.[..B.}H.xHFl5D.r...d(.':.....As...C.#u..RQ..cR..$....o.n.....[..fM...1...L|..0.T....Pf..I-I......,..@`Ah...n.....ym.0+.....au<...}>.z=..R.....N.^........5..4j..hk....f./.$1..V......}...F..b.....:*u.C ..|....-..}.....xb.M.-"..........Zn..o...P..>\...ZH#..-i..,$C{Z.3k..n3.hJ31...g$.|.Pbk...l%.*.7.....d.#..sz0}....wID.H.nR.7..a...<.Q\.D.$)......y.%.#.z.....]..t..E..q....f'.....k=..q..W.^..Q....2...`J0K4vCY]...C.

                                                                                                                                                                                    C:\Users\user\Downloads\KZWFNRXYKI.xlsx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1273
                                                                                                                                                                                    Entropy (8bit):7.844656956098135
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:ENE6Yz1kebaSdtXE1I8fRcj2IgiMHs+TMbR0tKmGacFKX+RvxdbtRukX1mU5JnKm:kE6edtx82jqMtbq8mGrFKuRdRzmAEuV
                                                                                                                                                                                    MD5:338C5BC394D5F0CDF633DB937F1AA13F
                                                                                                                                                                                    SHA1:A9E7DB4FF546873A94ED9D688DF7B585CE554A2E
                                                                                                                                                                                    SHA-256:94FB26912B0505AA8BFA9A2160A9863FBD535DE5BEA40B54F21935B5DCD55794
                                                                                                                                                                                    SHA-512:92F4DA25476A933B7080F7F94ED00D36A4F541E18F9BDCC339CC89D9D5125F8FEF9C75BDCD79676E79CB89CF41E465EC2F3F4EF604FC1387E9C7304713C6175F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:...........<.6....D.g..e5..9.3....Z."...s,.... ......b.N......O..ar[YW..<....h.....c.......tPp.^..Q.9......W...3.!.V$WC.D.:Aq=1....=.my.P.....W...I.o....3.x.$..$...:..@.(4.wZH..e..*.?665.O...A$..UJ.($...Q88.].p.^..R}...>&e..mv<....^.................).>....U.u..t9.&.:....U.:....`1....(.....j.I......A..pu@Z[../......`.....}.......fRu.B..Z.,......V...7.5.X6YZ.WH.zMq..1`|.z..v.Iaj.....S...2......V..........W...WE.A...!.`)-j.:.^.)I..qu%v.w...=..F....3\....3....._..:.M{.~..,E..u6..xl.G..>..iX..=.......txD[...A7G...T..i....,LC....D.[.oz.ln.......<4G<.j&.$.l!.s&..kT.,7Y...F.Bs.._..n9...q.'........&.t.[.5.\gv@..Q{..5iy.~...m.Ipd.....N...$......B.........D...ZA.C...;.d31t./.Y.$H..s.6f.j...4..A....+X..........O..).Hd.b..4Q..e&..hi...).y..|.K&.....1..nL@...c...+Y......4(...N.R.Uu.....E!.....S..G.3..X....qx)_.......SZX.K.V.y'[..-...G!......L.Zl..g...7.*\t......k.u.r@.....W-.X.._.........gk..O.....{s.#.C.........n.B.T.N|..J..mb....b@...ZQ".._.:..E.CQ

                                                                                                                                                                                    C:\Users\user\Downloads\LTKMYBSEYZ.docx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1274
                                                                                                                                                                                    Entropy (8bit):7.845857513341525
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:k3NnTK8ECdYPEnkHKyWWm6FpxQmJ1EZsm/sA45UGYOYcuiO:aNnTLmPYk1HQ9nxrAYcuV
                                                                                                                                                                                    MD5:DB182CBA631ED8CF774ECB36EA4187BA
                                                                                                                                                                                    SHA1:9E3A9015ACB1E7BC6BFB3A958997623F03548EC2
                                                                                                                                                                                    SHA-256:50C8FFE6F78FE241F328CF934F9862C0F96CF5E066ADB6CD2A8447918F231FAA
                                                                                                                                                                                    SHA-512:A1E1BCFAC594F04CC2070D1FC0221E163A0193F5062403F886C53543917DB797D536D56B0725D2F064A5FF00DEA3AE5341ABA58BAC1457F06595C65B4051B41D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.*.....6.1/..UG..HjBb^"..n.A...i.p.Lf......dV=!.j....e..$^.......M....'..*_..o.2.$H:...Y[..oQ2C.!|..7V!.E.......Q..T.z._..W6B.d....Z]U-..9e.^.....7.F..l.J..f....].-g.l?.....j.2.O.G..n.YJ..z.a....c..[.9...IB..YP. .8...oS.....IG.S.....j{89..../..=.*....$.05..]Y..ZiSgI/..{.B...e.j.Ch......rB+,.j....`..5R.......@....6..9H..t...!J9...TT..lO=M.-`..+S%.J.......O..B.h._..E&X.h....r..Hn.b.$....~..#..Hm6@....8{...."M...+.J.A.r.k........o.."..w(z.....9.3)........nvB..u...vf....g.}.....Y....Ei......-.).A..)$q%"...k.....{-........P.....9c~..6.0)p...."n..y..Q#U|.f.N...N....I...{.1.OX.mNW...2...5....V1.G.....(..0\.{....l..Qo.n.>....j..'..Jl>Y....5f....?E...;.N.K.o.m}.......|..*..u(w.......>.>=........i~Mf.~...oa$...m.a.....L.....gt...D.V...$4j... A.....A<.aA..7q +.......)1..Y\...e":x.WU....).......>...XR@9j*..t..<wg._.i.M....[%}{..j="...7..3(....f./K...b..=.jbG........f~.V~......h..Q.(...-s...}Q.... .....{..a...3pzw.L...KzQ.6..v0.#u./t.=...

                                                                                                                                                                                    C:\Users\user\Downloads\LTKMYBSEYZ.png.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1272
                                                                                                                                                                                    Entropy (8bit):7.844487373758881
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:DvRZFrOlt6WBd1dEEjMZHyXYkyEI5TEjVohimJ//Deh6OiEtobq//5uuiO:DcXru/6DM5rgml/Deh4B+//MuV
                                                                                                                                                                                    MD5:4BB5F74B0C852F96A5E049377209E94D
                                                                                                                                                                                    SHA1:5E3B207073A8D1BD25683CB46208543D46DCAC8B
                                                                                                                                                                                    SHA-256:D51EECC86274B00B1E2E49005D01F3B4A9531C027427DA95461AC9C12BB9413E
                                                                                                                                                                                    SHA-512:85607C63AFE9842CCFED7765778DED1B76F1785626D951559B9520059E809B8CD379B2EB8EF5EDF942AC10CCF68F721AD6E6D92B749C229F4119CAB7F180706F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:...p7D.E..[S.<..Q..J.g......D...n.>..B..........ER..4..\E..).I./.S.t..@B.g.5..j...q93...v...w...jI...V!.<Y.2Y*^..._.6..Si..r.P...*.;.:.1....D............:S...O...!.....y..g..s..U[..-........i.mN.i1.+.,......b....$..0.v...q..[Hc.m.*..E........n*R.Y..ZI.;..X..I.b.......X...q.0..B..........@R..8..QV..!.U.8.P.e..SU.o....y...l%3...h.a.y...qB...A..;K.;Z,@...\.6..N{G}J.y$.yO{]...H.E.f.N.w...o.....3w...%.......*4.m{.1.......`:K.q.%.6..L..u..m..3.0`./7...#.+.....<....y.+.1@^.W...@....J..1...uVk..+...Vw...5.......V.q....m(.e......4..&<C.....s..1....3.p...1.h...~.7...+kJ6ST<.|...u..~Ac...l5 .....$.6..0...@N2..QyD.|1.hQ`S...I.W.u.J.c...|.....&y...'.....j.&>.|..-.......j!K.y.6.>..N..f..s..9.0m.<%...%.,.....3...}.<.;SZ.]...O....^..p=Xf.....D>...Gpk.Jc.Gt....C.E7.....5..........,.h..Q.:..E. ...`...KI..\,...CpF.Rp.Y..v..Sl..LM.....1a.i.[.+p.....z...8..../&z8}...-6=I.9..(b..`.._Zb>....YE..}5.t.#..A[.KGJ.~.).p.z...C..`w......w.4_.........!...O.Q...q..y..S

                                                                                                                                                                                    C:\Users\user\Downloads\NEBFQQYWPS.mp3.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1272
                                                                                                                                                                                    Entropy (8bit):7.83703398907625
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5VbXXKpr4g5FBzyKWi60QqDxfTxBObzG6tpCyXDSQ1EYBCGAvqdobtM9UuiO:7bHK2gR+Kl6EDxfVBOP7prTS7/Gbdo+D
                                                                                                                                                                                    MD5:7AC25776362F875BBE9F04338A38A57F
                                                                                                                                                                                    SHA1:BFC5811762E9B4EC120744F17CD679EAFE2F6B1A
                                                                                                                                                                                    SHA-256:CC74F653351CFDD8F801FEE6BC13B44648954F893BF30396E353AEC16C6155D5
                                                                                                                                                                                    SHA-512:AA8FBDCD5F1A0D1DC827545773825C0A6D68E55EF3D0D05E1419E4A9D79C81BC583DDD112CE1F47A8185BE38FE7386C201325EEDD8993AE5CEA4F8B5401BB7D5
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:mgLuX.M......&.4.../.L.G......v. ....M.t.....PH..E.3...U.C..m.(....HW.E.B/D..._.....H.....|t/....}9.w..6.......a.."...I.Y8j.pk.o..U...P.6....+...N5..vs.-*m...%...&."k.W^M`4v{.:IP.5...:...M5........&I.!...d...*..8.......r......5.f.....2..mlDqS.[......<.?...=.P.Q......k.%....[.|.....]N..B.!...E.B..}.?....SS.B.@.E...H.....Z.....`{1....x<.j..(.....r..:...+....b.R...f....Q........1?*...I5'..s.z........%. m.6t.'p.r.4..C.5.....-..).mZ,f<S..7..1.~.#.Zq..I....._g...z1.!...>....R.jE...5...#..!S...&...../.j..(H5.p........D..]=79...(E{...e......T.....+5/8...s.........V.vVf....O!^..f...o{..[....+_.I_9....c.F...}......S.......'>5...@-$..hpl........".&x.;{.?z.s.$..^.!.....:..7..L".*N..&..2.p...@c.N.....Gp....2.?.. =....MWf..........w..UjbVK.k-.x.K.....E.`.!....u:.....R_......~..z.?..,......p.|.......P .2.*..Y....D.Ki....;\..`...4..<^.9.+...c...Q.a........I).P..=....8R....m.AE.}...Ce..".O.5"}+t..cJ.F .~\..e...V*.C..~#.[:.&;...?...

                                                                                                                                                                                    C:\Users\user\Downloads\NIKHQAIQAU.jpg.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1269
                                                                                                                                                                                    Entropy (8bit):7.81980510002399
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:IXr2r5mr2XkAd4zTj/zPieKhUosO7M7nChT6RpswKPNKEEUvtncuiO:26PqzfrF4aO7MoGRps9FKEZFcuV
                                                                                                                                                                                    MD5:4C9A532461E57E754FC7EDCA760E7324
                                                                                                                                                                                    SHA1:1708C9EB7B2243DED2275C3DD7E4D96BE7F71B1C
                                                                                                                                                                                    SHA-256:CBEE9446933D2C9F54292B474A66A276D2BFEA6112663288DCA8905E67C3A7FE
                                                                                                                                                                                    SHA-512:35598CFC4B93A0871CFF6AA6D8E30202A08FFE3D235EB645BE0F547D5A1F6EBC8FA3D589DC454186FF40D5B75439928E73FB6FA954692937CA977CB218039989
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:...}`.|.~...7B...D..X7.U.........D..2......E.yG..%&Z.~......A.WJC..X]..KVZo...:..SA..6.}3....#m2n..........T....... 1.Cz..)..-W.m,..2..._At,-H..=...(~.}..S..).8QM_.&...N.v.......t...]...l.Ty.ZSn..r............+..]5!~a..Yt...7O...Ej.~..8I.r.l(...z~.c.t...#M...N..K6.X........K..(.....pI.}O..."N.y......T.I\R..^K..]VNw...#..]I..".t0....9u3m.....w....K......;*.Zn..+.........!>...e2.b_MO.....I..I.A.]....q.tU.....w........&.D.g!.......e../..i3#A.J..K......[}+.....c.J`..+.T$..bW.v......&^..Q.....k.9.....S..%A.....[M.......pC<..0>#"._...{Y.../&.AX#n.^.-.\.@..EH.. .r.s....\..[k.../.C1...?jjB...f..X.6...'.2y<.........1)...q:.aZ@H.....X..U.N.I....s..bR......r........6(A.e?.......|..6..s<%[.@..\......Zh>.....m.Ej..).J&..gE.}.......F.%..{!...<..9.N..v..JDB......>Me&8.y...Rd.6..y...l`...w..<D.d.#.U.s...[.LZ..x@...<.....).<.W..t.....dx.j..S.Z....X,.(SR.(.bi.0._..D...k.G....tsIl........l.. Q....*......#.y1..)....[...[k.\{....[..[.&......D.GR.......

                                                                                                                                                                                    C:\Users\user\Downloads\NIKHQAIQAU.mp3.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1269
                                                                                                                                                                                    Entropy (8bit):7.846696112881501
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:sJWr3hIhvnUbYCGEkcev8oOYfY7hImosXNyUsuiO:kAxIhvnUbLqdvnrmosXNyZuV
                                                                                                                                                                                    MD5:5CD812198062700260BD71F7B880C1B7
                                                                                                                                                                                    SHA1:59F25B30AC1950A2B686BAB292165EF50121CD6D
                                                                                                                                                                                    SHA-256:912D1850867453C16DC820F157E9FCA1CA51DAEC9C9BE3A222F732CD40C73EEE
                                                                                                                                                                                    SHA-512:079073DE1D50C3B59641810C0BBDAA6314DC5C986AAEA6AFA32D60F9C4E996F7F530145A67371778975DAB49DE1555CD7C26B24A50EEB06A6DE484A56A546B6C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:N.5.....H./Rg.>.vS.P.......&...s/Dz.R.@81....S..Yjf:..6....[.}.........d~......V...X.(...A....s..........jS8..W!...1.l.!c...eYT....<...!.8\C..`..X..X..,.....|....`Z.h......3.Q............ ...B3y..diP.V.......o........lmS[....W..$...u\.V.~...U.......B."Qc.1.oM.M.......:...a)Cs.R.Z::...._..[wv1..*....Q.h......u..zi..k...T...V.-...H....v.......d..iU7...J?....*.u.4t..iK5....;..\.........] .2..../.tVl....L..I.0d.G..##.-..i.S........G..../;.(.....0..D.:.O%..y...........G[H...3.M...-...RQc..[.[...0..3H."h..l"..BII..p...N...........2.....6.....UP.=..y%..3C...G.nV..Dx%..h.1.6..t6.#..)....GR7a..Z.../y7........mI9....;..K.........E*.&....+.~Fc....Y..M.&c.X..=;.-..w.^........L.....*..1....."..U.+.G/..l...........ETV...6.Q..'#....h7..A...t.}....&..."H.^_7n.m.a....~.y# ...Ki>W....S(e.....y."....-.....:.....)E:...W.J..L.._.B......9....../u...|..4A.|.J..U.I.r}...P.......H.Q;..M..1.-(..UBA.H..~..]..'..\....X|...-.....=...j7..>6..E.t..@..!= x=..D...

                                                                                                                                                                                    C:\Users\user\Downloads\NWTVCDUMOB.mp3.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1273
                                                                                                                                                                                    Entropy (8bit):7.8691636480665474
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:0IF65J8vktZiVrsSrFwGDd8bPEUYwogFD8Yzm7W2jAiuiO:0VH8vkXiVrpKAdmAwoOAs2VuV
                                                                                                                                                                                    MD5:048E9FBAFA12EE9DBEB8860AAD93E783
                                                                                                                                                                                    SHA1:B6853F89FD52840637438F13E23699D533F1914E
                                                                                                                                                                                    SHA-256:6C45177593C8E704ACB3F2F448AE4631544DC4D1CBB1E6F24CD2249F1AA91EEE
                                                                                                                                                                                    SHA-512:99D748A871EC46CC950373463CAD78B97EEEE065F9ADDAB7E224F2D1F849CFB7996448D0D7574BFC718857777C9C2E292C4C36DF8189A1DD733E123B0E952C8B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.......h(..N,..G...;)..p..9.W&A...........Y\..R.....0Ki....BqC.o.5.[?...~6[........0....@...^....:Y..Yk.....4,h[....<..-.3>...u..................Gh.g..b..}.....A+[1w.N.p..5...TC..Z..[.E...u.|........sM..,.D..../..(...l.....q........O..j.T..h.S.D.....,.d#..W+..Vm..4:..p..<.W$W...........GX.N.....:G....._hV.w.:.K<...x#Y........3....^...L....7F..Lg.....8 b[....(..?.P#...X....e.~jcJ.._"\.....l.....~......A........4...51...o.:.-!.o@%^=t.3..+.UR6k;*.......!.NRn.sa.Uu..f....r..f6...xc6\A"_{o..*.tn.....}..R...G.9.i.|.....e&G.\>._<.2.&.}Fc...lXy'.yo.V.{k..ll).s..A{;..=...$...8.=.........dE....K..e!...,....J.-c....N?...F....~.`bg_..C7B...........}......L...$....<.n.<%...o.(.'3.iX8^-{.0..2.FT7o,9.......(.LNv.g`.Cb......p..u?...ta3HS4Rq...[....&..pU........3..J..{Q..J$.'.tuKP.p^Q.....<I.2..>........}A...B^d .~{.\.@..~..~oc..C..#.kR....-.<z.N~dG..0....J.A...'.L..2r..v..E.rl^.w.....?.a...Q.OE@|6..pjB...V..].......j.%Z.d....y.d........w.z...G:.8MDF?x(W..h.=..4

                                                                                                                                                                                    C:\Users\user\Downloads\NWTVCDUMOB.pdf.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1273
                                                                                                                                                                                    Entropy (8bit):7.86097130769708
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:EkL1uWGKheP+rK/hNsoO5wu94KxSAdQweF9krwB223Oxpy8Es3poidCil+nwvqgD:EQ1uWpwGW4jwFMfK9u2mpybziM2rOuV
                                                                                                                                                                                    MD5:4A4C1EAE2424A24910E4B808EF69388E
                                                                                                                                                                                    SHA1:C4920D4EC9611635B7531514EFE109AC13E81229
                                                                                                                                                                                    SHA-256:A70D0027A391E8478CD7586045CE85F006910DC4AC176E8000D964E8ED998A53
                                                                                                                                                                                    SHA-512:163D7CE44AAF9993A9A45F968E427E9CD976D76568CA490E36AFBDC2AAF8EDF117F83C62F2E4C8E2959B8BA2461555B6533CDBE65A7B953AB263D3865A582867
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:..y.h....^..-....mS3..d../..E..D@...8../4B....W..{..yEg.....;.Hq .,`>u.6...h.....i.P..Km.j.Tx.M..1..pG.....}N.'9..z.~..z..)...>...4m.:j4..oN..}.#,.LE.%....T..RN.....&...Y.(.d...E........I%p.o..vLy..n.}....v32..y$FZM..d./ E.v..eh.C.,HT.;T.....z.~....G..7....b@,..{../..B..NS..2.{5:^"...K..m..qX~.....,.Ke;.*u<y.8...x.....o.N..]..q.Vu.@..#..|G.....rO.-9...p.|....al..9.>R..]W$.....g3YB.8 2...Z...|&.])J.0y.U..a....}.G.s.]......b.p.I.5/U.Dc.......v..L.y...h.._hl..K..C.h......r..g.:...UU.q.K1...@F...'\...&.P..I...Z...I...-d.'.)..dH.....?vr-..a.o......l..z....GN}.<TA...I..g6.6..,.01.....4..?...lu....dt..3.%P..YB#.....|4YY.8!&...V...l*.D)A.0p.^..p....}.U.y.U.......w.i.Z.4+B.Qdu......n..M.o...q.Qik...X..D.j......b.....xRO....%.. .........(]....a.0<.`..B../..T...Es..u.Z....}.E..2........tm~.43..4e............2h...2'..R..n~..E.%.....@D.I......K.s.R.((.g....r.{..d{..#.-,.^..{...Y..S]'6c......@hx..$...$.....2.~C..*...:d....h...+..D..'i.

                                                                                                                                                                                    C:\Users\user\Downloads\NWTVCDUMOB.xlsx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1274
                                                                                                                                                                                    Entropy (8bit):7.841166440166036
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:8ad8h/egeFYX8lLX9KltGkgCc4Ak8l1TfmdEMtL0RPq3KC2YuiO:8ad2kWMJ9KbGh4Aku1zIBl0pq3KCJuV
                                                                                                                                                                                    MD5:4C6E4CC6262A50189A10AB4BCA577064
                                                                                                                                                                                    SHA1:056B91DA38CF7F3CDAD977304505A3FBCEA98FBC
                                                                                                                                                                                    SHA-256:2939F8F83229DCDE5A29CCFCAE3E3E13B7E9BCC4ED58A9CED02CD26F06EE99D0
                                                                                                                                                                                    SHA-512:FDD08FAC9DF7A61E880CFF1027A72039FE39BC4D289CD6964F77E5AFD97436F0810380950C5B4ED6E7E4EF47F9D7B63D89799FE7E941929D837303EE73A1D947
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:..W..o....'...*E.....zv..*CI6.O..KZ.}}..>..*.1_.A.M?.c6..C+.i...I..{N...#.....3.]....*9N....r.} .K.5.S..u..w.\.m....3.<.........t.N....g..].h.....,...'h..8slq.~.....-.,:..J....W..yD,.1.!"s.!...~+.. .{... e".c.8/....`.;.8.5.[.[6/..._.t.......L.+..Y..d....2...#L.....ss..(UN .E..AH.|c..0..:.-U.W.E".v%..L<.j...\..f@...3.....5.C...m'"Y....m.n5.K.(.[..t..}.K.v....!.........4,..0...r.A....r.F"....6....../z......?..Z!..U........a.xL.u......$6w.3.....^.....bU.!.....D":Z.[7.A./.....I7..hwx.....].b..C...:n-..h.........~..U."...ZJ.../..}.y.^.i>.G_.....~.PZ...n.N...P....N."....(..].g.do..NI.9..hs...D%..p...B0......../...4...n._....i.F#....;......"c......4..K>..T........|.hC.v......%2`.&.....X......tB./.....C ?E.R'.F.-.....C'..u.......hg..N...{.SC....$9.....[.`f..-...N^.....!.....']..@.`g!.8r.3.&.E....n..^..._.i......r...S..O.M..j~...9.1.3'..!.B,/........6.#.a;.....n.V..../W/-..........X..i.>X.....mI..Qf..z*...9.......8!.|u...2........Z.-...)0

                                                                                                                                                                                    C:\Users\user\Downloads\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Downloads\UMMBDNEQBN.docx.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1271
                                                                                                                                                                                    Entropy (8bit):7.85877522513615
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:nKrBNUEZcrs7ESmcc03I8rGGErWf5nQAmmUuXXFIX6bHz75tUq5duiO:67iarYTG5QAmmUAXSXwxGUduV
                                                                                                                                                                                    MD5:B4FE4EF7A7BE1E46AF8092403894CBB1
                                                                                                                                                                                    SHA1:FB506D46A861F6A65DBFE62D75349B9A78CEE9FF
                                                                                                                                                                                    SHA-256:3E268D458B29F86DF3B81B399E5FD1EA3933E61D95246830E87CDC75C16461A3
                                                                                                                                                                                    SHA-512:9544F2BA51A696D3DFBDFDB88068FC1EB262A509114028108E5F571BD3B48E1FBCA2A14CB9CECAF1F0C6DB64389482C3C236136569193E3E3068CC41F85DF815
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:*.`..c....*.B.nX....|.....Zn.N...Z.G..&...}.W...=W....(.......C...C..@..AY.........J.R...j......Xa..5m$9#&YF..$.W..@/.#.4.jF[SE...ha.W.P.....f.@^/.B9...DQ..&.P%..4."R.,....} .O...pB-..<..`.9.....Y.....$.0.m.=..&..Y.GU./..)..$.E.....?. ..O.*C7.k..i....9.Z.gX....y.....U~.^...N.O..'...c.S...(Q....(.......V...B..]..@Y.........T.W...n......\r...a4= <\[..".V..O(.,.%.}sL.5.e 7.....Q....!h....b...C.....j..x.X..F....A...{....B.PQX.e-..'.:..}...:4".$).C...F.t.....*..l...&....Z.l..WH.".q.q...1.:..z.b4.h...E..A....X......c........:T3jT....>...........u)i~J.ZI.{6,..J........Q...........z?.P.w..7..|.....p|@.Q.."..2.quZ.#.m+2.....K.... t......V.....h..e.G..A....Q...p...G.EPN.p5..-.$..o...?% .-5.Q...Y8g.....6..f...7....U.j..DI.%.x.o.......9.uz ......5..].Qo8.i...x<9.1..2..6)..#....eF.4..[4..........|.*.$..O?......@*.....Wn..HX.0..K..%\.L!...`..AX..I.._~.O../.i..e..V.q..x.J.....E......~..f"....M......by`A....Dz...R....H;%...1.Vc......[.p...=b(m...ZR.rW..

                                                                                                                                                                                    C:\Users\user\Downloads\UOOJJOZIRH.png.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1269
                                                                                                                                                                                    Entropy (8bit):7.850087156620049
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:5Q6E5jh/CxPfsmAmlBUR/toJP61aeDYBeh5ZUuiO:+6E5RCxP1tUltqvepPUuV
                                                                                                                                                                                    MD5:B8F863848FA08BA7A1572694055137E4
                                                                                                                                                                                    SHA1:DF16A2BC3DF65D64504A8D7BF5B1B20966E3CD21
                                                                                                                                                                                    SHA-256:67E88735F28EC6B5B44270D2259E158DE25E2D9AF70F5CF3F853D512D9855F7E
                                                                                                                                                                                    SHA-512:7EB9D1D644CF49A8654711EEB2301451799BD71833648B948D622721FB95F6583D2686C52166EABF9E6A2FFB737CB902A00263D34FFCDA3581843650FA3542C0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.qN...R%\.".L.y..+...Y_..F.rD.o.g...Ap..b..M.T..;&.kW;2.....`7.D.1......`....\"6.n...i.........(.....P.Q)b:...@4..>(Lu....h..0......(.._....{...T..+..\I.!..m..X.0JM.j..!..~.-2...s..g...a.AY....Qc...e..1u.ev%8..N&...k.Cg^.x.+.%"%!...)...../a.\.P.pG..P/V.8.[.d...,...MM..C.bO.o.b...Hl..p.._.Q...2 .hN3"...{2.@.+......c....O1).u...e.........;.....^.^+.+...Z,..!2Cj....k....)........e..R]..Q.fnp....q..#..*.dd.3...!.|N....p..6.L..f~.)..3.......G..[.J.\E...`Q....j.~y...a.O......*j.O.?.3....&^gk[...Az....+..v....m......'nA..~<.2........R%...X.]...x..C.y.,H./.HL..9.../.N... .l...,.......l8:.^..~>.....#.G.e....r.'...1........a..FQ..R.|wq....h.....$.lz.2.../...mU....|..%.M..sb.-..3........W..].Y.TD...oB....e.sr..s.Q......5..O.9.8...rJ...W.rb...-..>.6{m...&.aGZ.p..zi....-...X..g_....i_.*.6.....!N..).J.U..........~.RJ[.C.y.S.B.5.3.|....&..N.C.U..f.^Wi..g.A..UG..."...;R{:.[.s.+....|..U...Bln.#.}....X.R..l.......&.0.....`......7.k.*.^!kR...(........E[u

                                                                                                                                                                                    C:\Users\user\Downloads\WKXEWIOTXI.jpg.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1270
                                                                                                                                                                                    Entropy (8bit):7.849365901547006
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:L3Clh4Qkn2WOksYwJADKesqHpqXbVgAYgcQ9+kKXmb0juiO:rClh4QZ0sYwyTsiU1GDjuV
                                                                                                                                                                                    MD5:5EC8D94AA15F54F5C026858A4482D73D
                                                                                                                                                                                    SHA1:AEA93D9951111825FF7BD71FA649ADC3D3C4344F
                                                                                                                                                                                    SHA-256:EE453CD5F8038AFD60349F05447D09D27DE4C78021AE6014F85605234E2231C2
                                                                                                                                                                                    SHA-512:D0A15CED99104FE931BED5F8A3D6E567E08CD8613EE24E4CF2E3C77DE51A769E36214AE2736361C04BD330558808E9C30E601AA215BBA47552ACEA325BD5502D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:....gdX~......CK.....L..E.N.s...,+.].RD..e.........e......K,d.F.%..]...E..\s....Tl..m...............2....`K..iVxu.d=.CI.:.[.{SH?...}CK{.......G'.,...}.TO.D.kM..f!.[.J._.A#... ..v..C.`.EW,.>.(..D.6.A.-...jr$|."q.M.....PuV..D/.8^j.w....I....|..v.C...syPs......GI.....M..R.T.g...=5.J.^]..u.........k......@?l.R.&..T...Y..Ie...._v..x..............(....g\..zXsc.s=.PT.4.V..U%p0;.}.....X._.JX.|Y6J`R.nn...X...>..>.6..p...j..;.i....t..V-..]..u.lk6.&9..r.-...^...:.E"....w.V{l IS..c.5......nS.}..Bi...fH........qc%.U......9..`..%..7...m1.H^f..+~.-T#4h.aP3. W..l...s._....nO.{].R.].:.'P......:..^.,.&..N.'.M.P{.}......T*{12.f.....@.[.GO.}H.IaF..t...W..1..2.%..o...f..6.k....g..X...S..a.j};.$'..m.>...]...%.\*......t.Rc.=R_..y. ......r_.{..G(Di.30....#....XV+dT..._...p0<.5.3.Q....Rx.H...U..XK.6..a..-c:...f-....3....+6.e.......5.5.....!....%.1~:.h...?....'.I...n...,.7F.....Si.5....>..=".....|.P.....n...v-....O.....)..Iz.!.G.$.....?".(T.!...gB....j..83.3.`...g

                                                                                                                                                                                    C:\Users\user\Downloads\YPSIACHYXW.jpg.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1272
                                                                                                                                                                                    Entropy (8bit):7.835753276676039
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:hFWAN9shb9HEdCS76W7Wiw/g/hHsUaaN68Imvfsu6catuiO:fN9WSvCifhHsU9ImvHWuV
                                                                                                                                                                                    MD5:34D1993492460A254AFA0AF538B94644
                                                                                                                                                                                    SHA1:ED34012CF82BE114A03630268F7DCFF5C19820DB
                                                                                                                                                                                    SHA-256:F51A729A475FABE2DEA05DF169476FD2C54C9E7CED42E65C3F84162F47CA1C8E
                                                                                                                                                                                    SHA-512:EADAD63CFF32DC0B7AD86DDC117A758C91526F2FD9F35509E18AAAA81440E0A55FA2C9343D736B47563D9133925F93E404114BC3520BC730973DCA996184D828
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.{-.d.+9o.c....r.X....J1..#.2.....wi.k.9.p#.S.....~.jo.z..Tvk%.nf^..kgK........C.w.R.+Q......G..hY/......J..~....tQ...D...b>...A....].:_*\_.k...........2......B..-..o.g.)....m.......[.D..fU3>.....".P..N........%r...:fV....j.P..21......U.f#...c4.d.'%r.p....p.F....U1../.......dr.r.(.|'.P.....r.dh.o....Ppi4.juT..afU........@.h.F.-E......Z..xY6.......V..e....`P...Z......Dz.....m..&z..i8.;.. ].t....BT_....v..1`.....7.3X..`.SH.*..lB=.hirgLL.....**)..$...[.}....z.|.N....{m............J.y..m#n..#.s.[..5....2...2.Id7A.....l.%9....EU.4u...t.. ..[........UK..c}g...0.[...h...W.3|..d.?;.9.(..8eT*..v/.b.Ql...7..8.X..3....Ic....d.. y..p*.9..<].|....BEY.......;|.......=.%B..u.]_.*..dO,.kax~J_.....9=-..5....X.d....{.a.K...at............F.y..f9{.NrI0O.zh-..;>.b...G.Ns.7..u..J...Q1.X3..J<,.~....>U8.&...%...B(+.....@N...p.R.S..Bx......kk?0.+.......&.T5...o.3.....;..V..EN.;.j(4.Q... ..L.1(l....L`.t..X.[.I...,...`..F.+r#...PX......*..%l...f.9..p38O.G......*.....J_J;.

                                                                                                                                                                                    C:\Users\user\Downloads\ZTGJILHXQB.mp3.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1273
                                                                                                                                                                                    Entropy (8bit):7.87151759734963
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:qltwbYhc2r9JfrQgu3Zk+wcybj/IO6BeVurQcsMBUK2kcrALRBtjut/SbBuiO:EwbYK2pJfrW++M//H6ccr3sM2K2a9ytp
                                                                                                                                                                                    MD5:561377147865400ECFA02708B8121235
                                                                                                                                                                                    SHA1:ED94B0B9CE0B633651F216CAF088E6C7489C7DC3
                                                                                                                                                                                    SHA-256:187CCD74460234767A9584C3DA8000A64618210E6D60BC673FD4F80036A9ABA9
                                                                                                                                                                                    SHA-512:8053B189297C20886E2CE3357E102DEBE2D53B25CD87C9EF859DF56708BC30F9C0047ACC5628C95665B5F240F23967D1C844FC8D7FA7A1E3157C66DC608926C0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.F..z:.!.....y.V@...q!.sT.;*..O..o.....q...m.....c.u,..H.......>..<89..l..;..5.X.h..;^.<.[.0a..G...[... .9.^...OkZlM../....L:mQJ.Hd0%..].K.....4.....S$.R.'......Tm..5.W...%.-D.Jc....*.+...I.\HM...9..NZ..^....:...}.....1Y.......~.....,...x.F.K..~7..<....x.XX...j*.r\.*,..I..f.....x.}.e.....q.a7..X.......(..57=..u..4..3.G.|..#E.$.Y.7d..Z..C...?.?.X...Du@dQ......=%..8..jS.B...).2.....m..J..mU[HP.n..Aa...O.;.".p..At|.4r.....#...........1.s.I.@G.yy.'..._.xMT/6..ot<..... .....:..x..3.0.k....8(r....@..D..=bi........h..|.........tq..z)l.E+. .:.#...'29.w.7.....@.gD.X.7pwi~..;........q.3r..H..<.L.fW.....)+..2..`J.G...5.(..s..x..U..oMZVJ.k..Ow...T.8.!.m...R~w.3q.....$.............>.`.F.]E.l}.&...T.{ND%>..qu0......0.......p.^0P....]+.3l.7.0..1g........}..{;j...0i....P...)`..|.f%z..V".N|.;....5..?..3.5...8.]....jt..&.._3..Dk.9...!...<........./.y/...}.Z<.....\.a.4.^...3O.6.~.OVlj..B.c_}....R.~v/M.....8.1*..+...j.n.T..!|.v...,..\....i.@...g

                                                                                                                                                                                    C:\Users\user\Favorites\Amazon.url.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):350
                                                                                                                                                                                    Entropy (8bit):7.342452149106623
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:WPEDm+YEc4Q5UN9v6UPWxBk2N4X10YzgeZugobZDB+uRKPXh6RMpth6bAL8hteb3:HmLEcLKN9vAbc0CgOuddlCgu6bAkteD
                                                                                                                                                                                    MD5:E1ABDBBA6425F2FCAB16997F162F5A02
                                                                                                                                                                                    SHA1:47E29C0040FFF2F238AF3AC4DFC1C0A74308CE71
                                                                                                                                                                                    SHA-256:D8BCF1ED7918F32DA88FB16B7AF282DA4A757D48790A0B4430BEEB0828FC7F24
                                                                                                                                                                                    SHA-512:059174DB2B33492153281F016754C6F79D1483BDB6AC7D293332E2B646BB43B53F26A0B909A4FC08281D231F22835D593DC2194C473403351FA5322A362A1369
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:q.[...cNi.G.....Q4q.G.I..3.?2........_.?=aA.=.....J-....z5.d!9i.r.(.f..f..^.}q.k.b..o..c.q... ;m.d*Rjs.r.{...r.{.^.kI....q.eB.5.J*...+.....*.....+>..,.:....2....tnc.;...v...e .g.....q.3g........w..Q.%T.[.i...0E]c.h...1.............H_...p.0H...Xa*r..Z...5ho*2..p.88......4i..(.@.... .;.U..!.Y.PKv..M.6...5.y..N..`....[v..]>..<Xy.=._w.]

                                                                                                                                                                                    C:\Users\user\Favorites\Bing.url.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):443
                                                                                                                                                                                    Entropy (8bit):7.530568230769607
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:kwcFucBNvFcmu3kXT4Z6vEvjHEk7c4UCgu6bAkteD:kwpc7vFGkj48g7EuiO
                                                                                                                                                                                    MD5:B63B238EAD0EC83CC0028A5A714B705D
                                                                                                                                                                                    SHA1:76BEF254BAF33098BC9E12D5545A207DED789834
                                                                                                                                                                                    SHA-256:76A982B8DE91573EFAB200CA821ECC6FD7011F1D8EAB2403444E8C99EB7BC0EC
                                                                                                                                                                                    SHA-512:08880B5C1D17F856257C620E12CA5DFA538B757772B1AAF7BCB558AB02F31B102D68D2E6D06F2C74AAB8D73DFC0DE8EC0A46FD8325ACCEA7EE13E15EECD1B546
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:n.[g2'9.......Zk...T...X...W.....]I.D6....m.....5O7JB...;..3 `yc2..>....s.].Z....;...wl....p.&.J.#SR...C.u.{e.J....u8.........=y.,....I..Hn.F.".K...[i}.C...&4z..^S..k..2....+._.~..=.}.8.r..e..q..&3..v.t.C.*I.....j..B.5..J*O..+....].*nd.Y*.l/....nQ.1...9.G....1J..%?[.\|T.......t{+ _.hR..\.He...0E]c.h...1.............H_...p.0H...Xa*r..Z...5ho*2..p.88......4i..(.@.... .;.U..!.Y.PKv..M.6...5.y..N..`....[v..]>..<Xy.=._w.]

                                                                                                                                                                                    C:\Users\user\Favorites\Facebook.url.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):355
                                                                                                                                                                                    Entropy (8bit):7.43008073398738
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:6tNL2GHtSE0rcRjxdseOJRngesg9x4YrxtLjOlidoJJB+AB+uRKPXh6RMpth6bAP:4NSGNkr9eUhx4Y7+Idf6Cgu6bAkteD
                                                                                                                                                                                    MD5:BC5534DA3746A6FDDBB39ABDE6087EA7
                                                                                                                                                                                    SHA1:94CA5C21D045B1FEDF6788254AA1C26874FAC356
                                                                                                                                                                                    SHA-256:98A31E0C7F1D1776035A25735A4024747708BF7DD5BA15CB649B75E0D12F6D40
                                                                                                                                                                                    SHA-512:00DB5A93ED7F20031ED5677E437DBDD9E91CD76DC6A97CBE061F292F22FA3778CD091E7C29BE87F8DABBB32E34AB6D7143A060544CD91B396D3DAD29A6F486C0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.b.B..e...JR....n......|.C..ZN7.>......\...<.69..O.y.yD9.J9!....s.#.6.F.........o..k...t...Q..X.!:..Rf..#..D...~.y.A.fI.._.z....L...J0O...+.....*.."#A.B.=..Wd.}"....Ny....%M.F.N].Ga~+.:.....D.x4i1..0.m..,..'#al...0E]c.h...1.............H_...p.0H...Xa*r..Z...5ho*2..p.88......4i..(.@.... .;.U..!.Y.PKv..M.6...5.y..N..`....[v..]>..<Xy.=._w.]

                                                                                                                                                                                    C:\Users\user\Favorites\Google.url.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):347
                                                                                                                                                                                    Entropy (8bit):7.411466699758301
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:y/sJR3WMNMCxSKzt+dqs8+Z3rfPQqjFL92B+uRKPXh6RMpth6bAL8hteb3:yYR3JdSKzt+dW+hrfjFOCgu6bAkteD
                                                                                                                                                                                    MD5:28899C640EC2D4B0A7EBCBF3F431471D
                                                                                                                                                                                    SHA1:97CAC3FB8EED4367979A0825807F552AAEAE2DD1
                                                                                                                                                                                    SHA-256:22A417FDC65DAF550D57ED213143BBEC59D7D625ADAB80C3FEAB0995224B08D9
                                                                                                                                                                                    SHA-512:7E02D50754D9D7F1FBACF0E8BFCFC2C7E346910FD50A0379B5675F789FB37CA2A640F3A44D086F4DA2E0CC78AF22AE3CB872218D9EACA53662590C5D117B4D21
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:>....J`.....(.<8..!...|VPj:..Q..U+S...N.,.T6.am..m..j........C'|}.Jz..".z..c.Z.}.K.4...W....z....fi.+....p...*...|.A.&....V.5..J*O..+.........8.NRj......_>.....n.....eq...q..=.l..F./......v.'..5......f...0E]c.h...1.............H_...p.0H...Xa*r..Z...5ho*2..p.88......4i..(.@.... .;.U..!.Y.PKv..M.6...5.y..N..`....[v..]>..<Xy.=._w.]

                                                                                                                                                                                    C:\Users\user\Favorites\Links\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Favorites\Live.url.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):344
                                                                                                                                                                                    Entropy (8bit):7.373925011966054
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:OwcE1i+SbOiG54dW5MSforEWvjyzwgZ+guh3+62B+uRKPXh6RMpth6bAL8hteb3:0E1iuU+Macswg5Q3tUCgu6bAkteD
                                                                                                                                                                                    MD5:F17588F9F8179A261590CC8DCDD5CF54
                                                                                                                                                                                    SHA1:9BABC810FC5AC93784A1AF33E443B90091B73898
                                                                                                                                                                                    SHA-256:B8D59EB4AFB40449488DB8D5A395F35BC5C5F3C50BF64AB430B4F62D258E24A8
                                                                                                                                                                                    SHA-512:1C73A6A9DD740E7FF2F7170E40710945B4559B0BC69AF1AD36D2350C9BA2275A603006CDE89D2F31950341D69F19BAAF3B31B53C9A5F3DF229E7A0468FB42F08
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:Ns.U.9...6.%...".z]H.!...#K.'..R...86:..;...)....z..).......].w ..L.^.p@....4..j.s..|.;...4...VoN .FD....v.l.A.*I.....j..B.5..J*O..+.....y.....~.p.....)...-P.u......b[..S&..!".W..m.#....m.@2._...e...0E]c.h...1.............H_...p.0H...Xa*r..Z...5ho*2..p.88......4i..(.@.... .;.U..!.Y.PKv..M.6...5.y..N..`....[v..]>..<Xy.=._w.]

                                                                                                                                                                                    C:\Users\user\Favorites\NYTimes.url.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):353
                                                                                                                                                                                    Entropy (8bit):7.313086024910532
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:JRXavNVY88xYfjTMpRuxnrHyIdyPXc/RgG0xOLgK5Vg5B+uRKPXh6RMpth6bAL8A:JRKnRzMenrHyIdyPXcJD0EICgu6bAktw
                                                                                                                                                                                    MD5:05B7C0E2ACA9DBC08B040522B07F6CD4
                                                                                                                                                                                    SHA1:8170853E1C911F19C9E55FD71482A5D5E9235AC0
                                                                                                                                                                                    SHA-256:14F089C42F39AD8D6CC90C0B92E491F8CA69A7E72BE893E32D60D41826D73387
                                                                                                                                                                                    SHA-512:A62D8910D632213085BF8063C3CF9DB23834257F70A47D34A16DBA01BE57C88663BC02B58B00E0027D8E69D3F7824A475BA2BAD462B5BF511CECC6D5EB0AE323
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:....... ..?voYe2d.).....#.H.......X}.....i..g.a~...o..!v1.....ei{.5...<5..q..6MX..V+ROj<.eMC$.C.......Bo.wt.2..F.N.M.iI....v.{C.@..S*O...+.....).."l....r.dXo.K".D.y.%6..+|....]Oj$c....M..c(g.o.jnA...)r.!..n...k...0E]c.h...1.............H_...p.0H...Xa*r..Z...5ho*2..p.88......4i..(.@.... .;.U..!.Y.PKv..M.6...5.y..N..`....[v..]>..<Xy.=._w.]

                                                                                                                                                                                    C:\Users\user\Favorites\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Favorites\Reddit.url.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):349
                                                                                                                                                                                    Entropy (8bit):7.399403158803937
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:9j1ShwnOiMR5mWPePaU8lsBDqcYAHx2Oms6yB+uRKPXh6RMpth6bAL8hteb3:DSunIDmWPU+cd2S9Cgu6bAkteD
                                                                                                                                                                                    MD5:FD88C92B95F9768C45E593B7C8B649F1
                                                                                                                                                                                    SHA1:B09BEFFE2A7A6847EACBC656730985F69B1B61C7
                                                                                                                                                                                    SHA-256:D0AF6B58FD7A78802ACA3A85A2BAE1AA873C807559B052B457949B21FF23D191
                                                                                                                                                                                    SHA-512:C4E9278085A9A6E3747E6A08903BC364DE88D47A70F584D2BADC2E9AE16FC61D76173A3C6214094DA9037A6B4F26FD4854E86A247B5D7902E03F6B488417F7D3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:....E.LFP.x...f..OF.....p.s.yj+..8.ry....J..[.AC...1p....f...#9ec...X.;.....R...\.g..<V-.,...X.6.{.U~..*bX..z.~6!...|.A.&....B.#.JxO..(.....*....N...+...h.\|W.'.V...;|...4..*.k....F..r...x..z..fuU..Y)Ah...0E]c.h...1.............H_...p.0H...Xa*r..Z...5ho*2..p.88......4i..(.@.... .;.U..!.Y.PKv..M.6...5.y..N..`....[v..]>..<Xy.=._w.]

                                                                                                                                                                                    C:\Users\user\Favorites\Twitter.url.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):350
                                                                                                                                                                                    Entropy (8bit):7.416949388881332
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:w5yWhmzFOCO7V6cCGb3AjQS3RHQcE1NmEYAHJYzN8+Jz//MaUZe50KOBsB+uRKPV:wX6FOPtC6U3Nc1ND1iJT/MD3KOcCgu6U
                                                                                                                                                                                    MD5:B7507DD131D2AF16DCF79BEACC7CBC05
                                                                                                                                                                                    SHA1:AE095C37D757F703D5D4633ABFEF4679B6117BA0
                                                                                                                                                                                    SHA-256:48C8896FE904A5161A21B078D49259587C58257310E526EB0667783D6B353213
                                                                                                                                                                                    SHA-512:FA501D0983590E5C0A62814FBAC41E6461446BCD2BCE54A1BACFA90C1C2B4EA24C7ACC2D644E164BE6EAD9B9E7897264BC2346B94DC68F3BAA1A2843FB8AE6BC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.7.2....k.....E.k..a..3.rj..v..o).I....Ot.b.=..(......P...p.`z<.b....5..l6.?...V...p.%R<UJ...x}>....)../..XC......h.s.P... ...!....@.#.JxO..(.....*..w.;...../t.9Yf.Z+-,.....R|^..E. g...)?....*(^.uF...../U.](.h...0E]c.h...1.............H_...p.0H...Xa*r..Z...5ho*2..p.88......4i..(.@.... .;.U..!.Y.PKv..M.6...5.y..N..`....[v..]>..<Xy.=._w.]

                                                                                                                                                                                    C:\Users\user\Favorites\Wikipedia.url.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):356
                                                                                                                                                                                    Entropy (8bit):7.384455070020149
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:ZJgQKRrNN5la3rzPLYYNOR1cYA1QSGxPfFHdAB+uRKPXh6RMpth6bAL8hteb3:/KBoLYL1cYbSGxPv6Cgu6bAkteD
                                                                                                                                                                                    MD5:C72716BE20CC304C12AFA12942E60BED
                                                                                                                                                                                    SHA1:1564E4BF9BCAD93EFEE96484823475F6436C1AC8
                                                                                                                                                                                    SHA-256:F33F744715B1BC7658073271605B5264696C30DD20A0E5B8A3621B375EF832CD
                                                                                                                                                                                    SHA-512:5F9F753940F8DEA9A1D5AA7EA8CF48603457E80424440844E69012C46563FBC04B56000ACF0A43F9F4C637181DA697025A0B9CAA7988DD9254AED788D91BCCF1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:..S.D..o.....d.B.]..{.`...%..E...$v...i....I.S6*.:..Eg.+.ykg.#..r.....N...F.U..T.~..s...R..y..v....'...S2{..v.q6-...6.U)z......{.J0O...+.....*.."#....k..hD..".B*\.Z..(7K..@.~g..jl4mVb..)..k..2`...U..2._..Mf.l...0E]c.h...1.............H_...p.0H...Xa*r..Z...5ho*2..p.88......4i..(.@.... .;.U..!.Y.PKv..M.6...5.y..N..`....[v..]>..<Xy.=._w.]

                                                                                                                                                                                    C:\Users\user\Favorites\Youtube.url.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):350
                                                                                                                                                                                    Entropy (8bit):7.292238701762065
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:+5tx6o0CqxBVy0mBA6QkXMYAHEjWoSrA5dqjfh+6gB+uRKPXh6RMpth6bAL8hteD:caCqY0mBjQkc4Oc5dawCgu6bAkteD
                                                                                                                                                                                    MD5:09647DC1979417177A625A074469B1B3
                                                                                                                                                                                    SHA1:74C040EEF886D60AD7167CC1FF3050F27213147E
                                                                                                                                                                                    SHA-256:7BC1820950891985EEF47E270DAD4ED98531796FF53D9BDF9A3543A3984768E4
                                                                                                                                                                                    SHA-512:2A142B5C0C759485D27A6A9676D7BBC003F303F33E2A00D8D925754EF4B3E64141C7DD101ACF3A2C684DCFD6E970F7BEBF957A7B35BA896CC52FB060E35DA829
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:y..3`..x...Y|..N@...w..F.%'.L....^.W.|U..NY..t.1X..D...~.}.._.f....?..z.n.....Y%.?.a.E_.)..&...7d.].\..D.....p.o.P...7...&....@.#.JxO..(.....*..EC.;.....=.c..D.W.i...\.ZE+...P\bk&'.B.(..1W6.%z{o.......N^h...0E]c.h...1.............H_...p.0H...Xa*r..Z...5ho*2..p.88......4i..(.@.... .;.U..!.Y.PKv..M.6...5.y..N..`....[v..]>..<Xy.=._w.]

                                                                                                                                                                                    C:\Users\user\Links\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Music\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\OneDrive\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Pictures\Camera Roll\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Pictures\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Pictures\Saved Pictures\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Recent\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Saved Games\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Searches\Everywhere.search-ms.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):497
                                                                                                                                                                                    Entropy (8bit):7.540170528749578
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:JY0D+3y8J1u2JKKdsZsv0ROSCjZ4UCgu6bAkteD:5+CGQuzpSCt4KuiO
                                                                                                                                                                                    MD5:07196B2671F2F42F84F17E92C6F30487
                                                                                                                                                                                    SHA1:5971755A454619CE4E242699D81647FE684B7C54
                                                                                                                                                                                    SHA-256:667F33811BFF7BA9E9C851181ABE1B112B5FB260ED1CBD78C8D84BA77E254C42
                                                                                                                                                                                    SHA-512:3370582048A8CC421B822B9C672E22E5B00CFBC47C315C25443D8B894C16378F84F46FE1B280150A9E6B2823728B0B71439788FE065CD3568BE9A3AB8252ACA6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.......d..=.H..yS..T. .,..-d.....F.&..$V.v3Z....Bn...............6..[.e.."1..t.$.?..,.Jt.w=.y..{..)c.!s..of.1TXST.a...2".p9.uA....1....[Y.\......E......&.....5..Y.93..-&.p..=.{.G!l<...h...M,...CEh;.y.O.......<.N}.6FI._.l.F...3RN......i...V.}I....l.F:.O....c....+'.....*.." ..8'T.=...}o...A.k.e.|.fpB....'~..."flR......o.V..n&..$x.Y.J.....yG.s...0E]c.h...1.............H_...p.0H...Xa*r..Z...5ho*2..p.88......4i..(.@.... .;.U..!.Y.PKv..M.6...5.y..N..`....[v..]>..<Xy.=._w.]

                                                                                                                                                                                    C:\Users\user\Searches\Indexed Locations.search-ms.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):511
                                                                                                                                                                                    Entropy (8bit):7.580616462621242
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:FZkL5AG9oaiVO8xMP5xTD4s0pJqlfCgu6bAkteD:7cADfKxx4JqlTuiO
                                                                                                                                                                                    MD5:8BA7A902EF2AECC83AE59734FD7888FF
                                                                                                                                                                                    SHA1:D02F4D373749C92324B51158E75E182C482C43B5
                                                                                                                                                                                    SHA-256:AA368C7C5BF78FB0C9A63420307D698603BAFDEED8F8E75FA3F01C82F9E3821E
                                                                                                                                                                                    SHA-512:7198EC561513E10BA1C9BF0A47ABD063FB7291C164FB6DB45B7B479DB7B53DED5E0B4970FC5174DA73087B292A35F160A4E3EB115812EE664A15F94FFC575FFE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:...'_.$.fMO_]..1..mWm...A:! .%/ ...}..._.....3i.,Q.}l.R.B.B..k..Y...k/...=O..."r.%.r..$.u..` ..MM.:.:..2/...,/....{....L..)............OX]`x..B:.t.`.._3.5..IDw.Q.....W]"..n.._~.y......n..,...^..D...=.Q.X..b....z.......^..K..~.Nq.4=...+A....q.~.A.|p.B....l.jb#`A...?w...oc. ..l.9.O..X8.T.=b....[.....q..UH#..*4Fn......E{..`..0x.....On......Y3..63.......}.m3l......X....0E]c.h...1.............H_...p.0H...Xa*r..Z...5ho*2..p.88......4i..(.@.... .;.U..!.Y.PKv..M.6...5.y..N..`....[v..]>..<Xy.=._w.]

                                                                                                                                                                                    C:\Users\user\Searches\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1002}-.searchconnector-ms.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1174
                                                                                                                                                                                    Entropy (8bit):7.850434668825219
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:AjnFXB+2Mzsr3AzBZR28YiOpCqyQ9OHobx308YEVOOM+/ETfnuiO:AjFI2Mzsr3AznRnYiOo49Z1JMfuV
                                                                                                                                                                                    MD5:026A36B78782B57061894647D5BFC400
                                                                                                                                                                                    SHA1:4262FFCAA30B0666455B4EB0BEF724D8C5C67EA5
                                                                                                                                                                                    SHA-256:D70A5EEE65C56F8B5304F79B67A39836DF7AAD6658C8667B697A26A3780E7377
                                                                                                                                                                                    SHA-512:3B3EE947017FED56E73FD3D2A0718FA2A1DDCDE1615996E04452C297834F833AC62D2E375D53AE286295964662106DD377E9397EC5F5A6DD930BADCB95B8569E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:...%..=..Qv...!|......$. Y.....V.-..fJ.g.F.`..h.4..E!#d._..L.8fm.Q..0.q..E..u....]W....>..wp....M.Z..cP).B=..#..mq:....c...Qs5|.).6....K..B.@..pP...t......)....y...g.dP`E...;:..o........ .........2......n....Y......+.N...x..pNu1....@.pZ...9C..Y.....>..Mo...m...R..+.0U,..... ..yH....F.F..N.!..U.|de8......e>:...j.a....s.............#.aa...SB....aW6@.h..j.....9E..|...q....9Y.a.z....o...,..%....B....Z....7q..^.;.JK..@.0...h....2...=.c.wnW._...d.w17..MA.z}U...q.y...n...a.g..4.......T..}\U.~f....oXv=.......F...(......+.G(..B,i.gH..s....?.b..|..3lb.3k..9V7...........6...ye./...I.?.9b....L......DH.A..,...-:..._....b.............".C.:>{".m..*..|.._...*.[.56.1.O.Xb.P..gF...<.%...n..1...@<iV..0..Imu......O...i...asb..1...... F...G.{St.b.}...'/..1y...G#..../...y....*..g.4&9i..l....a$f.w...... YQ..#. ./.Y..G;v5......v.t.V.pI...O...Y..w4.../{....!.1.!.7?-\/."...Q.k..]b86...,.!.S..A..*..Wc.X.Eh.b!.qa.0..4l..]w.C.......m...tA...eQ.#ROT.v.. ."R..B..b

                                                                                                                                                                                    C:\Users\user\Videos\R4SZPhslZ.README.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (837), with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6291
                                                                                                                                                                                    Entropy (8bit):5.030481250001273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:mMiSZuBoGdN8zNOWp0UgAD/QCiS57diS1u1slkGijwweowwuiSOQYTbt6:biSuJXW0Wp0GMCiAimkA9i0
                                                                                                                                                                                    MD5:739C65AA91E998F136B1E142672A8331
                                                                                                                                                                                    SHA1:75246BDA6BCFC9CE34A314B518BC593AC2C8BC4E
                                                                                                                                                                                    SHA-256:607368BA37FF20F005705D41BB8887FD7E8F4D6DD0CC55F749D14F12D7144E3B
                                                                                                                                                                                    SHA-512:B1C281D66E3E6585A5D80666801E4C9B69BCEEB11F20CD0827DD92773E28FD3E2680621E2E5ACC9816CC513E48F7CB39335C1C6A8F020228AFC433698585DCF8
                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                    Preview:~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~....>>>>> You must pay us.....Tor Browser Links BLOG where the stolen infortmation will be published:..( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )..http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/..http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/..http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/..http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/..http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/..http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/..http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/....>>>>> What is the guarantee that we won't scam you? ..We are the oldest extortion gang on the planet and nothing is more important to us than our

                                                                                                                                                                                    C:\Users\user\_curlrc.R4SZPhslZ

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):239
                                                                                                                                                                                    Entropy (8bit):7.0956671091890575
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:7GS5XnVXD5KX5EKDB+uRKPXh6RMpth6bAL8hteb3:7GSJVXD5KX5HCgu6bAkteD
                                                                                                                                                                                    MD5:53AEA1F41D0EC1A55E9533BEE6BE160E
                                                                                                                                                                                    SHA1:3EBC6A3B752C38B3E5B9DF937949EE49C5D0CD67
                                                                                                                                                                                    SHA-256:97863631F9D7FAC9E124B5F5EB24EFCCF8B975618562C163BB319F6606E31F8F
                                                                                                                                                                                    SHA-512:3FD61BBB81A77CB5746728DD5A9A35B1CBEDA9F36FA867BF1776FF56005C700C1802A0FC33471C03F2268F278EA4C27483C10380890D32F20DC4E80F3AFEBFC0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......|.o.V.hr.F.6.[.h..B.5.I*O..+'...X.. .~..w.E(~r.J..I.k...MMx.[.......X(...k.#.....q..|..ma...0E]c.h...1.............H_...p.0H...Xa*r..Z...5ho*2..p.88......4i..(.@.... .;.U..!.Y.PKv..M.6...5.y..N..`....[v..]>..<Xy.=._w.]

                                                                                                                                                                                    C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):55
                                                                                                                                                                                    Entropy (8bit):4.306461250274409
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
                                                                                                                                                                                    MD5:DCA83F08D448911A14C22EBCACC5AD57
                                                                                                                                                                                    SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                                                                                                                                                                                    SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                                                                                                                                                                                    SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

                                                                                                                                                                                    C:\Windows\System32\spool\PRINTERS\00002.SPL

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\splwow64.exe
                                                                                                                                                                                    File Type:Microsoft OOXML
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):13715277
                                                                                                                                                                                    Entropy (8bit):7.892525462246416
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:196608:kYttEvlyQHuZ2jKVVWKOf54WAOeEt8cs+Mw+nSHTmYfxzGl3v78NJN1RKAU0K3q:kYtqvlpKVMf4c5KcQw+WUgNyf0cq
                                                                                                                                                                                    MD5:6B6AB4CD525C4D5D16C19C8B46452C78
                                                                                                                                                                                    SHA1:140D247335FF1DF970D6007953F1890B4D3B5AE1
                                                                                                                                                                                    SHA-256:6A41F4005C0841B4E26D8348031B354241F43B1A6DA3B53EBCF1A67BE4EA5108
                                                                                                                                                                                    SHA-512:013C49CC4C50832EB24AFC7B10EF7205FB56AB09E6D441E5931986D47519D7ED4FFDCB5F55B26E5C36DE9838E559D08AEF6E8DECD1DF394453DBE02F39DBD1BB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:PK........v8.Y................[Content_Types].xml/[0].piece.....0..W..o.x .....e.(....Ql!..<...S^.MMw....#Nr.9....p..:..J.z..`3..DM....T.n..J..-c...3....&a#......PK....X.j...q...PK........v8.Y................[Content_Types].xml/[1].piece..1..0....eE$....{e.C.&..X.........H\., .....o.T..i.."...K.s..4..VW...i+.Ak.....}....\.+..O?PK..K..jb...l...PK........v8.Y................_rels/.rels/[0].pieceM.A..!.E.B.w...1.....9@...C!...?,].......f..4.qp.,.._^I...y?\`.....Cc.jF". .^...#g.T.A.e.c.........3.....PK...BpJl...y...PK........v8.Y................_rels/.rels/[1].piece..K..0....9@&.....nk/.....O3S...s....L/'.UN...'.......P....UO:....=X......B..gD...c]...[..[..3..9.9a.... .....N.PK..4...u.......PK........v8.Y................[Content_Types].xml/[2].piece-.A.. .F....p.u.q.&....!...m..[.n_^..kA.......>|.......f....`........}..F..(v.6.t...0-.n.C|@.N-.Z...PK....[Pm...{...PK........v8.Y............%...FixedDocumentSequence.fdseq/[0].pieceU.M..0.F..fo&.....H.`..2.....H.o..p

                                                                                                                                                                                    c:\users\user\desktop\AAAAAAAAAAAAAAA (copy)

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\ProgramData\339E.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):477819
                                                                                                                                                                                    Entropy (8bit):7.997131646745169
                                                                                                                                                                                    Encrypted:true
                                                                                                                                                                                    SSDEEP:6144:akrfnRHNZkrfnRHNZkrfnRHNZkrfnRHNZkrfnRHNZkrfnRHNZkrfnRHNZk9:nnRt4nRt4nRt4nRt4nRt4nRt4nRt2
                                                                                                                                                                                    MD5:3F9812EE93EB5C65B2FBCC2F328A9A73
                                                                                                                                                                                    SHA1:C6783E17E08CB1A1C2F1456D35D303A9F6A3B8B5
                                                                                                                                                                                    SHA-256:CFB7F6241214914B33522454B0AC0FA4F9353AECF65BF0176F7BB4A0C487A749
                                                                                                                                                                                    SHA-512:4925AD3D992C972FAE5C541B408E38FA3310DA224494315E098819F84F516414C2FED6AC7ABE3144FDFD295C6BFAED7E573FCFF1EB9460E223C79DD4310D1A98
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:..f.O....8.9r..,...\.ZPFi.r.1e.?t0.z.*?. ...zu.[{YwL.......z.C..O.S.<....!.;-ckT#@..58....=8....AM.'.h.....~.......Lr/...K4...y9...........G....\..\\.0..CfL@.......{.M.;...5$..X..G.....t.............m_..2..._<....Q...._NB.x.d..n........k.{A..G...L&.-....!....{.a%........!.J.....e3{.:.....w..%<.H..%j.<Dz....f..`u...?u...M0......`O.....x.Q....A.t......X.i...G..ZY....9/6...u....\gP 91M&..l....1,...\...8...o.l..lJZ..l.D..G...)3+X;.S]MK....H.tH]..+3..y!.RvI.T.5..a.O.N..2..d>....V....r.lIU...;.Y.3..O..%..6........8HY.0.......f....a.9.9...l...A..y.'...jGPI.Wc.'....;-TCV.>.u.{..O_p.3<f/++}!..Wz3.......t..........|+Wi.n.,..c...:.......z..n8.. ..J.`...\.^<...w.......y...DQ3zp|..2.H..(.&....G..Q.n..D.....w..u.2ms..z.V|*.E...(.*?.S.y.t.YW. ..A.kK.[..X...q=..;).n.5.].E.-."tHX.} rG..-}..O..=.L~ ] ...6...U.....cdC./..+...."4zs.Y...)6..........1.C..ADm.p...Z......C..*w@..(..].....+1R..5.q.....U...T..O.A..,..I.f.R...lo..R.....OrB.....)...k....P.I..u.^

                                                                                                                                                                                    Static File Info

                                                                                                                                                                                    General

                                                                                                                                                                                    File type:ASCII text, with very long lines (65312), with CRLF, LF line terminators
                                                                                                                                                                                    Entropy (8bit):3.4804195379825793
                                                                                                                                                                                    TrID:
                                                                                                                                                                                      File name:IUccGQLWI0.ps1
                                                                                                                                                                                      File size:477'819 bytes
                                                                                                                                                                                      MD5:8015d634e9e5fd003885700bca4723d8
                                                                                                                                                                                      SHA1:ac4217259c16aefbec8c32024c66d74f99ceb48b
                                                                                                                                                                                      SHA256:36f48ef3776c01d63a2fd594d52dfb7402ea634162fd079b0d942367a2fbed56
                                                                                                                                                                                      SHA512:be9b03abf13ff74a47b6856684446d8fe93ed1276f27ac29fc857653d6f54a6ee72247a890a2c2b03ec6f327b04473c87c48446766ce518351c3d7f2f6bdde7a
                                                                                                                                                                                      SSDEEP:1536:Kk0H/lFq+N1mfoRlNyjZk11iBQcIY1Y+qFMJFOgvZ/wpKDcalOGODPNTbJYj6CJr:GA
                                                                                                                                                                                      TLSH:10A408F0636099E3B6D94993B265191E3B2A103F7EC635D84182FBDD1C7B6C08A19CD7
                                                                                                                                                                                      File Content Preview:for ($i = 0; $i -lt $args.count; $i++ ){$argument += $args[$i] + ' '} . $psFile=$PSCommandPath.$global:ProgressPreference = "SilentlyContinue"....# -- thread variables..$script:threadBody = '$data=$threadData;'..$data = @(..@(62416317159553766,61715855556

                                                                                                                                                                                      File Icon

                                                                                                                                                                                      Icon Hash:3270d6baae77db44

                                                                                                                                                                                      Network Behavior

                                                                                                                                                                                      ⊘No network behavior found

                                                                                                                                                                                      Statistics

                                                                                                                                                                                      CPU Usage

                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                      Memory Usage

                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                      High Level Behavior Distribution

                                                                                                                                                                                      Click to dive into process behavior distribution

                                                                                                                                                                                      Behavior

                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                      System Behavior

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:0
                                                                                                                                                                                      Start time:06:39:29
                                                                                                                                                                                      Start date:23/12/2024
                                                                                                                                                                                      Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                      Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\IUccGQLWI0.ps1"
                                                                                                                                                                                      Imagebase:0x7ff788560000
                                                                                                                                                                                      File size:452'608 bytes
                                                                                                                                                                                      MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:1
                                                                                                                                                                                      Start time:06:39:29
                                                                                                                                                                                      Start date:23/12/2024
                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                      Imagebase:0x7ff7699e0000
                                                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:2
                                                                                                                                                                                      Start time:06:39:32
                                                                                                                                                                                      Start date:23/12/2024
                                                                                                                                                                                      Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                      Commandline:"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ex bypass -nonI C:\Users\user\Desktop\IUccGQLWI0.ps1
                                                                                                                                                                                      Imagebase:0xc90000
                                                                                                                                                                                      File size:433'152 bytes
                                                                                                                                                                                      MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Yara matches:
                                                                                                                                                                                      • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: Windows_Ransomware_Lockbit_369e1e94, Description: unknown, Source: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                      • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000002.00000002.2233034724.0000000008D05000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000002.00000002.2179450701.0000000005AB4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: Windows_Ransomware_Lockbit_369e1e94, Description: unknown, Source: 00000002.00000002.2179450701.0000000005AB4000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                      • Rule: JoeSecurity_MetasploitPayload_1, Description: Yara detected MetasploitPayload, Source: 00000002.00000002.2179450701.0000000005A19000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                      • Rule: Windows_Hacktool_Mimikatz_355d5d3a, Description: Detection for Invoke-Mimikatz, Source: 00000002.00000002.2179450701.0000000005A19000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                      • Rule: Empire_Invoke_Gen, Description: Detects Empire component - from files Invoke-DCSync.ps1, Invoke-PSInject.ps1, Invoke-ReflectivePEInjection.ps1, Source: 00000002.00000002.2179450701.0000000005A19000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth
                                                                                                                                                                                      • Rule: Empire_PowerShell_Framework_Gen5, Description: Detects Empire component - from files Invoke-CredentialInjection.ps1, Invoke-PSInject.ps1, Invoke-ReflectivePEInjection.ps1, Source: 00000002.00000002.2179450701.0000000005A19000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth
                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:3
                                                                                                                                                                                      Start time:06:39:32
                                                                                                                                                                                      Start date:23/12/2024
                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                      Imagebase:0x7ff7699e0000
                                                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:7
                                                                                                                                                                                      Start time:06:39:42
                                                                                                                                                                                      Start date:23/12/2024
                                                                                                                                                                                      Path:C:\Windows\splwow64.exe
                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                      Commandline:C:\Windows\splwow64.exe 12288
                                                                                                                                                                                      Imagebase:0x7ff7db960000
                                                                                                                                                                                      File size:163'840 bytes
                                                                                                                                                                                      MD5 hash:77DE7761B037061C7C112FD3C5B91E73
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:13
                                                                                                                                                                                      Start time:06:40:13
                                                                                                                                                                                      Start date:23/12/2024
                                                                                                                                                                                      Path:C:\ProgramData\339E.tmp
                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                      Commandline:"C:\ProgramData\339E.tmp"
                                                                                                                                                                                      Imagebase:0x400000
                                                                                                                                                                                      File size:14'336 bytes
                                                                                                                                                                                      MD5 hash:294E9F64CB1642DD89229FFF0592856B
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Antivirus matches:
                                                                                                                                                                                      • Detection: 100%, Avira
                                                                                                                                                                                      • Detection: 100%, Joe Sandbox ML
                                                                                                                                                                                      • Detection: 87%, ReversingLabs
                                                                                                                                                                                      Reputation:moderate
                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:14
                                                                                                                                                                                      Start time:06:40:14
                                                                                                                                                                                      Start date:23/12/2024
                                                                                                                                                                                      Path:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                      Commandline:/insertdoc "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\{99BD1B98-4EF0-4608-B95D-29BBEDCA41A1}.xps" 133794275841470000
                                                                                                                                                                                      Imagebase:0xd70000
                                                                                                                                                                                      File size:2'191'768 bytes
                                                                                                                                                                                      MD5 hash:0061760D72416BCF5F2D9FA6564F0BEA
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Reputation:moderate
                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                      General

                                                                                                                                                                                      Target ID:16
                                                                                                                                                                                      Start time:06:40:19
                                                                                                                                                                                      Start date:23/12/2024
                                                                                                                                                                                      Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                      Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                                                                      Imagebase:0x7ff6eef20000
                                                                                                                                                                                      File size:55'320 bytes
                                                                                                                                                                                      MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                      Disassembly

                                                                                                                                                                                      Reset < >

                                                                                                                                                                                        Executed Functions

                                                                                                                                                                                        Function 00007FFD9B7E6585 Relevance: .0, Instructions: 49COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000000.00000002.1791504131.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9b7e0000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: bdc0d8ae6ffadae158c9762f5ca402545da03d5273d11d8dd13792fc728be4f5
                                                                                                                                                                                        • Instruction ID: bff13bf038daf706949bda2ff295dd2a27fc588f85026bbf3d982d88d108e75b
                                                                                                                                                                                        • Opcode Fuzzy Hash: bdc0d8ae6ffadae158c9762f5ca402545da03d5273d11d8dd13792fc728be4f5
                                                                                                                                                                                        • Instruction Fuzzy Hash: A401A73020CB0C4FD748EF0CE051AA5B3E0FF89320F10056DE59AC36A5D632E881CB41

                                                                                                                                                                                        Execution Graph

                                                                                                                                                                                        Execution Coverage:4%
                                                                                                                                                                                        Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                        Signature Coverage:18.9%
                                                                                                                                                                                        Total number of Nodes:811
                                                                                                                                                                                        Total number of Limit Nodes:1
                                                                                                                                                                                        execution_graph 49924 92d1700 49925 92d173a 49924->49925 49926 92d180b 49924->49926 49925->49926 49932 92d19ad 49925->49932 49936 92d1f78 49925->49936 49940 92d1c28 49925->49940 49944 92d1e49 49925->49944 49927 92d17ef 49933 92d19bd 49932->49933 49934 92d1d3a 49933->49934 49948 9300443 49933->49948 49934->49927 49937 92d1ecf 49936->49937 49939 9300443 125 API calls 49937->49939 49938 92d1f27 49938->49927 49939->49938 49941 92d1c5c 49940->49941 49942 92d1d3a 49941->49942 49943 9300443 125 API calls 49941->49943 49942->49927 49943->49942 49945 92d1da4 49944->49945 49946 92d1f27 49945->49946 49947 9300443 125 API calls 49945->49947 49946->49927 49947->49946 49950 930045d 49948->49950 49949 9300689 49949->49934 49950->49949 49954 922fa20 49950->49954 49963 922fa19 49950->49963 49951 930062a 49951->49934 49955 922fa60 49954->49955 49972 924b7e4 49955->49972 50005 924d0a8 49955->50005 50011 924818d 49955->50011 50053 92481bc 49955->50053 50096 9248176 49955->50096 50137 9256464 49955->50137 49956 922fa8a 49956->49951 49964 922fa60 49963->49964 49966 924b7e4 16 API calls 49964->49966 49967 9256464 123 API calls 49964->49967 49968 9248176 11 API calls 49964->49968 49969 92481bc 11 API calls 49964->49969 49970 924818d 11 API calls 49964->49970 49971 924d0a8 5 API calls 49964->49971 49965 922fa8a 49965->49951 49966->49965 49967->49965 49968->49965 49969->49965 49970->49965 49971->49965 49973 924b7e9 49972->49973 50145 9248dbc 49973->50145 49977 924b82b 50181 9248bac 49977->50181 49979 924b83a 49980 924b848 49979->49980 50184 924db18 49979->50184 49980->49956 49981 924b7fc 49981->49977 50219 924cea4 RtlAllocateHeap RtlFreeHeap 49981->50219 49984 924b854 50187 924d07c 49984->50187 49985 924b822 49985->49977 50220 924d430 RtlAllocateHeap RtlFreeHeap 49985->50220 49989 924d0a8 5 API calls 49990 924b863 49989->49990 50191 924cfe8 49990->50191 49994 924b86c 49995 924b8ca 49994->49995 50222 924cbdc RtlAllocateHeap RtlFreeHeap 49994->50222 50198 924e38c 49995->50198 49998 924b8b1 49998->49995 50223 924cf60 RtlAllocateHeap RtlFreeHeap 49998->50223 49999 924b882 49999->49994 50221 924c84c RtlAllocateHeap RtlFreeHeap 49999->50221 50262 924874c 50005->50262 50008 924d0b6 NtSetInformationProcess NtSetInformationProcess NtSetInformationProcess 50265 9248778 50008->50265 50009 924d0f8 50009->49956 50012 9248192 50011->50012 50013 92481ca RtlCreateHeap 50011->50013 50012->50013 50014 92481f1 50013->50014 50015 9248329 50013->50015 50268 9247988 50014->50268 50015->49956 50020 9247c3c 7 API calls 50021 9248239 50020->50021 50022 9247c3c 7 API calls 50021->50022 50023 924824a 50022->50023 50024 9247c3c 7 API calls 50023->50024 50025 924825b 50024->50025 50026 9247c3c 7 API calls 50025->50026 50027 924826c 50026->50027 50028 9247c3c 7 API calls 50027->50028 50029 924827d 50028->50029 50030 9247c3c 7 API calls 50029->50030 50031 924828e 50030->50031 50032 9247c3c 7 API calls 50031->50032 50033 924829f 50032->50033 50034 9247c3c 7 API calls 50033->50034 50035 92482b0 50034->50035 50036 9247c3c 7 API calls 50035->50036 50037 92482c1 50036->50037 50038 9247c3c 7 API calls 50037->50038 50039 92482d2 50038->50039 50040 9247c3c 7 API calls 50039->50040 50041 92482e3 50040->50041 50042 9247c3c 7 API calls 50041->50042 50043 92482f4 50042->50043 50044 9247c3c 7 API calls 50043->50044 50045 9248305 50044->50045 50046 9247c3c 7 API calls 50045->50046 50047 9248316 50046->50047 50281 9248614 50047->50281 50049 924831d 50284 9253c18 RtlAllocateHeap RtlFreeHeap 50049->50284 50051 9248324 50285 9248640 LdrGetProcedureAddress LdrGetProcedureAddress LdrLoadDll 50051->50285 50054 9247988 3 API calls 50053->50054 50055 92481ce 50054->50055 50056 92481d6 RtlCreateHeap 50055->50056 50057 9248329 50055->50057 50056->50057 50058 92481f1 50056->50058 50057->49956 50059 9247988 3 API calls 50058->50059 50060 924820d 50059->50060 50060->50057 50061 9247c3c 7 API calls 50060->50061 50062 9248228 50061->50062 50063 9247c3c 7 API calls 50062->50063 50064 9248239 50063->50064 50065 9247c3c 7 API calls 50064->50065 50066 924824a 50065->50066 50067 9247c3c 7 API calls 50066->50067 50068 924825b 50067->50068 50069 9247c3c 7 API calls 50068->50069 50070 924826c 50069->50070 50071 9247c3c 7 API calls 50070->50071 50072 924827d 50071->50072 50073 9247c3c 7 API calls 50072->50073 50074 924828e 50073->50074 50075 9247c3c 7 API calls 50074->50075 50076 924829f 50075->50076 50077 9247c3c 7 API calls 50076->50077 50078 92482b0 50077->50078 50079 9247c3c 7 API calls 50078->50079 50080 92482c1 50079->50080 50081 9247c3c 7 API calls 50080->50081 50082 92482d2 50081->50082 50083 9247c3c 7 API calls 50082->50083 50084 92482e3 50083->50084 50085 9247c3c 7 API calls 50084->50085 50086 92482f4 50085->50086 50087 9247c3c 7 API calls 50086->50087 50088 9248305 50087->50088 50089 9247c3c 7 API calls 50088->50089 50090 9248316 50089->50090 50091 9248614 NtSetInformationThread 50090->50091 50092 924831d 50091->50092 50312 9253c18 RtlAllocateHeap RtlFreeHeap 50092->50312 50094 9248324 50313 9248640 LdrGetProcedureAddress LdrGetProcedureAddress LdrLoadDll 50094->50313 50096->49956 50097 92481d4 RtlCreateHeap 50096->50097 50098 92481f1 50097->50098 50099 9248329 50097->50099 50100 9247988 3 API calls 50098->50100 50099->49956 50101 924820d 50100->50101 50101->50099 50102 9247c3c 7 API calls 50101->50102 50103 9248228 50102->50103 50104 9247c3c 7 API calls 50103->50104 50105 9248239 50104->50105 50106 9247c3c 7 API calls 50105->50106 50107 924824a 50106->50107 50108 9247c3c 7 API calls 50107->50108 50109 924825b 50108->50109 50110 9247c3c 7 API calls 50109->50110 50111 924826c 50110->50111 50112 9247c3c 7 API calls 50111->50112 50113 924827d 50112->50113 50114 9247c3c 7 API calls 50113->50114 50115 924828e 50114->50115 50116 9247c3c 7 API calls 50115->50116 50117 924829f 50116->50117 50118 9247c3c 7 API calls 50117->50118 50119 92482b0 50118->50119 50120 9247c3c 7 API calls 50119->50120 50121 92482c1 50120->50121 50122 9247c3c 7 API calls 50121->50122 50123 92482d2 50122->50123 50124 9247c3c 7 API calls 50123->50124 50125 92482e3 50124->50125 50126 9247c3c 7 API calls 50125->50126 50127 92482f4 50126->50127 50128 9247c3c 7 API calls 50127->50128 50129 9248305 50128->50129 50130 9247c3c 7 API calls 50129->50130 50131 9248316 50130->50131 50132 9248614 NtSetInformationThread 50131->50132 50133 924831d 50132->50133 50314 9253c18 RtlAllocateHeap RtlFreeHeap 50133->50314 50135 9248324 50315 9248640 LdrGetProcedureAddress LdrGetProcedureAddress LdrLoadDll 50135->50315 50138 9256493 50137->50138 50139 925646d 50137->50139 50138->49956 50140 92481bc 11 API calls 50139->50140 50141 9256480 50140->50141 50142 924b7e4 16 API calls 50141->50142 50143 925648e 50142->50143 50316 92539e0 50143->50316 50230 9248c54 50145->50230 50147 9248dd4 50148 92490ab 50147->50148 50233 92486d0 50147->50233 50148->49981 50178 9249edc 50148->50178 50150 92490a3 50151 92486f8 RtlFreeHeap 50150->50151 50151->50148 50152 9249095 50153 92486f8 RtlFreeHeap 50152->50153 50153->50150 50154 9248df1 50154->50150 50154->50152 50155 9248e74 50154->50155 50156 92486d0 RtlAllocateHeap 50154->50156 50157 92486d0 RtlAllocateHeap 50155->50157 50158 9248ea7 50155->50158 50156->50155 50157->50158 50159 9248eda 50158->50159 50160 92486d0 RtlAllocateHeap 50158->50160 50161 92486d0 RtlAllocateHeap 50159->50161 50163 9248f0d 50159->50163 50160->50159 50161->50163 50162 9248fa6 50169 92486d0 RtlAllocateHeap 50162->50169 50170 9248fdd 50162->50170 50164 9248f40 50163->50164 50165 92486d0 RtlAllocateHeap 50163->50165 50166 92486d0 RtlAllocateHeap 50164->50166 50167 9248f73 50164->50167 50165->50164 50166->50167 50167->50162 50168 92486d0 RtlAllocateHeap 50167->50168 50168->50162 50169->50170 50170->50152 50171 92486d0 RtlAllocateHeap 50170->50171 50172 9249018 50171->50172 50172->50152 50236 9248d58 50172->50236 50174 9249040 50175 92486d0 RtlAllocateHeap 50174->50175 50176 924905f 50175->50176 50176->50152 50242 92486f8 50176->50242 50179 9249ef1 NtQueryDefaultUILanguage 50178->50179 50180 9249f17 50179->50180 50180->49981 50182 92486d0 RtlAllocateHeap 50181->50182 50183 9248bc1 50182->50183 50183->49979 50185 92486d0 RtlAllocateHeap 50184->50185 50186 924db29 50185->50186 50186->49984 50188 924d089 50187->50188 50189 924d090 RtlAdjustPrivilege 50188->50189 50190 924b85e 50188->50190 50189->50188 50189->50190 50190->49989 50192 924cfff 50191->50192 50193 924b868 50192->50193 50194 924d003 NtQueryInformationToken 50192->50194 50193->49994 50195 924cdb8 50193->50195 50194->50193 50248 924b5d0 50195->50248 50197 924cdd5 50197->49999 50199 924e3ac 50198->50199 50200 924b8f8 50198->50200 50201 9248c54 RtlAllocateHeap 50199->50201 50224 9250214 50200->50224 50202 924e3bd 50201->50202 50202->50200 50203 92486d0 RtlAllocateHeap 50202->50203 50207 924e3d9 50203->50207 50204 924e5d9 50205 92486f8 RtlFreeHeap 50204->50205 50205->50200 50206 92486f8 RtlFreeHeap 50206->50204 50207->50204 50208 924e42d CreateFileW 50207->50208 50211 924e5c1 50207->50211 50209 924e481 WriteFile 50208->50209 50208->50211 50210 924e49c RegCreateKeyExW 50209->50210 50209->50211 50210->50211 50212 924e4c5 RegSetValueExW 50210->50212 50211->50206 50212->50211 50214 924e4f7 RegCreateKeyExW 50212->50214 50214->50211 50216 924e572 RegSetValueExW 50214->50216 50216->50211 50218 924e5a6 SHChangeNotify 50216->50218 50218->50211 50219->49985 50220->49977 50221->49994 50222->49998 50223->49995 50225 9250230 50224->50225 50258 92502ac 50225->50258 50227 9250286 50228 924b8fd 50227->50228 50229 92486f8 RtlFreeHeap 50227->50229 50228->49956 50229->50228 50231 92486d0 RtlAllocateHeap 50230->50231 50232 9248c65 50231->50232 50232->50147 50234 92486d8 50233->50234 50235 92486e6 RtlAllocateHeap 50234->50235 50235->50154 50237 9248d7f 50236->50237 50245 9248d00 50237->50245 50239 9248d9f 50240 92486f8 RtlFreeHeap 50239->50240 50241 9248db3 50240->50241 50241->50174 50243 9248700 50242->50243 50244 924870e RtlFreeHeap 50243->50244 50244->50152 50246 92486d0 RtlAllocateHeap 50245->50246 50247 9248d23 50246->50247 50247->50239 50249 92486d0 RtlAllocateHeap 50248->50249 50252 924b5ee 50249->50252 50250 924b5f1 NtQuerySystemInformation 50250->50252 50255 924b607 50250->50255 50251 924b624 50253 92486f8 RtlFreeHeap 50251->50253 50252->50250 50252->50251 50254 924b62c 50253->50254 50254->50197 50256 92486f8 RtlFreeHeap 50255->50256 50257 924b66a 50256->50257 50257->50197 50259 92502b8 50258->50259 50261 92502c5 50258->50261 50260 92486d0 RtlAllocateHeap 50259->50260 50259->50261 50260->50261 50261->50227 50263 92486d0 RtlAllocateHeap 50262->50263 50264 9248762 50263->50264 50264->50008 50264->50009 50266 92486f8 RtlFreeHeap 50265->50266 50267 924878a 50266->50267 50267->50009 50269 92479b4 50268->50269 50270 924799a 50268->50270 50272 9247988 3 API calls 50269->50272 50274 92479dc 50269->50274 50271 9247988 3 API calls 50270->50271 50271->50269 50272->50274 50273 9247aa6 50273->50015 50276 9247c3c 50273->50276 50274->50273 50286 9247920 50274->50286 50297 9247ac0 50276->50297 50278 9247c67 50278->50020 50279 9247988 3 API calls 50280 9247c51 50279->50280 50280->50278 50280->50279 50282 9248628 NtSetInformationThread 50281->50282 50282->50049 50284->50051 50285->50015 50287 924794c 50286->50287 50288 924797e 50286->50288 50287->50288 50293 92478bc 50287->50293 50288->50274 50290 9247960 50290->50288 50291 9247974 50290->50291 50296 9247870 LdrGetProcedureAddress LdrGetProcedureAddress 50291->50296 50295 92478d3 50293->50295 50294 9247901 LdrLoadDll 50294->50290 50295->50294 50296->50288 50298 9247aed 50297->50298 50299 9247ad3 50297->50299 50301 9247b15 50298->50301 50302 9247988 3 API calls 50298->50302 50300 9247988 3 API calls 50299->50300 50300->50298 50303 9247988 3 API calls 50301->50303 50306 9247b3d 50301->50306 50302->50301 50303->50306 50304 9247b85 FindFirstFileW 50304->50306 50305 9247bf6 50305->50280 50306->50304 50306->50305 50307 9247bb5 FindClose 50306->50307 50308 9247bd3 FindNextFileW 50306->50308 50309 92478bc LdrLoadDll 50307->50309 50308->50306 50310 9247be7 FindClose 50308->50310 50311 9247bcc 50309->50311 50310->50306 50311->50280 50312->50094 50313->50057 50314->50135 50315->50099 50317 92539fd 50316->50317 50334 924b4e4 50317->50334 50319 9253a03 50320 9253a24 50319->50320 50326 9253a4a 50319->50326 50332 9253a19 50319->50332 50322 924b9b0 3 API calls 50320->50322 50321 9253c10 50321->50138 50322->50332 50323 92486f8 RtlFreeHeap 50323->50321 50324 9253b91 50328 9253be1 50324->50328 50329 9253bbe 50324->50329 50324->50332 50325 9253b6e 50327 924b9b0 3 API calls 50325->50327 50326->50324 50326->50325 50327->50332 50331 924b9b0 3 API calls 50328->50331 50338 924b9b0 50329->50338 50333 9253be6 CreateThread 50331->50333 50332->50321 50332->50323 50333->50332 50352 92522e0 50333->50352 50335 924b4fd 50334->50335 50336 92486d0 RtlAllocateHeap 50335->50336 50337 924b50d 50336->50337 50337->50319 50339 924ba52 50338->50339 50340 924b9c3 50338->50340 50339->50332 50347 9249de0 50340->50347 50343 924ba05 50345 924ba25 CreateMutexW 50343->50345 50346 9248778 RtlFreeHeap 50345->50346 50346->50339 50349 9249df7 50347->50349 50348 9249eb0 50348->50343 50351 924a780 RtlAllocateHeap RtlFreeHeap 50348->50351 50349->50348 50350 924874c RtlAllocateHeap 50349->50350 50350->50348 50351->50343 50353 92522ef 50352->50353 50354 9252369 50353->50354 50355 9252342 50353->50355 50356 925232a CreateThread 50353->50356 50402 92492b8 GetLogicalDriveStringsW 50354->50402 50355->50354 50358 925234b CreateThread 50355->50358 50356->50355 50799 924b440 50356->50799 50358->50354 50788 924ad80 RtlAdjustPrivilege 50358->50788 50362 9252395 50363 92523b6 50362->50363 50364 925239e CreateThread 50362->50364 50366 92523c4 50363->50366 50412 924c034 50363->50412 50364->50363 50751 9249c7c 50364->50751 50368 924d0a8 5 API calls 50366->50368 50369 92523c9 50368->50369 50421 9250144 50369->50421 50372 925240a 50374 9250214 2 API calls 50372->50374 50383 925241d 50372->50383 50373 9250214 2 API calls 50375 92523fb 50373->50375 50377 9252418 50374->50377 50426 9252134 50375->50426 50454 9251838 50377->50454 50380 925247b 50382 9250214 2 API calls 50380->50382 50381 9250214 2 API calls 50384 9252405 50381->50384 50385 92524b5 50382->50385 50383->50380 50546 924f994 RtlAllocateHeap RtlFreeHeap 50383->50546 50430 9251ee8 50384->50430 50388 92524c5 50385->50388 50389 925254a 50385->50389 50476 924a050 50388->50476 50547 925333c RtlAllocateHeap RtlFreeHeap 50389->50547 50393 925254f 50548 9252e98 RtlAllocateHeap RtlFreeHeap 50393->50548 50394 92524d5 CreateThread 50395 92524f0 50394->50395 50759 924dff8 50394->50759 50399 9252540 ExitProcess 50395->50399 50509 92525c4 50395->50509 50397 9252556 50399->50397 50403 9249303 50402->50403 50404 92492db 50402->50404 50406 924967c 50403->50406 50404->50403 50549 924930c 50404->50549 50409 92496a9 50406->50409 50407 9249aef 50407->50362 50545 9249af4 RtlAllocateHeap RtlFreeHeap 50407->50545 50409->50407 50410 92499ba CoSetProxyBlanket 50409->50410 50411 9249916 CoUninitialize 50409->50411 50410->50411 50411->50407 50413 924c05b GetVolumeNameForVolumeMountPointW 50412->50413 50415 924c09e FindFirstVolumeW 50413->50415 50416 924c2ef 50415->50416 50420 924c0ba 50415->50420 50416->50366 50417 924c104 GetDriveTypeW 50417->50420 50418 924c1a5 CreateFileW 50418->50420 50419 924bfa8 GetLogicalDriveStringsW CreateThread ResumeThread GetExitCodeThread NtSetInformationThread 50419->50420 50420->50416 50420->50417 50420->50418 50420->50419 50424 9250151 50421->50424 50422 92501b6 50422->50372 50422->50373 50422->50383 50423 9250186 CreateThread 50423->50424 50579 924fdd0 SetThreadPriority 50423->50579 50424->50422 50424->50423 50425 9248614 NtSetInformationThread 50424->50425 50425->50424 50427 925218e 50426->50427 50429 9252208 50427->50429 50586 92487e4 50427->50586 50429->50381 50431 9251efd 50430->50431 50590 924be18 CreateThread 50431->50590 50433 9251f0f 50434 92486d0 RtlAllocateHeap 50433->50434 50452 9251f15 50433->50452 50436 9251f27 50434->50436 50435 925210e 50438 925211c 50435->50438 50440 92486f8 RtlFreeHeap 50435->50440 50439 924be18 5 API calls 50436->50439 50436->50452 50437 92486f8 RtlFreeHeap 50437->50435 50441 925212a 50438->50441 50443 92486f8 RtlFreeHeap 50438->50443 50442 9251f44 50439->50442 50440->50438 50441->50372 50444 92486d0 RtlAllocateHeap 50442->50444 50442->50452 50443->50441 50445 9251f5f 50444->50445 50446 92486d0 RtlAllocateHeap 50445->50446 50445->50452 50453 9251f7a 50446->50453 50448 92487e4 RtlAllocateHeap 50449 9251fd6 CreateThread 50448->50449 50449->50453 50612 9250f48 SetThreadPriority 50449->50612 50450 92487e4 RtlAllocateHeap 50450->50453 50452->50435 50452->50437 50453->50448 50453->50450 50453->50452 50598 924bb34 CreateThread 50453->50598 50606 924cdf0 50453->50606 50455 9251864 50454->50455 50456 92486d0 RtlAllocateHeap 50455->50456 50457 9251871 50456->50457 50458 925187a 50457->50458 50732 9251400 RtlAllocateHeap RtlFreeHeap 50457->50732 50461 9251b89 50458->50461 50462 92486f8 RtlFreeHeap 50458->50462 50460 9251887 50460->50458 50464 92486d0 RtlAllocateHeap 50460->50464 50463 9251b97 50461->50463 50465 92486f8 RtlFreeHeap 50461->50465 50462->50461 50466 9251ba5 50463->50466 50467 92486f8 RtlFreeHeap 50463->50467 50468 92518a5 50464->50468 50465->50463 50466->50383 50467->50466 50468->50458 50469 92486d0 RtlAllocateHeap 50468->50469 50475 92518c0 50469->50475 50470 9251170 NtSetInformationThread 50470->50475 50472 92486f8 RtlFreeHeap 50472->50475 50473 92512ac NtSetInformationThread 50473->50475 50474 924cdf0 NtSetInformationThread 50474->50475 50475->50458 50475->50470 50475->50472 50475->50473 50475->50474 50733 9248840 RtlAllocateHeap 50475->50733 50477 924a0ab 50476->50477 50480 924a0b0 50476->50480 50478 92486f8 RtlFreeHeap 50477->50478 50479 924a729 50477->50479 50478->50479 50481 92486f8 RtlFreeHeap 50479->50481 50483 924a737 50479->50483 50480->50477 50734 92526c4 50480->50734 50481->50483 50483->50394 50483->50395 50484 924a10d 50484->50477 50485 92486d0 RtlAllocateHeap 50484->50485 50486 924a1ef 50485->50486 50486->50477 50487 924a207 50486->50487 50488 924a221 50486->50488 50489 9248c54 RtlAllocateHeap 50487->50489 50490 9248c54 RtlAllocateHeap 50488->50490 50491 924a211 50489->50491 50490->50491 50491->50477 50492 924a254 50491->50492 50494 924a268 50491->50494 50493 92486f8 RtlFreeHeap 50492->50493 50493->50477 50494->50477 50495 924a31b DrawTextW 50494->50495 50495->50477 50496 924a343 50495->50496 50496->50477 50497 924a47d CreateFileW 50496->50497 50497->50477 50498 924a4a6 WriteFile 50497->50498 50498->50477 50499 924a4c7 WriteFile 50498->50499 50499->50477 50500 924a4e5 WriteFile 50499->50500 50500->50477 50501 924a503 50500->50501 50740 9248afc 50501->50740 50503 924a525 50503->50477 50504 924a5a8 RegCreateKeyExW 50503->50504 50504->50477 50505 924a5d9 50504->50505 50506 924a612 RegSetValueExW 50505->50506 50506->50477 50507 924a63f 50506->50507 50508 924a69e RegSetValueExW 50507->50508 50508->50477 50512 92525ed 50509->50512 50510 9252520 50515 924d660 50510->50515 50511 92486f8 RtlFreeHeap 50511->50510 50514 925261c 50512->50514 50746 924e858 RtlAllocateHeap RtlFreeHeap 50512->50746 50514->50510 50514->50511 50516 924d695 50515->50516 50517 9248c54 RtlAllocateHeap 50516->50517 50518 924d70d 50517->50518 50519 92486d0 RtlAllocateHeap 50518->50519 50544 924d716 50518->50544 50521 924d72d 50519->50521 50520 924dadb 50523 924dae9 50520->50523 50525 92486f8 RtlFreeHeap 50520->50525 50521->50544 50747 924d4e4 50521->50747 50522 92486f8 RtlFreeHeap 50522->50520 50526 924daf7 50523->50526 50527 92486f8 RtlFreeHeap 50523->50527 50525->50523 50528 924db05 50526->50528 50530 92486f8 RtlFreeHeap 50526->50530 50527->50526 50528->50399 50529 924d75e 50531 924d77f GetTempFileNameW CreateFileW 50529->50531 50529->50544 50530->50528 50532 924d7c4 WriteFile 50531->50532 50531->50544 50533 924d7e0 CreateProcessW 50532->50533 50532->50544 50535 924d84a NtQueryInformationProcess 50533->50535 50533->50544 50536 924d86e 50535->50536 50535->50544 50537 9248c54 RtlAllocateHeap 50536->50537 50536->50544 50538 924d89f 50537->50538 50539 924d92f NtWriteVirtualMemory 50538->50539 50538->50544 50540 924d949 50539->50540 50539->50544 50541 924d9ac NtDuplicateObject 50540->50541 50540->50544 50542 924d9d4 CreateNamedPipeW 50541->50542 50541->50544 50543 924da40 ResumeThread ConnectNamedPipe 50542->50543 50542->50544 50543->50544 50544->50520 50544->50522 50545->50362 50546->50380 50547->50393 50548->50397 50557 92493e0 50549->50557 50551 9249324 50552 9249356 FindFirstFileExW 50551->50552 50554 92493d0 50551->50554 50552->50554 50555 924937e 50552->50555 50553 92493bc FindNextFileW 50553->50554 50553->50555 50554->50404 50555->50553 50561 92494bc 50555->50561 50558 9249400 FindFirstFileExW 50557->50558 50560 924945e 50558->50560 50560->50551 50562 92494de 50561->50562 50563 9249673 50562->50563 50564 92486d0 RtlAllocateHeap 50562->50564 50563->50553 50569 92494f6 50564->50569 50565 924964e 50566 9249665 50565->50566 50567 92486f8 RtlFreeHeap 50565->50567 50566->50563 50568 92486f8 RtlFreeHeap 50566->50568 50567->50566 50568->50563 50569->50565 50570 924952e FindFirstFileExW 50569->50570 50570->50565 50572 9249556 50570->50572 50571 9249636 FindNextFileW 50571->50565 50571->50572 50572->50571 50573 92486d0 RtlAllocateHeap 50572->50573 50574 92495d0 GetFileAttributesW 50572->50574 50577 92494bc 2 API calls 50572->50577 50578 92486f8 RtlFreeHeap 50572->50578 50573->50572 50574->50572 50575 924961e DeleteFileW 50574->50575 50576 92486f8 RtlFreeHeap 50575->50576 50576->50572 50577->50572 50578->50572 50583 924fde7 50579->50583 50580 924fe3a 50581 924fe49 ReadFile 50581->50583 50582 9250006 WriteFile 50582->50583 50583->50580 50583->50581 50583->50582 50584 924ff8d WriteFile 50583->50584 50585 92486f8 RtlFreeHeap 50583->50585 50584->50583 50585->50583 50587 92487fc 50586->50587 50588 9248812 50587->50588 50589 92486d0 RtlAllocateHeap 50587->50589 50588->50429 50589->50588 50591 924bebe 50590->50591 50593 924be5d 50590->50593 50610 924be00 GetLogicalDriveStringsW 50590->50610 50591->50433 50592 924be94 ResumeThread 50596 924bea8 GetExitCodeThread 50592->50596 50593->50592 50594 924cdf0 NtSetInformationThread 50593->50594 50595 924be6e 50594->50595 50595->50592 50597 924be72 50595->50597 50596->50591 50597->50433 50599 924bb6c 50598->50599 50600 924bbcd 50598->50600 50611 924bb24 GetDriveTypeW 50598->50611 50601 924bba3 ResumeThread 50599->50601 50602 924cdf0 NtSetInformationThread 50599->50602 50600->50453 50603 924bbb7 GetExitCodeThread 50601->50603 50604 924bb7d 50602->50604 50603->50600 50604->50601 50605 924bb81 50604->50605 50605->50453 50607 924ce02 50606->50607 50609 924cdff 50606->50609 50608 924ce49 NtSetInformationThread 50607->50608 50607->50609 50608->50609 50609->50453 50613 9250f60 50612->50613 50614 92486d0 RtlAllocateHeap 50613->50614 50624 9250f7f 50614->50624 50617 92486f8 RtlFreeHeap 50618 9250faf FindFirstFileExW 50617->50618 50618->50624 50619 92486f8 RtlFreeHeap 50619->50624 50620 9251122 50621 92486f8 RtlFreeHeap 50620->50621 50623 9251145 50621->50623 50622 92510ea FindNextFileW 50622->50624 50624->50617 50624->50619 50624->50620 50624->50622 50625 9250e08 RtlAllocateHeap 50624->50625 50627 924e130 50624->50627 50646 9250da4 50624->50646 50650 9250bac 50624->50650 50625->50624 50628 924e14c 50627->50628 50643 924e147 50627->50643 50681 9248794 50628->50681 50631 924e164 GetFileAttributesW 50632 924e174 50631->50632 50633 924e1d2 50632->50633 50634 924e1b9 50632->50634 50636 924e1e9 GetFileAttributesW 50633->50636 50645 924e1da 50633->50645 50635 924e220 5 API calls 50634->50635 50637 924e1c1 50635->50637 50639 924e1f6 50636->50639 50640 924e202 CopyFileW 50636->50640 50642 92486f8 RtlFreeHeap 50637->50642 50644 92486f8 RtlFreeHeap 50639->50644 50641 92486f8 RtlFreeHeap 50640->50641 50641->50643 50642->50643 50643->50624 50644->50645 50685 924e220 CreateFileW 50645->50685 50647 9250dbc 50646->50647 50648 9250dd2 50647->50648 50649 92486d0 RtlAllocateHeap 50647->50649 50648->50624 50649->50648 50651 9250d95 50650->50651 50652 9250bcd 50650->50652 50651->50624 50696 9250308 50652->50696 50655 9250d8d 50656 92486f8 RtlFreeHeap 50655->50656 50656->50651 50658 9250be5 50658->50655 50659 9250c0c 50658->50659 50660 9250bf9 50658->50660 50730 9250924 RtlAllocateHeap 50659->50730 50729 9250840 RtlAllocateHeap 50660->50729 50663 9250c27 MoveFileExW 50664 9250c39 50663->50664 50670 9250c07 50663->50670 50667 9250c91 CreateFileW 50664->50667 50678 9250cb5 50664->50678 50665 9250c74 50666 92486f8 RtlFreeHeap 50665->50666 50666->50664 50669 9250cba 50667->50669 50667->50678 50668 92486f8 RtlFreeHeap 50668->50670 50709 9250970 50669->50709 50670->50655 50670->50663 50670->50664 50670->50665 50670->50668 50731 9250924 RtlAllocateHeap 50670->50731 50671 92486f8 RtlFreeHeap 50671->50655 50675 9250ce3 CreateIoCompletionPort 50676 9250cfa 50675->50676 50679 9250d1c 50675->50679 50677 92486f8 RtlFreeHeap 50676->50677 50677->50678 50678->50655 50678->50671 50679->50678 50680 92486f8 RtlFreeHeap 50679->50680 50680->50678 50682 92487aa 50681->50682 50683 92487c1 50682->50683 50684 92486d0 RtlAllocateHeap 50682->50684 50683->50631 50683->50643 50684->50683 50686 924e381 50685->50686 50687 924e251 50685->50687 50686->50643 50688 924e289 WriteFile 50687->50688 50689 924e2c0 WriteFile 50688->50689 50690 924e2ae 50688->50690 50691 924e2e7 50689->50691 50692 924e2f9 WriteFile 50689->50692 50690->50643 50691->50643 50693 924e330 WriteFile 50692->50693 50694 924e31e 50692->50694 50693->50687 50695 924e357 50693->50695 50694->50643 50695->50643 50697 9250321 SetFileAttributesW CreateFileW 50696->50697 50699 9250367 50697->50699 50700 925034f 50697->50700 50698 924fda0 RtlAllocateHeap RtlFreeHeap NtTerminateProcess 50698->50700 50699->50655 50701 92503b8 SetFileAttributesW CreateFileW 50699->50701 50700->50697 50700->50698 50700->50699 50702 9250464 50701->50702 50703 92503f8 SetFilePointerEx 50701->50703 50702->50658 50703->50702 50704 9250417 ReadFile 50703->50704 50704->50702 50705 9250436 50704->50705 50706 92502ac RtlAllocateHeap 50705->50706 50707 9250447 50706->50707 50707->50702 50708 92486f8 RtlFreeHeap 50707->50708 50708->50702 50711 92509a0 50709->50711 50710 92509d1 50713 92486d0 RtlAllocateHeap 50710->50713 50711->50710 50712 9250214 RtlAllocateHeap RtlFreeHeap 50711->50712 50712->50710 50720 92509dd 50713->50720 50714 9250b77 50716 92486f8 RtlFreeHeap 50714->50716 50718 9250b85 50714->50718 50715 92486f8 RtlFreeHeap 50715->50714 50716->50718 50717 9250b93 50717->50675 50717->50678 50718->50717 50719 92486f8 RtlFreeHeap 50718->50719 50719->50717 50721 92486d0 RtlAllocateHeap 50720->50721 50728 9250b24 50720->50728 50722 9250a3a 50721->50722 50723 92486d0 RtlAllocateHeap 50722->50723 50722->50728 50724 9250a69 50723->50724 50725 92486d0 RtlAllocateHeap 50724->50725 50724->50728 50726 9250b1b 50725->50726 50727 92486f8 RtlFreeHeap 50726->50727 50726->50728 50727->50728 50728->50714 50728->50715 50729->50670 50730->50670 50731->50670 50732->50460 50733->50475 50735 925270b 50734->50735 50736 925281a RegCreateKeyExW 50735->50736 50739 9252758 50735->50739 50737 9252847 50736->50737 50736->50739 50738 92528c2 RegDeleteKeyExW 50737->50738 50737->50739 50738->50739 50739->50484 50741 9248b3a NtQueryInformationToken 50740->50741 50743 9248b23 50740->50743 50742 9248b35 50741->50742 50744 9248b8c 50742->50744 50745 92486f8 RtlFreeHeap 50742->50745 50743->50741 50743->50742 50744->50503 50745->50744 50746->50514 50748 924d4fc 50747->50748 50749 92486d0 RtlAllocateHeap 50748->50749 50750 924d51d 50749->50750 50750->50529 50754 9249c84 50751->50754 50752 92486d0 RtlAllocateHeap 50752->50754 50753 9249c96 NtQuerySystemInformation 50753->50754 50754->50752 50754->50753 50755 9249cc9 50754->50755 50758 92486f8 RtlFreeHeap 50754->50758 50756 92486f8 RtlFreeHeap 50755->50756 50757 9249cd1 50756->50757 50758->50754 50760 9248c54 RtlAllocateHeap 50759->50760 50761 924e014 50760->50761 50762 924e0ff 50761->50762 50763 92486d0 RtlAllocateHeap 50761->50763 50764 924e10d 50762->50764 50765 92486f8 RtlFreeHeap 50762->50765 50770 924e02b 50763->50770 50766 924e11b 50764->50766 50768 92486f8 RtlFreeHeap 50764->50768 50765->50764 50767 924e129 50766->50767 50769 92486f8 RtlFreeHeap 50766->50769 50768->50766 50769->50767 50770->50762 50771 92486f8 RtlFreeHeap 50770->50771 50772 924e059 50771->50772 50773 92486d0 RtlAllocateHeap 50772->50773 50774 924e069 50773->50774 50774->50762 50775 9248d58 2 API calls 50774->50775 50776 924e07f 50775->50776 50777 92486f8 RtlFreeHeap 50776->50777 50778 924e09c 50777->50778 50804 924df28 50778->50804 50781 924e0de 50783 924df28 7 API calls 50781->50783 50782 924cdf0 NtSetInformationThread 50782->50781 50784 924e0e9 50783->50784 50785 924df28 7 API calls 50784->50785 50786 924e0f4 50785->50786 50787 924df28 7 API calls 50786->50787 50787->50762 50789 924b5d0 3 API calls 50788->50789 50790 924adb8 50789->50790 50792 924ae28 50790->50792 50794 924adcf NtSetInformationThread 50790->50794 50791 924ae4d 50792->50791 50837 924ace4 RtlAllocateHeap RtlFreeHeap NtQuerySystemInformation 50792->50837 50794->50792 50795 924ade3 50794->50795 50834 924abe0 OpenSCManagerW 50795->50834 50797 924adf8 50797->50792 50836 924aa18 RtlAllocateHeap RtlFreeHeap 50797->50836 50838 924afe0 50799->50838 50805 924df4d 50804->50805 50806 92486d0 RtlAllocateHeap 50805->50806 50808 924dfe3 50805->50808 50810 924df5f 50806->50810 50807 924dff1 50807->50781 50807->50782 50808->50807 50809 92486f8 RtlFreeHeap 50808->50809 50809->50807 50810->50808 50813 924de64 50810->50813 50818 924dbcc 50810->50818 50814 9248794 RtlAllocateHeap 50813->50814 50817 924de80 50814->50817 50815 924df1e 50815->50810 50816 92486f8 RtlFreeHeap 50816->50815 50817->50815 50817->50816 50819 924dbf4 50818->50819 50821 92486d0 RtlAllocateHeap 50819->50821 50831 924dbf8 50819->50831 50820 924de35 DeleteDC 50822 924de3e 50820->50822 50825 924dc21 50821->50825 50823 924de4c 50822->50823 50824 92486f8 RtlFreeHeap 50822->50824 50823->50810 50824->50823 50826 924dc74 CreateDCW 50825->50826 50825->50831 50827 924dc91 50826->50827 50826->50831 50828 924dd32 StartDocW 50827->50828 50828->50831 50832 924dd62 50828->50832 50829 924dd80 50830 924de00 EndDoc 50829->50830 50830->50831 50831->50820 50831->50822 50832->50829 50833 924ddee EndPage 50832->50833 50833->50830 50833->50832 50835 924ac14 50834->50835 50835->50797 50836->50792 50837->50791 50839 924b0c1 50838->50839 50840 924b285 RegCreateKeyExW 50839->50840 50841 924b2df RegCreateKeyExW 50840->50841 50848 924b2b9 50840->50848 50843 924b3d4 50841->50843 50844 924b3fa 50841->50844 50843->50844 50849 924b3fc OpenEventLogW 50843->50849 50853 924aed4 50844->50853 50845 924b2e4 RegCreateKeyExW 50846 924b312 RegSetValueExW 50845->50846 50845->50848 50847 924b334 RegSetValueExW 50846->50847 50846->50848 50847->50848 50850 924b352 OpenEventLogW 50847->50850 50848->50841 50848->50845 50849->50843 50851 924b414 ClearEventLogW 50849->50851 50850->50848 50852 924b36a ClearEventLogW 50850->50852 50851->50843 50852->50848 50860 924ae54 RtlAdjustPrivilege 50853->50860 50855 924afc4 CloseServiceHandle 50856 924afcd 50855->50856 50857 924aeed 50858 924afac 50857->50858 50863 924fbb8 50857->50863 50858->50855 50858->50856 50861 924b5d0 3 API calls 50860->50861 50862 924ae8c 50861->50862 50862->50857 50864 924fc12 50863->50864 50865 924fc16 NtTerminateProcess 50864->50865 50866 924fc2a 50864->50866 50865->50866 50866->50858

                                                                                                                                                                                        Executed Functions

                                                                                                                                                                                        Function 0924D660 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 341COMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 0 924d660-924d714 call 9248c54 7 924d716 0->7 8 924d71b-924d734 call 92486d0 0->8 9 924da94-924da9b 7->9 14 924d736 8->14 15 924d73b-924d74e call 9253ec4 8->15 11 924da9d 9->11 12 924daa9-924dab0 9->12 11->12 16 924dab2 12->16 17 924dabe-924dac2 12->17 14->9 24 924d755-924d765 call 924d4e4 15->24 25 924d750 15->25 16->17 19 924dac4 17->19 20 924dacd-924dad1 17->20 19->20 22 924dad3-924dad6 call 92486f8 20->22 23 924dadb-924dadf 20->23 22->23 27 924dae1-924dae4 call 92486f8 23->27 28 924dae9-924daed 23->28 38 924d767 24->38 39 924d76c-924d7bd GetTempFileNameW CreateFileW 24->39 25->9 27->28 31 924daf7-924dafb 28->31 32 924daef-924daf2 call 92486f8 28->32 34 924db05-924db0b 31->34 35 924dafd-924db00 call 92486f8 31->35 32->31 35->34 38->9 41 924d7c4-924d7d9 WriteFile 39->41 42 924d7bf 39->42 43 924d7e0-924d7f9 41->43 44 924d7db 41->44 42->9 46 924d7fb-924d800 43->46 44->9 47 924d804-924d806 46->47 48 924d802-924d843 CreateProcessW 46->48 47->46 50 924d845 48->50 51 924d84a-924d867 NtQueryInformationProcess 48->51 50->9 52 924d86e-924d88e 51->52 53 924d869 51->53 55 924d895-924d8a6 call 9248c54 52->55 56 924d890 52->56 53->9 59 924d8ad-924d928 call 9256410 call 92562e8 call 92563bc 55->59 60 924d8a8 55->60 56->9 68 924d92f-924d942 NtWriteVirtualMemory 59->68 69 924d92a 59->69 60->9 70 924d944 68->70 71 924d949-924d9a5 68->71 69->9 70->9 73 924d9a7 71->73 74 924d9ac-924d9cd NtDuplicateObject 71->74 73->9 75 924d9d4-924da3c CreateNamedPipeW 74->75 76 924d9cf 74->76 77 924da40-924da59 ResumeThread ConnectNamedPipe 75->77 78 924da3e 75->78 76->9 79 924da6a-924da87 77->79 80 924da5b-924da66 77->80 78->9 83 924da89 79->83 84 924da8b 79->84 80->79 81 924da68 80->81 81->9 83->9 84->9
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: @%%$D
                                                                                                                                                                                        • API String ID: 0-2950630167
                                                                                                                                                                                        • Opcode ID: ec4ad23bed75e26225104a18eda0ffc29dedf36f41706766ae8d21a4d068cbe6
                                                                                                                                                                                        • Instruction ID: 9d786eff2664389271fa85360893ecfe0a8d52e7dd9ed1afa5912ca5c71d45ad
                                                                                                                                                                                        • Opcode Fuzzy Hash: ec4ad23bed75e26225104a18eda0ffc29dedf36f41706766ae8d21a4d068cbe6
                                                                                                                                                                                        • Instruction Fuzzy Hash: 37E13871910319EFEF24DF90DC49BEEBBB8AB08304F1040A5E609A61D0D7B56A89CF56
                                                                                                                                                                                        Function 0924AFE0 Relevance: 13.7, APIs: 9, Instructions: 241registryCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 223 924afe0-924b2b3 call 9241190 * 5 RegCreateKeyExW 234 924b395-924b399 223->234 235 924b2b9 223->235 236 924b3a4-924b3d2 RegCreateKeyExW 234->236 237 924b39b 234->237 238 924b2c0-924b2dd 235->238 239 924b3d4 236->239 240 924b42d-924b431 236->240 237->236 245 924b2e4-924b310 RegCreateKeyExW 238->245 246 924b2df 238->246 242 924b3db-924b3f8 239->242 243 924b433 240->243 244 924b43c-924b43f 240->244 252 924b3fc-924b412 OpenEventLogW 242->252 253 924b3fa 242->253 243->244 247 924b312-924b332 RegSetValueExW 245->247 248 924b38d-924b390 245->248 246->234 250 924b334-924b350 RegSetValueExW 247->250 251 924b37e-924b382 247->251 248->238 250->251 254 924b352-924b368 OpenEventLogW 250->254 251->248 257 924b384 251->257 255 924b414-924b41f ClearEventLogW 252->255 256 924b428-924b42b 252->256 253->240 254->251 258 924b36a-924b375 ClearEventLogW 254->258 255->256 256->242 257->248 258->251
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • RegCreateKeyExW.KERNEL32(80000002,?,00000000,00000000,00000000,0002011F,00000000,00000000,00000000,?,00000007,?,00000004,?,00000019,?), ref: 0924B2AB
                                                                                                                                                                                        • RegCreateKeyExW.KERNEL32(00000000,?,00000000,00000000,00000000,0002011F,00000000,00000000,00000000), ref: 0924B308
                                                                                                                                                                                        • RegSetValueExW.KERNEL32(00000000,?,00000000,00000004,00000000,00000004), ref: 0924B32A
                                                                                                                                                                                        • RegSetValueExW.KERNEL32(00000000,?,00000000,00000001,?,00000064), ref: 0924B348
                                                                                                                                                                                        • OpenEventLogW.ADVAPI32(00000000,?), ref: 0924B35B
                                                                                                                                                                                        • ClearEventLogW.ADVAPI32(00000000,00000000), ref: 0924B36F
                                                                                                                                                                                        • RegCreateKeyExW.KERNELBASE(80000002,?,00000000,00000000,00000000,0002011F,00000000,00000000,00000000), ref: 0924B3CA
                                                                                                                                                                                        • OpenEventLogW.ADVAPI32(00000000,?), ref: 0924B405
                                                                                                                                                                                        • ClearEventLogW.ADVAPI32(00000000,00000000), ref: 0924B419
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Event$Create$ClearOpenValue
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 4090462516-0
                                                                                                                                                                                        • Opcode ID: 4266faa42b3bd928c695cbcb65a2e8831981d05b9942b1d331168995a55309f1
                                                                                                                                                                                        • Instruction ID: c929ee675fd62dadfbda3229ca2c496d86ed63f6c3e2cf1969598f5044aba79f
                                                                                                                                                                                        • Opcode Fuzzy Hash: 4266faa42b3bd928c695cbcb65a2e8831981d05b9942b1d331168995a55309f1
                                                                                                                                                                                        • Instruction Fuzzy Hash: 9BC1F4B0550B04EFEB54DF51D989FA9BF78FB04300F128099E6196F2A2E3768A94CF51
                                                                                                                                                                                        Function 092494BC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119fileCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 535 92494bc-92494e3 537 9249673-9249678 535->537 538 92494e9-92494fd call 92486d0 535->538 541 9249657-924965b 538->541 542 9249503-9249550 call 92416bc FindFirstFileExW 538->542 543 9249665-9249669 541->543 544 924965d-9249660 call 92486f8 541->544 542->541 552 9249556-924955f 542->552 543->537 546 924966b-924966e call 92486f8 543->546 544->543 546->537 553 9249565-924956b 552->553 554 9249636-9249648 FindNextFileW 552->554 553->554 555 9249571-924959f call 92486d0 553->555 554->552 556 924964e 554->556 555->554 561 92495a5-92495e1 GetFileAttributesW 555->561 556->541 565 92495e3-92495ee 561->565 566 924961e-924962a DeleteFileW call 92486f8 561->566 570 92495f0 565->570 571 92495f2-92495fd 565->571 569 924962f 566->569 569->554 572 924960d-924961c call 92486f8 570->572 573 92495ff-924960b call 92494bc 571->573 574 9249609 571->574 572->554 573->565 574->572
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 092486D0: RtlAllocateHeap.NTDLL(?,00000008,09250F7F,?,09250F7F,003D0900), ref: 092486EC
                                                                                                                                                                                        • FindFirstFileExW.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 09249543
                                                                                                                                                                                        • GetFileAttributesW.KERNELBASE(00000000), ref: 092495D6
                                                                                                                                                                                        • DeleteFileW.KERNEL32(00000000), ref: 09249621
                                                                                                                                                                                        • FindNextFileW.KERNELBASE(000000FF,?), ref: 09249640
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: File$Find$AllocateAttributesDeleteFirstHeapNext
                                                                                                                                                                                        • String ID: *
                                                                                                                                                                                        • API String ID: 2270753430-163128923
                                                                                                                                                                                        • Opcode ID: 131c0460c769bb174eab6482f0b50b8f4517507495751651afea5c3d140d74f2
                                                                                                                                                                                        • Instruction ID: 3e435a0696a1b19741f8d660f17b8c9224f8a89d97f304c2178dab449ff76baf
                                                                                                                                                                                        • Opcode Fuzzy Hash: 131c0460c769bb174eab6482f0b50b8f4517507495751651afea5c3d140d74f2
                                                                                                                                                                                        • Instruction Fuzzy Hash: 52416A74C20219FBDF25AF94ED4CBAEBB75BF00781F0045A0F525A90A0D7B54AA4DF46
                                                                                                                                                                                        Function 09247AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 99fileCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 580 9247ac0-9247ad1 581 9247af2-9247af9 580->581 582 9247ad3-9247aed call 9247988 580->582 584 9247b1a-9247b21 581->584 585 9247afb-9247b15 call 9247988 581->585 582->581 586 9247b42-9247b49 call 924165c 584->586 587 9247b23-9247b3d call 9247988 584->587 585->584 594 9247b4e-9247b52 586->594 587->586 595 9247b54-9247b7e call 9241190 594->595 596 9247b79-9247b7c 594->596 600 9247b85-9247ba0 FindFirstFileW 595->600 596->594 601 9247bf0-9247bf4 600->601 602 9247ba2-9247bb3 call 92411f0 600->602 603 9247bf6-9247c38 601->603 604 9247bf8-9247c02 601->604 612 9247bb5-9247bc7 FindClose call 92478bc 602->612 613 9247bd3-9247be5 FindNextFileW 602->613 607 9247c04-9247c09 604->607 608 9247c27-9247c2a 604->608 610 9247c22-9247c25 607->610 611 9247c0b-9247c20 call 9241190 607->611 608->600 610->607 611->608 617 9247bcc-9247bd0 612->617 613->602 615 9247be7-9247bea FindClose 613->615 615->601
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • FindFirstFileW.KERNEL32(?,?,?,00000004), ref: 09247B93
                                                                                                                                                                                        • FindClose.KERNEL32(000000FF,?,00000000), ref: 09247BB8
                                                                                                                                                                                        • FindNextFileW.KERNELBASE(000000FF,?,?,00000000), ref: 09247BDD
                                                                                                                                                                                        • FindClose.KERNEL32(000000FF), ref: 09247BEA
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Find$CloseFile$FirstNext
                                                                                                                                                                                        • String ID: 0vi}
                                                                                                                                                                                        • API String ID: 1164774033-463007280
                                                                                                                                                                                        • Opcode ID: cd18cdc318086c853368111eb0e61c593f93e35cb2a092960a487d897d597412
                                                                                                                                                                                        • Instruction ID: 129670814c821cc6e8e274adeb09c38507c447b7435830dcd3a613dbbd505e8f
                                                                                                                                                                                        • Opcode Fuzzy Hash: cd18cdc318086c853368111eb0e61c593f93e35cb2a092960a487d897d597412
                                                                                                                                                                                        • Instruction Fuzzy Hash: 0441B370860344FFEB24EF60E989BB9BB7CEB10300F11A0A5E919EA154D7704AD4CF52
                                                                                                                                                                                        Function 09250F48 Relevance: 4.6, APIs: 3, Instructions: 140filethreadCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • SetThreadPriority.KERNEL32(000000FE,00000002), ref: 09250F55
                                                                                                                                                                                        • FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,?,?,?,0925DF10,003D0900), ref: 09250FC2
                                                                                                                                                                                        • FindNextFileW.KERNELBASE(000000FF,?), ref: 092510F4
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FileFind$FirstNextPriorityThread
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 247853790-0
                                                                                                                                                                                        • Opcode ID: 8e3dfd1c59d40017b1cb1c1e07059da15bba6dc0756722fbe4baa43c6e36351e
                                                                                                                                                                                        • Instruction ID: d350e63b491ed8e86a2d50b0033792fd4566890f2963cb25822d1bfa94906273
                                                                                                                                                                                        • Opcode Fuzzy Hash: 8e3dfd1c59d40017b1cb1c1e07059da15bba6dc0756722fbe4baa43c6e36351e
                                                                                                                                                                                        • Instruction Fuzzy Hash: 6951803087925AEFDF20AF90DD49BAD7774EF04351F109291EC16761A1CB718AA1CB52
                                                                                                                                                                                        Function 0924D0A8 Relevance: 4.5, APIs: 3, Instructions: 31nativeCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • NtSetInformationProcess.NTDLL(000000FF,00000021,00000000,00000004,00000004,?,092523C9), ref: 0924D0C5
                                                                                                                                                                                        • NtSetInformationProcess.NTDLL(000000FF,00000012,00000000,00000002,?,092523C9), ref: 0924D0D7
                                                                                                                                                                                        • NtSetInformationProcess.NTDLL(000000FF,0000000C,00000000,00000004,?,092523C9), ref: 0924D0EC
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: InformationProcess
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1801817001-0
                                                                                                                                                                                        • Opcode ID: dff3ccd4708853ce01c785c5a5b9d7d54dec13b11b906d69108f3b7222bb3589
                                                                                                                                                                                        • Instruction ID: 4f477c4c72008acd982876221f955b384763b35d82d2ef00dfbd191446ec6ea9
                                                                                                                                                                                        • Opcode Fuzzy Hash: dff3ccd4708853ce01c785c5a5b9d7d54dec13b11b906d69108f3b7222bb3589
                                                                                                                                                                                        • Instruction Fuzzy Hash: D2F01CB1240354BBEB25AB94DCC9F65379C9B06720F505360B331EE0D5C7B099088723
                                                                                                                                                                                        Function 0924AD7E Relevance: 3.1, APIs: 2, Instructions: 70nativethreadCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • RtlAdjustPrivilege.NTDLL(00000014,00000001,00000000,00000000), ref: 0924ADA2
                                                                                                                                                                                          • Part of subcall function 0924B5D0: NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 0924B5FD
                                                                                                                                                                                        • NtSetInformationThread.NTDLL(000000FE,00000005,00000000,00000004,00000000,00000002,00000002,EBF9D5BF), ref: 0924ADD9
                                                                                                                                                                                          • Part of subcall function 0924ABE0: OpenSCManagerW.SECHOST(00000000,00000000,00000001), ref: 0924AC01
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Information$AdjustManagerOpenPrivilegeQuerySystemThread
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1715806643-0
                                                                                                                                                                                        • Opcode ID: a7f07c6cd71f154074e67a8581877d26eff4f12ab75962e592a65e60659767ab
                                                                                                                                                                                        • Instruction ID: abf87448455b57e2e715e3cb82660ef0f7372b42b7794953b6755f78187ddec8
                                                                                                                                                                                        • Opcode Fuzzy Hash: a7f07c6cd71f154074e67a8581877d26eff4f12ab75962e592a65e60659767ab
                                                                                                                                                                                        • Instruction Fuzzy Hash: 20211270A90309FAEB14AFE0ED4DFDE7AB89F04715F5051B4F514A61D0E7B48A84C751
                                                                                                                                                                                        Function 0924AD80 Relevance: 3.1, APIs: 2, Instructions: 69nativethreadCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • RtlAdjustPrivilege.NTDLL(00000014,00000001,00000000,00000000), ref: 0924ADA2
                                                                                                                                                                                          • Part of subcall function 0924B5D0: NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 0924B5FD
                                                                                                                                                                                        • NtSetInformationThread.NTDLL(000000FE,00000005,00000000,00000004,00000000,00000002,00000002,EBF9D5BF), ref: 0924ADD9
                                                                                                                                                                                          • Part of subcall function 0924ABE0: OpenSCManagerW.SECHOST(00000000,00000000,00000001), ref: 0924AC01
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Information$AdjustManagerOpenPrivilegeQuerySystemThread
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1715806643-0
                                                                                                                                                                                        • Opcode ID: c5dee7b853a8c79133a1b9fcb4fcbcc4dd0821c5448b20b49780e3ea7a658eaf
                                                                                                                                                                                        • Instruction ID: 88d90b566ade7bf975dc2bd429cd91315cff67319e32e1f589dc7adc7ece8917
                                                                                                                                                                                        • Opcode Fuzzy Hash: c5dee7b853a8c79133a1b9fcb4fcbcc4dd0821c5448b20b49780e3ea7a658eaf
                                                                                                                                                                                        • Instruction Fuzzy Hash: 42211270A90309FAEB14AFE0ED4DFDE7AB89F04705F5051B4F514A61D0E7B48A84C751
                                                                                                                                                                                        Function 0924930C Relevance: 3.1, APIs: 2, Instructions: 60fileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 092493E0: FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 0924944F
                                                                                                                                                                                        • FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 0924936F
                                                                                                                                                                                        • FindNextFileW.KERNELBASE(000000FF,?), ref: 092493C6
                                                                                                                                                                                          • Part of subcall function 092494BC: FindFirstFileExW.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 09249543
                                                                                                                                                                                          • Part of subcall function 092494BC: GetFileAttributesW.KERNELBASE(00000000), ref: 092495D6
                                                                                                                                                                                          • Part of subcall function 092494BC: FindNextFileW.KERNELBASE(000000FF,?), ref: 09249640
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: File$Find$First$Next$Attributes
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 407996502-0
                                                                                                                                                                                        • Opcode ID: 08957743242084993b1e8c3ab23d6b3ac88e5284a8eb60e50c586744cf6e7e8f
                                                                                                                                                                                        • Instruction ID: ef90fb1070281176ffdcf91f837c1fff3dad643d6ef78f616af6524bae1ee386
                                                                                                                                                                                        • Opcode Fuzzy Hash: 08957743242084993b1e8c3ab23d6b3ac88e5284a8eb60e50c586744cf6e7e8f
                                                                                                                                                                                        • Instruction Fuzzy Hash: E7213E7580020DEBDB10EB94DE4DBDABB7CAB14701F0040A5F609E2191E7759B588F62
                                                                                                                                                                                        Function 09249EDC Relevance: 1.6, APIs: 1, Instructions: 142nativeCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • NtQueryDefaultUILanguage.NTDLL(?), ref: 09249EF8
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: DefaultLanguageQuery
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1532992581-0
                                                                                                                                                                                        • Opcode ID: 40f55160db2c7e87fd3046b979bc376e17e3261d761ab191f0b23db75a19d7ce
                                                                                                                                                                                        • Instruction ID: cc112513d1c42e07890214dfde20d0d75b4eccf9e5eabafead967c8ec2e07d89
                                                                                                                                                                                        • Opcode Fuzzy Hash: 40f55160db2c7e87fd3046b979bc376e17e3261d761ab191f0b23db75a19d7ce
                                                                                                                                                                                        • Instruction Fuzzy Hash: 5331C52ABFB9074AFF7DE85093867F7A248F340BA0DDE2513E44E63582589D4DC18663
                                                                                                                                                                                        Function 09249C7C Relevance: 1.6, APIs: 1, Instructions: 73nativeCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 092486D0: RtlAllocateHeap.NTDLL(?,00000008,09250F7F,?,09250F7F,003D0900), ref: 092486EC
                                                                                                                                                                                        • NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 09249CA2
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AllocateHeapInformationQuerySystem
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3114120137-0
                                                                                                                                                                                        • Opcode ID: 7d26406a357e344a5d238b02b95b91e01d001d3a800774e63e855dac2e5bb810
                                                                                                                                                                                        • Instruction ID: 22c415554fb9e706445f556ea48bf619e2600376073a7537efff964f5888afb0
                                                                                                                                                                                        • Opcode Fuzzy Hash: 7d26406a357e344a5d238b02b95b91e01d001d3a800774e63e855dac2e5bb810
                                                                                                                                                                                        • Instruction Fuzzy Hash: 76216B74910208FFDF15EF90DD48BDEBBB8EF08704F108199E518AA150D7B28A85DF91
                                                                                                                                                                                        Function 09248AFC Relevance: 1.6, APIs: 1, Instructions: 64nativeCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • NtQueryInformationToken.NTDLL(00000000,00000001,?,00000028,?,?,?,?,?,00000000), ref: 09248B47
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: InformationQueryToken
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 4239771691-0
                                                                                                                                                                                        • Opcode ID: ca3786aae16ed6b64e40d08bde8bc179b2a0e99d0b06501dbd329ae453d8d504
                                                                                                                                                                                        • Instruction ID: 3566e46c4b519b417a3c6e9a20f138f90990606084b3d6055a11400b743ee640
                                                                                                                                                                                        • Opcode Fuzzy Hash: ca3786aae16ed6b64e40d08bde8bc179b2a0e99d0b06501dbd329ae453d8d504
                                                                                                                                                                                        • Instruction Fuzzy Hash: 421159B1920309FFEF149F90EC88FAEBBB8FB04754F0041A5F511A2190D7B19A48CB61
                                                                                                                                                                                        Function 09249C7A Relevance: 1.6, APIs: 1, Instructions: 60nativeCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 092486D0: RtlAllocateHeap.NTDLL(?,00000008,09250F7F,?,09250F7F,003D0900), ref: 092486EC
                                                                                                                                                                                        • NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 09249CA2
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AllocateHeapInformationQuerySystem
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3114120137-0
                                                                                                                                                                                        • Opcode ID: 309dfbab704d706e3a65b7999c116c950085986c8bed9137ba55c6249e931922
                                                                                                                                                                                        • Instruction ID: 0cecdebd584bb7e5acf64cc41428c62bfeafd071aa96f52e50d20a975935c6c2
                                                                                                                                                                                        • Opcode Fuzzy Hash: 309dfbab704d706e3a65b7999c116c950085986c8bed9137ba55c6249e931922
                                                                                                                                                                                        • Instruction Fuzzy Hash: 4A216D74910208EFDF05DF90DD48B9E7BB8EF04704F108098E514AA190D7B29A45CFA1
                                                                                                                                                                                        Function 092493E0 Relevance: 1.6, APIs: 1, Instructions: 58COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 0924944F
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FileFindFirst
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1974802433-0
                                                                                                                                                                                        • Opcode ID: dea0d658e579ec43581250c132d0f72eaa58b8da84010b06d638cdd4e10ae164
                                                                                                                                                                                        • Instruction ID: cacdd69fc19c6d0f210ec6765ba54f8cbda41c4f759293c529eba1fd57ad6de5
                                                                                                                                                                                        • Opcode Fuzzy Hash: dea0d658e579ec43581250c132d0f72eaa58b8da84010b06d638cdd4e10ae164
                                                                                                                                                                                        • Instruction Fuzzy Hash: 27210BB0800208FFDB109F90ED4CBADBBB8FB04755F1081A5F908AA151D7759B99DF95
                                                                                                                                                                                        Function 0924B5D0 Relevance: 1.6, APIs: 1, Instructions: 57nativeCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 092486D0: RtlAllocateHeap.NTDLL(?,00000008,09250F7F,?,09250F7F,003D0900), ref: 092486EC
                                                                                                                                                                                        • NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 0924B5FD
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AllocateHeapInformationQuerySystem
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3114120137-0
                                                                                                                                                                                        • Opcode ID: cd24065209f55f6f326847cd8449e905801b4b5cd53cef6da9875ea01f1e2b73
                                                                                                                                                                                        • Instruction ID: c4622ce4873e874fe68b427bb0d4c9451913eb377f4bfcb0598e918fbdee7889
                                                                                                                                                                                        • Opcode Fuzzy Hash: cd24065209f55f6f326847cd8449e905801b4b5cd53cef6da9875ea01f1e2b73
                                                                                                                                                                                        • Instruction Fuzzy Hash: 8D118C71D20108FBCF19EF94D980BDDBBB8EF04350F108196EA11AA150D772DA609F94
                                                                                                                                                                                        Function 09249CAE Relevance: 1.6, APIs: 1, Instructions: 56nativeCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 09249CA2
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: InformationQuerySystem
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3562636166-0
                                                                                                                                                                                        • Opcode ID: 00fd1345e9fef80cc26c4e47984ef20f76224d1bf405df5a6f6db5f461b027c3
                                                                                                                                                                                        • Instruction ID: 8b8617f074f77c2177364659dd495795c2f0c0c0a97a9e630c5ada249f5f6594
                                                                                                                                                                                        • Opcode Fuzzy Hash: 00fd1345e9fef80cc26c4e47984ef20f76224d1bf405df5a6f6db5f461b027c3
                                                                                                                                                                                        • Instruction Fuzzy Hash: E9216D74950209EFDF05DF90D948B9E7BB8FF08704F108099E505BA154D7B29A89CF91
                                                                                                                                                                                        Function 09249CC7 Relevance: 1.6, APIs: 1, Instructions: 56nativeCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 09249CA2
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: InformationQuerySystem
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3562636166-0
                                                                                                                                                                                        • Opcode ID: e5e237894bf5c4a332d482b51dfe991eeb786449dbe2a67cb6b3aeb1caf9c282
                                                                                                                                                                                        • Instruction ID: 8b8617f074f77c2177364659dd495795c2f0c0c0a97a9e630c5ada249f5f6594
                                                                                                                                                                                        • Opcode Fuzzy Hash: e5e237894bf5c4a332d482b51dfe991eeb786449dbe2a67cb6b3aeb1caf9c282
                                                                                                                                                                                        • Instruction Fuzzy Hash: E9216D74950209EFDF05DF90D948B9E7BB8FF08704F108099E505BA154D7B29A89CF91
                                                                                                                                                                                        Function 0924CDF0 Relevance: 1.5, APIs: 1, Instructions: 43nativethreadCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • NtSetInformationThread.NTDLL(00000000,00000005,00000000,00000004), ref: 0924CE54
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: InformationThread
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 4046476035-0
                                                                                                                                                                                        • Opcode ID: 9f473028ea6bf0977fcc2d7d4c2434323f3b5aea68097409b8afc138c8e588ce
                                                                                                                                                                                        • Instruction ID: eef7605786e0a83ce5459c3c7818e149ad63539c8f4bf4a9f1f0782b3c738241
                                                                                                                                                                                        • Opcode Fuzzy Hash: 9f473028ea6bf0977fcc2d7d4c2434323f3b5aea68097409b8afc138c8e588ce
                                                                                                                                                                                        • Instruction Fuzzy Hash: 1D017C70610308EFEB10CF40ED8DFAABBA8FB00714F4181A4F9049B1A2D3B58A09CB91
                                                                                                                                                                                        Function 092478BC Relevance: 1.5, APIs: 1, Instructions: 40libraryloaderCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • LdrLoadDll.NTDLL(00000000,00000000,00000000,?), ref: 0924790D
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Load
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2234796835-0
                                                                                                                                                                                        • Opcode ID: 5b690488c9b1984aa05b263f94bb3b669ad68d9669ba6b3fa24494d65200b47e
                                                                                                                                                                                        • Instruction ID: ddaa606805013511952e91401e3b6f2728777d72300eb9aeef78b5f2583448aa
                                                                                                                                                                                        • Opcode Fuzzy Hash: 5b690488c9b1984aa05b263f94bb3b669ad68d9669ba6b3fa24494d65200b47e
                                                                                                                                                                                        • Instruction Fuzzy Hash: 5AF0EC7695010DFEDF10EEA4D949FDEB7BCAB04355F0081A2E919A7040D770AB1C9FA1
                                                                                                                                                                                        Function 0924FBB8 Relevance: 1.5, APIs: 1, Instructions: 34nativeCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • NtTerminateProcess.NTDLL(0924FD70,00000000), ref: 0924FC1B
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ProcessTerminate
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 560597551-0
                                                                                                                                                                                        • Opcode ID: 5675a9316068ef823601cd8b2245f4cb49bffae08afe03a5ef0961315a71044a
                                                                                                                                                                                        • Instruction ID: f249e8e379ec5eb4cf2d9f525405d6364ae873463b4568a555cbb48ed20ea3ee
                                                                                                                                                                                        • Opcode Fuzzy Hash: 5675a9316068ef823601cd8b2245f4cb49bffae08afe03a5ef0961315a71044a
                                                                                                                                                                                        • Instruction Fuzzy Hash: 8B01ACB190030CEFDB00CF90D958BDEBBB8FB05318F148199E504AB281D7B69A4ADF91
                                                                                                                                                                                        Function 0924CFE8 Relevance: 1.5, APIs: 1, Instructions: 34nativeCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • NtQueryInformationToken.NTDLL(?,00000001,?,0000002C,?), ref: 0924D012
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: InformationQueryToken
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 4239771691-0
                                                                                                                                                                                        • Opcode ID: f0546f3c195da2df02fefd94bd8e126f2beb607ab52f80e0dc00c323cbb41b63
                                                                                                                                                                                        • Instruction ID: 6428c9074bb262f9f51ee512751ef9fd48942c0f8c4e4ea40315e390fd772363
                                                                                                                                                                                        • Opcode Fuzzy Hash: f0546f3c195da2df02fefd94bd8e126f2beb607ab52f80e0dc00c323cbb41b63
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7FF03A31605208FFEB10CEA4ED8AFA9B7ADEB04310F5012A1F914D71D0E7B1AF48CA52
                                                                                                                                                                                        Function 0924B622 Relevance: 1.5, APIs: 1, Instructions: 31nativeCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 0924B5FD
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: InformationQuerySystem
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3562636166-0
                                                                                                                                                                                        • Opcode ID: 64c0c1b7b8ca2ddc6e298e1f7aa946a86f35fe695443689e284ecd7907c45e9c
                                                                                                                                                                                        • Instruction ID: 89ad1379505b623c254f919b7f80a4aac36a457c0b475bfa7c322bfc81930449
                                                                                                                                                                                        • Opcode Fuzzy Hash: 64c0c1b7b8ca2ddc6e298e1f7aa946a86f35fe695443689e284ecd7907c45e9c
                                                                                                                                                                                        • Instruction Fuzzy Hash: C5F05E31A20108FBCF19DF94D984BACB778EF04340F549092FA16AE154C3B1DA60DF11
                                                                                                                                                                                        Function 0924B609 Relevance: 1.5, APIs: 1, Instructions: 31nativeCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 0924B5FD
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: InformationQuerySystem
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3562636166-0
                                                                                                                                                                                        • Opcode ID: ad6c2a8355bb950a01173ddd459762221a2f9164958a21eb96256eadd20c0ca8
                                                                                                                                                                                        • Instruction ID: 89ad1379505b623c254f919b7f80a4aac36a457c0b475bfa7c322bfc81930449
                                                                                                                                                                                        • Opcode Fuzzy Hash: ad6c2a8355bb950a01173ddd459762221a2f9164958a21eb96256eadd20c0ca8
                                                                                                                                                                                        • Instruction Fuzzy Hash: C5F05E31A20108FBCF19DF94D984BACB778EF04340F549092FA16AE154C3B1DA60DF11
                                                                                                                                                                                        Function 09248614 Relevance: 1.5, APIs: 1, Instructions: 18nativethreadCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • NtSetInformationThread.NTDLL(00000000,?,00000000,00000000,?,092501A7,00000000), ref: 09248635
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: InformationThread
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 4046476035-0
                                                                                                                                                                                        • Opcode ID: 8fe6c36109fea30554400e09bb279bd6e814d6820c6958b455b6109d86c578fb
                                                                                                                                                                                        • Instruction ID: 831ab9c7b27954b9a577d2024d6cb26ec110cbbde9e87e5e3656682b2165311e
                                                                                                                                                                                        • Opcode Fuzzy Hash: 8fe6c36109fea30554400e09bb279bd6e814d6820c6958b455b6109d86c578fb
                                                                                                                                                                                        • Instruction Fuzzy Hash: 26D05E725B020DAAD714AB50EC09BB6335CD305341F004124B5068D080D6B0B5508655
                                                                                                                                                                                        Function 0924BE00 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetLogicalDriveStringsW.KERNEL32(?,?), ref: 0924BE0B
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: DriveLogicalStrings
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2022863570-0
                                                                                                                                                                                        • Opcode ID: 937fde2665126e39af47f4be7a5a428ae87327e45d90d5ad112278202a5bfccb
                                                                                                                                                                                        • Instruction ID: d8650fb1fba1d996d8712448387a1882c5187c8f12ddeac789cfaa05f42c5fdd
                                                                                                                                                                                        • Opcode Fuzzy Hash: 937fde2665126e39af47f4be7a5a428ae87327e45d90d5ad112278202a5bfccb
                                                                                                                                                                                        • Instruction Fuzzy Hash: E7C09236000208EF8B019F88E808C95BFE9FB58B007058061F6084B231CB32E924EB9A
                                                                                                                                                                                        Function 0924A050 Relevance: 18.0, APIs: 8, Strings: 2, Instructions: 502COMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 85 924a050-924a0a9 86 924a0b0-924a0bf 85->86 87 924a0ab 85->87 92 924a0c6-924a0d6 86->92 93 924a0c1 86->93 88 924a6d9-924a6dd 87->88 90 924a6df 88->90 91 924a6e8-924a6ec 88->91 90->91 94 924a6fd-924a701 91->94 95 924a6ee-924a6f2 91->95 102 924a0dd-924a0ed 92->102 103 924a0d8 92->103 93->88 97 924a703 94->97 98 924a70c-924a710 94->98 95->94 96 924a6f4 95->96 96->94 97->98 100 924a712 98->100 101 924a71b-924a71f 98->101 100->101 104 924a721-924a724 call 92486f8 101->104 105 924a729-924a72d 101->105 115 924a0f4-924a10f call 92526c4 102->115 116 924a0ef 102->116 103->88 104->105 107 924a737-924a73b 105->107 108 924a72f-924a732 call 92486f8 105->108 111 924a746-924a74a 107->111 112 924a73d 107->112 108->107 113 924a755-924a759 111->113 114 924a74c 111->114 112->111 117 924a764-924a768 113->117 118 924a75b 113->118 114->113 123 924a111-924a136 115->123 124 924a139-924a1c9 call 9241190 115->124 116->88 120 924a775-924a77b 117->120 121 924a76a-924a76d 117->121 118->117 121->120 123->124 131 924a1d0-924a1de 124->131 132 924a1cb 124->132 134 924a1e5-924a1f6 call 92486d0 131->134 135 924a1e0 131->135 132->88 138 924a1fd-924a205 call 9241568 134->138 139 924a1f8 134->139 135->88 142 924a207-924a218 call 9248c54 138->142 143 924a221-924a232 call 9248c54 138->143 139->88 148 924a21f 142->148 149 924a21a 142->149 150 924a234 143->150 151 924a239-924a252 143->151 148->151 149->88 150->88 153 924a254-924a263 call 92486f8 151->153 154 924a268-924a27b 151->154 153->88 158 924a282-924a298 154->158 159 924a27d 154->159 161 924a29f-924a2ad 158->161 162 924a29a 158->162 159->88 164 924a2b4-924a307 call 9241568 161->164 165 924a2af 161->165 162->88 171 924a318 164->171 172 924a309-924a316 164->172 165->88 173 924a31b-924a33c DrawTextW 171->173 172->173 174 924a343-924a3eb 173->174 175 924a33e 173->175 179 924a3f2-924a41f 174->179 180 924a3ed 174->180 175->88 183 924a426-924a49f call 92416bc call 9241190 CreateFileW 179->183 184 924a421 179->184 180->88 192 924a4a6-924a4c0 WriteFile 183->192 193 924a4a1 183->193 184->88 194 924a4c7-924a4de WriteFile 192->194 195 924a4c2 192->195 193->88 196 924a4e5-924a4fc WriteFile 194->196 197 924a4e0 194->197 195->88 198 924a503-924a527 call 9248afc 196->198 199 924a4fe 196->199 197->88 203 924a52e-924a5d2 call 92416bc call 9241190 RegCreateKeyExW 198->203 204 924a529 198->204 199->88 210 924a5d4 203->210 211 924a5d9-924a638 call 9241190 RegSetValueExW 203->211 204->88 210->88 215 924a63f-924a6c0 call 9241190 RegSetValueExW 211->215 216 924a63a 211->216 220 924a6c4-924a6c8 215->220 221 924a6c2 215->221 216->88 220->88 222 924a6ca-924a6d1 220->222 221->88 222->88
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: ($BM
                                                                                                                                                                                        • API String ID: 0-2980357723
                                                                                                                                                                                        • Opcode ID: 692d022ba762ef4f88e8a74277e6020afe4606dd936a2393c36776d8b670b473
                                                                                                                                                                                        • Instruction ID: 623035b2204a68f50d7f864c093728c207c8b332b1eb25e78016c3e4c027a8c4
                                                                                                                                                                                        • Opcode Fuzzy Hash: 692d022ba762ef4f88e8a74277e6020afe4606dd936a2393c36776d8b670b473
                                                                                                                                                                                        • Instruction Fuzzy Hash: 0A2247719A0309EFEF14DFA0DD49BADBBB4BF08341F109055E106BA1A0D7B18A94DF66
                                                                                                                                                                                        Function 0924E38C Relevance: 10.7, APIs: 7, Instructions: 173registryfileCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 259 924e38c-924e3a6 260 924e3ac-924e3c1 call 9248c54 259->260 261 924e5df-924e5e8 259->261 260->261 264 924e3c7-924e3dd call 92486d0 260->264 267 924e3e3-924e3f4 call 9253ec4 264->267 268 924e5d9-924e5da call 92486f8 264->268 272 924e5d3-924e5d4 call 92486f8 267->272 273 924e3fa-924e47b call 92416bc CreateFileW 267->273 268->261 272->268 273->272 279 924e481-924e496 WriteFile 273->279 280 924e49c-924e4bf RegCreateKeyExW 279->280 281 924e5ca 279->281 280->281 282 924e4c5-924e4f1 RegSetValueExW 280->282 281->272 284 924e4f7-924e570 RegCreateKeyExW 282->284 285 924e5c1 282->285 284->285 288 924e572-924e5a4 RegSetValueExW 284->288 285->281 288->285 290 924e5a6-924e5ba SHChangeNotify 288->290 290->285
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 092486D0: RtlAllocateHeap.NTDLL(?,00000008,09250F7F,?,09250F7F,003D0900), ref: 092486EC
                                                                                                                                                                                        • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0924E46E
                                                                                                                                                                                        • WriteFile.KERNEL32(000000FF,00000000,000000FF,?,00000000), ref: 0924E48E
                                                                                                                                                                                        • RegCreateKeyExW.KERNEL32(80000000,?,00000000,00000000,00000000,00020106,00000000,?,00000000), ref: 0924E4B7
                                                                                                                                                                                        • RegSetValueExW.KERNEL32(?,00000000,00000000,00000001,?,00000000), ref: 0924E4E9
                                                                                                                                                                                        • RegCreateKeyExW.KERNEL32(80000000,?,00000000,00000000,00000000,00020106,00000000,?,00000000), ref: 0924E568
                                                                                                                                                                                        • RegSetValueExW.KERNEL32(?,00000000,00000000,00000001,?,00000000), ref: 0924E59C
                                                                                                                                                                                        • SHChangeNotify.SHELL32(08000000,00001000,00000000,00000000), ref: 0924E5B4
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Create$FileValue$AllocateChangeHeapNotifyWrite
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2786709897-0
                                                                                                                                                                                        • Opcode ID: 10163fc871aad4a0b1d9f5562304cdbca733a3e0747267747cbc45657368d597
                                                                                                                                                                                        • Instruction ID: 8f943b1206b3c848061df2ffecf5c53e502165cbfd68d21b3491dd6c43a6557d
                                                                                                                                                                                        • Opcode Fuzzy Hash: 10163fc871aad4a0b1d9f5562304cdbca733a3e0747267747cbc45657368d597
                                                                                                                                                                                        • Instruction Fuzzy Hash: E6516071A10309FBEB109FA0ED4DFAE7B79BB04705F104164F615EA0C0E7B1AA54CBA5
                                                                                                                                                                                        Function 06F42CC8 Relevance: 9.4, Strings: 7, Instructions: 647COMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 291 6f42cc8-6f42cf1 292 6f42cf7-6f42cfc 291->292 293 6f43672-6f43677 291->293 294 6f42d14-6f42d1e 292->294 295 6f42cfe-6f42d04 292->295 294->293 298 6f42d24-6f42d29 294->298 296 6f42d06 295->296 297 6f42d08-6f42d12 295->297 296->294 297->294 300 6f42d41-6f42d4b 298->300 301 6f42d2b-6f42d31 298->301 300->293 305 6f42d51-6f42d56 300->305 303 6f42d35-6f42d3f 301->303 304 6f42d33 301->304 303->300 304->300 306 6f42d6e 305->306 307 6f42d58-6f42d5e 305->307 310 6f42d71-6f42d7b 306->310 308 6f42d60 307->308 309 6f42d62-6f42d6c 307->309 308->306 309->306 310->293 312 6f42d81-6f42d86 310->312 314 6f42d9e-6f42dbc 312->314 315 6f42d88-6f42d8e 312->315 318 6f42dbe-6f42de7 314->318 319 6f42dea-6f42df4 314->319 316 6f42d90 315->316 317 6f42d92-6f42d9c 315->317 316->314 317->314 318->319 319->293 320 6f42dfa-6f42dff 319->320 321 6f42e17-6f42e71 320->321 322 6f42e01-6f42e07 320->322 333 6f43656-6f43662 321->333 334 6f42e77-6f42e97 321->334 325 6f42e09 322->325 326 6f42e0b-6f42e15 322->326 325->321 326->321 337 6f42e9a-6f42ea6 334->337 338 6f42eaf-6f42eca 337->338 339 6f42ea8 337->339 341 6f42ef3-6f42efd 338->341 342 6f42ecc-6f42eeb 338->342 339->338 340 6f4311d-6f43138 339->340 343 6f43161-6f4316b 340->343 344 6f4313a-6f43159 340->344 345 6f42f03-6f42f08 341->345 346 6f4345c-6f43496 341->346 342->341 343->346 349 6f43171-6f43176 343->349 344->343 347 6f42f20-6f42f29 345->347 348 6f42f0a-6f42f10 345->348 346->337 347->346 353 6f42f2f-6f42f3a 347->353 351 6f42f14-6f42f1e 348->351 352 6f42f12 348->352 355 6f4318e-6f4319a 349->355 356 6f43178-6f4317e 349->356 351->347 352->347 359 6f42f52-6f42fbc 353->359 360 6f42f3c-6f42f42 353->360 355->346 358 6f431a0-6f431a8 355->358 361 6f43180 356->361 362 6f43182-6f4318c 356->362 365 6f431c0-6f431cc 358->365 366 6f431aa-6f431b0 358->366 359->346 389 6f42fc2-6f42fc7 359->389 367 6f42f44 360->367 368 6f42f46-6f42f50 360->368 361->355 362->355 365->346 372 6f431d2-6f431da 365->372 370 6f431b4-6f431be 366->370 371 6f431b2 366->371 367->359 368->359 370->365 371->365 375 6f431f2-6f43249 372->375 376 6f431dc-6f431e2 372->376 375->346 393 6f4324f-6f43254 375->393 380 6f431e4 376->380 381 6f431e6-6f431f0 376->381 380->375 381->375 391 6f42fdf-6f43010 389->391 392 6f42fc9-6f42fcf 389->392 391->346 402 6f43016-6f43021 391->402 394 6f42fd1 392->394 395 6f42fd3-6f42fdd 392->395 396 6f43256-6f4325c 393->396 397 6f4326c-6f4329d 393->397 394->391 395->391 398 6f43260-6f4326a 396->398 399 6f4325e 396->399 397->346 404 6f432a3-6f432ae 397->404 398->397 399->397 406 6f43023-6f43029 402->406 407 6f43039-6f43048 402->407 410 6f432c6-6f432cf 404->410 411 6f432b0-6f432b6 404->411 408 6f4302d-6f43037 406->408 409 6f4302b 406->409 407->346 412 6f4304e-6f43116 407->412 408->407 409->407 410->346 415 6f432d5-6f432e0 410->415 413 6f432b8 411->413 414 6f432ba-6f432c4 411->414 412->340 413->410 414->410 418 6f432e2-6f432e8 415->418 419 6f432f8-6f433ca 415->419 421 6f432ec-6f432f6 418->421 422 6f432ea 418->422 419->346 439 6f433d0-6f433d5 419->439 421->419 422->419 440 6f433d7-6f433dd 439->440 441 6f433ed-6f4356d 439->441 442 6f433e1-6f433eb 440->442 443 6f433df 440->443 451 6f43596-6f435a0 441->451 452 6f4356f-6f4358e 441->452 442->441 443->441 451->293 453 6f435a6-6f435ab 451->453 452->451 454 6f435c3-6f435cf 453->454 455 6f435ad-6f435b3 453->455 454->293 459 6f435d5-6f435dc 454->459 457 6f435b5 455->457 458 6f435b7-6f435c1 455->458 457->454 458->454 460 6f435f4-6f43651 459->460 461 6f435de-6f435e4 459->461 460->310 463 6f435e6 461->463 464 6f435e8-6f435f2 461->464 463->460 464->460
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2203302135.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: 4'^q$4'^q$4'^q$4'^q$$^q$$^q$$^q
                                                                                                                                                                                        • API String ID: 0-3199432138
                                                                                                                                                                                        • Opcode ID: 722de10e49baa17848d8816e96cab12f4d5a3390563844ad2eea743320791c6e
                                                                                                                                                                                        • Instruction ID: d49f46ee9b611e8b0bf2254dd297491864f22047a81036d07d5368cd2fc631f7
                                                                                                                                                                                        • Opcode Fuzzy Hash: 722de10e49baa17848d8816e96cab12f4d5a3390563844ad2eea743320791c6e
                                                                                                                                                                                        • Instruction Fuzzy Hash: 5A428E75F002049FE794DB98C941A6ABBB2FF88304F14C069D9199F795CB72EC86CB91
                                                                                                                                                                                        Function 0924C034 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 190fileCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 471 924c034-924c0b4 GetVolumeNameForVolumeMountPointW FindFirstVolumeW 475 924c2f8-924c2fd 471->475 476 924c0ba-924c0c0 471->476 477 924c0c6-924c0cd 476->477 478 924c2c7-924c2e9 476->478 477->478 479 924c0d3-924c0ea 477->479 478->476 484 924c2ef 478->484 479->478 483 924c0f0-924c0f4 479->483 483->478 485 924c0fa-924c0fe 483->485 484->475 485->478 486 924c104-924c10e GetDriveTypeW 485->486 487 924c110-924c113 486->487 488 924c119-924c121 call 9241568 486->488 487->478 487->488 491 924c123-924c16b 488->491 492 924c19f-924c1c5 call 92416ec CreateFileW 488->492 499 924c16d-924c186 call 924bfa8 491->499 500 924c18b-924c18f 491->500 496 924c2be 492->496 497 924c1cb-924c1f1 492->497 496->478 497->496 504 924c1f7-924c1fe 497->504 499->500 502 924c191 500->502 503 924c19a 500->503 502->503 503->478 506 924c264-924c26b 504->506 507 924c200-924c20c 504->507 506->496 511 924c26d-924c274 506->511 508 924c20e-924c215 507->508 509 924c22b-924c231 507->509 508->509 513 924c217-924c21e 508->513 514 924c250-924c25d call 92416bc call 924bfa8 509->514 515 924c233-924c23a 509->515 511->496 512 924c276-924c27d 511->512 512->496 516 924c27f-924c299 call 92416bc 512->516 513->509 517 924c220-924c227 513->517 525 924c262 514->525 515->514 518 924c23c-924c243 515->518 529 924c2b2-924c2b9 call 924bfa8 516->529 530 924c29b-924c2a2 516->530 517->509 521 924c229 517->521 518->514 522 924c245-924c24c 518->522 521->525 522->514 526 924c24e 522->526 525->496 526->525 529->496 531 924c2a4-924c2ab call 924bfa8 530->531 532 924c2b0 530->532 531->532 532->496
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetVolumeNameForVolumeMountPointW.KERNEL32(?,?,00000104), ref: 0924C07E
                                                                                                                                                                                        • FindFirstVolumeW.KERNEL32(?,00000104), ref: 0924C0A7
                                                                                                                                                                                        • GetDriveTypeW.KERNEL32(?), ref: 0924C105
                                                                                                                                                                                        • CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?), ref: 0924C1B8
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Volume$CreateDriveFileFindFirstMountNamePointType
                                                                                                                                                                                        • String ID: '
                                                                                                                                                                                        • API String ID: 470739279-1997036262
                                                                                                                                                                                        • Opcode ID: 326f91eafe7f44c9ba62c6f105cd70c25895f0191d746fb0b59882324095e480
                                                                                                                                                                                        • Instruction ID: 1e85670508aab4e0dcc6b6628a4fb796b9cb2731019f0dce39a2c50c08ce36b0
                                                                                                                                                                                        • Opcode Fuzzy Hash: 326f91eafe7f44c9ba62c6f105cd70c25895f0191d746fb0b59882324095e480
                                                                                                                                                                                        • Instruction Fuzzy Hash: B371AB70922315FADB25EFA4ED0DBDA7B78AF02711F018195F589A6090D7B08684CF62
                                                                                                                                                                                        Function 0924DBCC Relevance: 7.7, APIs: 5, Instructions: 190COMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 619 924dbcc-924dbf6 621 924dbfd-924dc14 619->621 622 924dbf8 619->622 627 924dc16 621->627 628 924dc1b-924dc28 call 92486d0 621->628 623 924de20-924de24 622->623 625 924de26 623->625 626 924de2f-924de33 623->626 625->626 629 924de35-924de38 DeleteDC 626->629 630 924de3e-924de42 626->630 627->623 638 924dc2f-924dc8a call 9241190 CreateDCW 628->638 639 924dc2a 628->639 629->630 632 924de44-924de47 call 92486f8 630->632 633 924de4c-924de50 630->633 632->633 636 924de52 633->636 637 924de5b-924de60 633->637 636->637 643 924dc91-924dd5b call 9241190 StartDocW 638->643 644 924dc8c 638->644 639->623 655 924dd62-924dd6d call 924171c 643->655 656 924dd5d 643->656 644->623 659 924dd72-924dd7e 655->659 656->623 661 924dd80 659->661 662 924dd82-924ddfa EndPage 659->662 663 924de00-924de0f EndDoc call 924171c 661->663 662->659 662->663 666 924de14-924de17 663->666 666->623
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Delete
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1035893169-0
                                                                                                                                                                                        • Opcode ID: 23911d1cd73e2c4e68db2aea18f0424d2256771a994176c1379ff09c69334428
                                                                                                                                                                                        • Instruction ID: 668d553293815047e8ebd24d6e129555f3a7b420ef4debfa3f55dfa55f43e797
                                                                                                                                                                                        • Opcode Fuzzy Hash: 23911d1cd73e2c4e68db2aea18f0424d2256771a994176c1379ff09c69334428
                                                                                                                                                                                        • Instruction Fuzzy Hash: E6811470910209FFEF119FA0ED09BAEBB75FB18301F2144A9F605AA1A0D7729A54DF42
                                                                                                                                                                                        Function 092522E0 Relevance: 7.7, APIs: 5, Instructions: 173threadCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 671 92522e0-92522ed 672 92522ef-9252315 call 9248948 671->672 673 9252318-925231f call 924ce84 671->673 672->673 677 9252321-9252328 673->677 678 925237d-925238e call 92492b8 call 924967c 673->678 679 9252342-9252349 677->679 680 925232a-925233f CreateThread 677->680 691 9252395-925239c 678->691 692 9252390 call 9249af4 678->692 679->678 683 925234b-9252367 CreateThread 679->683 680->679 683->678 686 9252369-9252374 683->686 686->678 693 92523b6-92523bd 691->693 694 925239e-92523b3 CreateThread 691->694 692->691 696 92523c4-92523eb call 924d0a8 call 9250144 693->696 697 92523bf call 924c034 693->697 694->693 704 9252425-9252439 696->704 705 92523ed-92523f4 696->705 697->696 714 925247b-9252482 704->714 715 925243b-925243f 704->715 706 92523f6-9252405 call 9250214 call 9252134 call 9250214 call 9251ee8 705->706 707 925240a-9252411 705->707 706->707 708 9252413-9252418 call 9250214 call 9251838 707->708 709 925241d-9252420 call 92501cc 707->709 708->709 709->704 721 9252484 714->721 722 925248d-9252494 714->722 717 9252441-9252455 715->717 718 925245c-9252476 call 9248948 call 924f994 715->718 717->718 718->714 721->722 725 9252496-925249a 722->725 726 92524b0-92524bf call 9250214 722->726 725->726 727 925249c-92524a7 725->727 741 92524c5-92524d3 call 924a050 726->741 742 925254a-9252551 call 925333c call 9252e98 726->742 727->726 747 92524d5-92524ee CreateThread 741->747 748 9252500-9252507 741->748 753 9252556-9252559 742->753 747->748 752 92524f0-92524f9 747->752 750 9252509-9252510 748->750 751 925251b-925253b call 92525c4 call 924d660 748->751 750->751 754 9252512-9252519 750->754 756 9252540-9252548 ExitProcess 751->756 752->748 754->751 754->756 756->753
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CreateThread.KERNEL32(00000000,00000000,Function_0000A440,00000000,00000000,00000000), ref: 09252339
                                                                                                                                                                                        • CreateThread.KERNEL32(00000000,00000000,Function_00009D80,00000000,00000000,00000000), ref: 0925235A
                                                                                                                                                                                        • CreateThread.KERNEL32(00000000,00000000,Function_00008C7C,00000000,00000000,00000000), ref: 092523AD
                                                                                                                                                                                        • CreateThread.KERNEL32(00000000,00000000,Function_0000CFF8,00000000,00000000,00000000,00000001), ref: 092524E4
                                                                                                                                                                                        • ExitProcess.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000001), ref: 09252542
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CreateThread$ExitProcess
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3195946472-0
                                                                                                                                                                                        • Opcode ID: 440c83d96612e7455b29239d9dbc671ed46c8028de3c0cc9d961f0070c5785a9
                                                                                                                                                                                        • Instruction ID: 9fb8ac392418daafaa459439e562ac52d49f863a301076438d7fc125ee16f1af
                                                                                                                                                                                        • Opcode Fuzzy Hash: 440c83d96612e7455b29239d9dbc671ed46c8028de3c0cc9d961f0070c5785a9
                                                                                                                                                                                        • Instruction Fuzzy Hash: 2861E170964386FEFF25AFB0BD0DBAC3EA0AB04711F14A154F926741E4C7B41A84CB22
                                                                                                                                                                                        Function 0924E220 Relevance: 7.6, APIs: 5, Instructions: 134fileCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 760 924e220-924e24b CreateFileW 761 924e381-924e387 760->761 762 924e251-924e26a 760->762 763 924e270-924e282 call 92417a8 762->763 766 924e289-924e2ac WriteFile 763->766 767 924e2c0-924e2e5 WriteFile 766->767 768 924e2ae-924e2bd 766->768 769 924e2e7-924e2f6 767->769 770 924e2f9-924e31c WriteFile 767->770 771 924e330-924e355 WriteFile 770->771 772 924e31e-924e32d 770->772 775 924e357-924e366 771->775 776 924e369-924e376 771->776 776->766 778 924e37c 776->778 778->763
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,?,00000000), ref: 0924E23E
                                                                                                                                                                                        • WriteFile.KERNEL32(000000FF,?,00000001,00000000,00000000,0925F000,?,?,?,00000000), ref: 0924E29F
                                                                                                                                                                                        • WriteFile.KERNEL32(000000FF,?,00000001,00000000,00000000,?,?,00000000), ref: 0924E2D8
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: File$Write$Create
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1602526932-0
                                                                                                                                                                                        • Opcode ID: 5e1d5d891270e10968b6149885c28042233572a5fced67dc3a3af91ca505fca3
                                                                                                                                                                                        • Instruction ID: c1f00a475ad5ed9120885057c94e54beff9c21513a173360e5ea70fdfdca4d66
                                                                                                                                                                                        • Opcode Fuzzy Hash: 5e1d5d891270e10968b6149885c28042233572a5fced67dc3a3af91ca505fca3
                                                                                                                                                                                        • Instruction Fuzzy Hash: DB412D75A0024DFFEB00DB94E949BEEFB7AEB44322F5041A6E604A2191D7710F54DBA2
                                                                                                                                                                                        Function 0924FDD0 Relevance: 6.3, APIs: 4, Instructions: 257filethreadCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 780 924fdd0-924fde1 SetThreadPriority 781 924fde7-924fe06 780->781 783 924fe36-924fe38 781->783 784 924fe08-924fe10 781->784 786 924fe3e-924fe43 783->786 787 924fe3a-924fe3d 783->787 784->783 785 924fe12 784->785 788 924fe19-924fe2e 785->788 789 924fef8-924fefb 786->789 790 924fe49-924fe7b ReadFile 786->790 801 924fe30-924fe34 788->801 802 924fe32 788->802 791 924ff01-924ff4a call 92420d0 789->791 792 924fffd-9250000 789->792 793 924fe7d-924fe88 790->793 794 924feee 790->794 833 924ff63-924ff6b 791->833 834 924ff4c-924ff61 791->834 796 9250006-9250045 WriteFile 792->796 797 925008d-9250090 792->797 793->794 799 924fe8a-924fe92 793->799 798 92500dc-92500fb 794->798 803 9250047-9250052 796->803 804 9250089 796->804 797->798 800 9250092-9250096 797->800 819 92500fd 798->819 820 92500ff-9250107 798->820 806 924fe94-924feae 799->806 807 924feb0-924fed7 799->807 809 92500ac-92500da call 9241074 call 92486f8 800->809 810 9250098-925009e 800->810 801->781 802->788 803->804 813 9250054-9250072 803->813 804->798 806->794 835 924fed9-924fee4 807->835 836 924feea 807->836 809->798 859 925013c 809->859 816 92500a0 810->816 817 92500a2-92500aa 810->817 839 9250085 813->839 840 9250074-925007f 813->840 816->809 817->810 823 925012f-9250131 819->823 821 925012d 820->821 822 9250109 820->822 821->798 821->823 827 9250110-9250125 822->827 830 9250137 823->830 831 9250133-9250136 823->831 851 9250127-925012b 827->851 852 9250129 827->852 830->786 842 924ff6d-924ff6f 833->842 843 924ff7a-924ff86 833->843 841 924ff8d-924ffa9 WriteFile 834->841 845 924fee6 835->845 846 924fee8 835->846 836->794 839->804 848 9250081 840->848 849 9250083 840->849 853 924fff3 841->853 854 924ffab-924ffb6 841->854 842->843 850 924ff71-924ff78 842->850 843->841 845->794 846->807 848->804 849->813 850->841 851->798 852->827 853->798 854->853 857 924ffb8-924ffdc 854->857 862 924ffde-924ffe9 857->862 863 924ffef 857->863 859->781 864 924ffed 862->864 865 924ffeb 862->865 863->853 864->857 865->853
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • SetThreadPriority.KERNEL32(000000FE,00000002), ref: 0924FDE1
                                                                                                                                                                                        • ReadFile.KERNEL32(?,?,?,?,?), ref: 0924FE73
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FilePriorityReadThread
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3643687941-0
                                                                                                                                                                                        • Opcode ID: b72d0cdff571881e3be9b43df7db46db236f7e0db683ecb4fb8cf042d7608e2c
                                                                                                                                                                                        • Instruction ID: 1a7ffc8cc20b75193ee3a7c60f444e42aa9cb9c9dc24d10482b4e89bdd23feb3
                                                                                                                                                                                        • Opcode Fuzzy Hash: b72d0cdff571881e3be9b43df7db46db236f7e0db683ecb4fb8cf042d7608e2c
                                                                                                                                                                                        • Instruction Fuzzy Hash: 63A18F71521205EFEF258F40DEC9BE637BCFB08314F1151A2ED0A8A09AD7B0DA44CB62
                                                                                                                                                                                        Function 092503B8 Relevance: 6.1, APIs: 4, Instructions: 61fileCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 866 92503b8-92503f6 SetFileAttributesW CreateFileW 867 925046d-9250474 866->867 868 92503f8-9250415 SetFilePointerEx 866->868 869 9250464 868->869 870 9250417-9250434 ReadFile 868->870 869->867 870->869 871 9250436-925044b call 92502ac 870->871 871->869 874 925044d-9250455 871->874 875 9250457 874->875 876 925045e-925045f call 92486f8 874->876 875->876 876->869
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • SetFileAttributesW.KERNEL32(00000000,00000080,?), ref: 092503D1
                                                                                                                                                                                        • CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 092503E9
                                                                                                                                                                                        • SetFilePointerEx.KERNEL32(000000FF,-00000084,00000000,00000000,00000002), ref: 0925040D
                                                                                                                                                                                        • ReadFile.KERNEL32(000000FF,?,00000084,?,00000000), ref: 0925042C
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: File$AttributesCreatePointerRead
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 4170910816-0
                                                                                                                                                                                        • Opcode ID: 734f6f3a9123c3e9bf2757f22a005ffae479908b3c86cdd33b8434fa278c4954
                                                                                                                                                                                        • Instruction ID: c06a8b984c118295c83330ae2aab67e56ca6a1f3615240b4e713d4027672ab4d
                                                                                                                                                                                        • Opcode Fuzzy Hash: 734f6f3a9123c3e9bf2757f22a005ffae479908b3c86cdd33b8434fa278c4954
                                                                                                                                                                                        • Instruction Fuzzy Hash: 79114F70A50309FBEF209FA0DD49FAD7BB9BB04700F10C0A4BA0AA60D1DB709E58CB15
                                                                                                                                                                                        Function 0924967C Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 295COMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 878 924967c-92496ab 880 92496b1-9249914 call 9241190 * 10 878->880 881 9249aef-9249af2 878->881 903 9249916 880->903 904 924991b-9249933 880->904 905 9249aa5-9249aa9 903->905 911 9249935 904->911 912 924993a-9249949 call 9248cc0 904->912 906 9249ab6-9249aba 905->906 907 9249aab-9249ab0 905->907 909 9249ac7-9249acb 906->909 910 9249abc-9249ac1 906->910 907->906 913 9249acd-9249ad2 909->913 914 9249ad8-9249adc 909->914 910->909 911->905 919 924998e-92499b3 912->919 920 924994b-924997d 912->920 913->914 917 9249ade-9249ae3 914->917 918 9249ae9 CoUninitialize 914->918 917->918 918->881 923 92499b5 919->923 924 92499ba-92499d3 CoSetProxyBlanket 919->924 928 9249984-9249987 920->928 929 924997f 920->929 923->905 926 92499d5 924->926 927 92499da-92499fd 924->927 926->905 931 9249a04-9249a23 927->931 932 92499ff 927->932 928->919 929->905 933 9249a29-9249a2b 931->933 932->905 934 9249a2d 933->934 935 9249a2f-9249a57 933->935 934->905 938 9249a95-9249aa0 935->938 939 9249a59-9249a8e 935->939 938->931 939->938
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Uninitialize
                                                                                                                                                                                        • String ID: @
                                                                                                                                                                                        • API String ID: 3861434553-2766056989
                                                                                                                                                                                        • Opcode ID: c0af10e7ad26b1130ce3674c9ae1b0a7346253fc5f0126c22b2b1ea19d4c6984
                                                                                                                                                                                        • Instruction ID: 9116dc6840b255cdc4dc98f33919d1503654845427a2f921bd5055a502c62b69
                                                                                                                                                                                        • Opcode Fuzzy Hash: c0af10e7ad26b1130ce3674c9ae1b0a7346253fc5f0126c22b2b1ea19d4c6984
                                                                                                                                                                                        • Instruction Fuzzy Hash: B0D138B491021AEFEB14DF90C989FAABB78FF04300F118195E518AF2A5D771DA85CF61
                                                                                                                                                                                        Function 09300443 Relevance: 5.2, Strings: 4, Instructions: 191COMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 943 9300443-930045b 944 93004c6-93004cf 943->944 945 930045d-9300463 943->945 953 93004d1-93004d7 944->953 954 93004e9-9300508 944->954 946 9300689-9300693 945->946 947 9300469-930046d 945->947 949 93006a1-93006a7 946->949 950 9300695-930069e 946->950 951 9300480 947->951 952 930046f-930047e 947->952 956 93006a9-93006ab 949->956 957 93006ad-93006b9 949->957 955 9300482-9300484 951->955 952->955 958 93004d9 953->958 959 93004db-93004e7 953->959 968 9300570-93005bf 954->968 969 930050a-930052a 954->969 955->946 960 930048a-930048e 955->960 961 93006bb-93006e1 956->961 957->961 958->954 959->954 963 9300490-930049f 960->963 964 93004a1 960->964 970 93004a3-93004a5 963->970 964->970 986 93005c6-93005cc 968->986 976 9300544-930055d 969->976 977 930052c-9300532 969->977 970->946 971 93004ab-93004b8 970->971 971->968 972 93004be-93004c1 971->972 972->944 984 930056b-930056e 976->984 985 930055f-9300561 976->985 978 9300534 977->978 979 9300536-9300542 977->979 978->976 979->976 984->986 985->984 988 93005ce-93005d7 986->988 989 93005ef 986->989 990 93005d9-93005dc 988->990 991 93005de-93005eb 988->991 992 93005f2-93005fb 989->992 994 93005ed 990->994 991->994 995 930060a-9300625 992->995 996 93005fd-9300600 992->996 994->992 1001 9300628 call 922fa20 995->1001 1002 9300628 call 922fa19 995->1002 996->995 999 930062a-9300686 1001->999 1002->999
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2248931148.0000000009300000.00000040.00000800.00020000.00000000.sdmp, Offset: 09300000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9300000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: 84il$84il$tP^q$tP^q
                                                                                                                                                                                        • API String ID: 0-302046226
                                                                                                                                                                                        • Opcode ID: 42b8a59acb1257ac72bb7ff232de1fed987170ea5267853bf5e733f69aab74a8
                                                                                                                                                                                        • Instruction ID: 12c7829b23f776d1b396d8a885eb00a7f4f5afdf8cbe93793bc334dd05a54328
                                                                                                                                                                                        • Opcode Fuzzy Hash: 42b8a59acb1257ac72bb7ff232de1fed987170ea5267853bf5e733f69aab74a8
                                                                                                                                                                                        • Instruction Fuzzy Hash: F961CF32A00218DFCB18DF68D5657ABBBE6EBC8310F158869E8059B391DB31DD45CFA1
                                                                                                                                                                                        Function 09250BAC Relevance: 4.6, APIs: 3, Instructions: 139fileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 09250308: SetFileAttributesW.KERNEL32(00000000,00000080,?,00000000,?,?,?), ref: 09250329
                                                                                                                                                                                          • Part of subcall function 09250308: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?,?,?), ref: 09250341
                                                                                                                                                                                          • Part of subcall function 092503B8: SetFileAttributesW.KERNEL32(00000000,00000080,?), ref: 092503D1
                                                                                                                                                                                          • Part of subcall function 092503B8: CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 092503E9
                                                                                                                                                                                          • Part of subcall function 092503B8: SetFilePointerEx.KERNEL32(000000FF,-00000084,00000000,00000000,00000002), ref: 0925040D
                                                                                                                                                                                          • Part of subcall function 092503B8: ReadFile.KERNEL32(000000FF,?,00000084,?,00000000), ref: 0925042C
                                                                                                                                                                                        • MoveFileExW.KERNEL32(00000000,00000000,00000008,00000000,00000000,00000000,00000000,?,00000000,?), ref: 09250C2F
                                                                                                                                                                                        • CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,00000000,00000000,00000000,?,00000000,?), ref: 09250CF0
                                                                                                                                                                                        • CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000003,48000000,00000000,00000000,?,00000000,?), ref: 09250CA6
                                                                                                                                                                                          • Part of subcall function 092486F8: RtlFreeHeap.NTDLL(?,00000000,0924E217,?,0924E217,00000000), ref: 09248714
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: File$Create$Attributes$CompletionFreeHeapMovePointerPortRead
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 97630321-0
                                                                                                                                                                                        • Opcode ID: 74e78f3530537041375c7cd15b7e20cc6b388563ce52e178fda5adedc901b202
                                                                                                                                                                                        • Instruction ID: 76de29e1f0b8a745e232a5b8a0158529c7aa92ed6531e73321b52df25b703844
                                                                                                                                                                                        • Opcode Fuzzy Hash: 74e78f3530537041375c7cd15b7e20cc6b388563ce52e178fda5adedc901b202
                                                                                                                                                                                        • Instruction Fuzzy Hash: 495168309A0249FBEF212FA0ED0DB9D7B75EF04342F1091A4F91E690A4C7B19A50DF06
                                                                                                                                                                                        Function 0924E130 Relevance: 4.6, APIs: 3, Instructions: 68COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 1aeae3111305ffcc13bfb591832024599a0cd31d8435ebc23ebd7314d263e80b
                                                                                                                                                                                        • Instruction ID: 7666e1fa2ee77787303055d8f2ca204ac69dc5753a7e538d9a5986e3f71528ac
                                                                                                                                                                                        • Opcode Fuzzy Hash: 1aeae3111305ffcc13bfb591832024599a0cd31d8435ebc23ebd7314d263e80b
                                                                                                                                                                                        • Instruction Fuzzy Hash: BD212A30860248FFEF16AFA4EE49B6CBB71BF01354F1191A0F519691A5C7B14F60EB06
                                                                                                                                                                                        Function 0924BE18 Relevance: 4.6, APIs: 3, Instructions: 66threadCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CreateThread.KERNEL32(00000000,00000000,Function_0000AE00,?,00000004,00000000,?,?,?,?,00000000), ref: 0924BE4E
                                                                                                                                                                                        • ResumeThread.KERNEL32(00000000,?,?,?,?,00000000), ref: 0924BE97
                                                                                                                                                                                        • GetExitCodeThread.KERNEL32(00000000,00000000,?,?,?,?,00000000), ref: 0924BEAF
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Thread$CodeCreateExitResume
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 4070214711-0
                                                                                                                                                                                        • Opcode ID: dca36f52bdc10e9c676fbdd361801f8429ca7bb9fb60c5c0a0be64658076766a
                                                                                                                                                                                        • Instruction ID: 7922420502b8c40b33658861a918cb27ace3ff13214b066110731b9590b3ae52
                                                                                                                                                                                        • Opcode Fuzzy Hash: dca36f52bdc10e9c676fbdd361801f8429ca7bb9fb60c5c0a0be64658076766a
                                                                                                                                                                                        • Instruction Fuzzy Hash: 80210B75A04208FFDB10DF94ED09B9DBBB8EB48321F204165FA14A2190D7715F54DB51
                                                                                                                                                                                        Function 0924BB34 Relevance: 4.6, APIs: 3, Instructions: 61threadCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CreateThread.KERNEL32(00000000,00000000,Function_0000AB24,?,00000004,00000000,00000000,00000000,?,?,00000000), ref: 0924BB5D
                                                                                                                                                                                        • ResumeThread.KERNEL32(00000000,?,?,00000000), ref: 0924BBA6
                                                                                                                                                                                        • GetExitCodeThread.KERNEL32(00000000,00000000,?,?,00000000), ref: 0924BBBE
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Thread$CodeCreateExitResume
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 4070214711-0
                                                                                                                                                                                        • Opcode ID: eecd748ba7c853ba4e84441ee699c0cd17e74be18412796ba7eaddb509fc6d9f
                                                                                                                                                                                        • Instruction ID: 1bc25a7a6b5e4375dd81efa4b7f690f6e01f357b352653be603f2a8061c2e036
                                                                                                                                                                                        • Opcode Fuzzy Hash: eecd748ba7c853ba4e84441ee699c0cd17e74be18412796ba7eaddb509fc6d9f
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7B112B36A04208FFEF149F94ED0EB9DBB78EB48322F2041A5FA04A11A4D7715F54EB51
                                                                                                                                                                                        Function 09251EE8 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 184COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CreateThread
                                                                                                                                                                                        • String ID: $%
                                                                                                                                                                                        • API String ID: 2422867632-3767712007
                                                                                                                                                                                        • Opcode ID: 7681f9e6952af2b8182de2475338c2197184b86e4fbefbdd0ab1936dce82d914
                                                                                                                                                                                        • Instruction ID: 5d62176d94a27922e915a48650a35fd9652c216b953e8b9cb053a378f8cbe9d7
                                                                                                                                                                                        • Opcode Fuzzy Hash: 7681f9e6952af2b8182de2475338c2197184b86e4fbefbdd0ab1936dce82d914
                                                                                                                                                                                        • Instruction Fuzzy Hash: 1161AE7092130AFFDF119FA0ED49BAEBB75FB14310F104065EA12B61E0D7B59A54CB92
                                                                                                                                                                                        Function 092526C4 Relevance: 3.2, APIs: 2, Instructions: 157registryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • RegCreateKeyExW.KERNEL32(80000002,?,00000000,00000000,00000000,00020119,00000000,?,00000000), ref: 09252839
                                                                                                                                                                                        • RegDeleteKeyExW.KERNEL32(80000002,?,00000100,00000000,000000FF,00000000), ref: 092528D5
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CreateDelete
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2606249652-0
                                                                                                                                                                                        • Opcode ID: 3839e544f89608e8c584d2ab41c71e88f0536e5a022d6fbbea105143e3204bd6
                                                                                                                                                                                        • Instruction ID: 503b519cc0fa840a35863b702b9c4996f758eea39768b12ef3be7bc2eac645f6
                                                                                                                                                                                        • Opcode Fuzzy Hash: 3839e544f89608e8c584d2ab41c71e88f0536e5a022d6fbbea105143e3204bd6
                                                                                                                                                                                        • Instruction Fuzzy Hash: 9251F6B1950219EFEB11DF90DD49FE9BBB8FB08700F0040A5FA15EA1D1E7749A54CB62
                                                                                                                                                                                        Function 09250308 Relevance: 3.1, APIs: 2, Instructions: 58fileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • SetFileAttributesW.KERNEL32(00000000,00000080,?,00000000,?,?,?), ref: 09250329
                                                                                                                                                                                        • CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?,?,?), ref: 09250341
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: File$AttributesCreate
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 415043291-0
                                                                                                                                                                                        • Opcode ID: 7cd28f7e7395a33f1613fdade14178ad6002b997e3875e6a14d62380598e1faa
                                                                                                                                                                                        • Instruction ID: 410b8be6a365dabcde9e4cafd2d7c292bc9edefc6fed5c238abc9872345a1f28
                                                                                                                                                                                        • Opcode Fuzzy Hash: 7cd28f7e7395a33f1613fdade14178ad6002b997e3875e6a14d62380598e1faa
                                                                                                                                                                                        • Instruction Fuzzy Hash: B6118F719A5309FFEF204F95DE09BAD7B78EB00761F208266FD1AB50D0D3B05A84CA46
                                                                                                                                                                                        Function 09250C72 Relevance: 3.0, APIs: 2, Instructions: 36fileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • MoveFileExW.KERNEL32(00000000,00000000,00000008,00000000,00000000,00000000,00000000,?,00000000,?), ref: 09250C2F
                                                                                                                                                                                        • CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000003,48000000,00000000,00000000,?,00000000,?), ref: 09250CA6
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: File$CreateMove
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3198096935-0
                                                                                                                                                                                        • Opcode ID: 3f9e2ca293ac8a2dac792f056511c3c472e74c25cfd4d4ddcbc4a9e6893921a8
                                                                                                                                                                                        • Instruction ID: f57ee5e4843f6ddf5713e2b70046509bb0ed3c5a9470a47be4eb27cdc0016c7a
                                                                                                                                                                                        • Opcode Fuzzy Hash: 3f9e2ca293ac8a2dac792f056511c3c472e74c25cfd4d4ddcbc4a9e6893921a8
                                                                                                                                                                                        • Instruction Fuzzy Hash: DCF01230AB1209FADF215F54ED09B9CB775EF01762F208255FA1B780D0C7B15650DB09
                                                                                                                                                                                        Function 0925038C Relevance: 3.0, APIs: 2, Instructions: 23fileCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • SetFileAttributesW.KERNEL32(00000000,00000080,?,00000000,?,?,?), ref: 09250329
                                                                                                                                                                                        • CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?,?,?), ref: 09250341
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: File$AttributesCreate
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 415043291-0
                                                                                                                                                                                        • Opcode ID: 8703f5b40cb49c34f58b72b6f95588728bf5e5df028161f1652e5b0f698c5a02
                                                                                                                                                                                        • Instruction ID: 1eb78d480d6ebddfaf55a6809ecad883932efc52092f0db23cab52cd457b3c64
                                                                                                                                                                                        • Opcode Fuzzy Hash: 8703f5b40cb49c34f58b72b6f95588728bf5e5df028161f1652e5b0f698c5a02
                                                                                                                                                                                        • Instruction Fuzzy Hash: DDE09A305E4745FBEF311FA1DE4AB5C3A64AB04BA0F509521FE1BB80E0D7B4D6449A4A
                                                                                                                                                                                        Function 06F44368 Relevance: 2.0, Strings: 1, Instructions: 782COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2203302135.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: h2^k
                                                                                                                                                                                        • API String ID: 0-107084036
                                                                                                                                                                                        • Opcode ID: 7f9c2ed3d0584707b2d65eb8b4afe2af8f8a2e6479fbf635a81a284eaec5d5ff
                                                                                                                                                                                        • Instruction ID: 048d9c0178649835f977f1eb2390559463d031fb88b33a41a4464e1ea405b41d
                                                                                                                                                                                        • Opcode Fuzzy Hash: 7f9c2ed3d0584707b2d65eb8b4afe2af8f8a2e6479fbf635a81a284eaec5d5ff
                                                                                                                                                                                        • Instruction Fuzzy Hash: 88721874B002148FEB94DB48C991B99BBB2FF89304F15C095D909AB791CB72ED86CF91
                                                                                                                                                                                        Function 092539E0 Relevance: 1.7, APIs: 1, Instructions: 164COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 763c1d9f6fc5b79189b4b56814d1c4c6f1ca9a925dbaa36f114bcc28e5fba780
                                                                                                                                                                                        • Instruction ID: e5af29df89678d6720dcd9eb3e22576c0aa5a196a0bdc4a9c39a19e7ae25deaf
                                                                                                                                                                                        • Opcode Fuzzy Hash: 763c1d9f6fc5b79189b4b56814d1c4c6f1ca9a925dbaa36f114bcc28e5fba780
                                                                                                                                                                                        • Instruction Fuzzy Hash: 9E516E70AA0304FBEB20EFA0ED4EBAD7B74EB04741F116090FA06BA1D0D7B56644DB56
                                                                                                                                                                                        Function 0924B8FE Relevance: 1.6, APIs: 1, Instructions: 122synchronizationCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CreateMutexW.KERNEL32(0000000C,00000001,?), ref: 0924BA3F
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CreateMutex
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1964310414-0
                                                                                                                                                                                        • Opcode ID: 65331529602168eaf405ab93d6b16e388f27ac43437607a002d93e8f9cedc9e6
                                                                                                                                                                                        • Instruction ID: a1dfa7f326392b8b823ac163f151b44f453e41471432de72d39c5aa7c17a7025
                                                                                                                                                                                        • Opcode Fuzzy Hash: 65331529602168eaf405ab93d6b16e388f27ac43437607a002d93e8f9cedc9e6
                                                                                                                                                                                        • Instruction Fuzzy Hash: C0414A7545E3C59FDB435BB0A8696983FB1AF0B224F1B10D7D084CA0A7E26D194ACB22
                                                                                                                                                                                        Function 0924818D Relevance: 1.6, APIs: 1, Instructions: 121memoryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • RtlCreateHeap.NTDLL(00041002,00000000,00000000,00000000,00000000,00000000,?,?,09256480,?,00000001,?), ref: 092481E5
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CreateHeap
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 10892065-0
                                                                                                                                                                                        • Opcode ID: a544df8a2b0ae368a0553861f462fad5d2c744c81004da1629e533c473dbfc3e
                                                                                                                                                                                        • Instruction ID: 962ffad5b23bdaad48bea3672aee39efe120dde6fa7007bc61690f334bbd735a
                                                                                                                                                                                        • Opcode Fuzzy Hash: a544df8a2b0ae368a0553861f462fad5d2c744c81004da1629e533c473dbfc3e
                                                                                                                                                                                        • Instruction Fuzzy Hash: 42317C103F239531C13D36A68D0FF9F5D1C8FD3EA0BC26154B929760838AE44116C4FA
                                                                                                                                                                                        Function 092481BC Relevance: 1.6, APIs: 1, Instructions: 114memoryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • RtlCreateHeap.NTDLL(00041002,00000000,00000000,00000000,00000000,00000000,?,?,09256480,?,00000001,?), ref: 092481E5
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CreateHeap
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 10892065-0
                                                                                                                                                                                        • Opcode ID: 4da3f316265e28cc2dc5d3cdd04506392605d9e3c0d3864fb6315c7e7f08c7f1
                                                                                                                                                                                        • Instruction ID: c105d9b00103674bb48c0d5e9d185a6538d928e2df3ee82ca775c4169629ef18
                                                                                                                                                                                        • Opcode Fuzzy Hash: 4da3f316265e28cc2dc5d3cdd04506392605d9e3c0d3864fb6315c7e7f08c7f1
                                                                                                                                                                                        • Instruction Fuzzy Hash: 3B212E103F23A530547D36A79D0FF9F0C1CCEE3DA47C2A455B929B50938AE88516C4FA
                                                                                                                                                                                        Function 09248176 Relevance: 1.6, APIs: 1, Instructions: 108memoryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • RtlCreateHeap.NTDLL(00041002,00000000,00000000,00000000,00000000,00000000,?,?,09256480,?,00000001,?), ref: 092481E5
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CreateHeap
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 10892065-0
                                                                                                                                                                                        • Opcode ID: 80130c7a352aae8eaf9ba98433d2c5c5b7174c61513f1156b7ebe1208a438546
                                                                                                                                                                                        • Instruction ID: 49b8a0102f929624c2d9e50cef8ee4518e87a1a4a33860e4b32c2ef48fe9bf58
                                                                                                                                                                                        • Opcode Fuzzy Hash: 80130c7a352aae8eaf9ba98433d2c5c5b7174c61513f1156b7ebe1208a438546
                                                                                                                                                                                        • Instruction Fuzzy Hash: CE2130103F67A530507D36A79D0FF9F0C2CCEE3EA47C2A455B929750938AE8451AC4FA
                                                                                                                                                                                        Function 0924AED4 Relevance: 1.6, APIs: 1, Instructions: 78serviceCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                          • Part of subcall function 0924AE54: RtlAdjustPrivilege.NTDLL(00000014,00000001,00000000,00000000), ref: 0924AE76
                                                                                                                                                                                        • CloseServiceHandle.ADVAPI32(00000000), ref: 0924AFC7
                                                                                                                                                                                          • Part of subcall function 0924FBB8: NtTerminateProcess.NTDLL(0924FD70,00000000), ref: 0924FC1B
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AdjustCloseHandlePrivilegeProcessServiceTerminate
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3176663195-0
                                                                                                                                                                                        • Opcode ID: 1b868710b5bf9f2d57ec3f4791b64b22e42eb0d6c1fc748428907e01770ec6c9
                                                                                                                                                                                        • Instruction ID: 871b08b3ad76943dea18e2848d5c2421eb98b8f691f381fb01522c4cb20b36a6
                                                                                                                                                                                        • Opcode Fuzzy Hash: 1b868710b5bf9f2d57ec3f4791b64b22e42eb0d6c1fc748428907e01770ec6c9
                                                                                                                                                                                        • Instruction Fuzzy Hash: 8D3149B0990308FFEB11AF90ED4DBDDBBB9AF04701F0140A4F505AA1A1E7B18A94DB12
                                                                                                                                                                                        Function 0924ABE0 Relevance: 1.6, APIs: 1, Instructions: 71COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • OpenSCManagerW.SECHOST(00000000,00000000,00000001), ref: 0924AC01
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: ManagerOpen
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1889721586-0
                                                                                                                                                                                        • Opcode ID: 42625172f27a1169eee9592fb9e7faee39dd987ca43ad5df53c3fbc0956d1ee1
                                                                                                                                                                                        • Instruction ID: cf3eb1924947f1d5ebfdb0537628d4a68fa317a75a0962ded4a3b2fed7a80030
                                                                                                                                                                                        • Opcode Fuzzy Hash: 42625172f27a1169eee9592fb9e7faee39dd987ca43ad5df53c3fbc0956d1ee1
                                                                                                                                                                                        • Instruction Fuzzy Hash: 3C314BB0991209EFDB58DF90DA49BACBBB8FB00305F108198F501AB2A0E7759B44CF85
                                                                                                                                                                                        Function 09250144 Relevance: 1.5, APIs: 1, Instructions: 46threadCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CreateThread.KERNEL32(00000000,00000000,Function_0000EDD0,00000000,00000000,00000000), ref: 09250195
                                                                                                                                                                                          • Part of subcall function 09248614: NtSetInformationThread.NTDLL(00000000,?,00000000,00000000,?,092501A7,00000000), ref: 09248635
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Thread$CreateInformation
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 425492364-0
                                                                                                                                                                                        • Opcode ID: 406f1bae3ac313a9526e34d6230613f9e49bba040bb18259bcf24aff9e3aad5c
                                                                                                                                                                                        • Instruction ID: f26f229160b70d7bc3cadb0c3db9de6e6af1a09372a07b84346f2457e6c060d2
                                                                                                                                                                                        • Opcode Fuzzy Hash: 406f1bae3ac313a9526e34d6230613f9e49bba040bb18259bcf24aff9e3aad5c
                                                                                                                                                                                        • Instruction Fuzzy Hash: 0E01D630740315FBF3206F58BC8DB9E72A8DB05720F211250FD09A62D5DBB05F04C69A
                                                                                                                                                                                        Function 0924B9B0 Relevance: 1.5, APIs: 1, Instructions: 42synchronizationCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CreateMutexW.KERNEL32(0000000C,00000001,?), ref: 0924BA3F
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CreateMutex
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1964310414-0
                                                                                                                                                                                        • Opcode ID: 6a70d50078ddcc9bc13e203deae4f398963c6058402c28caeddb54fe12c3d022
                                                                                                                                                                                        • Instruction ID: 7d77ecf73e8fc3f9e8d3f37e16210eae86d1cd94feba123ee209cb7326f8e74c
                                                                                                                                                                                        • Opcode Fuzzy Hash: 6a70d50078ddcc9bc13e203deae4f398963c6058402c28caeddb54fe12c3d022
                                                                                                                                                                                        • Instruction Fuzzy Hash: 50012574834388EBEF19EFA0F84CBAC7BB4BB04700F116156E504A22D8E7B55A90DB42
                                                                                                                                                                                        Function 0924AE54 Relevance: 1.5, APIs: 1, Instructions: 42COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • RtlAdjustPrivilege.NTDLL(00000014,00000001,00000000,00000000), ref: 0924AE76
                                                                                                                                                                                          • Part of subcall function 0924B5D0: NtQuerySystemInformation.NTDLL(00000005,?,00000400,00000400,00000400), ref: 0924B5FD
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AdjustInformationPrivilegeQuerySystem
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 4254901982-0
                                                                                                                                                                                        • Opcode ID: 2fa8e3faa03753ce33619fd4b2631ed6e375dd3f7487e9e024bbb6ba418bfbce
                                                                                                                                                                                        • Instruction ID: 09260f2dbe47531037b2c590a4ac09b0d64005d58cb754143e0b7efe60e272be
                                                                                                                                                                                        • Opcode Fuzzy Hash: 2fa8e3faa03753ce33619fd4b2631ed6e375dd3f7487e9e024bbb6ba418bfbce
                                                                                                                                                                                        • Instruction Fuzzy Hash: 3F01F470A51308FBEF14DFE4DD4DF9EBAB89B04714F5041A4FA14AA2D0E7B58A44C751
                                                                                                                                                                                        Function 092492B8 Relevance: 1.5, APIs: 1, Instructions: 31COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetLogicalDriveStringsW.KERNEL32(00000104,?), ref: 092492CF
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: DriveLogicalStrings
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2022863570-0
                                                                                                                                                                                        • Opcode ID: e35df2516ebb32c486063cc920da9376e396366a7d0d4ac310d25f5af7a0d844
                                                                                                                                                                                        • Instruction ID: ec2bfe43c3e4bbed605cd856fc3668130cec22a6c83d2b78d48c42c2c91c7458
                                                                                                                                                                                        • Opcode Fuzzy Hash: e35df2516ebb32c486063cc920da9376e396366a7d0d4ac310d25f5af7a0d844
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7EE09B3A50172B57DF28A9D46DC9AEB735CDB05B00F000551FE59D2145DF609EC58ED3
                                                                                                                                                                                        Function 0924D07C Relevance: 1.5, APIs: 1, Instructions: 21COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • RtlAdjustPrivilege.NTDLL(?,00000001,00000000,?), ref: 0924D09B
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AdjustPrivilege
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3260937286-0
                                                                                                                                                                                        • Opcode ID: 95ae4cfbe0e96d78e44bcc7b67393a82310085a5c0ed23a47ae8c663e364959a
                                                                                                                                                                                        • Instruction ID: ef2818f6a0c0cccb5eff6d8dbfccea7aa1282b97abb1d210b261d3a295b5b0de
                                                                                                                                                                                        • Opcode Fuzzy Hash: 95ae4cfbe0e96d78e44bcc7b67393a82310085a5c0ed23a47ae8c663e364959a
                                                                                                                                                                                        • Instruction Fuzzy Hash: 6CD02B7163A205A7CA2415543C05BE6335C8341310F001351FD06D71C0EAE27A0581D2
                                                                                                                                                                                        Function 092486F8 Relevance: 1.5, APIs: 1, Instructions: 13memoryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • RtlFreeHeap.NTDLL(?,00000000,0924E217,?,0924E217,00000000), ref: 09248714
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FreeHeap
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3298025750-0
                                                                                                                                                                                        • Opcode ID: fa7c0699b7a55d96c44429b61dfb25f78fd9b02ffc28f14b9ef5a9b10340f33d
                                                                                                                                                                                        • Instruction ID: 12707cdf5fb6085a27f2e1d6ec46298498dd5ba333134060bfd5c00c90a46b6f
                                                                                                                                                                                        • Opcode Fuzzy Hash: fa7c0699b7a55d96c44429b61dfb25f78fd9b02ffc28f14b9ef5a9b10340f33d
                                                                                                                                                                                        • Instruction Fuzzy Hash: 36D01231160308AFC714AF68A909FAA371CAB10600F854414F6094B1A5D775D8B0DB55
                                                                                                                                                                                        Function 092486D0 Relevance: 1.5, APIs: 1, Instructions: 13memoryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • RtlAllocateHeap.NTDLL(?,00000008,09250F7F,?,09250F7F,003D0900), ref: 092486EC
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AllocateHeap
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1279760036-0
                                                                                                                                                                                        • Opcode ID: fab59510828363f3db99d4620eaf7d2cf2e9b9c389cdf2747298ddcde36a7ef6
                                                                                                                                                                                        • Instruction ID: 45ec0e3fd5103e84aff60df4315898e17e1537175cf5e013c0c39ad990097cd3
                                                                                                                                                                                        • Opcode Fuzzy Hash: fab59510828363f3db99d4620eaf7d2cf2e9b9c389cdf2747298ddcde36a7ef6
                                                                                                                                                                                        • Instruction Fuzzy Hash: CCD01231194708BFC7549F58B809FAA7758AB30600F858410B6085B162CB75D4A0EB51
                                                                                                                                                                                        Function 0924BB24 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetDriveTypeW.KERNEL32(?), ref: 0924BB2A
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: DriveType
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 338552980-0
                                                                                                                                                                                        • Opcode ID: a55590cb8e68fbdd267e14ce9f98cf4a1a805aef6243daa4761323cbba0bdb43
                                                                                                                                                                                        • Instruction ID: 60c3d758a72522f0f51a111feee957f039a3ecebf1dcd75c11ef2c8abbc30765
                                                                                                                                                                                        • Opcode Fuzzy Hash: a55590cb8e68fbdd267e14ce9f98cf4a1a805aef6243daa4761323cbba0bdb43
                                                                                                                                                                                        • Instruction Fuzzy Hash: 16B0123100020CF786001A41F8088457F1CD7106507004021F508001118B3259209597
                                                                                                                                                                                        Function 06F44171 Relevance: .8, Instructions: 762COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2203302135.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: eeb5ba15a6e8522769bdc5d8f89efe794e5793c7bc4f6279720cc061af5a294d
                                                                                                                                                                                        • Instruction ID: d139aa3e635903ac6c5c9ca04682db82c461d363f77987e17be8c1455cebb4ee
                                                                                                                                                                                        • Opcode Fuzzy Hash: eeb5ba15a6e8522769bdc5d8f89efe794e5793c7bc4f6279720cc061af5a294d
                                                                                                                                                                                        • Instruction Fuzzy Hash: 0C721874B002148FEB94DB48C990B59BBB2FF89304F15C095D909AB791CB72ED86CF91
                                                                                                                                                                                        Function 00827A20 Relevance: .7, Instructions: 729COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2150013605.0000000000820000.00000040.00000800.00020000.00000000.sdmp, Offset: 00820000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_820000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: de8dc956ae2683f30ee222e3d0e314303b1ff57f3e8b170fd0d87ae160709ff0
                                                                                                                                                                                        • Instruction ID: 9e82c803cdb3de9ea60be5778521091f9a498408100449eb4ac8e4c044945998
                                                                                                                                                                                        • Opcode Fuzzy Hash: de8dc956ae2683f30ee222e3d0e314303b1ff57f3e8b170fd0d87ae160709ff0
                                                                                                                                                                                        • Instruction Fuzzy Hash: 16622974A05219DFCB05CFA8D984AAEBBB2FF48314F258559E804EB365C735ED81CB90
                                                                                                                                                                                        Function 06F436A8 Relevance: .7, Instructions: 716COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2203302135.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 577108f1552c3033688d1c1fbf1829615881ac840368af8bb213b34da3a3e6b6
                                                                                                                                                                                        • Instruction ID: a82cbfb52698d537b2e0f0fd93d8f65631e0e6b40f6007c9f9eeefa44212d450
                                                                                                                                                                                        • Opcode Fuzzy Hash: 577108f1552c3033688d1c1fbf1829615881ac840368af8bb213b34da3a3e6b6
                                                                                                                                                                                        • Instruction Fuzzy Hash: 3D620874A002148FEB94DB48C990F99BBB2FF89304F15C199D909AB791C772ED86CF91
                                                                                                                                                                                        Function 092D1C28 Relevance: .3, Instructions: 277COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2248691018.00000000092D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 092D0000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_92d0000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 0c3a582d6449541509b07cc567658fd4cab1955daa0361cc1964a3236933d1a4
                                                                                                                                                                                        • Instruction ID: a84ea535a79b29f12865af72deb2c7a3b94dc1d725d0aa2f2d22070e537b6d95
                                                                                                                                                                                        • Opcode Fuzzy Hash: 0c3a582d6449541509b07cc567658fd4cab1955daa0361cc1964a3236933d1a4
                                                                                                                                                                                        • Instruction Fuzzy Hash: 5BC12C34A15209EFDB09DF98D584A9DFBB2FF88310F248159E804AB766C771ED91CB90
                                                                                                                                                                                        Function 008229F0 Relevance: .2, Instructions: 214COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2150013605.0000000000820000.00000040.00000800.00020000.00000000.sdmp, Offset: 00820000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_820000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 7a33374b6fc818ef17ca1c49e475872524913dc59bb1998563f28748b3256fc6
                                                                                                                                                                                        • Instruction ID: 39e3802bab0b86cb517bedef92d3010664a18ef817df9b4ecc34f54fa37d55d1
                                                                                                                                                                                        • Opcode Fuzzy Hash: 7a33374b6fc818ef17ca1c49e475872524913dc59bb1998563f28748b3256fc6
                                                                                                                                                                                        • Instruction Fuzzy Hash: 91916CB0A002599FCB15CF59C4949AEFBB1FF88310B248599D815EB3A5C736FC91CBA0
                                                                                                                                                                                        Function 092D1700 Relevance: .2, Instructions: 152COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2248691018.00000000092D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 092D0000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_92d0000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 6d1ac005eba3227f8abd5ee4ad77812365877e362ed66327ae61aa7366cf079e
                                                                                                                                                                                        • Instruction ID: 5c403aeaab997d6bd15481e3c017d88183def1e5d9d10f63d2744fe2a3dc6eab
                                                                                                                                                                                        • Opcode Fuzzy Hash: 6d1ac005eba3227f8abd5ee4ad77812365877e362ed66327ae61aa7366cf079e
                                                                                                                                                                                        • Instruction Fuzzy Hash: BD51E230A0A3858FC716DF6CC8905AABFB1EF4A310B294596D491DB3A7D334EC45CBA0
                                                                                                                                                                                        Function 092D1E49 Relevance: .1, Instructions: 128COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2248691018.00000000092D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 092D0000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_92d0000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 70e57b11cb30c240cf70b39956d9ea22babd6febb8e99b0c296347edd86f8320
                                                                                                                                                                                        • Instruction ID: 47aa3571be926c8e0b7141041d9635e4abc892aa1dc2590ecf676d8956c0b38a
                                                                                                                                                                                        • Opcode Fuzzy Hash: 70e57b11cb30c240cf70b39956d9ea22babd6febb8e99b0c296347edd86f8320
                                                                                                                                                                                        • Instruction Fuzzy Hash: 1B51E534A11209EFDB05DFA8D584A9DBBB2FF88310F248558E804AB365C775ED92CB90
                                                                                                                                                                                        Function 092D16A6 Relevance: .1, Instructions: 118COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2248691018.00000000092D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 092D0000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_92d0000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 5a9195c11db65de88713aa91ffdc1b87d479342705a1ceefba66d6249c2cc8d6
                                                                                                                                                                                        • Instruction ID: b6b5ab62440cbc130cbc9b300ace3cbcb30401582417417582a5de182ec43d3a
                                                                                                                                                                                        • Opcode Fuzzy Hash: 5a9195c11db65de88713aa91ffdc1b87d479342705a1ceefba66d6249c2cc8d6
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7051B674A093458FCB09CF58C8949AABFB2FF49310B24869AD415EB7A2D335EC51CF90
                                                                                                                                                                                        Function 00822B00 Relevance: .1, Instructions: 112COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2150013605.0000000000820000.00000040.00000800.00020000.00000000.sdmp, Offset: 00820000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_820000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 08150bc0377ccf157513717e4292f72ff79958afe8a13f714b12355ab6ad40c5
                                                                                                                                                                                        • Instruction ID: 1cd371776895ff04ba17bf478c1f4be7cfb3a42506e1879bb464ab9e25b7fb33
                                                                                                                                                                                        • Opcode Fuzzy Hash: 08150bc0377ccf157513717e4292f72ff79958afe8a13f714b12355ab6ad40c5
                                                                                                                                                                                        • Instruction Fuzzy Hash: 804148B4A001199FCB05CF58C5989AEFBB1FF48310B258199D855AB364C736FC91CFA0
                                                                                                                                                                                        Function 00827A11 Relevance: .1, Instructions: 98COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2150013605.0000000000820000.00000040.00000800.00020000.00000000.sdmp, Offset: 00820000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_820000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 58a8769d0d0761ab48207151d4db7977746660b885e490b0e6b6c7333cec20a1
                                                                                                                                                                                        • Instruction ID: 936cddfb772ea5719c95c4e60c39dae2eef3ed425044e691caef4b561b7efce1
                                                                                                                                                                                        • Opcode Fuzzy Hash: 58a8769d0d0761ab48207151d4db7977746660b885e490b0e6b6c7333cec20a1
                                                                                                                                                                                        • Instruction Fuzzy Hash: 28410874A012198FCB14CF99D8849AEBBF1FF88320B248659D915EB3A5D335EC81CF50
                                                                                                                                                                                        Function 008237C8 Relevance: .1, Instructions: 60COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2150013605.0000000000820000.00000040.00000800.00020000.00000000.sdmp, Offset: 00820000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_820000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: b0fd8d424ec6e7922d6cc87c9646b3232209ecea081d6224ef262f63f52b0b5c
                                                                                                                                                                                        • Instruction ID: 5ea17fab6aa7d064969ff8313bfc4904e7478c2e8f97e8387b76472c56cd8eb9
                                                                                                                                                                                        • Opcode Fuzzy Hash: b0fd8d424ec6e7922d6cc87c9646b3232209ecea081d6224ef262f63f52b0b5c
                                                                                                                                                                                        • Instruction Fuzzy Hash: 29211774A002198FCB04DF98D4909AEBBB5FF89310B1485A9E909EB352C735ED41CBA0
                                                                                                                                                                                        Function 008237B9 Relevance: .1, Instructions: 58COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2150013605.0000000000820000.00000040.00000800.00020000.00000000.sdmp, Offset: 00820000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_820000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 06aed62757a4d0b1f5e03ea1ca08bb54051ec21e51f2ff444609bf11df6d65e5
                                                                                                                                                                                        • Instruction ID: e3d8b09c6ba669a779c021f690a2f3beaad40e81292753cc40376082205d86d9
                                                                                                                                                                                        • Opcode Fuzzy Hash: 06aed62757a4d0b1f5e03ea1ca08bb54051ec21e51f2ff444609bf11df6d65e5
                                                                                                                                                                                        • Instruction Fuzzy Hash: 2921F9B4E04219DFCB00DF98D9909AABBF5FF48310B1585A9E909EB351C735ED41CBA1
                                                                                                                                                                                        Function 0922FA19 Relevance: .1, Instructions: 57COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2246766772.0000000009220000.00000040.00000800.00020000.00000000.sdmp, Offset: 09220000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9220000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 1ac68632b59321a430cf96bf034f2d1402fde8f11113053c9c36315e2dcd61bc
                                                                                                                                                                                        • Instruction ID: 1a16511bc559d8614cb65c80d00ab0a42b609e18b0a6f26d3cdebf185e9cafd3
                                                                                                                                                                                        • Opcode Fuzzy Hash: 1ac68632b59321a430cf96bf034f2d1402fde8f11113053c9c36315e2dcd61bc
                                                                                                                                                                                        • Instruction Fuzzy Hash: 6F116772800209CFDB10DFA9C545BEEBFF1EF88324F248429D459A7250CB399585CFA4
                                                                                                                                                                                        Function 0922FA20 Relevance: .1, Instructions: 54COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2246766772.0000000009220000.00000040.00000800.00020000.00000000.sdmp, Offset: 09220000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9220000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: d12db99f28e19eeb3009815758bda1a0c86646f2927ccb5f6b91f6d3a38cbb00
                                                                                                                                                                                        • Instruction ID: f87bb872727ffa8f384ba8a5933085704d3897a8ff64031e108e97f8d456f9ee
                                                                                                                                                                                        • Opcode Fuzzy Hash: d12db99f28e19eeb3009815758bda1a0c86646f2927ccb5f6b91f6d3a38cbb00
                                                                                                                                                                                        • Instruction Fuzzy Hash: CF1149728002199FDB10DFAAC545BEEBFF5EF88320F148429D559A7250CB38A584CFA4
                                                                                                                                                                                        Function 092D1F78 Relevance: .0, Instructions: 49COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2248691018.00000000092D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 092D0000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_92d0000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: e8555d688c01444cb5a772e1dd9ee15bd0d12a20313936b82a17345c5a6245b5
                                                                                                                                                                                        • Instruction ID: f6670929def4d6db80a8a8470e2c8bb353f5910f4f8584a3cd4f0342719918a8
                                                                                                                                                                                        • Opcode Fuzzy Hash: e8555d688c01444cb5a772e1dd9ee15bd0d12a20313936b82a17345c5a6245b5
                                                                                                                                                                                        • Instruction Fuzzy Hash: 3711DA35A15209EFDB05CF98D984E9DFBB2FF48314F288154E404AB765C771E992CB40
                                                                                                                                                                                        Function 0078D01D Relevance: .0, Instructions: 45COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2148984900.000000000078D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0078D000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_78d000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: e96a029ecaafc24ada86ec4a0062260a17b7f2e5a88dbe397a2c82f260b78e5b
                                                                                                                                                                                        • Instruction ID: 929cbda6c64e54fcaba35e31819dadd6b7922b2b107f8d1dafea40c1c6d1c9af
                                                                                                                                                                                        • Opcode Fuzzy Hash: e96a029ecaafc24ada86ec4a0062260a17b7f2e5a88dbe397a2c82f260b78e5b
                                                                                                                                                                                        • Instruction Fuzzy Hash: 0C01F2311883449AE720AA2ACD84B67BF98EF41324F18C42AED084A286C67D9C81C7B1
                                                                                                                                                                                        Function 0078D002 Relevance: .0, Instructions: 45COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2148984900.000000000078D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0078D000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_78d000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 936763db3e6224e022f6575ca6805ec49eb8f29050a6726e560c19b8c0b17c27
                                                                                                                                                                                        • Instruction ID: 01b0d497bc5051fc4959ec90b86c48c88708d13e3d8774139b78a02e5c7a2ded
                                                                                                                                                                                        • Opcode Fuzzy Hash: 936763db3e6224e022f6575ca6805ec49eb8f29050a6726e560c19b8c0b17c27
                                                                                                                                                                                        • Instruction Fuzzy Hash: AA01406144E3C05ED7124B258C94B52BFB4EF53224F1DC0DBD9888F2A3C2695C48C772

                                                                                                                                                                                        Non-executed Functions

                                                                                                                                                                                        Function 09246BA4 Relevance: .3, Instructions: 328COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 182a176d554c39b6e6c78ed4e48a0a5ad6c8eea6e8310cb4c262b6afca725c1d
                                                                                                                                                                                        • Instruction ID: 90c64c8cdbeb16a39931c070a674d2ec086f0f2c5577d83f8a08add4eb4b0ef4
                                                                                                                                                                                        • Opcode Fuzzy Hash: 182a176d554c39b6e6c78ed4e48a0a5ad6c8eea6e8310cb4c262b6afca725c1d
                                                                                                                                                                                        • Instruction Fuzzy Hash: 96E1417AA20E479BE718CE18E894B35B7A2FB8E700F09C538D64587B49D375F560CAC1
                                                                                                                                                                                        Function 092470B4 Relevance: .3, Instructions: 287COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: db0c3fdca8fcc2c74d5a2584fff8c7ee261984dcbd5d6f53cfbdbfba11830eb4
                                                                                                                                                                                        • Instruction ID: 7395dd3f5d3d66f1277003bfd96e966b1ce6b858772afa2f7e2637670250acc2
                                                                                                                                                                                        • Opcode Fuzzy Hash: db0c3fdca8fcc2c74d5a2584fff8c7ee261984dcbd5d6f53cfbdbfba11830eb4
                                                                                                                                                                                        • Instruction Fuzzy Hash: A0D12F7AE2098A8BDB14CE98F8D4B7AB7B2FB8D700F198538C75193745C774A911CB90
                                                                                                                                                                                        Function 092504DC Relevance: .2, Instructions: 241COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 203078b86fb779ae640a45b6cecc2cecf8a712b68b1e93bb9b80616b91450146
                                                                                                                                                                                        • Instruction ID: 3c8797db758749fa44fb1d0d57914a8ef5c474dd016c9c88b7f2ee561a671b99
                                                                                                                                                                                        • Opcode Fuzzy Hash: 203078b86fb779ae640a45b6cecc2cecf8a712b68b1e93bb9b80616b91450146
                                                                                                                                                                                        • Instruction Fuzzy Hash: BFA184B4556605CBEB08DF10DD15B5A7BA2FF85344F14C06EEC0A8B3A1EB7A8852CF91
                                                                                                                                                                                        Function 09246B9F Relevance: .1, Instructions: 77COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 9a6bfa260f2b6e7f99e805bbcf3681c1c277a182868b4f02fce20b12285153a5
                                                                                                                                                                                        • Instruction ID: ed45653660a3b07ca81cdfa9752dfd24d238b34889b37b810c767df0bbcd71c8
                                                                                                                                                                                        • Opcode Fuzzy Hash: 9a6bfa260f2b6e7f99e805bbcf3681c1c277a182868b4f02fce20b12285153a5
                                                                                                                                                                                        • Instruction Fuzzy Hash: DE3127B6A21E069BD328CF19D488A26F7A2FF5E310B15CA29D959C3B51D770F950CBC0
                                                                                                                                                                                        Function 0924108C Relevance: .0, Instructions: 37COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 6e9e9d037a559c25274071be2e09c2d3cf2f15b9f66fb5d997d9d64617e40bf4
                                                                                                                                                                                        • Instruction ID: 372ab281bc8c57413de2906836744a44f979e2621d06d9e62f1dc26e55f40eab
                                                                                                                                                                                        • Opcode Fuzzy Hash: 6e9e9d037a559c25274071be2e09c2d3cf2f15b9f66fb5d997d9d64617e40bf4
                                                                                                                                                                                        • Instruction Fuzzy Hash: 21E04FBB70D3425FF92C855174533A79387C780575E25849EF806DF2C0EF1BE8A52045
                                                                                                                                                                                        Function 06F4F608 Relevance: 22.9, Strings: 18, Instructions: 411COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2203302135.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: 4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$84il$84il$<,_k$TQcq$TQcq$TQcq$tP^q$tP^q
                                                                                                                                                                                        • API String ID: 0-3861204963
                                                                                                                                                                                        • Opcode ID: bbbb8f1b8075f138d9233af4685372fc9bdf20a3568027efb8e92cdf4c75a2ff
                                                                                                                                                                                        • Instruction ID: f6bca37a3da74c6486f900a99baec724027c96d7cdce40478d4ec46e6b7e48e6
                                                                                                                                                                                        • Opcode Fuzzy Hash: bbbb8f1b8075f138d9233af4685372fc9bdf20a3568027efb8e92cdf4c75a2ff
                                                                                                                                                                                        • Instruction Fuzzy Hash: 61D12931F062089FDB54AF29C4146AA7FE2AFC5710F24846AD809DF795CB36CC85C7A2
                                                                                                                                                                                        Function 06F4C998 Relevance: 19.2, Strings: 15, Instructions: 464COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2203302135.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: 4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$al$al$al$al
                                                                                                                                                                                        • API String ID: 0-246105492
                                                                                                                                                                                        • Opcode ID: fe80ffc454b8eabf6d0d455cb86b062119d0bb330f21fd80b84592e505e87abc
                                                                                                                                                                                        • Instruction ID: 8c7b2bf466c37407d20237b67bb5c221596075315b9a1f83faba3561ec9f0336
                                                                                                                                                                                        • Opcode Fuzzy Hash: fe80ffc454b8eabf6d0d455cb86b062119d0bb330f21fd80b84592e505e87abc
                                                                                                                                                                                        • Instruction Fuzzy Hash: AE02CF74E01205DFDB54EF58C450A6ABFB2BF89710F24D52AD809ABB55CB32EC42CB91
                                                                                                                                                                                        Function 09253DE6 Relevance: 16.5, APIs: 11, Instructions: 37windowCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2247395857.0000000009241000.00000020.00001000.00020000.00000000.sdmp, Offset: 09241000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9241000_powershell.jbxd
                                                                                                                                                                                        Yara matches
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CountTick$CreateDialogMenuParam$BrushColorCommandHandleLineLoadModuleTextWindow
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 354372533-0
                                                                                                                                                                                        • Opcode ID: cf21330174decdf2dd75a1173b6e65d51e3c81e2dec6fc824f84760f8be5c0f3
                                                                                                                                                                                        • Instruction ID: 5d57b99b5cc547896f273366973159691a26e51ca05c658c510294515ba2d0b2
                                                                                                                                                                                        • Opcode Fuzzy Hash: cf21330174decdf2dd75a1173b6e65d51e3c81e2dec6fc824f84760f8be5c0f3
                                                                                                                                                                                        • Instruction Fuzzy Hash: 97F04211C706A8F58E06B3F9701AF8C9AC82EC0191799F06CFC8F445200FF06548E133
                                                                                                                                                                                        Function 091FD830 Relevance: 9.2, Strings: 7, Instructions: 499COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2245413941.00000000091F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 091F0000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_91f0000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: 4'^q$4'^q$dfrq$|irq$$^q$$^q$$^q
                                                                                                                                                                                        • API String ID: 0-790992246
                                                                                                                                                                                        • Opcode ID: 6286b745540975f76c05b196e620b61e98e225395d8a37a9cecdc3a39a6291fe
                                                                                                                                                                                        • Instruction ID: a404f2bb9699fcba58e1b713165cd2b9cc71f3b448537b7a6675e2deb2b7acc6
                                                                                                                                                                                        • Opcode Fuzzy Hash: 6286b745540975f76c05b196e620b61e98e225395d8a37a9cecdc3a39a6291fe
                                                                                                                                                                                        • Instruction Fuzzy Hash: E2022839F042198FCB199F68E42067ABBF1EFC6314F1584BAE645CB291DB31C855C7A1
                                                                                                                                                                                        Function 06F45BA0 Relevance: 9.2, Strings: 7, Instructions: 487COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2203302135.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: 84il$84il$XX^q$XX^q$tP^q$tP^q$$^q
                                                                                                                                                                                        • API String ID: 0-2811726746
                                                                                                                                                                                        • Opcode ID: 7586309d139ecc536fedffd0cc12d4958fe91159727b980af6b17405ca14e3ae
                                                                                                                                                                                        • Instruction ID: b316a39d393717ccd8f279075c8219a85d079d42a24182846457e5c36f04dc6e
                                                                                                                                                                                        • Opcode Fuzzy Hash: 7586309d139ecc536fedffd0cc12d4958fe91159727b980af6b17405ca14e3ae
                                                                                                                                                                                        • Instruction Fuzzy Hash: 86F12431F042149FDB54BF78C810A6ABFE2AF85710F24846AE505DB7A1DB72CD45C7A2
                                                                                                                                                                                        Function 06F46388 Relevance: 9.2, Strings: 7, Instructions: 469COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2203302135.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: 4'^q$4'^q$4'^q$4'^q$H-]k$al$al
                                                                                                                                                                                        • API String ID: 0-1531018717
                                                                                                                                                                                        • Opcode ID: bb2c272f35c1e4758accb968d84b8f20337f23ba06c0267df7b1d4751848c857
                                                                                                                                                                                        • Instruction ID: 5650f1ff65fa4c92eaf2ed954cfcdd65730510721bc0818d918a8ea6c45dd8d1
                                                                                                                                                                                        • Opcode Fuzzy Hash: bb2c272f35c1e4758accb968d84b8f20337f23ba06c0267df7b1d4751848c857
                                                                                                                                                                                        • Instruction Fuzzy Hash: 53E11532F082158FDB54AF68D41067ABFE6AFC7211F14847BD409CBB55DA32C895C7A1
                                                                                                                                                                                        Function 093022EA Relevance: 9.2, Strings: 7, Instructions: 408COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2248931148.0000000009300000.00000040.00000800.00020000.00000000.sdmp, Offset: 09300000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9300000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: (fkl$4'^q$4'^q$`9<!%$b9@!'$x.\k$-\k
                                                                                                                                                                                        • API String ID: 0-3921287227
                                                                                                                                                                                        • Opcode ID: e1c6f240d286c7d1b7f95429ba4bc61b17d7305bfd983f11d7af3c616cc9fa5e
                                                                                                                                                                                        • Instruction ID: 8bdfb7d3019251ec03153d8a66d25ebd71e47971d3bb76c68a55115e40682f39
                                                                                                                                                                                        • Opcode Fuzzy Hash: e1c6f240d286c7d1b7f95429ba4bc61b17d7305bfd983f11d7af3c616cc9fa5e
                                                                                                                                                                                        • Instruction Fuzzy Hash: CF0282707402189FDB14DB28CC65FAE7BA7BB85300F1080A5E6096F795CB76DD858FA1
                                                                                                                                                                                        Function 06F44EC0 Relevance: 7.7, Strings: 6, Instructions: 222COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2203302135.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: 4'^q$4'^q$Te^q$$^q$$^q$$^q
                                                                                                                                                                                        • API String ID: 0-2683635004
                                                                                                                                                                                        • Opcode ID: 99a72981038bba19da76b43e9591ea2ee8be3a2981ddab7b47790488f2ad1891
                                                                                                                                                                                        • Instruction ID: 18eaa11b018f9a195bc58fda2028469cb775e71718a1c8a79c2c3c7c0dcd1316
                                                                                                                                                                                        • Opcode Fuzzy Hash: 99a72981038bba19da76b43e9591ea2ee8be3a2981ddab7b47790488f2ad1891
                                                                                                                                                                                        • Instruction Fuzzy Hash: 12617A36F043068FDB94BE6D984067ABFE6EFC5220B14847BD405CBA55EE32C849C7A1
                                                                                                                                                                                        Function 06F49BA8 Relevance: 7.7, Strings: 6, Instructions: 220COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2203302135.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: 4'^q$4'^q$84il$84il$84il$tP^q
                                                                                                                                                                                        • API String ID: 0-1343413898
                                                                                                                                                                                        • Opcode ID: dabb40e46b66958cc3f8a3ae2a62abc5dc83afed0f60ed2666cbf9d363cef407
                                                                                                                                                                                        • Instruction ID: 430de6d18764cef7e7d1110d40aafcd82f8f791619d9e84e03eea9da847c637a
                                                                                                                                                                                        • Opcode Fuzzy Hash: dabb40e46b66958cc3f8a3ae2a62abc5dc83afed0f60ed2666cbf9d363cef407
                                                                                                                                                                                        • Instruction Fuzzy Hash: 79817E31F00209DFEB54EE08C540BAABFE2BF88710F15C459E9056BA94C7B2DC81CBA1
                                                                                                                                                                                        Function 06F4D730 Relevance: 7.7, Strings: 6, Instructions: 205COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2203302135.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: `Q^q$`Q^q$`Q^q$`Q^q$`Q^q$dDbq
                                                                                                                                                                                        • API String ID: 0-1916931808
                                                                                                                                                                                        • Opcode ID: f461be287e01ae7b494af777a0e411e2b5217a6c3e4234758161086c27159e4f
                                                                                                                                                                                        • Instruction ID: da31704a86aa8cbccd9489ebd47bd6a3ba5121c77136e4d538d868592883e0f3
                                                                                                                                                                                        • Opcode Fuzzy Hash: f461be287e01ae7b494af777a0e411e2b5217a6c3e4234758161086c27159e4f
                                                                                                                                                                                        • Instruction Fuzzy Hash: 20519B32F083049FD765AE69985063ABFA6AFC1611B18C47FD445CB796DA36CC09C3B1
                                                                                                                                                                                        Function 091F060C Relevance: 7.7, Strings: 6, Instructions: 152COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2245413941.00000000091F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 091F0000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_91f0000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: 84il$tP^q$c^q$c^q$c^q$c^q
                                                                                                                                                                                        • API String ID: 0-2322308862
                                                                                                                                                                                        • Opcode ID: ce87a2ed58eb0192bb23b69fc07a699518edcaa03f2133e77b1a6aec4d8dd1eb
                                                                                                                                                                                        • Instruction ID: 896cd474c2ae87844f992898203de0a7525478f8726ac220907c9602374ccdbe
                                                                                                                                                                                        • Opcode Fuzzy Hash: ce87a2ed58eb0192bb23b69fc07a699518edcaa03f2133e77b1a6aec4d8dd1eb
                                                                                                                                                                                        • Instruction Fuzzy Hash: 0B51D431F01209DBCB18CF19C4A4A55FBE2BF88724F19C6AAE9459F252D770DD85CB81
                                                                                                                                                                                        Function 06F4F603 Relevance: 7.6, Strings: 6, Instructions: 140COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2203302135.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: 4'^q$4'^q$84il$TQcq$TQcq$tP^q
                                                                                                                                                                                        • API String ID: 0-1406622218
                                                                                                                                                                                        • Opcode ID: 9690a2bc89d18b179da7b73f020fb8f1ec0884af3a53a38934a29a62fca0d06e
                                                                                                                                                                                        • Instruction ID: 1c063336a4c8773276198466e17636fb6dc2b39dcd0e87079c6ddfccafe7ab8a
                                                                                                                                                                                        • Opcode Fuzzy Hash: 9690a2bc89d18b179da7b73f020fb8f1ec0884af3a53a38934a29a62fca0d06e
                                                                                                                                                                                        • Instruction Fuzzy Hash: 8651A131E06204DFDB64EF15D544AAABFE2ABC5311F15806AD80C9FAA5C375DC84CBA1
                                                                                                                                                                                        Function 06F4B0D8 Relevance: 7.6, Strings: 6, Instructions: 138COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2203302135.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: 4'^q$4'^q$84il$TQcq$TQcq$tP^q
                                                                                                                                                                                        • API String ID: 0-1406622218
                                                                                                                                                                                        • Opcode ID: 7ebbedd11004ddaa062c11b1b5d58c0fadd23fa593d3944f4db86d87e3a6a3f7
                                                                                                                                                                                        • Instruction ID: c92174a155099cb74ea447eef8013a786dd27c7df3b495bb9ce0621d2740e240
                                                                                                                                                                                        • Opcode Fuzzy Hash: 7ebbedd11004ddaa062c11b1b5d58c0fadd23fa593d3944f4db86d87e3a6a3f7
                                                                                                                                                                                        • Instruction Fuzzy Hash: 9451C531E00205DFEBA4EF1AC545BBABFF2AF84751F14806AE8055BA96C771DD80CB91
                                                                                                                                                                                        Function 093019F4 Relevance: 6.5, Strings: 5, Instructions: 281COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2248931148.0000000009300000.00000040.00000800.00020000.00000000.sdmp, Offset: 09300000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_9300000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: 4'^q$4'^q$Pq^q$x.\k$-\k
                                                                                                                                                                                        • API String ID: 0-2665516923
                                                                                                                                                                                        • Opcode ID: 2dbf5b91da414a3c381a2e7a4e274330225c2d25a67b10bf68acc093f4710668
                                                                                                                                                                                        • Instruction ID: b66b0b8f8d5dc59ff939ef212539df4358e0050ddb5aab075639a0d44f4c8bb6
                                                                                                                                                                                        • Opcode Fuzzy Hash: 2dbf5b91da414a3c381a2e7a4e274330225c2d25a67b10bf68acc093f4710668
                                                                                                                                                                                        • Instruction Fuzzy Hash: BDC1D670A402189FD715DB64C865B9EBBF6FB84300F1084E9E5086F395CB769E86CFA1
                                                                                                                                                                                        Function 091FFAF8 Relevance: 6.3, Strings: 5, Instructions: 72COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2245413941.00000000091F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 091F0000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_91f0000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: tP^q$tP^q$$^q$$^q$$^q
                                                                                                                                                                                        • API String ID: 0-578306960
                                                                                                                                                                                        • Opcode ID: 89de7befc550054ec8c1cf9f250a292b0e14fbc26b25ae22531dcb574c493851
                                                                                                                                                                                        • Instruction ID: 99e93d329a2bd09d11c275a8a51162cd43c0ec8d970c5167439f272b2167c5c1
                                                                                                                                                                                        • Opcode Fuzzy Hash: 89de7befc550054ec8c1cf9f250a292b0e14fbc26b25ae22531dcb574c493851
                                                                                                                                                                                        • Instruction Fuzzy Hash: 8F210832B0021C8FD7288E69C824A66BFE5AF84B64F25415AFA049F365CBB1DC46C790
                                                                                                                                                                                        Function 06F44988 Relevance: 6.3, Strings: 5, Instructions: 71COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2203302135.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: $^q$$^q$$^q$al$al
                                                                                                                                                                                        • API String ID: 0-3847835584
                                                                                                                                                                                        • Opcode ID: c543e99a59b1323171ff2f9c70927a7c89fd32bed1794f403b772cd86d74033d
                                                                                                                                                                                        • Instruction ID: 0a77d7652e9cdab962e18d0a086a9e6d6eace9a526f4e6467b30ddb40cd68fb2
                                                                                                                                                                                        • Opcode Fuzzy Hash: c543e99a59b1323171ff2f9c70927a7c89fd32bed1794f403b772cd86d74033d
                                                                                                                                                                                        • Instruction Fuzzy Hash: FC11EC32B042099BEB746D2A9904B67BFDAEFC1721F24C42AE549ABB94DA32C441C751
                                                                                                                                                                                        Function 091FEEB8 Relevance: 5.2, Strings: 4, Instructions: 210COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2245413941.00000000091F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 091F0000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_91f0000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: 84il$84il$tP^q$tP^q
                                                                                                                                                                                        • API String ID: 0-302046226
                                                                                                                                                                                        • Opcode ID: 76037784f0a1b482f12dae23a8c57cdfd0edfd22fb06dfb6c6cff1393fc14ee1
                                                                                                                                                                                        • Instruction ID: 025bf9057e1a79452918fe74439f99d196b4f9b702d2c587cb6a506c117924a2
                                                                                                                                                                                        • Opcode Fuzzy Hash: 76037784f0a1b482f12dae23a8c57cdfd0edfd22fb06dfb6c6cff1393fc14ee1
                                                                                                                                                                                        • Instruction Fuzzy Hash: 9F613C33B042198FC7248E68942057AFBE29FC5715B2984BAE605DB3A1DF72CD46C7B1
                                                                                                                                                                                        Function 06F47960 Relevance: 5.2, Strings: 4, Instructions: 153COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2203302135.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: 4'^q$4'^q$tP^q$tP^q
                                                                                                                                                                                        • API String ID: 0-3859475322
                                                                                                                                                                                        • Opcode ID: 2052e0f37c10ff4dafa312626157fc05e7ab9b17ab823106baab728ebd9bafff
                                                                                                                                                                                        • Instruction ID: 4d3979f6052f130dc877b9f6786b755b276463eebd12c77b01c101c2e034fc0c
                                                                                                                                                                                        • Opcode Fuzzy Hash: 2052e0f37c10ff4dafa312626157fc05e7ab9b17ab823106baab728ebd9bafff
                                                                                                                                                                                        • Instruction Fuzzy Hash: 12513B31F043158FDB54BB689804B6ABFA2AF82710F18C4AAE1459F7A5DB32CD45C7E1
                                                                                                                                                                                        Function 091F0180 Relevance: 5.2, Strings: 4, Instructions: 153COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2245413941.00000000091F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 091F0000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_91f0000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: 84il$84il$tP^q$tP^q
                                                                                                                                                                                        • API String ID: 0-302046226
                                                                                                                                                                                        • Opcode ID: 60ff11a850e8b74d26899f4003438028e8a00cfda9253f9ce1bff4a1ee22f735
                                                                                                                                                                                        • Instruction ID: e61e01a798f30000080f346c47bb69eb40b23dbab574506ce0ef28c0b7cd2b98
                                                                                                                                                                                        • Opcode Fuzzy Hash: 60ff11a850e8b74d26899f4003438028e8a00cfda9253f9ce1bff4a1ee22f735
                                                                                                                                                                                        • Instruction Fuzzy Hash: C8514A31F042099FCB149F698864A2AFBE2AF89714F19C45AF649DF352C731DC45C7A1
                                                                                                                                                                                        Function 06F4B404 Relevance: 5.1, Strings: 4, Instructions: 147COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2203302135.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: 4'^q$4'^q$84il$tP^q
                                                                                                                                                                                        • API String ID: 0-1484865457
                                                                                                                                                                                        • Opcode ID: c8de7888af5611931869bf4dc6a958ce43275395df741c2f21d26fd74ed926cb
                                                                                                                                                                                        • Instruction ID: 15ae2081afabdaa66298bd05ee4bf107890bfc98aef6bf85017a8bf3613505e2
                                                                                                                                                                                        • Opcode Fuzzy Hash: c8de7888af5611931869bf4dc6a958ce43275395df741c2f21d26fd74ed926cb
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7A51F231E04214DFEB64AE18C540BBABFF2AF85741F188495E8046BAA6C735DD81CBA1
                                                                                                                                                                                        Function 06F47550 Relevance: 5.1, Strings: 4, Instructions: 137COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2203302135.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: 84il$84il$tP^q$tP^q
                                                                                                                                                                                        • API String ID: 0-302046226
                                                                                                                                                                                        • Opcode ID: 23cb92ee34724186cd559e1bacc9cc6b1aed5a9dc4a396b9b09839253716858a
                                                                                                                                                                                        • Instruction ID: 71853e43aecb364724b0b0d1d15968ec69531bd9eb1632aec80131fcdb8b2fb9
                                                                                                                                                                                        • Opcode Fuzzy Hash: 23cb92ee34724186cd559e1bacc9cc6b1aed5a9dc4a396b9b09839253716858a
                                                                                                                                                                                        • Instruction Fuzzy Hash: FA414731E053449FD711BB6CC810A6ABFB2AF87710F25889AE4459F7A2CB31DC45C7A2
                                                                                                                                                                                        Function 06F4B418 Relevance: 5.1, Strings: 4, Instructions: 135COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2203302135.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: 4'^q$4'^q$84il$tP^q
                                                                                                                                                                                        • API String ID: 0-1484865457
                                                                                                                                                                                        • Opcode ID: d70a05e686d52fa34baf12d0a99aea177b2e1d4aebb3d97df817aa78a854c0e0
                                                                                                                                                                                        • Instruction ID: 0c323474f97454140efd2f7da67ac5ca03c398aa8d04ab8f9d0c4a46af910a65
                                                                                                                                                                                        • Opcode Fuzzy Hash: d70a05e686d52fa34baf12d0a99aea177b2e1d4aebb3d97df817aa78a854c0e0
                                                                                                                                                                                        • Instruction Fuzzy Hash: F841D231E04214DFEB64AE58C540BBABFF2BB88751F1484A5D8056BAA6C731DD81CBA1
                                                                                                                                                                                        Function 06F4AC5C Relevance: 5.1, Strings: 4, Instructions: 133COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2203302135.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: 4'^q$d%dq$d%dq$d%dq
                                                                                                                                                                                        • API String ID: 0-1017794317
                                                                                                                                                                                        • Opcode ID: 20de6cc171f2a009d97862ca2b5e99169ae51fc43cd7006509dfdaa5d14b8262
                                                                                                                                                                                        • Instruction ID: 3567707e41e0d831ca4422d4e664278f0d071c4db0fdbd3b9415037056df8a5c
                                                                                                                                                                                        • Opcode Fuzzy Hash: 20de6cc171f2a009d97862ca2b5e99169ae51fc43cd7006509dfdaa5d14b8262
                                                                                                                                                                                        • Instruction Fuzzy Hash: 11411532E84305DFDBA8AE16C5807BA7FA2AF40311F144469ED119FAE9DB35CD40C7A1
                                                                                                                                                                                        Function 06F4AC70 Relevance: 5.1, Strings: 4, Instructions: 125COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2203302135.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: 4'^q$d%dq$d%dq$d%dq
                                                                                                                                                                                        • API String ID: 0-1017794317
                                                                                                                                                                                        • Opcode ID: 7522bca8d331a0db08404232d61c504c5239a535c6204248c81fd273f339dd8a
                                                                                                                                                                                        • Instruction ID: 09237d2afddee18b214e64b419aa6902653b0ad43871747cdb3782eb7aa3f246
                                                                                                                                                                                        • Opcode Fuzzy Hash: 7522bca8d331a0db08404232d61c504c5239a535c6204248c81fd273f339dd8a
                                                                                                                                                                                        • Instruction Fuzzy Hash: DB41F732E44305DFDBA8AE16C58077A7FA2AF40351F144865ED119BAE8DB75CD40C7E1
                                                                                                                                                                                        Function 091FCF68 Relevance: 5.1, Strings: 4, Instructions: 116COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2245413941.00000000091F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 091F0000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_91f0000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: 4'^q$84il$dfrq$tP^q
                                                                                                                                                                                        • API String ID: 0-664710503
                                                                                                                                                                                        • Opcode ID: 3768d956f8160beecbae62bd57a6396fecc21d00cad84eb1df416b6af82af6c9
                                                                                                                                                                                        • Instruction ID: e68e72c3edb62a7a7398f1450ca9490a2f4170ddf4a5d592639b1a8580034bd9
                                                                                                                                                                                        • Opcode Fuzzy Hash: 3768d956f8160beecbae62bd57a6396fecc21d00cad84eb1df416b6af82af6c9
                                                                                                                                                                                        • Instruction Fuzzy Hash: 4D41E23AF0420C9BDB288E54D564A75F7E2BF84718F1580AAE6095B290C731DC86CBD2
                                                                                                                                                                                        Function 06F48BE0 Relevance: 5.1, Strings: 4, Instructions: 105COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2203302135.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: 4'^q$4'^q$al$al
                                                                                                                                                                                        • API String ID: 0-744728856
                                                                                                                                                                                        • Opcode ID: 26d3500ee6cc99a1ef0271415c78a96aa2a8be9613f31efe6b4d96a2b06b216a
                                                                                                                                                                                        • Instruction ID: 2c6f6cd35ae7d7271e78ab0d60016c2918c996232b84091a5c40009cd996c4d9
                                                                                                                                                                                        • Opcode Fuzzy Hash: 26d3500ee6cc99a1ef0271415c78a96aa2a8be9613f31efe6b4d96a2b06b216a
                                                                                                                                                                                        • Instruction Fuzzy Hash: 81318B32F462058FDB556A698450277FFA3ABD6290B24856BC2228BB65CF32CC56C391
                                                                                                                                                                                        Function 091FD6D8 Relevance: 5.1, Strings: 4, Instructions: 105COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2245413941.00000000091F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 091F0000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_91f0000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: 84il$84il$tP^q$tP^q
                                                                                                                                                                                        • API String ID: 0-302046226
                                                                                                                                                                                        • Opcode ID: 6ed64317645373a8df09afe2b5a6be47c964028859a32e1942548ac1f94a9d3f
                                                                                                                                                                                        • Instruction ID: 0ed69fb5b0de723f48288538819decc2976f1e61056622b5600fbd717bed4929
                                                                                                                                                                                        • Opcode Fuzzy Hash: 6ed64317645373a8df09afe2b5a6be47c964028859a32e1942548ac1f94a9d3f
                                                                                                                                                                                        • Instruction Fuzzy Hash: 40311834F043489FC7159B689815B6ABFA5AF86718F15859AFA04DF2D2C7309C44C7A2
                                                                                                                                                                                        Function 06F4D630 Relevance: 5.0, Strings: 4, Instructions: 50COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2203302135.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: `Q^q$`Q^q$`Q^q$dDbq
                                                                                                                                                                                        • API String ID: 0-3083454599
                                                                                                                                                                                        • Opcode ID: 88b4a8e6aff16c4af382b152ba738dbd9423089d9d75d5dc1983f43e7d621ac6
                                                                                                                                                                                        • Instruction ID: 2370292f1d42db5106c41bca533b2fa019b16218ae190095073bee9ec2e6184c
                                                                                                                                                                                        • Opcode Fuzzy Hash: 88b4a8e6aff16c4af382b152ba738dbd9423089d9d75d5dc1983f43e7d621ac6
                                                                                                                                                                                        • Instruction Fuzzy Hash: 31014937F0130A9F5BA83D2A8540537BFE9AFC369135C847AD80C87748DA35C808CBA1
                                                                                                                                                                                        Function 06F401D8 Relevance: 5.0, Strings: 4, Instructions: 47COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2203302135.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: 4'^q$4'^q$$^q$$^q
                                                                                                                                                                                        • API String ID: 0-2049395529
                                                                                                                                                                                        • Opcode ID: 5ebfb801eac2221bbd732d58673f1733bccb28fc62f47d2aa076f5438ad31df4
                                                                                                                                                                                        • Instruction ID: 06a0ed70806edc253a44856490bb33b9c268996ec4ebf9d980b86f315175d193
                                                                                                                                                                                        • Opcode Fuzzy Hash: 5ebfb801eac2221bbd732d58673f1733bccb28fc62f47d2aa076f5438ad31df4
                                                                                                                                                                                        • Instruction Fuzzy Hash: 9C01DB21B493855FD32A22681C241666FB24BC395032900DBC189DF7E6CD298E4A83E6
                                                                                                                                                                                        Function 06F473A0 Relevance: 5.0, Strings: 4, Instructions: 38COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 00000002.00000002.2203302135.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID: oll$ oll$Lkl$Lkl
                                                                                                                                                                                        • API String ID: 0-4029222707
                                                                                                                                                                                        • Opcode ID: 9486c47855bcd7d763442fb1a3822c407af1540e6cd7f2b80328eee1894f5fb1
                                                                                                                                                                                        • Instruction ID: 717611417919e37eca2ad5801f6524e0f9773ba67f40bcb0354c7ff8290bcce6
                                                                                                                                                                                        • Opcode Fuzzy Hash: 9486c47855bcd7d763442fb1a3822c407af1540e6cd7f2b80328eee1894f5fb1
                                                                                                                                                                                        • Instruction Fuzzy Hash: 60F02433F602548F8360794C8807A7ABF9BEBC4A507140026D900CBB28DBB1EC0187EB

                                                                                                                                                                                        Execution Graph

                                                                                                                                                                                        Execution Coverage:40.2%
                                                                                                                                                                                        Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                        Signature Coverage:1%
                                                                                                                                                                                        Total number of Nodes:196
                                                                                                                                                                                        Total number of Limit Nodes:8
                                                                                                                                                                                        execution_graph 877 403983 881 40389c 877->881 890 402a78 881->890 883 403903 885 403914 26 API calls 883->885 920 40362e 883->920 934 4028ba 890->934 891 402a9e 891->885 895 4026c0 891->895 893 402af0 CreateMutexW 893->891 948 4024f8 895->948 897 402729 897->883 897->885 901 402f18 897->901 898 4026e7 CreateFileW 898->897 899 40270b ReadFile 898->899 899->897 902 402f2e 901->902 902->902 952 40227c FindFirstFileExW 902->952 903 402f67 CreateFileW 905 402f57 903->905 908 402faf 903->908 904 402faa 907 4030c5 NtFreeVirtualMemory 904->907 909 4030ed 904->909 905->903 905->904 906 402fb4 NtAllocateVirtualMemory 906->908 915 402fe8 906->915 907->904 908->906 908->915 910 4030f3 NtClose 909->910 911 4030ff 909->911 910->911 954 402e10 911->954 913 40311f 913->883 914 40304b WriteFile 914->915 916 403068 SetFilePointerEx 914->916 915->904 915->914 917 403095 SetFilePointerEx 915->917 916->914 916->915 917->915 921 40365e 920->921 958 403144 921->958 923 403673 923->885 924 403678 GetLogicalDriveStringsW 924->923 927 403695 924->927 925 40371d GetDriveTypeW 925->927 926 4037c6 928 403809 926->928 931 4037f9 NtClose 926->931 927->923 927->925 927->926 930 40375a CreateThread 927->930 963 40217c 927->963 928->923 929 40381e Sleep 928->929 929->928 930->927 974 4032e8 SetThreadPriority GetDiskFreeSpaceW GetDiskFreeSpaceExW 930->974 931->928 931->931 935 4028dd 934->935 938 402760 CreateFileW 935->938 939 402797 938->939 944 4027da 938->944 939->944 946 4020bc 939->946 940 402802 940->891 940->893 941 4027f6 NtClose 941->940 942 4027b7 943 4027c0 ReadFile 942->943 942->944 943->944 944->940 944->941 947 4020c8 RtlAllocateHeap 946->947 947->942 949 402512 948->949 951 402760 4 API calls 949->951 950 402522 950->897 950->898 951->950 953 4022af 952->953 953->905 956 402e2e 954->956 955 402e37 DeleteFileW 955->913 956->955 957 402e7c MoveFileExW 956->957 957->955 957->956 961 403155 958->961 959 40318d CreateThread 959->961 970 403478 SetThreadPriority 959->970 960 4031c6 960->923 960->924 961->959 961->960 967 401d94 961->967 965 402192 963->965 964 40222a 964->927 965->964 966 40221b CreateDirectoryW 965->966 966->964 968 401da8 NtSetInformationThread 967->968 968->961 973 40348b 970->973 971 4034af 972 4034f0 WriteFile 972->973 973->971 973->972 975 403349 GetTempFileNameW CreateFileW 974->975 976 4033a9 DeviceIoControl 975->976 979 4033a4 975->979 981 403258 976->981 978 4033fd CreateIoCompletionPort 978->979 982 40326d 981->982 984 4020bc RtlAllocateHeap 982->984 983 403283 983->978 983->979 984->983 1103 4032e4 1104 4032e8 SetThreadPriority GetDiskFreeSpaceW GetDiskFreeSpaceExW 1103->1104 1105 403349 GetTempFileNameW CreateFileW 1104->1105 1106 4033a9 DeviceIoControl 1105->1106 1109 4033a4 1105->1109 1110 403258 RtlAllocateHeap 1106->1110 1107 4033e9 1108 4033fd CreateIoCompletionPort 1107->1108 1107->1109 1108->1109 1110->1107 985 403956 986 403963 985->986 987 403976 985->987 994 4019d4 986->994 1032 4016b4 994->1032 997 4016b4 9 API calls 998 4019f4 997->998 999 4016b4 9 API calls 998->999 1000 401a05 999->1000 1001 4016b4 9 API calls 1000->1001 1002 401a16 1001->1002 1003 4016b4 9 API calls 1002->1003 1004 401a27 1003->1004 1005 4016b4 9 API calls 1004->1005 1006 401a38 1005->1006 1007 401b70 RtlCreateHeap 1006->1007 1008 401ba1 1007->1008 1009 401ba6 RtlCreateHeap 1007->1009 1024 402812 1008->1024 1028 402836 1008->1028 1009->1008 1010 401bcb 1009->1010 1010->1008 1080 401a40 1010->1080 1012 401c03 1012->1008 1013 401a40 RtlAllocateHeap 1012->1013 1014 401c59 1013->1014 1014->1008 1015 401a40 RtlAllocateHeap 1014->1015 1016 401caf 1015->1016 1016->1008 1017 401a40 RtlAllocateHeap 1016->1017 1018 401d05 1017->1018 1018->1008 1019 401a40 RtlAllocateHeap 1018->1019 1020 401d55 1019->1020 1020->1008 1022 401d94 NtSetInformationThread 1020->1022 1021 401d7a 1085 401dc2 1021->1085 1022->1021 1025 402836 1024->1025 1026 402850 RtlAdjustPrivilege 1025->1026 1027 40284e 1025->1027 1026->1025 1026->1027 1027->987 1029 402849 1028->1029 1030 402850 RtlAdjustPrivilege 1029->1030 1031 40284e 1029->1031 1030->1029 1030->1031 1031->987 1033 40176f 1032->1033 1034 4016cf 1032->1034 1033->997 1035 4016f5 NtAllocateVirtualMemory 1034->1035 1058 401000 1034->1058 1035->1033 1037 40172f NtAllocateVirtualMemory 1035->1037 1037->1033 1039 401752 1037->1039 1043 40152c 1039->1043 1041 401000 3 API calls 1042 40175f 1041->1042 1042->1033 1042->1041 1044 401540 1043->1044 1045 401558 1043->1045 1046 401000 3 API calls 1044->1046 1047 40157e 1045->1047 1048 401000 3 API calls 1045->1048 1046->1045 1049 401000 3 API calls 1047->1049 1051 4015a4 1047->1051 1048->1047 1049->1051 1050 4015ed FindFirstFileExW 1050->1051 1051->1050 1052 40166c 1051->1052 1053 401649 FindNextFileW 1051->1053 1054 40162a FindClose 1051->1054 1052->1042 1053->1051 1056 40165d FindClose 1053->1056 1066 401474 1054->1066 1056->1051 1057 401641 1057->1042 1059 401012 1058->1059 1060 40102a 1058->1060 1061 401000 3 API calls 1059->1061 1062 401000 3 API calls 1060->1062 1063 401050 1060->1063 1061->1060 1062->1063 1064 4010fb 1063->1064 1069 401394 1063->1069 1064->1035 1067 40148a 1066->1067 1068 4014b8 LdrLoadDll 1067->1068 1068->1057 1070 4013ee 1069->1070 1071 4013be 1069->1071 1070->1064 1071->1070 1072 401474 LdrLoadDll 1071->1072 1073 4013d2 1072->1073 1073->1070 1075 4014d8 1073->1075 1076 4014ee 1075->1076 1077 40150f LdrGetProcedureAddress 1075->1077 1079 4014fa LdrGetProcedureAddress 1076->1079 1078 401521 1077->1078 1078->1070 1079->1078 1081 401a5d RtlAllocateHeap 1080->1081 1082 401a79 1081->1082 1083 401a85 1081->1083 1082->1012 1083->1081 1084 401b5b 1083->1084 1084->1012 1086 401de9 1085->1086 1087 401e12 1086->1087 1088 401df2 NtProtectVirtualMemory 1086->1088 1087->1008 1088->1087 1111 402126 1112 402141 1111->1112 1113 402158 1112->1113 1114 4020bc RtlAllocateHeap 1112->1114 1114->1113 1089 4019b7 1090 4019e0 1089->1090 1091 4016b4 9 API calls 1089->1091 1092 4016b4 9 API calls 1090->1092 1091->1090 1093 4019f4 1092->1093 1094 4016b4 9 API calls 1093->1094 1095 401a05 1094->1095 1096 4016b4 9 API calls 1095->1096 1097 401a16 1096->1097 1098 4016b4 9 API calls 1097->1098 1099 401a27 1098->1099 1100 4016b4 9 API calls 1099->1100 1101 401a38 1100->1101 1102 40286c NtSetInformationProcess NtSetInformationProcess NtSetInformationProcess

                                                                                                                                                                                        Callgraph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        • Opacity -> Relevance
                                                                                                                                                                                        • Disassembly available
                                                                                                                                                                                        callgraph 0 Function_004026C0 39 Function_004024F8 0->39 1 Function_00401A40 40 Function_00401E78 1->40 2 Function_00401DC2 3 Function_004024C2 4 Function_00402B44 5 Function_00403144 38 Function_00403478 5->38 55 Function_00401D94 5->55 6 Function_00401FC8 7 Function_00401F4C 8 Function_0040204C 9 Function_00402B50 10 Function_00401350 71 Function_00401130 10->71 11 Function_00402ED0 12 Function_004024D4 13 Function_004019D4 76 Function_004016B4 13->76 14 Function_00403956 14->13 33 Function_00401B70 14->33 54 Function_00402812 14->54 78 Function_00402836 14->78 15 Function_00403258 83 Function_004020BC 15->83 16 Function_004014D8 81 Function_00401438 16->81 17 Function_00401FDB 18 Function_0040205C 19 Function_00401F5C 20 Function_004022DC 21 Function_004020DE 22 Function_00402760 22->83 23 Function_004031E0 24 Function_00402264 25 Function_00401EE4 26 Function_004032E4 26->15 27 Function_004032E8 27->15 28 Function_00401868 29 Function_0040286C 30 Function_00401F6C 31 Function_00401B6E 32 Function_00401FEF 33->1 33->2 33->55 34 Function_00401472 35 Function_00401474 41 Function_004013F8 35->41 36 Function_004013F6 37 Function_00402A78 82 Function_004028BA 37->82 39->22 62 Function_00401E28 40->62 42 Function_0040217C 43 Function_0040227C 44 Function_00402BFC 45 Function_00401000 45->7 45->10 45->25 45->45 56 Function_00401394 45->56 73 Function_00401EB0 45->73 46 Function_00402D80 47 Function_00403983 60 Function_0040389C 47->60 48 Function_00402003 49 Function_00402104 50 Function_00402C88 51 Function_00402E10 52 Function_00401190 52->71 53 Function_00401911 56->16 56->35 57 Function_00402017 58 Function_00402F18 58->43 58->51 59 Function_00401F9A 60->0 60->37 60->58 69 Function_0040362E 60->69 61 Function_00402126 61->83 63 Function_00402DA8 64 Function_0040152A 65 Function_0040202A 66 Function_0040152C 66->18 66->25 66->35 66->45 67 Function_00401F2C 66->67 68 Function_004018AD 69->5 69->27 69->42 70 Function_00401EAE 72 Function_00403230 74 Function_00401FB1 75 Function_004016B2 76->40 76->45 76->66 77 Function_00402234 79 Function_00401436 80 Function_004019B7 80->76 82->22 84 Function_00401A3E

                                                                                                                                                                                        Executed Functions

                                                                                                                                                                                        Function 00403983 Relevance: 39.0, APIs: 26, Instructions: 32windowlibraryloaderCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        APIs
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2955967865.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2955796450.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956065274.0000000000404000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956241352.0000000000405000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956412457.0000000000406000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_339E.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Text$Color$CreateWindow$Proc$CommandFontFreeHandleLibraryLineLoadMenuModule$AddressBitmapCharsetErrorInfoLastLocaleObjectSelect
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1586701277-0
                                                                                                                                                                                        • Opcode ID: 75a7f395dfd15dd6a7f12e7587c497a330da91454d241e242464d6c2316bf13f
                                                                                                                                                                                        • Instruction ID: 44f13d8dc4ada08d969f55db554330e9d88bd117b0c18836a0928b418f5903af
                                                                                                                                                                                        • Opcode Fuzzy Hash: 75a7f395dfd15dd6a7f12e7587c497a330da91454d241e242464d6c2316bf13f
                                                                                                                                                                                        • Instruction Fuzzy Hash: 89F0B724B651416AC500BFFB9947A0D6E2C6E8472BB50657EB0C1344E74D3C87009EAF
                                                                                                                                                                                        Function 00402F18 Relevance: 12.2, APIs: 8, Instructions: 184filenativememoryCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 4 402f18-402f2b 5 402f2e-402f33 4->5 5->5 6 402f35-402f5b call 40227c 5->6 8 402f67-402f8c CreateFileW 6->8 9 402f5d-402f61 6->9 11 402f8e-402f96 8->11 12 402faf-402fb1 8->12 9->8 10 4030bb-4030bd 9->10 13 4030c0-4030c3 10->13 14 402f98-402fa6 11->14 15 402faa 11->15 16 402fb4-402fe0 NtAllocateVirtualMemory 12->16 17 4030c5-4030e4 NtFreeVirtualMemory 13->17 18 4030e7-4030eb 13->18 14->15 30 402fa8 14->30 15->10 19 402fe2-402fed 16->19 20 402fe8 16->20 17->18 18->13 23 4030ed-4030f1 18->23 25 403000-403003 19->25 26 402fef-402ffe 19->26 22 40301b-403020 20->22 29 403023-40302e 22->29 27 4030f3-4030fc NtClose 23->27 28 4030ff-40311d call 402e10 DeleteFileW 23->28 31 403015-403019 25->31 32 403005-403010 25->32 26->31 27->28 37 403126-40312a 28->37 38 40311f 28->38 33 403030-40303a 29->33 34 40303c 29->34 30->8 31->16 31->22 32->31 36 403041-403048 33->36 34->36 39 40304b-403064 WriteFile 36->39 40 403138-403141 37->40 41 40312c-403132 37->41 38->37 42 403066 39->42 43 403068-403088 SetFilePointerEx 39->43 41->40 44 40308a-403091 42->44 43->39 43->44 45 403093 44->45 46 403095-4030b6 SetFilePointerEx 44->46 45->10 46->29
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CreateFileW.KERNELBASE(?,40000000,00000003,00000000,00000003,80000000,00000000), ref: 00402F82
                                                                                                                                                                                        • NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00010000,00001000,00000004), ref: 00402FDB
                                                                                                                                                                                        • WriteFile.KERNELBASE(000000FF,00000000,00010000,00010000,00000000), ref: 0040305F
                                                                                                                                                                                        • SetFilePointerEx.KERNELBASE(000000FF,00010000,?,00000000,00000001), ref: 0040307E
                                                                                                                                                                                        • SetFilePointerEx.KERNELBASE(000000FF,00010000,00000000,00000000,00000000,?,00000000,00000001), ref: 004030B3
                                                                                                                                                                                        • NtFreeVirtualMemory.NTDLL(000000FF,00000000,00010000,00008000,?,00000000,00000001), ref: 004030E4
                                                                                                                                                                                        • NtClose.NTDLL(000000FF,?,00000000,00000001), ref: 004030FC
                                                                                                                                                                                        • DeleteFileW.KERNELBASE(?,?,00000000,00000001), ref: 00403118
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2955967865.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2955796450.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956065274.0000000000404000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956241352.0000000000405000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956412457.0000000000406000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_339E.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: File$MemoryPointerVirtual$AllocateCloseCreateDeleteFreeWrite
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 590822095-0
                                                                                                                                                                                        • Opcode ID: 52122dafd602033dbf0aaa267e6343e8fb4df09450a7f36494692c9b8865e816
                                                                                                                                                                                        • Instruction ID: 1b8bdb635f3090c090aca30f1047892238d11e79f8ef36d2dcee79009cce4089
                                                                                                                                                                                        • Opcode Fuzzy Hash: 52122dafd602033dbf0aaa267e6343e8fb4df09450a7f36494692c9b8865e816
                                                                                                                                                                                        • Instruction Fuzzy Hash: ED714871901209AFDB11CF90DD48BEEBB79FB08311F204266E511B62D4D3759E85CF99
                                                                                                                                                                                        Function 004032E8 Relevance: 10.6, APIs: 7, Instructions: 126filethreadCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        APIs
                                                                                                                                                                                        • SetThreadPriority.KERNELBASE(000000FE,00000002), ref: 004032FB
                                                                                                                                                                                        • GetDiskFreeSpaceW.KERNELBASE(?,?,?,00000000,00000000), ref: 00403313
                                                                                                                                                                                        • GetDiskFreeSpaceExW.KERNELBASE(?,00000000,00000000,?), ref: 00403332
                                                                                                                                                                                        • GetTempFileNameW.KERNELBASE(?,00000000,00000000,?), ref: 00403375
                                                                                                                                                                                        • CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000000), ref: 00403398
                                                                                                                                                                                        • DeviceIoControl.KERNELBASE(000000FF,0009C040,00000000,00000002,00000000,00000000,?,00000000), ref: 004033CD
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2955967865.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2955796450.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956065274.0000000000404000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956241352.0000000000405000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956412457.0000000000406000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_339E.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: DiskFileFreeSpace$ControlCreateDeviceNamePriorityTempThread
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2011835681-0
                                                                                                                                                                                        • Opcode ID: 229209989839885a3588f396d77e0cdc96e3fac898d9f41ca49139373efe7470
                                                                                                                                                                                        • Instruction ID: c3badfffa75a89a0abcd59fd2fd34812244497566a58eab59887ac76a1f04a4a
                                                                                                                                                                                        • Opcode Fuzzy Hash: 229209989839885a3588f396d77e0cdc96e3fac898d9f41ca49139373efe7470
                                                                                                                                                                                        • Instruction Fuzzy Hash: D6510A71A01209AFDB00DF90DD49F9EBB79FF08700F2092A5E611BA2A1D730AE45DF95
                                                                                                                                                                                        Function 0040152C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 104fileCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        APIs
                                                                                                                                                                                        • FindFirstFileExW.KERNELBASE(C:\Windows\System32\*.dll,00000000,?,00000000,00000000,00000000), ref: 00401601
                                                                                                                                                                                        • FindClose.KERNELBASE(000000FF,?,00000000), ref: 0040162D
                                                                                                                                                                                        • FindNextFileW.KERNELBASE(000000FF,?,?,00000000), ref: 00401653
                                                                                                                                                                                        • FindClose.KERNEL32(000000FF), ref: 00401660
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2955967865.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2955796450.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956065274.0000000000404000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956241352.0000000000405000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956412457.0000000000406000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_339E.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Find$CloseFile$FirstNext
                                                                                                                                                                                        • String ID: C:\Windows\System32\*.dll
                                                                                                                                                                                        • API String ID: 1164774033-1305136377
                                                                                                                                                                                        • Opcode ID: bdb8730289e2ca857be386bc3c3ab385330ed8d95a663a52d2d02b9110bb0279
                                                                                                                                                                                        • Instruction ID: b8f602421e8d3e3309feb9384621a56ef9d54da146c7d7394d3b11ea37959a12
                                                                                                                                                                                        • Opcode Fuzzy Hash: bdb8730289e2ca857be386bc3c3ab385330ed8d95a663a52d2d02b9110bb0279
                                                                                                                                                                                        • Instruction Fuzzy Hash: 30418C71900608EFDB20AFA4DD48BAA77B4FB44325F608276E521BE1F0D7794A85DF48
                                                                                                                                                                                        Function 0040362E Relevance: 7.7, APIs: 5, Instructions: 184COMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 102 40362e-403671 call 403144 105 403673 102->105 106 403678-40368e GetLogicalDriveStringsW 102->106 107 403886-40388a 105->107 108 403690 106->108 109 403695-4036af 106->109 110 403898-40389b 107->110 111 40388c-403892 107->111 108->107 113 4036b1 109->113 114 4036b6-4036cd 109->114 111->110 113->107 116 4036d4-4036eb 114->116 117 4036cf 114->117 119 4036f2-40371a 116->119 120 4036ed 116->120 117->107 121 40371d-40372a GetDriveTypeW 119->121 120->107 122 403735-403749 call 40217c 121->122 123 40372c-40372f 121->123 129 40374c-40374f 122->129 123->122 124 4037ba-4037c0 123->124 124->121 125 4037c6-4037ca 124->125 127 403809-40381a 125->127 128 4037cc-4037d2 125->128 130 40381c-40382b 127->130 131 40381e-403829 Sleep 127->131 132 4037d5-4037d8 128->132 133 403751-403775 CreateThread 129->133 134 403755-403758 129->134 140 40382e-403831 130->140 131->127 136 4037da-4037db 132->136 137 4037dc-4037de 132->137 133->124 139 403777-40378b 133->139 134->129 136->137 137->132 141 4037e0-4037f6 137->141 139->124 142 40378d-4037b7 139->142 143 403833-403854 140->143 144 403835-40384e 140->144 147 4037f9-403807 NtClose 141->147 142->124 150 403862-403866 143->150 151 403856-40385c 143->151 144->140 147->127 147->147 152 403874-403878 150->152 153 403868-40386e 150->153 151->150 152->107 154 40387a-403880 152->154 153->152 154->107
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • GetLogicalDriveStringsW.KERNELBASE(00000068,?), ref: 00403687
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2955967865.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2955796450.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956065274.0000000000404000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956241352.0000000000405000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956412457.0000000000406000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_339E.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: DriveLogicalStrings
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2022863570-0
                                                                                                                                                                                        • Opcode ID: b400b6a985817d68bb33d17dbc945ad3f7ed75c1c6e1d9200f5b880ce86a855b
                                                                                                                                                                                        • Instruction ID: 4dd69471dbc29d4f16846e3344e2d9633d6215cd74752d72760f366e6b0bc30a
                                                                                                                                                                                        • Opcode Fuzzy Hash: b400b6a985817d68bb33d17dbc945ad3f7ed75c1c6e1d9200f5b880ce86a855b
                                                                                                                                                                                        • Instruction Fuzzy Hash: 33815CB590160ADFDB10DF90D948BAFBB75FF08306F1086AAE511772A0D7399A41CF98
                                                                                                                                                                                        Function 00402760 Relevance: 4.6, APIs: 3, Instructions: 62filenativeCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 179 402760-402795 CreateFileW 180 4027f0-4027f4 179->180 181 402797-4027a9 179->181 182 402802-40280b 180->182 183 4027f6-4027ff NtClose 180->183 181->180 185 4027ab-4027be call 4020bc 181->185 183->182 185->180 187 4027c0-4027d8 ReadFile 185->187 188 4027e4-4027ea 187->188 189 4027da-4027e2 187->189 188->180 189->180
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0040278B
                                                                                                                                                                                        • ReadFile.KERNELBASE(000000FF,00000000,00000000,00000000,00000000), ref: 004027D3
                                                                                                                                                                                        • NtClose.NTDLL(000000FF), ref: 004027FF
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2955967865.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2955796450.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956065274.0000000000404000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956241352.0000000000405000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956412457.0000000000406000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_339E.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: File$CloseCreateRead
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1419693385-0
                                                                                                                                                                                        • Opcode ID: da89fd3cbdd23a7ddbe5d8b9f381f279ea58f3e72d3b71a90626c9ff8252170d
                                                                                                                                                                                        • Instruction ID: da411bd40fb0d6d878d2d447c4e829303a7e8bd202b0d35ae7576ead56d2946b
                                                                                                                                                                                        • Opcode Fuzzy Hash: da89fd3cbdd23a7ddbe5d8b9f381f279ea58f3e72d3b71a90626c9ff8252170d
                                                                                                                                                                                        • Instruction Fuzzy Hash: CA211A35601209EBDB10CF94DD89B9EBB75FF08310F2082A5A510AB2E1D7719E51DF94
                                                                                                                                                                                        Function 0040286C Relevance: 4.5, APIs: 3, Instructions: 28nativeCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 191 40286c-4028b9 NtSetInformationProcess * 3
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • NtSetInformationProcess.NTDLL(000000FF,00000021,?,00000004), ref: 00402888
                                                                                                                                                                                        • NtSetInformationProcess.NTDLL(000000FF,00000012,00000000,00000002,?,00000004), ref: 0040289D
                                                                                                                                                                                        • NtSetInformationProcess.NTDLL(000000FF,0000000C,00000000,00000004,?,00000004), ref: 004028B5
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2955967865.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2955796450.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956065274.0000000000404000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956241352.0000000000405000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956412457.0000000000406000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_339E.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: InformationProcess
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1801817001-0
                                                                                                                                                                                        • Opcode ID: b71ac733508e6e437ba76d930e61bde730921b23b00966883a2217b3d9eaec84
                                                                                                                                                                                        • Instruction ID: 48adbd17ca007e7691ff2066b81a5959555298f4bd9a539b6f325b5cfe831ef7
                                                                                                                                                                                        • Opcode Fuzzy Hash: b71ac733508e6e437ba76d930e61bde730921b23b00966883a2217b3d9eaec84
                                                                                                                                                                                        • Instruction Fuzzy Hash: 2BF0F871141610EBEB15DB84DDC9F9637A8FB09720F2403A1F2319E1E6D3B0A484CF96
                                                                                                                                                                                        Function 00401DC2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 38nativeCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 192 401dc2-401df0 194 401e21-401e27 192->194 195 401df2-401e10 NtProtectVirtualMemory 192->195 195->194 196 401e12-401e1f 195->196 196->194
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • NtProtectVirtualMemory.NTDLL(000000FF,00000000,00000020,00000040,?), ref: 00401E0B
                                                                                                                                                                                        Strings
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2955967865.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2955796450.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956065274.0000000000404000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956241352.0000000000405000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956412457.0000000000406000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_339E.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: MemoryProtectVirtual
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2706961497-3916222277
                                                                                                                                                                                        • Opcode ID: 743ccc95185ac25335bad8a24ea2ffb6d91b2a6f6c30658889cc31c7cdbad58c
                                                                                                                                                                                        • Instruction ID: 836d3446d31acb3b31e0b6cd8f4ee088cd02c28435d2c0c4ff934eaabbb3754d
                                                                                                                                                                                        • Opcode Fuzzy Hash: 743ccc95185ac25335bad8a24ea2ffb6d91b2a6f6c30658889cc31c7cdbad58c
                                                                                                                                                                                        • Instruction Fuzzy Hash: 72F03176500109ABDB00CF95D988BDFB7BCEB44324F2042A9EA14A72D1D7355E458B94
                                                                                                                                                                                        Function 004016B4 Relevance: 3.1, APIs: 2, Instructions: 130memorynativeCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 289 4016b4-4016c9 290 401859-401862 289->290 291 4016cf-4016d6 289->291 292 4016f5-401729 NtAllocateVirtualMemory 291->292 293 4016d8-4016f0 call 401000 291->293 292->290 295 40172f-40174c NtAllocateVirtualMemory 292->295 293->292 295->290 297 401752-40175a call 40152c 295->297 299 40175f-401761 297->299 299->290 300 401767-40176d 299->300 301 401774-401781 call 401000 300->301 302 40176f 300->302 305 401851-401854 301->305 306 401787-401798 call 401e78 301->306 302->290 305->300 309 4017c9-4017cc 306->309 310 40179a-4017c4 call 401e78 306->310 312 4017fa-4017fd 309->312 313 4017ce-4017f8 call 401e78 309->313 310->305 316 401815-401818 312->316 317 4017ff-401813 312->317 313->305 318 401830-401833 316->318 319 40181a-40182e 316->319 317->305 318->305 321 401835-40184b 318->321 319->305 321->305
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,?,00103000,00000040), ref: 0040171F
                                                                                                                                                                                        • NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000000,00103000,00000004), ref: 00401742
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2955967865.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2955796450.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956065274.0000000000404000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956241352.0000000000405000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956412457.0000000000406000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_339E.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AllocateMemoryVirtual
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2167126740-0
                                                                                                                                                                                        • Opcode ID: 4a0fb159cb167e270aa132b3f88ebad20637f68d71e3a3db65f788631af4fc76
                                                                                                                                                                                        • Instruction ID: ad4b5e7ce53ce887a57ee0cc443bca07838dd3003dcb7b2c4dfa2ad75add82e8
                                                                                                                                                                                        • Opcode Fuzzy Hash: 4a0fb159cb167e270aa132b3f88ebad20637f68d71e3a3db65f788631af4fc76
                                                                                                                                                                                        • Instruction Fuzzy Hash: E3416031904204DADF10EF58C884B9AB7A4FF05314F14C1BAE919EF2E6D7788A41CB6A
                                                                                                                                                                                        Function 0040227C Relevance: 1.5, APIs: 1, Instructions: 29COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • FindFirstFileExW.KERNELBASE(?,00000000,?,00000000,00000000,00000000), ref: 004022A4
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2955967865.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2955796450.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956065274.0000000000404000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956241352.0000000000405000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956412457.0000000000406000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_339E.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FileFindFirst
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1974802433-0
                                                                                                                                                                                        • Opcode ID: cdec62c82a5867c9461e13d27f073131a42764883e1863d73d8ab6d37f0e38bf
                                                                                                                                                                                        • Instruction ID: 55f0629c3eadcc188d8749e42e063c0b49bca1bc4f8f265f590f61ae6da82bee
                                                                                                                                                                                        • Opcode Fuzzy Hash: cdec62c82a5867c9461e13d27f073131a42764883e1863d73d8ab6d37f0e38bf
                                                                                                                                                                                        • Instruction Fuzzy Hash: BBF0C974902608EFDB10DF94CD49B9DFBB4EB48310F2082A5A918AB2A0D7715E91CF84
                                                                                                                                                                                        Function 00401D94 Relevance: 1.5, APIs: 1, Instructions: 19nativethreadCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • NtSetInformationThread.NTDLL(00000000,?,00000000,00000000), ref: 00401DBB
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2955967865.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2955796450.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956065274.0000000000404000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956241352.0000000000405000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956412457.0000000000406000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_339E.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: InformationThread
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 4046476035-0
                                                                                                                                                                                        • Opcode ID: 2ec57d8305034ae4dcd04f6f280aec29aa5e37325b0f502564d07dd60a6e8475
                                                                                                                                                                                        • Instruction ID: 482b214da63c1bafeb7c1bb62a0bbbc62c262419b9af6fea3894fce228737229
                                                                                                                                                                                        • Opcode Fuzzy Hash: 2ec57d8305034ae4dcd04f6f280aec29aa5e37325b0f502564d07dd60a6e8475
                                                                                                                                                                                        • Instruction Fuzzy Hash: FEE05E329A020DAFD710DB50DC45FBB376DEB55311F508236B5029A1E0D6B8F891DA98
                                                                                                                                                                                        Function 004032E4 Relevance: 7.6, APIs: 5, Instructions: 67filethreadCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 159 4032e4-4033a2 SetThreadPriority GetDiskFreeSpaceW GetDiskFreeSpaceExW GetTempFileNameW CreateFileW 162 4033a4 159->162 163 4033a9-4033ed DeviceIoControl call 403258 159->163 164 40346f-403472 162->164 166 4033fd-403415 CreateIoCompletionPort 163->166 167 4033ef-4033fb 163->167 168 403417-40342d 166->168 169 40342f-403447 166->169 167->164 168->164 173 403461-403467 169->173 174 403449-40345f 169->174 173->164 174->164
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • SetThreadPriority.KERNELBASE(000000FE,00000002), ref: 004032FB
                                                                                                                                                                                        • GetDiskFreeSpaceW.KERNELBASE(?,?,?,00000000,00000000), ref: 00403313
                                                                                                                                                                                        • GetDiskFreeSpaceExW.KERNELBASE(?,00000000,00000000,?), ref: 00403332
                                                                                                                                                                                        • GetTempFileNameW.KERNELBASE(?,00000000,00000000,?), ref: 00403375
                                                                                                                                                                                        • CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000000), ref: 00403398
                                                                                                                                                                                        • DeviceIoControl.KERNELBASE(000000FF,0009C040,00000000,00000002,00000000,00000000,?,00000000), ref: 004033CD
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2955967865.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2955796450.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956065274.0000000000404000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956241352.0000000000405000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956412457.0000000000406000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_339E.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: DiskFileFreeSpace$ControlCreateDeviceNamePriorityTempThread
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2011835681-0
                                                                                                                                                                                        • Opcode ID: 2bb202560a6aa134e71a635a3921368a9451dbb9fce4d81eab453209c020e30b
                                                                                                                                                                                        • Instruction ID: db71fdc1c22404a5b670ef955f883ff194a6135e3213665c05072d4c5e51ce30
                                                                                                                                                                                        • Opcode Fuzzy Hash: 2bb202560a6aa134e71a635a3921368a9451dbb9fce4d81eab453209c020e30b
                                                                                                                                                                                        • Instruction Fuzzy Hash: 3621F871901209AFDB10DF94DD45F9EBBB9FF08710F208265F610BA2A1D770AA41CF94
                                                                                                                                                                                        Function 00401B70 Relevance: 3.2, APIs: 2, Instructions: 156memoryCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 197 401b70-401b9f RtlCreateHeap 198 401ba1 197->198 199 401ba6-401bc4 RtlCreateHeap 197->199 200 401d8a-401d90 198->200 201 401bc6 199->201 202 401bcb-401be7 199->202 201->200 204 401be9 202->204 205 401bee-401c05 call 401a40 202->205 204->200 208 401c07 205->208 209 401c0c-401c3d 205->209 208->200 212 401c44-401c5b call 401a40 209->212 213 401c3f 209->213 216 401c62-401c93 212->216 217 401c5d 212->217 213->200 220 401c95 216->220 221 401c9a-401cb1 call 401a40 216->221 217->200 220->200 224 401cb3 221->224 225 401cb8-401ce9 221->225 224->200 228 401cf0-401d07 call 401a40 225->228 229 401ceb 225->229 232 401d09 228->232 233 401d0b-401d3c 228->233 229->200 232->200 236 401d40-401d57 call 401a40 233->236 237 401d3e 233->237 240 401d59 236->240 241 401d5b-401d80 call 401d94 call 401dc2 236->241 237->200 240->200 244 401d83 241->244 244->200
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • RtlCreateHeap.NTDLL(00001002,00000000,00000000,00000000,00000000,00000000), ref: 00401B96
                                                                                                                                                                                        • RtlCreateHeap.NTDLL(00041002,00000000,00000000,00000000,00000000,00000000), ref: 00401BBB
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2955967865.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2955796450.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956065274.0000000000404000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956241352.0000000000405000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956412457.0000000000406000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_339E.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CreateHeap
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 10892065-0
                                                                                                                                                                                        • Opcode ID: 453bda9d08a0096fe53e6a5bcc4a475ef93f8d776735eeddf63228c397926240
                                                                                                                                                                                        • Instruction ID: eac1ce902914894448f3c06d12ced00cbe17960004271ddceb971b2a38276b5e
                                                                                                                                                                                        • Opcode Fuzzy Hash: 453bda9d08a0096fe53e6a5bcc4a475ef93f8d776735eeddf63228c397926240
                                                                                                                                                                                        • Instruction Fuzzy Hash: 34513034A80A04FBD7109B60ED09B5B7770FF18701F2086BAE6117A2F1D775A5859F8D
                                                                                                                                                                                        Function 00403478 Relevance: 3.1, APIs: 2, Instructions: 137filethreadCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 247 403478-403488 SetThreadPriority 248 40348b-4034ad 247->248 250 4034b3-4034b5 248->250 251 4034af-4034b2 248->251 252 4034b7-4034bf 250->252 253 4034e8-4034ee 250->253 252->253 256 4034c1 252->256 254 4034f0-403513 WriteFile 253->254 255 403533-403535 253->255 257 403515-403520 254->257 258 40352e 254->258 259 4035d4-4035d7 255->259 260 40353b-40354f 255->260 261 4034c8-4034e0 256->261 257->258 262 403522-40352a 257->262 263 403629 258->263 259->263 266 4035d9-403625 259->266 264 403551-403561 260->264 265 403598-40359c 260->265 273 4034e2-4034e6 261->273 274 4034e4 261->274 262->258 270 40352c 262->270 263->248 271 403563-40356a 264->271 272 40356c-40358f 264->272 268 4035ad 265->268 269 40359e-4035a2 265->269 266->263 276 4035b4-4035cc 268->276 269->268 275 4035a4-4035ab 269->275 270->256 277 403596 271->277 272->277 273->248 274->261 275->276 283 4035d0 276->283 284 4035ce-4035d2 276->284 277->276 283->276 284->263
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • SetThreadPriority.KERNELBASE(000000FE,00000002), ref: 00403488
                                                                                                                                                                                        • WriteFile.KERNELBASE(?,?,?,?,?), ref: 0040350E
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2955967865.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2955796450.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956065274.0000000000404000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956241352.0000000000405000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956412457.0000000000406000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_339E.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: FilePriorityThreadWrite
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3596769661-0
                                                                                                                                                                                        • Opcode ID: 0fcde9d867e2c8e00a33e5a4b04594799b7cacc31207ed4f9c9132c7825b27dd
                                                                                                                                                                                        • Instruction ID: 02d7b4ff8a3576d09fe5cde13513df6eb5b6ce77b27be8b8a28bc97f0a3a62b9
                                                                                                                                                                                        • Opcode Fuzzy Hash: 0fcde9d867e2c8e00a33e5a4b04594799b7cacc31207ed4f9c9132c7825b27dd
                                                                                                                                                                                        • Instruction Fuzzy Hash: E75128B1101601EBDB10CF50DD84B577BB8FF08305F2052AAE905AE2A6D379DE95CF89
                                                                                                                                                                                        Function 004026C0 Relevance: 3.1, APIs: 2, Instructions: 51fileCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 322 4026c0-4026e5 call 4024f8 324 402730-402734 322->324 325 4026e7-402709 CreateFileW 322->325 327 402742-402746 324->327 328 402736-40273c 324->328 325->324 326 40270b-402727 ReadFile 325->326 326->324 329 402729 326->329 330 402754-40275a 327->330 331 402748-40274e 327->331 328->327 329->324 331->330
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004026FF
                                                                                                                                                                                        • ReadFile.KERNELBASE(000000FF,000000FF,0000021C,?,00000000), ref: 00402722
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2955967865.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2955796450.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956065274.0000000000404000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956241352.0000000000405000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956412457.0000000000406000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_339E.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: File$CreateRead
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3388366904-0
                                                                                                                                                                                        • Opcode ID: 64d441af2ae5f8cd80c02da2bb5cacaba4a8c0a7bb8fd120945ed4e9a720f5dc
                                                                                                                                                                                        • Instruction ID: dec784d2d3492f4c007a4c80bb83cd8b4abde05e7af7cfb80cb91198c32a9eba
                                                                                                                                                                                        • Opcode Fuzzy Hash: 64d441af2ae5f8cd80c02da2bb5cacaba4a8c0a7bb8fd120945ed4e9a720f5dc
                                                                                                                                                                                        • Instruction Fuzzy Hash: 7511D774910209EFDB10DF94DD48B9FBBB5FB08311F2046A9A524B62E1D7B15A91CF84
                                                                                                                                                                                        Function 00401A40 Relevance: 1.6, APIs: 1, Instructions: 98memoryCOMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 333 401a40-401a5a 334 401a5d-401a77 RtlAllocateHeap 333->334 335 401a85-401a94 call 401e78 334->335 336 401a79-401a82 334->336 339 401ac5-401ac8 335->339 340 401a96-401ac0 call 401e78 335->340 342 401af6-401af9 339->342 343 401aca-401af4 call 401e78 339->343 348 401b4d-401b55 340->348 346 401b11-401b14 342->346 347 401afb-401b0f 342->347 343->348 350 401b16-401b2a 346->350 351 401b2c-401b2f 346->351 347->348 348->334 352 401b5b-401b6b 348->352 350->348 351->348 353 401b31-401b47 351->353 353->348
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • RtlAllocateHeap.NTDLL(00000000,00000008,00000010), ref: 00401A6D
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2955967865.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2955796450.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956065274.0000000000404000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956241352.0000000000405000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956412457.0000000000406000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_339E.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AllocateHeap
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1279760036-0
                                                                                                                                                                                        • Opcode ID: 3090814481001f51fad53404be7bb9f089635e5ecf5702693e45b6397da5dce2
                                                                                                                                                                                        • Instruction ID: 68c0462a3af62cc3e50a8e225ecc1fff045641083c52707b2e4de1a33f1d8fac
                                                                                                                                                                                        • Opcode Fuzzy Hash: 3090814481001f51fad53404be7bb9f089635e5ecf5702693e45b6397da5dce2
                                                                                                                                                                                        • Instruction Fuzzy Hash: 9F316935A14308DFDB10CF99C488E99F7F1BF24320F15D0AAD508AB2B2D7B59950DB4A
                                                                                                                                                                                        Function 00402E10 Relevance: 1.6, APIs: 1, Instructions: 66COMMON
                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                        • Executed
                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                        control_flow_graph 354 402e10-402e35 356 402e37 354->356 357 402e39-402e4e 354->357 358 402eab-402eb7 356->358 362 402e50 357->362 363 402e52-402e57 357->363 359 402ec5-402eca 358->359 360 402eb9-402ebf 358->360 360->359 362->358 364 402e5c-402e6d 363->364 366 402e70-402e7a 364->366 366->366 367 402e7c-402e8f MoveFileExW 366->367 368 402e91 367->368 369 402e93-402ea9 367->369 368->358 369->358 369->364
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2955967865.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2955796450.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956065274.0000000000404000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956241352.0000000000405000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956412457.0000000000406000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_339E.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 2ec2b1c2d5d64686e5e6a52de2e159d7ebe58570cf782c44f0051c3652f2bf9a
                                                                                                                                                                                        • Instruction ID: 64be472d3da9365df722bb42b6a14b0a0006b9682bbf08d732ce7ada7e71b141
                                                                                                                                                                                        • Opcode Fuzzy Hash: 2ec2b1c2d5d64686e5e6a52de2e159d7ebe58570cf782c44f0051c3652f2bf9a
                                                                                                                                                                                        • Instruction Fuzzy Hash: 8A214C71940208EFDB109F90DE49B9ABB71FF18301F2081BAE505AA2E1D3759E91DF89
                                                                                                                                                                                        Function 0040217C Relevance: 1.6, APIs: 1, Instructions: 58COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CreateDirectoryW.KERNELBASE(00000000,00000000), ref: 00402227
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2955967865.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2955796450.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956065274.0000000000404000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956241352.0000000000405000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956412457.0000000000406000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_339E.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CreateDirectory
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 4241100979-0
                                                                                                                                                                                        • Opcode ID: aec36a0482896fdefc261f9a8e4ed8b8fffad9c6a154dc279330f3fd88b4ab19
                                                                                                                                                                                        • Instruction ID: 9ce072fc3005d4f78cf2e49f7f895573a995d668e844b6c98341eda9cf3d519c
                                                                                                                                                                                        • Opcode Fuzzy Hash: aec36a0482896fdefc261f9a8e4ed8b8fffad9c6a154dc279330f3fd88b4ab19
                                                                                                                                                                                        • Instruction Fuzzy Hash: 81117CB5601105EFD700DF94ED88A87BBA8FF08300B1092B9EA15AB262D731D955CFD9
                                                                                                                                                                                        Function 00403144 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • CreateThread.KERNELBASE(00000000,00000000,Function_00003478,00000000,00000000,00000000), ref: 004031A2
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2955967865.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2955796450.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956065274.0000000000404000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956241352.0000000000405000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956412457.0000000000406000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_339E.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: CreateThread
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2422867632-0
                                                                                                                                                                                        • Opcode ID: 9e58d635c8bd693d4c2dc2c3a668e721e6aa14a97984da7d58b39bf4f406ce1f
                                                                                                                                                                                        • Instruction ID: e5ec22d449c3d307afb1fc97fd659449252656cd0b8efbbc1ce39923ac99279f
                                                                                                                                                                                        • Opcode Fuzzy Hash: 9e58d635c8bd693d4c2dc2c3a668e721e6aa14a97984da7d58b39bf4f406ce1f
                                                                                                                                                                                        • Instruction Fuzzy Hash: B5115E75741B05ABD310AF94ED89B8BB768FF08711F2043B5EA10BA2E1D7749D418F98
                                                                                                                                                                                        Function 00402A78 Relevance: 1.6, APIs: 1, Instructions: 52COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2955967865.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2955796450.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956065274.0000000000404000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956241352.0000000000405000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956412457.0000000000406000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_339E.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID:
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                        • Opcode ID: 76ac4189c2e983f292498be2e35779ead737e5081f8c929ef40d6d428a78efce
                                                                                                                                                                                        • Instruction ID: 5f31ce468cef0475a522e9655e813cee8f96e501922e94d34a843d9ecc1c4f5f
                                                                                                                                                                                        • Opcode Fuzzy Hash: 76ac4189c2e983f292498be2e35779ead737e5081f8c929ef40d6d428a78efce
                                                                                                                                                                                        • Instruction Fuzzy Hash: A921F974901608EFDB00CF90EA8C79EBB71FF08301F6045A9E5017A2A0D7B95A85DF89
                                                                                                                                                                                        Function 00401474 Relevance: 1.5, APIs: 1, Instructions: 38libraryloaderCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • LdrLoadDll.NTDLL(00000000,00000000,00000000,?), ref: 004014C4
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2955967865.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2955796450.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956065274.0000000000404000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956241352.0000000000405000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956412457.0000000000406000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_339E.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: Load
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 2234796835-0
                                                                                                                                                                                        • Opcode ID: cc821bb6490c49b643c0aee4c8a66cc2fb92e167f5171f05bab2522af16bb81c
                                                                                                                                                                                        • Instruction ID: 140de97a3c31e0856ca0b204e221eb1e366fb0b1d4fd9a07ba92ba20ce5f8dd4
                                                                                                                                                                                        • Opcode Fuzzy Hash: cc821bb6490c49b643c0aee4c8a66cc2fb92e167f5171f05bab2522af16bb81c
                                                                                                                                                                                        • Instruction Fuzzy Hash: F7F03C3690020DFADF10EAA4D848FDE77BCEB14314F0041A6E904B7190D238AA099BA5
                                                                                                                                                                                        Function 00402836 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • RtlAdjustPrivilege.NTDLL(?,00000001,00000000,00000000), ref: 00402861
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2955967865.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2955796450.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956065274.0000000000404000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956241352.0000000000405000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956412457.0000000000406000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_339E.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AdjustPrivilege
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 3260937286-0
                                                                                                                                                                                        • Opcode ID: b838e4be5c385c0dc624d50355c604d381d153ee0a89857c9e86ae645bc67477
                                                                                                                                                                                        • Instruction ID: 70193a9dbc7aa9cd3770003b3bb97339f6e2972f30e24310785a39762e1cef45
                                                                                                                                                                                        • Opcode Fuzzy Hash: b838e4be5c385c0dc624d50355c604d381d153ee0a89857c9e86ae645bc67477
                                                                                                                                                                                        • Instruction Fuzzy Hash: B9E0263251821AABCB20A2189E0CBA7739DD744314F1043B6A805F71D1EAF69A0A87DA
                                                                                                                                                                                        Function 004020BC Relevance: 1.5, APIs: 1, Instructions: 12memoryCOMMON
                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                        APIs
                                                                                                                                                                                        • RtlAllocateHeap.NTDLL(?,00000008,?), ref: 004020D7
                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                        • Source File: 0000000D.00000002.2955967865.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                        • Associated: 0000000D.00000002.2955796450.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956065274.0000000000404000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956241352.0000000000405000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        • Associated: 0000000D.00000002.2956412457.0000000000406000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                        • Snapshot File: hcaresult_13_2_400000_339E.jbxd
                                                                                                                                                                                        Similarity
                                                                                                                                                                                        • API ID: AllocateHeap
                                                                                                                                                                                        • String ID:
                                                                                                                                                                                        • API String ID: 1279760036-0
                                                                                                                                                                                        • Opcode ID: 37c2d1e8b064bb17fe79b9677c4ca25dfdae977e826a45f6764b5f2e7935cd48
                                                                                                                                                                                        • Instruction ID: 701e22a529f931561d5ec47da2ef603e250127bb9ab3ab4db12cbc5835053477
                                                                                                                                                                                        • Opcode Fuzzy Hash: 37c2d1e8b064bb17fe79b9677c4ca25dfdae977e826a45f6764b5f2e7935cd48
                                                                                                                                                                                        • Instruction Fuzzy Hash: 05D0C97A140609ABC6009F94E949D87F769FF58711B00C6A1BA045B222C630E890CFD4